Externalize tls version and security protocols configuration on mail sending #5119

GutoVeronezi · 2021-06-16T13:43:16Z

Description

Some servers (such as Microsoft exchange) are deprecating TLSv1 and TLSv1.1. On alert's and project's mailing settings, ACS uses the protocol TLSv1; therefore, operators do not have options to choose which version they want to use.
ACS has configurations (\*.smtp.useAuth) to inform if it will use secure SMTP authentication when sending emails; However, this configuration only refers to the use of SSL. Operators have no means to choose if they want to use StartTLS option.

This PR intends to externalize the protocol's and StartTLS settings on alert's and project's mail sending. Alert and project (also quota) send email through the class SMTPMailSender, inserted in PR 4954, which will handle these configurations.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

How Has This Been Tested?

It was tested in a test lab.

I set SMTP global settings to project and alert and enabled StartTLS (global setting); Then I allowed Less secure app access on my Google account and set the following settings:

server address: smtp.gmail.com
username: <gmail address>
password: <gmail password>
port (TLS): 587

To alert, I started mgmt;
To project, I enabled global setting project.invite.required and added a user via email;

In Gmail, we have an option to show original message, which provides the TLS version and the cipher. So I changed the configuration a few times and sent some alerts and invitations to verify if both versions, in configuration and Gmail, were the same.

rohityadavcloud · 2021-06-18T01:17:15Z

@blueorangutan package

blueorangutan · 2021-06-18T01:18:03Z

@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

blueorangutan · 2021-06-18T03:07:51Z

Packaging result: ✔️ centos7 ✔️ centos8 ✔️ debian. SL-JID 275

DaanHoogland · 2021-06-18T13:49:05Z

@GutoVeronezi It makes sense to make this configuratble, but should we allow it to be different for alert and project? seems like it is a true global setting.

blueorangutan · 2021-06-18T14:02:23Z

Trillian Build Failed (tid-1005)

GutoVeronezi · 2021-06-18T16:58:59Z

@GutoVeronezi It makes sense to make this configuratble, but should we allow it to be different for alert and project? seems like it is a true global setting.

@DaanHoogland I am following the way mail settings are implemented today; each scope (quota, alert and project) has its own settings. Although, I don't see any plausible reason to keep settings to each scope (it seems that an operator could use different providers to send mail is a remote probability).

I think that if we turn these global, we should turn those too, to maintain the same pattern.

DaanHoogland · 2021-06-18T17:13:03Z

I think that if we turn these global, we should turn those too, to maintain the same pattern.

makes sense.

GutoVeronezi · 2021-06-28T12:52:53Z

Can anyone review this?

RodrigoDLopez

Nice work @GutoVeronezi
The Code LGTM, i will try run some manual tests. But i'm not sure if i can do this in my env.

rohityadavcloud · 2021-07-15T07:15:57Z

@blueorangutan package

blueorangutan · 2021-07-15T07:17:03Z

@rhtyd a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

blueorangutan · 2021-07-15T07:52:48Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian. SL-JID 550

DaanHoogland

clgtm

GutoVeronezi · 2021-07-20T12:36:31Z

@DaanHoogland @RodrigoDLopez is there anything else to do?

blueorangutan · 2021-07-20T13:25:28Z

Trillian Build Failed (tid-1324)

blueorangutan · 2021-07-20T14:20:54Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian. SL-JID 599

nvazquez · 2021-07-21T01:39:48Z

@blueorangutan package

blueorangutan · 2021-07-21T01:40:02Z

@nvazquez a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

nvazquez

LGTM

nvazquez · 2021-07-21T01:52:40Z

@GutoVeronezi as the PR is only exposing config keys for existing properties I think a round of tests will be enough as there are no changes in the functionality

blueorangutan · 2021-07-21T02:05:42Z

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian. SL-JID 608

nvazquez · 2021-07-21T02:15:27Z

@blueorangutan test

blueorangutan · 2021-07-21T02:16:03Z

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

GabrielBrascher

Code LGTM

blueorangutan · 2021-07-21T08:22:39Z

Trillian test result (tid-1326)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 46479 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5119-t1326-kvm-centos7.zip
Intermittent failure detected: /marvin/tests/smoke/test_kubernetes_clusters.py
Intermittent failure detected: /marvin/tests/smoke/test_vpc_redundant.py
Intermittent failure detected: /marvin/tests/smoke/test_vpc_vpn.py
Smoke tests completed. 87 look OK, 2 have error(s)
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_07_deploy_kubernetes_ha_cluster	`Failure`	3614.11	test_kubernetes_clusters.py
test_08_deploy_and_upgrade_kubernetes_ha_cluster	`Failure`	0.06	test_kubernetes_clusters.py
test_09_delete_kubernetes_ha_cluster	`Failure`	0.04	test_kubernetes_clusters.py
ContextSuite context=TestKubernetesCluster>:teardown	`Error`	83.57	test_kubernetes_clusters.py
test_01_create_redundant_VPC_2tiers_4VMs_4IPs_4PF_ACL	`Failure`	545.96	test_vpc_redundant.py
test_03_create_redundant_VPC_1tier_2VMs_2IPs_2PF_ACL_reboot_routers	`Failure`	421.73	test_vpc_redundant.py

