[PATCH oz 1/2] Implement SSL vhost support in ssh tunneling.

Chris Lalancette clalancette at gmail.com
Mon Dec 19 02:22:35 UTC 2011


Heh, good timing.  I just split this up into 3 patches and pushed the
result.  Please test it out and let me know how it goes.

Thanks,
Chris Lalancette

On Sun, Dec 18, 2011 at 8:14 PM, Chris Alfonso <calfonso at redhat.com> wrote:
> This patch creates a forwarding tunnel to the repository hosts.  A
> temporary host entry is added as an alias in the guest /etc/hosts.
> When the tunnel is finished being used, the alias is removed and any
> persisted repositories are reverted to their original base urls.
> ---
>  oz/RedHat.py |   57 ++++++++++++++++++++++++++++++++++++++++++---------------
>  1 files changed, 42 insertions(+), 15 deletions(-)
>
> diff --git a/oz/RedHat.py b/oz/RedHat.py
> index 48a4483..25319b4 100644
> --- a/oz/RedHat.py
> +++ b/oz/RedHat.py
> @@ -55,7 +55,7 @@ AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
>  AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
>  AcceptEnv XMODIFIERS
>  X11Forwarding yes
> -Subsystem      sftp    /usr/libexec/openssh/sftp-server
> +Subsystem   sftp    /usr/libexec/openssh/sftp-server
>  """
>
>         self.stock_ks = stock_ks
> @@ -868,7 +868,6 @@ class RedHatCDYumGuest(RedHatCDGuest):
>         """
>         # this is the path to the metadata XML
>         full_url = repo_url + "/repodata/repomd.xml"
> -
>         # first, check if we can access it from the host
>         self.data = ''
>         def _writefunc(buf):
> @@ -877,37 +876,40 @@ class RedHatCDYumGuest(RedHatCDGuest):
>             """
>             self.data += buf
>
> -        c = pycurl.Curl()
> -        c.setopt(c.URL, full_url)
> -        c.setopt(c.CONNECTTIMEOUT, 5)
> -        c.setopt(c.WRITEFUNCTION, _writefunc)
> +        crl = pycurl.Curl()
> +        crl.setopt(crl.URL, full_url)
> +        crl.setopt(crl.CONNECTTIMEOUT, 5)
> +        crl.setopt(crl.WRITEFUNCTION, _writefunc)
>
>         curlargs = ""
>         if "sslclientcert" in certdict:
> -            c.setopt(c.SSLCERT, certdict["sslclientcert"]["localname"])
> +            crl.setopt(crl.SSLCERT, certdict["sslclientcert"]["localname"])
>             curlargs += "--cert %s " % (certdict["sslclientcert"]["remotename"])
>         if "sslclientkey" in certdict:
> -            c.setopt(c.SSLKEY,  certdict["sslclientkey"]["localname"])
> +            crl.setopt(crl.SSLKEY,  certdict["sslclientkey"]["localname"])
>             curlargs += "--key %s " % (certdict["sslclientkey"]["remotename"])
>         if "sslcacert" in certdict:
> -            c.setopt(c.CAINFO,  certdict["sslcacert"]["localname"])
> +            crl.setopt(crl.CAINFO,  certdict["sslcacert"]["localname"])
>             curlargs += "--cacert %s " % (certdict["sslcacert"]["remotename"])
>         else:
>             # We enforce either setting a ca cert or setting no verify in TDL
>             # If this is a non-SSL connection setting this option is benign
> -            c.setopt(c.SSL_VERIFYHOST, 0)
> +            crl.setopt(crl.SSL_VERIFYPEER, 0)
> +            crl.setopt(crl.SSL_VERIFYHOST, 0)
>             curlargs += "--insecure "
>
>         try:
> -            c.perform()
> +            crl.perform()
>             # if we reach here, then the perform succeeded, which means we
>             # could reach the repo from the host
>             host = True
> -        except pycurl.error:
> +        except pycurl.error, err:
>             # if we got an exception, then we could not reach the repo from
>             # the host
> +            self.log.debug("Unable to route to the repo host from here, and SSH tunnel will never be established")
> +            self.log.debug(err)
>             host = False
> -        c.close()
> +        crl.close()
>
>         # now check if we can access it remotely
>         try:
> @@ -916,8 +918,10 @@ class RedHatCDYumGuest(RedHatCDGuest):
