Change in vdsm[ovirt-3.4]: vdsm_config: move download certificate
dougsland at redhat.com
dougsland at redhat.com
Wed May 28 03:05:14 UTC 2014
Hello Alon Bar-Lev, Dan Kenigsberg,
I'd like you to do a code review. Please visit
http://gerrit.ovirt.org/28164
to review the following change.
Change subject: vdsm_config: move download certificate
......................................................................
vdsm_config: move download certificate
DHCP servers might delay to deliver the ip address
and we can't download the engine certificate from
vdsm-config stage. This patch is moving the download
certificate from vdsm-config to vdsm-reg-setup.
Change-Id: Ia2c025eedd2be92b9418ddbe01efc02c913af2a7
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1065368
Signed-off-by: Alon Bar-Lev <alonbl at redhat.com>
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
Reviewed-on: http://gerrit.ovirt.org/26718
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
---
M vdsm_reg/deployUtil.py.in
M vdsm_reg/vdsm-config
M vdsm_reg/vdsm-reg-setup.in
M vdsm_reg/vdsm-reg.conf.in
4 files changed, 133 insertions(+), 10 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/64/28164/1
diff --git a/vdsm_reg/deployUtil.py.in b/vdsm_reg/deployUtil.py.in
index 3e16557..2a6522a 100644
--- a/vdsm_reg/deployUtil.py.in
+++ b/vdsm_reg/deployUtil.py.in
@@ -1683,18 +1683,30 @@
return [chain[depth] for depth in sorted(chain.keys())]
-def getRhevmCert(IP, port):
+def getRhevmCert(IP, port, output=None):
"""Aquire CA certificate from SSL handshake
This certificate is saved to a file and later used
to validate HTTPS connections with the engine web
server.
+ Args:
+ IP -- IP address to collect the SSL chain
+ port -- Port to connect
+ output -- Path to save the ssl chain
+
+ Returns:
+ True or False
"""
try:
chain = getChainFromSSL((IP, int(port)))
ca = chain[-1]
- _, _, engineWebCACert = certPaths('')
+
+ if output is None:
+ _, _, engineWebCACert = certPaths('')
+ else:
+ engineWebCACert = output
+
dirName = os.path.dirname(engineWebCACert)
if not os.path.exists(dirName):
os.makedirs(dirName)
diff --git a/vdsm_reg/vdsm-config b/vdsm_reg/vdsm-config
index 5e4d16c..711227c 100755
--- a/vdsm_reg/vdsm-config
+++ b/vdsm_reg/vdsm-config
@@ -90,22 +90,24 @@
sed --copy -i "s/\(^vdc_host_name=\)\(..*$\)/\1${vdc_managment_server}/" \
/etc/vdsm-reg/vdsm-reg.conf
- res=`python "$DEPLOY_UTIL" --node-cleanup`
- ret_val=$?
- echo "$res" >> $LOG 2>&1
- if [ ! $ret_val -eq 0 ];then
- echo "Node cleanup failed" >> $LOG 2>&1
- fi
-
if [ "$vdc_managment_server" != "$vdc_managment_port" ]; then
sed --copy -i "s/\(^vdc_host_port=\)\(..*$\)/\1${vdc_managment_port}/" \
/etc/vdsm-reg/vdsm-reg.conf
fi
- res=`python "$DEPLOY_UTIL" --download-rhevm-cert --server-address="$vdc_managment_server" --server-port="$vdc_managment_port" --fingerprint="$management_server_fingerprint"`
+ if [ ! -z "$management_server_fingerprint" ]; then
+ echo "checkpoint 4::management_server_fingerprint: ${management_server_fingerprint}" >> $LOG 2>&1
+ sed --copy -i "/^fingerprint=/d" \
+ /etc/vdsm-reg/vdsm-reg.conf
+ echo "fingerprint=${management_server_fingerprint}" \
+ >> /etc/vdsm-reg/vdsm-reg.conf
+ fi
+
+ res=`python "$DEPLOY_UTIL" --node-cleanup`
ret_val=$?
