[PATCH] - Create sub directory for sysconfig key storage
by Adam Stokes
- Resolves rhbz 740091
- Keeps our data directory clean and allows us to
concentrate specifically on keys stored in this sub directory
with no cause for confusion.
Signed-off-by: Adam Stokes <astokes(a)fedoraproject.org>
---
src/lib/sysconfig.c | 16 +++++++++++++++-
src/tests/mh_api_sysconfig.h | 2 +-
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/src/lib/sysconfig.c b/src/lib/sysconfig.c
index 4e32737..a4cec6d 100644
--- a/src/lib/sysconfig.c
+++ b/src/lib/sysconfig.c
@@ -38,7 +38,7 @@ MH_TRACE_INIT_DATA(mh_sysconfig);
#ifdef WIN32
static const char DEFAULT_KEYS_DIR[] = "c:\\";
#else
-static const char DEFAULT_KEYS_DIR[] = "/var/lib/matahari/";
+static const char DEFAULT_KEYS_DIR[] = "/var/lib/matahari/sysconfig-keys/";
#endif
/*!
@@ -48,6 +48,15 @@ static const char DEFAULT_KEYS_DIR[] = "/var/lib/matahari/";
*/
static char _keys_dir[PATH_MAX];
+static gboolean
+keys_dir_create(const char *path) {
+ if (g_mkdir(path, 0755) < 0 ) {
+ mh_err("Could not create directory %s", path);
+ return FALSE;
+ }
+ return TRUE;
+}
+
static const char *
keys_dir_get(void)
{
@@ -74,6 +83,11 @@ set_key(const char *key, const char *contents)
return -1;
}
+ if (!g_file_test(keys_dir_get(), G_FILE_TEST_IS_DIR) && !keys_dir_create(keys_dir_get())) {
+ mh_err("Could not create keys directory %s", keys_dir_get());
+ return FALSE;
+ }
+
g_snprintf(key_file, sizeof(key_file), "%s%s", keys_dir_get(), key);
if (!g_file_set_contents(key_file, contents, strlen(contents), NULL)) {
mh_err("Could not set file %s", key_file);
diff --git a/src/tests/mh_api_sysconfig.h b/src/tests/mh_api_sysconfig.h
index 0ea4507..caca67a 100644
--- a/src/tests/mh_api_sysconfig.h
+++ b/src/tests/mh_api_sysconfig.h
@@ -31,7 +31,7 @@ class MhApiSysconfigSuite : public CxxTest::TestSuite
const char key[] = "org.matahariproject.test.unittest"; // Unimportant key defined
char *key_res;
- mh_sysconfig_keys_dir_set("/tmp/");
+ mh_sysconfig_keys_dir_set("/tmp/sysconfig-keys/");
TS_ASSERT((mh_sysconfig_set_configured(key, "OK")) == TRUE);
TS_ASSERT(((key_res = mh_sysconfig_is_configured(key))) != NULL);
--
1.7.6.2
12 years, 7 months
[PATCH] - Create sub directory for sysconfig key storage v2
by Adam Stokes
- Resolves rhbz 740091
- Keeps our data directory clean and allows us to
concentrate specifically on keys stored in this sub directory
with no cause for confusion.
Signed-off-by: Adam Stokes <astokes(a)fedoraproject.org>
---
src/lib/sysconfig.c | 8 +++++++-
src/tests/mh_api_sysconfig.h | 2 +-
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/src/lib/sysconfig.c b/src/lib/sysconfig.c
index 4e32737..0301734 100644
--- a/src/lib/sysconfig.c
+++ b/src/lib/sysconfig.c
@@ -38,7 +38,7 @@ MH_TRACE_INIT_DATA(mh_sysconfig);
#ifdef WIN32
static const char DEFAULT_KEYS_DIR[] = "c:\\";
#else
-static const char DEFAULT_KEYS_DIR[] = "/var/lib/matahari/";
+static const char DEFAULT_KEYS_DIR[] = "/var/lib/matahari/sysconfig-keys/";
#endif
/*!
@@ -74,6 +74,12 @@ set_key(const char *key, const char *contents)
return -1;
}
+ if (!g_file_test(keys_dir_get(), G_FILE_TEST_IS_DIR) &&
+ g_mkdir(keys_dir_get(), 0755) < 0) {
+ mh_err("Could not create keys directory %s", keys_dir_get());
+ return FALSE;
+ }
+
g_snprintf(key_file, sizeof(key_file), "%s%s", keys_dir_get(), key);
if (!g_file_set_contents(key_file, contents, strlen(contents), NULL)) {
mh_err("Could not set file %s", key_file);
diff --git a/src/tests/mh_api_sysconfig.h b/src/tests/mh_api_sysconfig.h
index 0ea4507..0bab713 100644
--- a/src/tests/mh_api_sysconfig.h
+++ b/src/tests/mh_api_sysconfig.h
@@ -31,7 +31,7 @@ class MhApiSysconfigSuite : public CxxTest::TestSuite
const char key[] = "org.matahariproject.test.unittest"; // Unimportant key defined
char *key_res;
- mh_sysconfig_keys_dir_set("/tmp/");
+ mh_sysconfig_keys_dir_set("/tmp/matahari-sysconfig-keys/");
TS_ASSERT((mh_sysconfig_set_configured(key, "OK")) == TRUE);
TS_ASSERT(((key_res = mh_sysconfig_is_configured(key))) != NULL);
--
1.7.6.2
12 years, 7 months
[PATCH] sysconfig: rhbz#740038 Fix run_uri/run_string with no response.