nvazquez · 2021-07-21T12:01:00Z

Merging based on approvals and test results as failures are intermitent issues

blueorangutan · 2021-07-22T01:51:46Z

Trillian test result (tid-1331)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 83146 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5119-t1331-kvm-centos7.zip
Intermittent failure detected: /marvin/tests/smoke/test_internal_lb.py
Intermittent failure detected: /marvin/tests/smoke/test_network.py
Intermittent failure detected: /marvin/tests/smoke/test_reset_vm_on_reboot.py
Intermittent failure detected: /marvin/tests/smoke/test_resource_accounting.py
Intermittent failure detected: /marvin/tests/smoke/test_router_dhcphosts.py
Intermittent failure detected: /marvin/tests/smoke/test_router_dns.py
Intermittent failure detected: /marvin/tests/smoke/test_router_dnsservice.py
Intermittent failure detected: /marvin/tests/smoke/test_routers_iptables_default_policy.py
Intermittent failure detected: /marvin/tests/smoke/test_routers_network_ops.py
Intermittent failure detected: /marvin/tests/smoke/test_routers.py
Intermittent failure detected: /marvin/tests/smoke/test_service_offerings.py
Intermittent failure detected: /marvin/tests/smoke/test_snapshots.py
Intermittent failure detected: /marvin/tests/smoke/test_vm_life_cycle.py
Intermittent failure detected: /marvin/tests/smoke/test_volumes.py
Intermittent failure detected: /marvin/tests/smoke/test_vpc_redundant.py
Smoke tests completed. 79 look OK, 10 have error(s)
Only failed tests results shown below:

Test	Result	Time (s)	Test File
ContextSuite context=TestResetVmOnReboot>:setup	`Error`	0.00	test_reset_vm_on_reboot.py
ContextSuite context=TestRAMCPUResourceAccounting>:setup	`Error`	0.00	test_resource_accounting.py
ContextSuite context=TestRouterDns>:setup	`Error`	0.00	test_router_dns.py
ContextSuite context=TestRouterDnsService>:setup	`Error`	0.00	test_router_dnsservice.py
ContextSuite context=TestRouterIpTablesPolicies>:setup	`Error`	0.00	test_routers_iptables_default_policy.py
ContextSuite context=TestVPCIpTablesPolicies>:setup	`Error`	0.00	test_routers_iptables_default_policy.py
ContextSuite context=TestIsolatedNetworks>:setup	`Error`	0.00	test_routers_network_ops.py
ContextSuite context=TestRedundantIsolateNetworks>:setup	`Error`	0.00	test_routers_network_ops.py
ContextSuite context=TestRouterServices>:setup	`Error`	0.00	test_routers.py
ContextSuite context=TestCpuCapServiceOfferings>:setup	`Error`	0.00	test_service_offerings.py
ContextSuite context=TestServiceOfferings>:setup	`Error`	0.12	test_service_offerings.py
ContextSuite context=TestSnapshotRootDisk>:setup	`Error`	0.00	test_snapshots.py
test_03_create_redundant_VPC_1tier_2VMs_2IPs_2PF_ACL_reboot_routers	`Failure`	532.16	test_vpc_redundant.py

GutoVeronezi added 2 commits June 16, 2021 10:06

Externalize configs to alert

f9364fc

Externalize configs to project

9e2d763

RodrigoDLopez approved these changes Jun 28, 2021

View reviewed changes

DaanHoogland approved these changes Jul 16, 2021

View reviewed changes

sureshanaparti added this to the 4.16.0.0 milestone Jul 16, 2021

nvazquez approved these changes Jul 21, 2021

View reviewed changes

GabrielBrascher approved these changes Jul 21, 2021

View reviewed changes

nvazquez merged commit eb3acc3 into apache:main Jul 21, 2021

nvazquez added Severity:Minor type:enhancement labels Oct 14, 2021

Externalize tls version and security protocols configuration on mail sending #5119

Externalize tls version and security protocols configuration on mail sending #5119

Uh oh!

Conversation

GutoVeronezi commented Jun 16, 2021

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

How Has This Been Tested?

Uh oh!

rohityadavcloud commented Jun 18, 2021

Uh oh!

blueorangutan commented Jun 18, 2021

Uh oh!

blueorangutan commented Jun 18, 2021

Uh oh!

DaanHoogland commented Jun 18, 2021

Uh oh!

blueorangutan commented Jun 18, 2021

Uh oh!

GutoVeronezi commented Jun 18, 2021

Uh oh!

DaanHoogland commented Jun 18, 2021

Uh oh!

GutoVeronezi commented Jun 28, 2021

Uh oh!

RodrigoDLopez left a comment

Choose a reason for hiding this comment

Uh oh!

rohityadavcloud commented Jul 15, 2021

Uh oh!

blueorangutan commented Jul 15, 2021

Uh oh!

blueorangutan commented Jul 15, 2021

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

GutoVeronezi commented Jul 20, 2021

Uh oh!

blueorangutan commented Jul 20, 2021

Uh oh!

blueorangutan commented Jul 20, 2021

Uh oh!

nvazquez commented Jul 21, 2021

Uh oh!

blueorangutan commented Jul 21, 2021

Uh oh!

nvazquez left a comment

Choose a reason for hiding this comment

Uh oh!

nvazquez commented Jul 21, 2021

Uh oh!

blueorangutan commented Jul 21, 2021

Uh oh!

nvazquez commented Jul 21, 2021

Uh oh!

blueorangutan commented Jul 21, 2021

Uh oh!

GabrielBrascher left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Jul 21, 2021

Uh oh!

nvazquez commented Jul 21, 2021

Uh oh!

blueorangutan commented Jul 22, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants