X-Road v6.24.0 Release Notes

6.24.0

31.08.2020

• 6.240

• 6.23.0

• 6.22.1

Central Server

• Ubuntu 18.04 LTS

Configuration Proxy

• Ubuntu 18.04 LTS

Security Server

• Ubuntu 18.04 LTS

• RHEL 7

• RHEL 8

https://github.com/nordic-institute/X-Road/tree/master/doc

https://github.com/nordic-institute/X-Road/tree/master

MIT

XRDDEV-17

Improvement

Add validation to client certificates expiration date. Before version 6.24.0 the Security Server does not validate the expiration date of a client information system's certificate. Starting from version 6.24.0 the expiration date of client certificates is validated, and in case the certificate is expired, a warning is logged in the proxy log by default. It is also possible to prevent the use of expired client certificates and block message processing in case an expired client certificate is detected. This can be achieved by adding the below configuration in "/etc/xroad/conf.d/local.ini" on Security Server:

/etc/xroad/conf.d/local.ini

XRDDEV-59

Improvement

Update the date and time format used in the X-Road application logs to be based on the international standard ISO 8601 so that it's consistent. Starting from version 6.24.0 the date and time format used in the X-Road application logs is "yyyy-MM-ddTHH:mm:ss.SSSZ".

XRDDEV-63

Fix

Fix signer-console reporting correctly closed akka connections as erros.

XRDDEV-68

Fix

Fix the usage of thread local variables in the Security Server.

XRDDEV-113

Improvement

Optimize message log archiving performance. The database query logic used in the archival process was updated to use streaming instead of multiple separate queries.

XRDDEV-125

Improvement

Improve the Security Server architecture documentation by adding a description of contracts and responsibilities of different Security Server modules. The information is available in the Security Server Architecture document (ARC-SS).

XRDDEV-142

Improvement

Add DNS name or IP that was used to register the Security Server to the Security Server UI. Starting from version 6.24.0 the DNS name or IP can be viewed in the Security Server UI by taking the mouse cursor over the Security Server name on the top banner.

XRDDEV-261

Improvement

Improve Security Server's fault tolerance when internal load balancing is used. After the change requests are no longer being sent to Security Servers with a failing TLS handshake.

The fastest wins connection selection Security Server HA strategy was updated to take successful TLS handshake into account when choosing the winner. Before version 6.24.0 the fastest wins selection worked so that the Security Server that first responded to TCP connect request was selected as the winner. In case TLS handshake failed in a later phase of the message flow, the whole request failed. Starting from version 6.24.0 the fastest wins selection takes TLS handshake into account, and a Security Server with a failing TLS handshake cannot be selected as a winner. For example, a Security Server that is running without a valid authentication certificate or without PIN code being typed, does no longer receive requests from other Security Servers.

XRDDEV-377

Improvement

Improve failover for timestamping requests so that failover works also when the TSA certificate is incorrect and/or expired. Before the change failover worked only in case connection to the TSA failed, but starting from version 6.24.0 the failover is done also when connection succeeds, but the TSA response is invalid. After the change timestamping is more robust since all the configured TSAs are tried until a valid response is received. In case any of the configured TSAs is not able to provide a valid response, timestamping fails. However, the failover requires that the Security Server has more than one configured TSA.

XRDDEV-440

Improvement

Improve security and configurability by adding a separate database users for Security Server database migrations, so that the normal DB users used by the application cannot update the DB schema. Each Security Server database has its own admin user (by default serverconf_admin, messagelog_admin, opmonitor_admin) and normal DB user (by default serverconf, messagelog, opmonitor).

XRDDEV-546

Improvement

Update operational monitoring implementation and protocols so that separate fields for storing the same metric for SOAP and REST messages are not used. After the change there's a single field for each metric that is used for both SOAP and REST messages.

getSecurityServerOperationalData

Changes in the "getSecurityServerOperationalData" response's "operational-monitoring-data.json.gz" attachment:

• requestSoapSize → requestSize

• responseSoapSize → responseSize

• requestRestSize → requestSize

• responseRestSize → responseSize

• serviceType → this new field is returned with possible values WSDL, REST, OPENAPI3

• soapFaultCode → faultCode

• soapFaultString → faultString

getSecurityServerHealthData

Changes in the "getSecurityServerHealthData" response:

• requestMinSoapSize → requestMinSize

• requestAverageSoapSize → requestAverageSize

• requestMaxSoapSize → requestMaxSize

• requestSoapSizeStdDev → requestSizeStdDev

• responseMinSoapSize → responseMinSize

• responseAverageSoapSize → responseAverageSize

• responseMaxSoapSize → responseMaxSize

• responseSoapSizeStdDev → responseSizeStdDev

JMX

Changes in the JMX metrics:

• requestSoapSize → requestSize

• responseSoapSize → responseSize

• serviceType → this new field is returned with possible values WSDL, REST, OPENAPI3

XRDDEV-559

New

Add new UI and management API package (xroad-proxy-ui-api) to the Security Server packaging. Remove the old UI package (xroad-jetty) and Nginx package (xroad-nginx) from the packaging.

During the Security Server version upgrade to version 6.24.0 the old UI's TLS key and certificate are migrated to the new UI.

SELinux configuration changes are removed from RHEL installations.

Log files

Removed log files and directories:

• /var/log/xroad/jetty/jetty.log

• /var/log/nginx

New log files:

• /var/log/xroad/proxy_ui_api.log

• /var/log/xroad/proxy_ui_api_access.log

Services

Removed services:

• xroad-jetty

• nginx

New services:

• xroad-proxy-ui-api

XRDDEV-591

New

Add support for returning Security Server generated error messages in different formats (JSON, XML). Starting from version 6.24.0 the Security Server respects "Accept" header value when providing error responses. The formats application/json, application/xml and text/xml are supported, application/json is the default.

Security Server respects the "Accept" header value only when the error response is generated by the Security Server. Error messages originating from service provider's information system are not converted or transformed - they are returned as-is. In other words, the "Accept" header value is not respected when the error response is not generated by the Security Server.

XRDDEV-595

Improvement

Replace "-" characters with "_" in ansible scripts to fix deprecation warnings.

XRDDEV-608

Fix

Fix a problem that caused WSDL validation to return warnings as errors that cannot be ignored.

WSDL validation may return warnings that can be ignored and errors that cannot be ignored. The problem caused warnings to be interpreted as errors with the result that warnings caused WSDL validation to fail without the possibility to ignore them.

XRDDEV-700

Improvement

Optimize serverconf caching and access rights evaluation. Before version 6.24.0 service access rights were fetched from database separately for every incoming request. Starting from version 6.24.0 the access rights are fetched from the database periodically and cached for 60 seconds by default. Therefore, changes in the service access rights not applied immediately, but within 60 seconds from the change.

XRDDEV-712

Improvement

Update Ansible scripts to support Ubuntu 18 minimal OS.

XRDDEV-728

Fix

Remove old, unused RHEL7 port forwarding scripts and all references to these scripts from RHEL7 packaging.

XRDDEV-739

Improvement

Clarify documentation related to downloading service descriptions.

Updated documentation can be found here, here and here.

XRDDEV-745

Fix

Fix a problem that caused rsyslog and nginx configuration changes not to be applied on fresh RHEL install without restarting rsyslogd and nginx.

XRDDEV-747

Improvement

Improve configurability by splitting nginx default-xroad.conf so that it can be updated independently for Central Server and Security Server.

XRDDEV-752

Improvement

Update Akka to version 2.6.

XRDDEV-773

New

Update ansible scripts to allow the Central Server to be installed with a remote database.

More information can be found here.

XRDDEV-805

Improvement

Improve security and configurability by moving Security Server DB tables to a separate schema instead of using the default "public" schema, so that maintenance does not require super-user rights. The change also enables user defined database names and users which makes it possible to host several databases in the same PostgreSQL cluster (instance). Before version 6.24.0, database names and users were hard-coded which prevented sharing the same PostgreSQL cluster among multiple Security Servers.

When upgrading to version 6.24.0, the serverconf database schema is renamed and the migration requires that installer can access the database using administrative permissions. In case sufficient permissions are not available, the upgrade will fail and some manual steps are needed. The manual steps are documented here.

Please note, that messagelog and opmonitor schemas are not renamed during an upgrade. Instead, new installations will use separate schemas.

XRDDEV-807

Improvement

Improve security by moving Central Server DB tables to a separate schema instead of using the default "public" schema, so that maintenance does not require super-user rights.

XRDDEV-814

Improvement

Update license in source code file headers.

XRDDEV-822

Improvement

Make the Security Server listen to connections from client information systems only on localhost when the Estonian meta package is installed.