by Russell Bryant
A recent change updated these sysconfig APIs to have their result
delivered back to the agent code asynchronously. One case got missed in
the implementation that resulted in no result being delivered. The case
was if the key already exists and the FORCE flag was not set.
Signed-off-by: Russell Bryant <rbryant(a)redhat.com>
---
src/lib/sysconfig_linux.c | 40 ++++++++++++++++++++++++++--------------
1 files changed, 26 insertions(+), 14 deletions(-)
diff --git a/src/lib/sysconfig_linux.c b/src/lib/sysconfig_linux.c
index c46ac1e..9a87288 100644
--- a/src/lib/sysconfig_linux.c
+++ b/src/lib/sysconfig_linux.c
@@ -313,14 +313,20 @@ sysconfig_os_run_uri(const char *uri, uint32_t flags, const char *scheme,
{
int rc = 0;
- if (mh_sysconfig_is_configured(key) == FALSE || (flags & MH_SYSCONFIG_FLAG_FORCE)) {
- if (strcasecmp(scheme, "puppet") == 0) {
- rc = run_puppet(uri, NULL, key, result_cb, cb_data);
- } else if (strcasecmp(scheme, "augeas") == 0) {
- rc = run_augeas(uri, NULL, key, result_cb, cb_data);
- } else {
- rc = -1;
- }
+ if (mh_sysconfig_is_configured(key) && !(flags & MH_SYSCONFIG_FLAG_FORCE)) {
+ /*
+ * Already configured and not being forced. Report success now.
+ */
+ result_cb(cb_data, 0);
+ return 0;
+ }
+
+ if (strcasecmp(scheme, "puppet") == 0) {
+ rc = run_puppet(uri, NULL, key, result_cb, cb_data);
+ } else if (strcasecmp(scheme, "augeas") == 0) {
+ rc = run_augeas(uri, NULL, key, result_cb, cb_data);
+ } else {
+ rc = -1;
}
return rc;
@@ -332,12 +338,18 @@ sysconfig_os_run_string(const char *string, uint32_t flags, const char *scheme,
{
int rc = 0;
- if (mh_sysconfig_is_configured(key) == FALSE || (flags & MH_SYSCONFIG_FLAG_FORCE)) {
- if (strcasecmp(scheme, "puppet") == 0) {
- rc = run_puppet(NULL, string, key, result_cb, cb_data);
- } else {
- rc = -1;
- }
+ if (mh_sysconfig_is_configured(key) && !(flags & MH_SYSCONFIG_FLAG_FORCE)) {
+ /*
+ * Already configured and not being forced. Report success now.
+ */
+ result_cb(cb_data, 0);
+ return 0;
+ }
+
+ if (!strcasecmp(scheme, "puppet")) {
+ rc = run_puppet(NULL, string, key, result_cb, cb_data);
+ } else {
+ rc = -1;
}
return rc;
--
1.7.6
12 years, 7 months
[PATCH] Spec: rhbz#739216 - Reload systemd after installation
by Zane Bitter
After installing new systemd service files, we need to force systemd to
reload its configuration to get the new services.
Signed-off-by: Zane Bitter <zbitter(a)redhat.com>
---
matahari.spec.in | 15 +++++++++++++++
1 files changed, 15 insertions(+), 0 deletions(-)
diff --git a/matahari.spec.in b/matahari.spec.in
index 242d87f..6e89967 100644
--- a/matahari.spec.in
+++ b/matahari.spec.in
@@ -214,6 +214,9 @@ rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/rc.d/init.d/matahari-broker
#== Host
%post host
+%if %{defined _unitdir}
+systemctl --system daemon-reload
+%endif
/sbin/service matahari-host condrestart
%preun host
@@ -232,6 +235,9 @@ fi
#== Network
%post network
+%if %{defined _unitdir}
+systemctl --system daemon-reload
+%endif
/sbin/service matahari-network condrestart
%preun network
@@ -250,6 +256,9 @@ fi
#== Services
%post service
+%if %{defined _unitdir}
+systemctl --system daemon-reload
+%endif
/sbin/service matahari-service condrestart
%preun service
@@ -268,6 +277,9 @@ fi
#== sysconfig
%post sysconfig
+%if %{defined _unitdir}
+systemctl --system daemon-reload
+%endif
/sbin/service matahari-sysconfig condrestart
%preun sysconfig
@@ -286,6 +298,9 @@ fi
#== Broker
%post broker
+%if %{defined _unitdir}
+systemctl --system daemon-reload
+%endif
/sbin/service matahari-broker condrestart
%preun broker
12 years, 7 months
Reconsidering v0.4 branch
by Russell Bryant
Greetings,
A few weeks ago we created a v0.4 branch. After some more
consideration, it doesn't really seem to add any value. In short, I
propose that we delete the branch for now and just work out of master
until there is real demand for an upstream stable release branch.