echo "$res" >> $LOG 2>&1
if [ ! $ret_val -eq 0 ];then
+ echo "Node cleanup failed" >> $LOG 2>&1
mv "$tmp_vdsm_reg_conf" /etc/vdsm-reg/vdsm-reg.conf
echo "Rebooting ... " >> $LOG 2>&1
/sbin/reboot
diff --git a/vdsm_reg/vdsm-reg-setup.in b/vdsm_reg/vdsm-reg-setup.in
index b7d1a9b..0b70a3e 100644
--- a/vdsm_reg/vdsm-reg-setup.in
+++ b/vdsm_reg/vdsm-reg-setup.in
@@ -19,11 +19,16 @@
import logging
import logging.config
import urllib
+import shutil
import ssl
+import tempfile
from config import config
import deployUtil
import createDaemon
from deployUtil import MGT_BRIDGE_NAME
+
+from ConfigParser import NoOptionError
+from ovirtnode import ovirtfunctions
TICKET_RETRIES=3
DEFAULT_CONFIG_FILE="/etc/vdsm-reg/vdsm-reg.conf"
@@ -40,6 +45,14 @@
self.fInitOK = True
self.vdcURL = "None"
self.vdcName = config.get('vars', 'vdc_host_name')
+
+ try:
+ self.cfg_fprint = config.get('vars', 'fingerprint')
+ except NoOptionError:
+ self.cfg_fprint = "None"
+
+ _, _, self.engineWebCACert = deployUtil.certPaths('')
+
if self.vdcName != "None":
try: self.vdcURL = socket.gethostbyname(self.vdcName)
except: self.vdcURL = "None"
@@ -177,6 +190,41 @@
logging.debug("registerVDS end.")
return fReturn
+ def _compare_fingerprint(self, ca_path):
+ """ Compare fingerprint provided configration against
+ provided certificate.
+
+ Args:
+ ca_path -- Path to CA certificate
+
+ Returns:
+ True -- Fingerprint matched
+ False -- Fingerprint didn't match
+ """
+ ret = False
+
+ if self.cfg_fprint == "None":
+ ret = True
+ else:
+ if not os.path.exists(ca_path):
+ logging.error(
+ "Fingerprint requested but no certificate"
+ )
+ else:
+ engine_fprint = deployUtil.generateFingerPrint(ca_path)
+ ret = self.cfg_fprint.upper() == engine_fprint
+
+ if not ret:
+ logging.error(
+ "Fingerprint differs from Engine\n"
+ "vdsm-reg.conf fingerprint [%s]\n"
+ "Engine fingerprint [%s]",
+ self.cfg_fprint.upper(),
+ engine_fprint
+ )
+
+ return ret
+
def execute(self):
fOK = True
fOKNow = True
@@ -189,6 +237,65 @@
fOK = self.renameBridge()
logging.debug("execute: after renameBridge: %s", fOK)
+ #
+ # make sure we have correct
+ # certificate at trust store
+ # delete it if not.
+ #
+ if fOK and not self._compare_fingerprint(self.engineWebCACert) and \
+ os.path.exists(self.engineWebCACert):
+ ovirtfunctions.ovirt_safe_delete_config(
+ self.engineWebCACert
+ )
+ os.unlink(self.engineWebCACert)
+
+ #
+ # Attempt to download certificate if not available.
+ #
+ if fOK and not os.path.exists(self.engineWebCACert):
+ fd_tmp, file_tmp = tempfile.mkstemp()
+ os.close(fd_tmp)
+
+ try:
+ #
+ # this will only succeed if certificate
+ # available via the ssl session
+ #
+ if not deployUtil.getRhevmCert(
+ IP=self.vdcName,
+ port=self.vdcPORT,
+ output=file_tmp
+ ):
+ logging.info(
+ "Cannot download Engine Web CA certificate file: "
+ "%s:%s",
+ self.vdcName,
+ self.vdcPORT
+ )
+ os.unlink(file_tmp)
+
+ #
+ # if the fingerprint is incorrect, there
+ # is no reason to re-try, just exit.
+ #
+ if fOK and not self._compare_fingerprint(file_tmp):
+ fOK = False
+ sys.exit(1)
+
+ #
+ # if we have certificate and all ok, then
+ # we move to trust store.
+ #
+ if fOK and os.path.exists(file_tmp):
+ shutil.move(file_tmp, self.engineWebCACert)
+ ovirtfunctions.ovirt_store_config(
+ self.engineWebCACert
+ )
+
+ finally:
+ if os.path.exists(file_tmp):
+ os.unlink(file_tmp)
+
if fOK:
strKey = deployUtil.getAuthKeysFile(self.vdcURL, self.vdcPORT)
if strKey is not None:
diff --git a/vdsm_reg/vdsm-reg.conf.in b/vdsm_reg/vdsm-reg.conf.in
index 2e9df0d..114edce 100644
--- a/vdsm_reg/vdsm-reg.conf.in
+++ b/vdsm_reg/vdsm-reg.conf.in
@@ -18,3 +18,5 @@
upgrade_mount_point=/live
# registration ticket
ticket=
+# Fingerprint of oVirt Engine CA
+fingerprint=None
--
To view, visit http://gerrit.ovirt.org/28164
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ia2c025eedd2be92b9418ddbe01efc02c913af2a7
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.4
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>
Gerrit-Reviewer: Alon Bar-Lev <alonbl at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
More information about the vdsm-patches
mailing list