New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 769550 link

Starred by 1 user
Status: Untriaged
Owner: ----
Cc:
benchan@chromium.org
ejcaruso@chromium.org
█ cernekee@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 3
Type: Bug



Sign in to add a comment

Shill throws 'InvalidProperty' error when setting OpenVPN.Pkcs11.Slot

Project Member Reported by steve...@chromium.org, Sep 28 2017 
shill/dbus-constants.h includes:

const char kOpenVPNClientCertSlotProperty[] = "OpenVPN.Pkcs11.Slot";

However if we set it Shill throws an InvalidProperty error.

We should remove it from the header.

Also, EAP.CertID uses the format tpm_slot:pkcs11Id (which is not documented in service-api.txt).

Should OpenVPN.Pkcs11.ID use the same format?

VPNs using L2TP-IPsec specify slot explicitly using 
L2TPIPsec.ClientCertSlot.

Comment 1 by steve...@chromium.org, Sep 28 2017

Labels: -Pri-2 -M-64 Pri-3
Note: It appears that we have been just setting the pkcs11id and not the slot from the UI and presumably this is working. We can continue to do so, but should probably remove the constant and update the documentation at some point.

Comment 2 by benchan@chromium.org, Sep 28 2017 

stevenjb: seems like you added the constant :)

https://chromium-review.googlesource.com/c/chromiumos/platform/system_api/+/7293

"OpenVPN.Pkcs11.Slot" is never used in shill according to git history. It isn't referenced in the shill api doc either. Perhaps we wanted to make openvpn handles pkcs11 cert like l2tp/ipsec vpn, or perhaps it's a flimflam legacy. Either way,  removing it from service-api sgtm: https://chromium-review.googlesource.com/c/chromiumos/platform/system_api/+/688822

Comment 3 by steve...@chromium.org, Sep 28 2017 

We should really update the api doc to explain how Shill handles the TPM slot for OpenVPN. Does anyone know for sure whether it even works?

Comment 4 by benchan@chromium.org, Sep 28 2017 

I believe cernekee would have more recent experience with openvpn and provide more insight.  Otherwise, we would need to dig through the code

Comment 5 by benchan@chromium.org, Sep 28 2017

Cc: benchan@chromium.org

Comment 6 by cernekee@chromium.org, Sep 28 2017 

Corp OpenVPN uses the PKCS11 properties because it relies on a hardware-backed key.  The autotests exercise the openvpn-with-cert configuration as well.

Comment 7 by benchan@chromium.org, Sep 28 2017 

Re #6: That uses OpenVPN.Pkcs11.ID, but not OpenVPN.Pkcs11.Slot, right?

Comment 8 by marcuskoehler@chromium.org, Jan 15

Labels: Enterprise-Triaged
►

Sign in to add a comment