To be clear, we have a commitment to maintain C API and QMF API
compatibility in our development, even in master. If that were to ever
change, we will revisit this topic.
Let me know if you have any comments or questions.
Thanks,
--
Russell Bryant
12 years, 7 months
SSL Support
by Zane Bitter
(Note: technically you should read "TLS" everywhere I've written "SSL".)
OK, I finally have SSL working. Some investigation into the background
of it reveals that in the forthcoming version 1.0 of AMQP, there is a
STARTTLS-style feature for the client and server to negotiate whether to
use SSL for a connection. See Book 5 of this document:
http://www.amqp.org/confluence/download/attachments/7340084/amqp-1.0.0+%2...
This is very much my preferred way of doing things. However, this is not
part of the current AMQP version 0.10 :( The spec also notes a reason
you may need a separate SSL port: a packet-inspecting firewall might see
the AMQP handshake and regard it as not being an SSL connection. (I can
think of another: you may want to configure blocking of non-secure
connections from a portion of the network using your firewall, rather
than through the application.)
Qpid does not support a way of running both SSL and non-SSL connections
on the same port. So it looks like we will indeed have to request a
separate SSL port from the IANA.
As for broker configuration, I suggest we add a MATAHARI_SSL_PORT
environment variable rather than require a ssl-port entry in the config
file. We would handle it the same way as the MATAHARI_PORT variable, so
that it defaults to our assigned port number (presumably 49001) rather
than 5671.
Client configuration will be trickier. At the moment it requires a bunch
of environment variables that the Qpid client library reads, but there
is no nice way of passing those. There was a request that we be able to
set the config file for the Qpid client library so that we could use
/etc/matahari-broker.conf to configure it, but that support is not yet
available. I am inclined to add CLI options to configure it.
That answers my basic SSL questions, but there is a whole other layer of
questions about our security model in general that I am unclear on:
Which users is Matahari targeted at?
a) Public cloud providers
b) Public cloud users
c) Private cloud users
d) All of the above
Where does the broker run?
a) On the same host as the agents
b) On the physical host with the agents in VMs
c) Some centralised location
d) All of the above
Which parts of the communication run on trusted networks (or locally)
and which on untrusted networks?
Who should be authorised to access the Matahari agents?
How do we set up the initial keys to enforce the access policies?
It would be good to document, say, the two or three most common
scenarios that we envision, so that we can optimise for simple
configuration in those cases. I think that would also be valuable in
communicating to potential users whether Matahari is for them.
cheers,
Zane,
12 years, 7 months
[PATCH] core: rhbz#739666 - ensure mh_uuid() doesn't return NULL.
by Russell Bryant
QMF has a hissy-fit if you give it NULL when it expects a string. We
set a UUID as a parameter in all of the agents. Make the function that
returns the UUID never return NULL.
Ideally, this would never happen. This functionality depends on the
fact that at least one of systemd or dbus are installed on the system.
A nice enhancement here would be to rework the UUID support so that it's
not split between libmcommon (utilities.c) and libmhost (host.c) and
then make it so that the "Filesystem" UUID is not the only one used
here. If the "Filesystem" UUID is not found, falling back to the
other types of UUIDs seems like a better thing to do than to just leave
it blank.
Signed-off-by: Russell Bryant <rbryant(a)redhat.com>
---
src/lib/utilities.c | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/src/lib/utilities.c b/src/lib/utilities.c
index 68c6582..ba16c7a 100644
--- a/src/lib/utilities.c
+++ b/src/lib/utilities.c
@@ -383,7 +383,11 @@ mh_dnsdomainname(void)
const char *
mh_uuid(void)
{
- return mh_os_uuid();
+ const char *uuid;
+
+ uuid = mh_os_uuid();
+
+ return uuid ? uuid : "";
}
const char *
--
1.7.6
12 years, 7 months
[PATCH 1/2] host: Fix memory leak and potential crash.
by Russell Bryant
Free the old uuid before overwriting it with an error message. Also
strdup() the error message since the error object gets freed just after
this code.
Signed-off-by: Russell Bryant <rbryant(a)redhat.com>
---
src/lib/host_linux.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/src/lib/host_linux.c b/src/lib/host_linux.c
index fd748c1..fa4d41c 100644
--- a/src/lib/host_linux.c
+++ b/src/lib/host_linux.c
@@ -274,7 +274,8 @@ char *host_os_reboot_uuid(void)
if(g_file_set_contents(file, uuid, strlen(uuid), &error) == FALSE) {
mh_info("%s", error->message);
- uuid = error->message;
+ free(uuid);
+ uuid = strdup(error->message);
}
if(error) {
--
1.7.6
12 years, 7 months