XRDDEV-825

Improvement

Remove the deprecated HTTP GET metaservice interface for fetching WSDL descriptions. Starting from version 6.24.0 the "getWsdl" metaservice is available through the HTTP POST metaservice interface only.

XRDDEV-826

Improvement

Add validation of X-Road identifiers for restricted characters when identifiers are added or modified using the Security Server REST management API.

XRDDEV-827

Improvement

Add validation of X-Road identifiers for restricted characters when identifiers are added or modified on the Central Server, during management request processing on the Central Server and during message processing on the Security Server:

• Central Server UI validates user inputted identifiers.

• Management services check that incoming identifiers do not contain invalid characters.

• Client proxy checks the incoming identifiers in SOAP and REST messages and in case there is a non-conforming identifier creates a warning in application logs.

Restricted characters are:

• ISO control characters (U+0000 - U+001F, U+007F - U+009F)

• Zero-width spaces (U+200B, U+FEFF)

• colon, semicolon, slash, backslash, percent

The restricted characters are applied to the following identifiers:

• member code

• subsystem code

• service code (REST)

• service code & service version (SOAP)

• instance id

• member class

• security server code

• central service

XRDDEV-828

Improvement

Add support for configuring database super-user name for the Security Server and Central Server.

Before version 6.24.0 the Central Server and Security Server used a hard-coded database super-user "postgres". However, some environments / platforms use other super-user name which made the installation fail. Starting from version 6.24.0 is is possible to configure the database super-user name in xroad.properties file.

XRDDEV-874

Improvement

Improve Central Server HA migration guides here and here.

XRDDEV-911

New

Create Security Server installation packages for Red Hat Enterprise Linux 8 (RHEL8).

XRDDEV-913

Fix

Fix a problem that caused xroad-opmonitor standalone installation fail on Ubuntu 18.

XRDDEV-925

Improvement

Implement ordering of the configured TSA providers on the Security Server so that the same ordering is used by the Security Server management REST API, UI and proxy in message processing. Before version 6.24.0 the ordering of TSA providers wasn't explicitly defined and the ordering may have varied between different Security Server components. Starting from version 6.24.0 all the Security Server components use the same ordering.

XRDDEV-972

Improvement

Document manually upgrading the Security Server DB schema to 6.24 in case the automated process fails.

The documentation is available here.

XRDDEV-999

Fix

Update Rake version to 13.0.1.

XRDDEV-1010

Fix

Fix a problem that caused the operational monitoring getSecurityServerOperationalData response json file to contain responses which were not made by the requesting client. The problem occurred only with result sets exceeding the max-records-in-payload (10000 by default) limit.

XRDDEV-1011

Improvement

Add summary output to HA cluster status check in Central Server system status API. The summary status is presented by the "all_nodes_ok" property, and it's value is true if the status of all nodes is "OK" and false otherwise.

XRDDEV-1017

Improvement

Make signer client recover faster from signer connection failures to avoid long hanging connections. When connection is lost, signer client tries to re-establish the connection as soon as possible. Signer client is used by other X-Road modules (e.g., proxy, proxy-ui-api) that need to connect to signer.

XRDDEV-1021

Fix

Update jackson-databind version to 2.10.3.

XRDDEV-1123

Improvement

Remove unnecessary OCSP fetching of root certificates when Security Server diagnostics information is accessed. Before version 6.24.0 accessing the Security Server diagnostics information caused an error in the signer log, because fetching of root certificates was attempted. Starting from version 6.24.0 accessing the Security Server diagnostics information does not cause false error messages in the logs.

XRDDEV-1156

Fix

Improve security by making rsyslog listen for connections on localhost only by default. Before version 6.24.0 rsyslog listened for connections on all interfaces by default.

XRDDEV-1157

Improvement

Publish X-Road release repository sign key on key servers maintained by a trusted third party (SKS key servers) for improved trust. Add X-Road release repository sign key details to installation guides.

XRDDEV-1159

Improvement

Improve security by disabling Security Server JMX interfaces by default.

XRDDEV-1160

Improvement

Improve security by auto generating the default password for Central Server database user "centerui" during installation process.

XRDDEV-1161

Improvement

Turn message body logging off on the Security Server for the Icelandic Security Server meta package ("xroad-securityserver-is").

XRDDEV-1173

Improvement

Enable enforcing token PIN policy in the Estonian meta package. After the change the token PIN policy is enforced when "xroad-securityserver-ee" package is installed.

XRDDEV-1180