From: Ondrej Lichtner <olichtne(a)redhat.com>
This updates the save_machine_config method to store the security
information of the machine into the temporary file. This information is
later used to connect to the machine during the deconfiguration. This
can probably be done in a more sensible way, but that would probably
require reimplementation of these two methods to work in a different
way. To add at least some form of security I made sure that the
temporary file only has rw- permissions for the owner.
Signed-off-by: Ondrej Lichtner <olichtne(a)redhat.com>
---
lnst/Controller/Machine.py | 3 +++
lnst/Controller/NetTestController.py | 18 +++++++++++++++---
2 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/lnst/Controller/Machine.py b/lnst/Controller/Machine.py
index 4112bd0..5d8db7d 100644
--- a/lnst/Controller/Machine.py
+++ b/lnst/Controller/Machine.py
@@ -512,6 +512,9 @@ class Machine(object):
def wait_interface_init(self):
return self._rpc_call("wait_interface_init")
+ def get_security(self):
+ return self._security
+
class Interface(object):
""" Abstraction of a test network interface on a slave machine
diff --git a/lnst/Controller/NetTestController.py b/lnst/Controller/NetTestController.py
index e1b2054..6484c99 100644
--- a/lnst/Controller/NetTestController.py
+++ b/lnst/Controller/NetTestController.py
@@ -28,6 +28,8 @@ from lnst.Controller.RecipeParser import RecipeParser, RecipeError
from lnst.Controller.SlavePool import SlavePool
from lnst.Controller.Machine import MachineError, VirtualInterface
from lnst.Controller.Machine import StaticInterface
+from lnst.Controller.CtlSecSocket import CtlSecSocket
+from lnst.Common.SecureSocket import SecSocketException
from lnst.Common.ConnectionHandler import send_data, recv_data
from lnst.Common.ConnectionHandler import ConnectionHandler
from lnst.Common.Config import lnst_config
@@ -548,6 +550,8 @@ class NetTestController:
machine["libvirt_dom"] = m.get_libvirt_domain()
machine["interfaces"] = []
+ machine["security"] = m.get_security()
+
for i in m._interfaces:
if isinstance(i, VirtualInterface):
hwaddr = i.get_orig_hwaddr()
@@ -559,6 +563,7 @@ class NetTestController:
bridges.append(bridge.get_name())
with open("/tmp/.lnst_machine_conf", "wb") as f:
+ os.fchmod(f.fileno(), 0o600)
pickled_data = cPickle.dump(config_data, f)
@classmethod
@@ -578,16 +583,23 @@ class NetTestController:
for hostname, machine in cfg["machines"].iteritems():
port = lnst_config.get_option("environment",
"rpcport")
if test_tcp_connection(hostname, port):
- rpc_con = socket.create_connection((hostname, port))
+ s = socket.create_connection((hostname, port))
+ rpc_con = CtlSecSocket(s)
+ try:
+ rpc_con.handshake(machine["security"])
+ except SecSocketException:
+ logging.error("Failed authentication for machine %s"
%\
+ hostname)
+ continue
rpc_msg= {"type": "command",
"method_name": "machine_cleanup",
"args": []}
logging.debug("Calling cleanup on slave '%s'" %
hostname)
- send_data(rpc_con, rpc_msg)
+ rpc_con.send_msg(rpc_msg)
while True:
- msg = recv_data(rpc_con)
+ msg = rpc_con.recv_msg()
if msg['type'] == 'result':
break
rpc_con.close()
--
2.7.2