libvirt users - Dec 2021 - error during host deploy

Hi,
While running a test case of adding hosts on ovirt system tests there was a
failure while the following command was executed:
vdsm-tool configure --force

On libvirtd log I found this error:

2021-12-17 00:11:41.753+0000: 28031: error : virNetTLSContextNew:732 :
Unable to generate diffie-hellman parameters: Error in public key
generation.

How would you suggest to debug this failure?
attaching libvirtd & journalctl logs
libvirt version: 7.10.0, package: 1.module_el8.6.0+1046+bd8eec5e

Thanks,
Dana

The error from host deploy log:

"2021-12-17 01":"11":"45 CET - fatal":[
   ost-basic-suite-master-host-0
]:"FAILED! =>"{
   "changed":true,
   "cmd":[
      "vdsm-tool",
      "configure",
      "--force"
   ],
   "delta":"0:00:06.908971",
   "end":"2021-12-17 01:11:42.815057",
   "msg":"non-zero return code",
   "rc":1,
   "start":"2021-12-17 01:11:35.906086",
   "stderr":"Error:  ServiceOperationError: _systemctlStart
failed\nb'Job for libvirtd.service failed because a fatal signal was
delivered causing the control process to dump core.\\nSee \"systemctl
status libvirtd.service\" and \"journalctl -xe\" for
details.\\n' ",
   "stderr_lines":[
      "Error:  ServiceOperationError: _systemctlStart failed",
      "b'Job for libvirtd.service failed because a fatal signal was
delivered causing the control process to dump core.\\nSee \"systemctl
status libvirtd.service\" and \"journalctl -xe\" for
details.\\n' "
   ],
   "stdout":"\nChecking configuration status...\n\nlvm is
configured
for vdsm\nCurrent revision of multipath.conf detected,
preserving\nlibvirt is already configured for vdsm\nSUCCESS: ssl
configured to true. No conflicts\nsanlock is configured for
vdsm\nManaged volume database is already configured\n\nRunning
configure...\nReconfiguration of libvirt is done.\nReconfiguration of
passwd is done.",
   "stdout_lines":[
      "",
      "Checking configuration status...",
      "",
      "lvm is configured for vdsm",
      "Current revision of multipath.conf detected, preserving",
      "libvirt is already configured for vdsm",
      "SUCCESS: ssl configured to true. No conflicts",
      "sanlock is configured for vdsm",
      "Managed volume database is already configured",
      "",
      "Running configure...",
      "Reconfiguration of libvirt is done.",
      "Reconfiguration of passwd is done."
   ]
}
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://listman.redhat.com/archives/libvirt-users/attachments/20211220/1e3b642f/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: libvirt.log
Type: text/x-log
Size: 168973 bytes
Desc: not available
URL:
<http://listman.redhat.com/archives/libvirt-users/attachments/20211220/1e3b642f/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: journalctl.log
Type: text/x-log
Size: 286744 bytes
Desc: not available
URL:
<http://listman.redhat.com/archives/libvirt-users/attachments/20211220/1e3b642f/attachment-0001.bin>

On 12/20/21 11:34, Dana Elfassy wrote:
> Hi,
> While running a test case of adding hosts on ovirt system tests there
> was a failure while the following command was executed:
> vdsm-tool configure --force
> 
> On libvirtd log I found this error:
> 
> 2021-12-17 00:11:41.753+0000: 28031: error : virNetTLSContextNew:732 :
> Unable to generate diffie-hellman parameters: Error in public key
> generation.

This is the code on that line:

  err = gnutls_dh_params_init(&ctxt->dhParams);
  if (err < 0) {
      virReportError(VIR_ERR_SYSTEM_ERROR,
                     _("Unable to initialize diffie-hellman parameters:
%s"),
                     gnutls_strerror(err));
      goto error;
  }
  err = gnutls_dh_params_generate2(ctxt->dhParams, DH_BITS);
  if (err < 0) {
      virReportError(VIR_ERR_SYSTEM_ERROR,
                     _("Unable to generate diffie-hellman parameters:
%s"),
                     gnutls_strerror(err));
      goto error;
  }
  
  gnutls_certificate_set_dh_params(ctxt->x509cred,
                                         ctxt->dhParams);


More specific, it's gnutls_dh_params_generate2() that fails. I suspect
it's because DH_BITS is defined as following:

  #define DH_BITS 2048

which might be too short for system policy. If you're able, you can try
the following patch:

diff --git i/src/rpc/virnettlscontext.c w/src/rpc/virnettlscontext.c
index 1a3dd92676..3ab9f6c4ce 100644
--- i/src/rpc/virnettlscontext.c
+++ w/src/rpc/virnettlscontext.c
@@ -717,16 +717,20 @@ static virNetTLSContext *virNetTLSContextNew(const char
*cacert,
      * once a day, once a week or once a month. Depending on the
      * security requirements.
      */
     if (isServer) {
+        unsigned int bits = 0;
+
+        bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH,
GNUTLS_SEC_PARAM_HIGH);
+
         err = gnutls_dh_params_init(&ctxt->dhParams);
         if (err < 0) {
             virReportError(VIR_ERR_SYSTEM_ERROR,
                            _("Unable to initialize diffie-hellman
parameters: %s"),
                            gnutls_strerror(err));
             goto error;
         }
-        err = gnutls_dh_params_generate2(ctxt->dhParams, DH_BITS);
+        err = gnutls_dh_params_generate2(ctxt->dhParams, bits);
         if (err < 0) {
             virReportError(VIR_ERR_SYSTEM_ERROR,
                            _("Unable to generate diffie-hellman
parameters: %s"),
                            gnutls_strerror(err));


If it helps, I can post it for review.

Michal