[NEW PATCH] BZ#727509 Vdsm-reg should get RHEVM certificates (via gerrit-bot)

Yotam Oron yoron at redhat.com
Wed Aug 3 14:10:10 UTC 2011


New patch submitted by Yotam Oron (yoron at redhat.com)

You can review this change at: http://gerrit.usersys.redhat.com/779

commit 06cc413b7dbfc68da08d89cc36ce8b6b6987afef
Author: Federico Simoncelli <fsimonce at redhat.com>
Date:   Tue Aug 2 15:46:12 2011 +0000

    BZ#727509 Vdsm-reg should get RHEVM certificates
    
    Change-Id: I09673ab7bc9fa5dc99829eb6b8d6a65bc13d0e73

diff --git a/vdsm_reg/deployUtil.py b/vdsm_reg/deployUtil.py
index 016c461..ce330e5 100644
--- a/vdsm_reg/deployUtil.py
+++ b/vdsm_reg/deployUtil.py
@@ -1316,6 +1316,8 @@ def getRhevmCert(IP, port):
             crt.write(rhevmCert)
         finally:
             crt.close()
+        if isOvirt():
+            ovirtfunctions.ovirt_store_config(CACERT)
         return True
     else:
         return False
@@ -1354,31 +1356,45 @@ def parseOptions():
             help="""
             The fingerprint to compare to the fingerprint of the downloaded
             certificate""")
+    parser.add_option("-u", "--invalidate-rhevm-cert", action="store_true",
+            default=False, dest="invalidateRhevmCert",
+            help="Invalidaterhevm certificate so that consequent RHEVM registrations will fail")
 
     options, args = parser.parse_args()
 
     return (options, args)
 
+def invalidateRhevmCert():
+    CACERT, dontcare = certPaths('')
+    if os.path.exists(CACERT):
+        crt = open(CACERT, "w")
+        try:
+            crt.write("Certificate invalidated due to certificate fingerprint mismatch.")
+        finally:
+            crt.close()
+        if isOvirt():
+            ovirtfunctions.ovirt_store_config(CACERT)
+
 def main():
     options, args = parseOptions()
 
+    if options.invalidateRhevmCert:
+        invalidateRhevmCert()
+
     if options.downloadRhevmCert:
-        if not options.serverIp or not options.serverPort or \
-                not options.fingerPrint:
-            print "Must supply RHEVM's IP, port and a fingerprint to " + \
-                  "verify against"
+        if not options.serverIp or not options.serverPort:
+            print "Must supply RHEVM's IP and port for verification"
             return -1
         if not getRhevmCert(options.serverIp, options.serverPort):
             print 'Failed downloading the RHEVM certificate file'
             return -1
-        CACERT, dontcare = certPaths('')
-        fp = generateFingerPrint(CACERT)
-        if options.fingerPrint != fp:
-            print 'Expected fingerprint %s is different from recieved fingerprint %s' % (options.fingerPrint, fp)
-            return -1
+        if options.fingerPrint:
+            CACERT, dontcare = certPaths('')
+            fp = generateFingerPrint(CACERT)
+            if options.fingerPrint != fp:
+                print 'Expected fingerprint %s is different from recieved fingerprint %s' % (options.fingerPrint, fp)
+                return -1
 
-        if isOvirt():
-            ovirtfunctions.ovirt_store_config(CACERT)
         print 'RHEVM certificate downloaded and verified successfully.'
         return 0
     print 'Missing arguments'
diff --git a/vdsm_reg/rhevm.py b/vdsm_reg/rhevm.py
index d32c639..0761bf2 100755
--- a/vdsm_reg/rhevm.py
+++ b/vdsm_reg/rhevm.py
@@ -139,14 +139,15 @@ class Plugin(PluginBase):
         self.ncs.screen.setColor("BUTTON", "black", "red")
         self.ncs.screen.setColor("ACTBUTTON", "blue", "white")
         if len(self.rhevm_server.value()) > 0:
-            if self.verify_rhevm_cert.selected():
-                if deployUtil.getRhevmCert(self.rhevm_server.value(),  self.rhevm_server_port.value()):
+            if deployUtil.getRhevmCert(self.rhevm_server.value(),  self.rhevm_server_port.value()):
+                if self.verify_rhevm_cert.selected():
                     path, dontCare = deployUtil.certPaths('')
                     fp = deployUtil.generateFingerPrint(path)
                     approval = ButtonChoiceWindow(self.ncs.screen,
                                 "Certificate Fingerprint (Rejecting the finrgerprint will reboot the host):",
                                 fp, buttons = ['Approve', 'Reject'])
                     if 'reject' == approval:
+                        deployUtil.invalidateRhevmCert()
                         out, err, rc = deployUtil._logExec(['/sbin/reboot'])
                         if rc is not 0:
                             log("Failed rebooting after fingerprint" + \
@@ -154,9 +155,11 @@ class Plugin(PluginBase):
                     else:
                         ovirt_store_config(path)
                         self.ncs.reset_screen_colors()
-                else:
-                    ButtonChoiceWindow(self.ncs.screen, "RHEV-M Configuration", "Failed downloading RHEV-M certificate", buttons = ['Ok'])
-                    self.ncs.reset_screen_colors()
+            else:
+                ButtonChoiceWindow(self.ncs.screen, "RHEV-M Configuration",
+                                   "Failed downloading RHEV-M certificate", buttons = ['Ok'])
+                self.ncs.reset_screen_colors()
+
             if write_vdsm_config(self.rhevm_server.value(), self.rhevm_server_port.value()):
                 ButtonChoiceWindow(self.ncs.screen, "RHEV-M Configuration", "RHEV-M Configuration Successfully Updated", buttons = ['Ok'])
                 self.ncs.reset_screen_colors()
diff --git a/vdsm_reg/vdsm-config b/vdsm_reg/vdsm-config
index b341588..a6d3cb2 100755
--- a/vdsm_reg/vdsm-config
+++ b/vdsm_reg/vdsm-config
@@ -82,16 +82,17 @@ set_addresses() {
 					/etc/vdsm-reg/vdsm-reg.conf
 			fi
 
-			if [ ! -z "$managment_server_fingerprint" ]; then
-				res=`python "$DEPLOY_UTIL" --download-rhevm-cert --server-address="$vdc_managment_server" --server-port="$vdc_managment_port" --fingerprint="$managment_server_fingerprint"`
+			if [ ! -z "$management_server_fingerprint" ]; then
+				res=`python "$DEPLOY_UTIL" --download-rhevm-cert --server-address="$vdc_managment_server" --server-port="$vdc_managment_port" --fingerprint="$management_server_fingerprint"`
 				ret_val=$?
 				echo "$res" >> $LOG 2>&1
 				if [ ! $ret_val -eq 0 ];then
+                    res=`python "$DEPLOY_UTIL" --invalidate-rhevm-cert`
 					echo "Rebooting ... " >> $LOG 2>&1
 					/sbin/reboot
 				fi
 			else
-				echo "No management_server_fingerprint found." | tee -a $LOG
+				res=`python "$DEPLOY_UTIL" --download-rhevm-cert --server-address="$vdc_managment_server" --server-port="$vdc_managment_port"`
 			fi
 
 			## Set new configuration




More information about the vdsm-patches mailing list