>             # if we reach here, then the perform succeeded, which means we
>             # could reach the repo from the guest
>             guest = True
> -        except oz.ozutil.SubprocessException:
> +        except oz.ozutil.SubprocessException, err:
>             # if we got an exception, then we could not reach the repo from
> +            self.log.debug("Unable to route to the repo host from the guest, will attempt to establish an SSH tunnel")
> +            self.log.debug(err)
>             # the guest
>             guest = False
>
> @@ -932,6 +936,22 @@ class RedHatCDYumGuest(RedHatCDGuest):
>                 for remotefile in repo.remotefiles:
>                     self.guest_execute_command(guestaddr,
>                                                "rm -f %s" % (remotefile))
> +            else:
> +                if len(self.tunnels) > 0:
> +                   for remotefile in repo.remotefiles:
> +                       (protocol, hostname, port, path) = self._deconstruct_repo_url(repo.url)
> +                       if (hostname in self.tunnels) and (port in self.tunnels[hostname]):
> +                           remote_tun_port = self.tunnels[hostname][port]
> +                           self.guest_execute_command(guestaddr,
> +                                                      "sed -i -e 's|^baseurl=.*$|baseurl=%s|' %s" % (repo.url, remotefile))
> +
> +    def _remove_host_aliases(self, guestaddr):
> +        if len(self.tunnels) > 0:
> +            for repo in self.tdl.repositories.values():
> +                (protocol, hostname, port, path) = self._deconstruct_repo_url(repo.url)
> +                self.log.debug("Removing tunnel host entry for %s from host %s" % (hostname, guestaddr))
> +                self.guest_execute_command(guestaddr,
> +                                           "mv -f /etc/hosts.backup /etc/hosts; restorecon /etc/hosts")
>
>     def _customize_repos(self, guestaddr):
>         """
> @@ -955,6 +975,11 @@ class RedHatCDYumGuest(RedHatCDGuest):
>             # the repo is not persistent
>             repo.remotefiles = []
>
> +            def _add_remote_host_alias(hostname):
> +                self.log.debug("Modifying /etc/hosts on %s to make %s resolve to localhost tunnel port" % (guestaddr, hostname))
> +                self.guest_execute_command(guestaddr,
> +                                           "test -f /etc/hosts.backup || cp /etc/hosts /etc/hosts.backup; sed -i -e 's/localhost.localdomain/localhost.localdomain %s/g' /etc/hosts" % hostname)
> +
>             # before we can do the locality check below we need to be sure any
>             # required cert material is already available in file form on both
>             # the guest and the host - do that here and remember the lines
> @@ -1028,10 +1053,11 @@ class RedHatCDYumGuest(RedHatCDGuest):
>                 else:
>                     # New tunnel required
>                     if not (hostname in self.tunnels):
> +                        _add_remote_host_alias(hostname)
>                         self.tunnels[hostname] = {}
>                     self.tunnels[hostname][port] = str(remote_tun_port)
>                     tunport = tunport + 1
> -                remote_url = "%s://localhost:%s/%s" % (protocol,
> +                remote_url = "%s://%s:%s/%s" % (protocol, hostname,
>                                                        remote_tun_port, path)
>                 f.write("# This is a tunneled version of local repo: (%s)\n" % (repo.url))
>                 f.write("baseurl=%s\n" % remote_url)
> @@ -1087,6 +1113,7 @@ class RedHatCDYumGuest(RedHatCDGuest):
>         for content in self.tdl.commands.values():
>             self.guest_execute_command(guestaddr, content)
>
> +        self._remove_host_aliases(guestaddr)
>         self._remove_repos(guestaddr)
>
>         self.log.debug("Syncing")
> --
> 1.7.6.4
>



More information about the aeolus-devel mailing list