[NEW PATCH] BZ#727509 Vdsm-reg should get RHEVM certificates (via gerrit-bot)
Yotam Oron
yoron at redhat.com
Wed Aug 3 14:10:10 UTC 2011
New patch submitted by Yotam Oron (yoron at redhat.com)
You can review this change at: http://gerrit.usersys.redhat.com/779
commit 06cc413b7dbfc68da08d89cc36ce8b6b6987afef
Author: Federico Simoncelli <fsimonce at redhat.com>
Date: Tue Aug 2 15:46:12 2011 +0000
BZ#727509 Vdsm-reg should get RHEVM certificates
Change-Id: I09673ab7bc9fa5dc99829eb6b8d6a65bc13d0e73
diff --git a/vdsm_reg/deployUtil.py b/vdsm_reg/deployUtil.py
index 016c461..ce330e5 100644
--- a/vdsm_reg/deployUtil.py
+++ b/vdsm_reg/deployUtil.py
@@ -1316,6 +1316,8 @@ def getRhevmCert(IP, port):
crt.write(rhevmCert)
finally:
crt.close()
+ if isOvirt():
+ ovirtfunctions.ovirt_store_config(CACERT)
return True
else:
return False
@@ -1354,31 +1356,45 @@ def parseOptions():
help="""
The fingerprint to compare to the fingerprint of the downloaded
certificate""")
+ parser.add_option("-u", "--invalidate-rhevm-cert", action="store_true",
+ default=False, dest="invalidateRhevmCert",
+ help="Invalidaterhevm certificate so that consequent RHEVM registrations will fail")
options, args = parser.parse_args()
return (options, args)
+def invalidateRhevmCert():
+ CACERT, dontcare = certPaths('')
+ if os.path.exists(CACERT):
+ crt = open(CACERT, "w")
+ try:
+ crt.write("Certificate invalidated due to certificate fingerprint mismatch.")
+ finally:
+ crt.close()
+ if isOvirt():
+ ovirtfunctions.ovirt_store_config(CACERT)
+
def main():
options, args = parseOptions()
+ if options.invalidateRhevmCert:
+ invalidateRhevmCert()
+
if options.downloadRhevmCert:
- if not options.serverIp or not options.serverPort or \
- not options.fingerPrint:
- print "Must supply RHEVM's IP, port and a fingerprint to " + \
- "verify against"
+ if not options.serverIp or not options.serverPort:
+ print "Must supply RHEVM's IP and port for verification"
return -1
if not getRhevmCert(options.serverIp, options.serverPort):
print 'Failed downloading the RHEVM certificate file'
return -1
- CACERT, dontcare = certPaths('')
- fp = generateFingerPrint(CACERT)
- if options.fingerPrint != fp:
- print 'Expected fingerprint %s is different from recieved fingerprint %s' % (options.fingerPrint, fp)
- return -1
+ if options.fingerPrint:
+ CACERT, dontcare = certPaths('')
+ fp = generateFingerPrint(CACERT)
+ if options.fingerPrint != fp:
+ print 'Expected fingerprint %s is different from recieved fingerprint %s' % (options.fingerPrint, fp)
+ return -1
- if isOvirt():
- ovirtfunctions.ovirt_store_config(CACERT)
print 'RHEVM certificate downloaded and verified successfully.'
return 0
print 'Missing arguments'
diff --git a/vdsm_reg/rhevm.py b/vdsm_reg/rhevm.py
index d32c639..0761bf2 100755
--- a/vdsm_reg/rhevm.py
+++ b/vdsm_reg/rhevm.py
@@ -139,14 +139,15 @@ class Plugin(PluginBase):
self.ncs.screen.setColor("BUTTON", "black", "red")
self.ncs.screen.setColor("ACTBUTTON", "blue", "white")
if len(self.rhevm_server.value()) > 0:
- if self.verify_rhevm_cert.selected():
- if deployUtil.getRhevmCert(self.rhevm_server.value(), self.rhevm_server_port.value()):
+ if deployUtil.getRhevmCert(self.rhevm_server.value(), self.rhevm_server_port.value()):
+ if self.verify_rhevm_cert.selected():
path, dontCare = deployUtil.certPaths('')
fp = deployUtil.generateFingerPrint(path)
approval = ButtonChoiceWindow(self.ncs.screen,
"Certificate Fingerprint (Rejecting the finrgerprint will reboot the host):",
fp, buttons = ['Approve', 'Reject'])
if 'reject' == approval:
+ deployUtil.invalidateRhevmCert()
out, err, rc = deployUtil._logExec(['/sbin/reboot'])
if rc is not 0:
log("Failed rebooting after fingerprint" + \
@@ -154,9 +155,11 @@ class Plugin(PluginBase):
else:
ovirt_store_config(path)
self.ncs.reset_screen_colors()
- else:
- ButtonChoiceWindow(self.ncs.screen, "RHEV-M Configuration", "Failed downloading RHEV-M certificate", buttons = ['Ok'])
- self.ncs.reset_screen_colors()
+ else:
+ ButtonChoiceWindow(self.ncs.screen, "RHEV-M Configuration",
+ "Failed downloading RHEV-M certificate", buttons = ['Ok'])
+ self.ncs.reset_screen_colors()
+
if write_vdsm_config(self.rhevm_server.value(), self.rhevm_server_port.value()):
ButtonChoiceWindow(self.ncs.screen, "RHEV-M Configuration", "RHEV-M Configuration Successfully Updated", buttons = ['Ok'])
self.ncs.reset_screen_colors()
diff --git a/vdsm_reg/vdsm-config b/vdsm_reg/vdsm-config
index b341588..a6d3cb2 100755
--- a/vdsm_reg/vdsm-config
+++ b/vdsm_reg/vdsm-config
@@ -82,16 +82,17 @@ set_addresses() {
/etc/vdsm-reg/vdsm-reg.conf
fi
- if [ ! -z "$managment_server_fingerprint" ]; then
- res=`python "$DEPLOY_UTIL" --download-rhevm-cert --server-address="$vdc_managment_server" --server-port="$vdc_managment_port" --fingerprint="$managment_server_fingerprint"`
+ if [ ! -z "$management_server_fingerprint" ]; then
+ res=`python "$DEPLOY_UTIL" --download-rhevm-cert --server-address="$vdc_managment_server" --server-port="$vdc_managment_port" --fingerprint="$management_server_fingerprint"`
ret_val=$?
echo "$res" >> $LOG 2>&1
if [ ! $ret_val -eq 0 ];then
+ res=`python "$DEPLOY_UTIL" --invalidate-rhevm-cert`
echo "Rebooting ... " >> $LOG 2>&1
/sbin/reboot
fi
else
- echo "No management_server_fingerprint found." | tee -a $LOG
+ res=`python "$DEPLOY_UTIL" --download-rhevm-cert --server-address="$vdc_managment_server" --server-port="$vdc_managment_port"`
fi
## Set new configuration
More information about the vdsm-patches
mailing list