Skip to content

gNMI TLS certs never found when profile name contains uppercase - upload writes to slug directory, lookup reads from profile_name #136

Description

@mattg66

Environment: YANG Suite 3.0.13, Docker, Python 3.10.
Device: Nexus 9000v, NX-OS, gNMI over TLS on port 50051, self-signed cert CN=ems.cisco.com.

Repro

  1. Create a device profile named N9Kv (slug becomes n9kv).
  2. gNMI section: secure: true, secure port 50051, TLS host override ems.cisco.com.
  3. Upload the device cert as TLS Authority Certificate, save, run the reachability check.

Actual

POST /devices/upload/n9kv stores the file under the slug:

  /ys-data/users/admin/devices/n9kv/n9k-gnmi.pem

But the lookup uses profile_name instead:

  ERROR [yangsuite:373] Client certificate file not found. /ys-data/users/admin/devices/N9Kv/client.crt
  ERROR [yangsuite:389] Client key file not found.         /ys-data/users/admin/devices/N9Kv/client.key

So the certificate lookup fails and the 'None' is not an instance of 'bytes' issue is shown.

Workaround

  ln -s n9kv /ys-data/users/admin/devices/N9Kv

All-lowercase profile names avoid the bug entirely.

Suggested fix

Use the slug on both sides of the cert path, since POST /devices/upload/<slug> already does.
Also consider surfacing "certificate file not found" to the user.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions