Middlewared Mattermost Notifications Don't Respect Imported CAs
Description
Problem/Justification
Impact
Attachments
- 27 Dec 2023, 04:19 PM
Activity
Bug Clerk January 14, 2024 at 2:46 PM
This issue has now been closed. Comments made after this point may not be viewed by the TrueNAS Teams. Please open a new issue if you have found a problem or need to re-engage with the TrueNAS Engineering Teams.
Bug Clerk January 10, 2024 at 8:21 PM
Bonnie Follweiler December 29, 2023 at 7:11 PM
Good Afternoon @Nate Moyer.
I have moved this ticket into our queue to review.
An engineering representative will update with any further questions or details in the near future.
Nate Moyer December 29, 2023 at 6:11 PM
Apologies, but I will not be submitting a debug file for this ticket due to lack of confidence in api and webhook secrets being stripped out of the output. I have detailed the issues and a possible solution (leaving it to your team to create an appropriate integration). If you need any additional information, I will be glad to provide it. I did include a snippet of the middlewared.log file with the detailed error message as an attachment to this ticket.
Bonnie Follweiler December 27, 2023 at 6:32 PM
Good Afternoon @Nate Moyer.
Please upload a debug file from the affected system to our secure and private upload service located at https://ixsystems.atlassian.net/servicedesk/customer/portal/15/group/37/create/153?
Thank you.
Details
Details
Assignee
Reporter
Labels
Impact
Time remaining
Components
Fix versions
Affects versions
Priority
LowKatalon Platform
Linked Test Cases, Katalon Defect Results, Katalon Studio Test Results
Katalon Platform
The Mattermost alert python code imports the requests module. By default, the requests module ships with it’s own, internal trust store for trusted Certificate Authorities. Because of this, mattermost alert notifications that are sent to a self hosted server using an internal or self signed CA will always fail, even if a user has imported the CA to the CA section of the TrueNAS GUI. I have tested on a local system, and adding the “verify” parameter to the post request inside the
/usr/local/lib/python3.9/site-packages/middlewared/alert/service/mattermost.pyfile successfully allows for a mattermost notification to an internal CA after a restart of the middlewared service. I will leave it up to you on how best to implement the correct fix so that the entire system truststore is used (if desired) or at the very least, trust the truenas_cacerts.pem file. Sample code for the post request in the send_sync function:def send_sync(self, alerts, gone_alerts, new_alerts): r = requests.post( self.attributes["url"], headers={"Content-type": "application/json"}, data=json.dumps({ "username": self.attributes["username"], "channel": self.attributes["channel"], "icon_url": self.attributes["icon_url"], "text": self._format_alerts(alerts, gone_alerts, new_alerts), }), verify="/etc/ssl/truenas_cacerts.pem", timeout=INTERNET_TIMEOUT, ) r.raise_for_status()Specifically, line 11 above is what I added to allow the imported CA to be trusted for Mattermost alerts.