Change in vdsm[ovirt-3.4]: vdsm_config: move download certificate

dougsland at redhat.com dougsland at redhat.com
Wed May 28 03:05:14 UTC 2014


Hello Alon Bar-Lev, Dan Kenigsberg,

I'd like you to do a code review.  Please visit

    http://gerrit.ovirt.org/28164

to review the following change.

Change subject: vdsm_config: move download certificate
......................................................................

vdsm_config: move download certificate

DHCP servers might delay to deliver the ip address
and we can't download the engine certificate from
vdsm-config stage. This patch is moving the download
certificate from vdsm-config to vdsm-reg-setup.

Change-Id: Ia2c025eedd2be92b9418ddbe01efc02c913af2a7
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1065368
Signed-off-by: Alon Bar-Lev <alonbl at redhat.com>
Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
Reviewed-on: http://gerrit.ovirt.org/26718
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
---
M vdsm_reg/deployUtil.py.in
M vdsm_reg/vdsm-config
M vdsm_reg/vdsm-reg-setup.in
M vdsm_reg/vdsm-reg.conf.in
4 files changed, 133 insertions(+), 10 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/64/28164/1

diff --git a/vdsm_reg/deployUtil.py.in b/vdsm_reg/deployUtil.py.in
index 3e16557..2a6522a 100644
--- a/vdsm_reg/deployUtil.py.in
+++ b/vdsm_reg/deployUtil.py.in
@@ -1683,18 +1683,30 @@
     return [chain[depth] for depth in sorted(chain.keys())]
 
 
-def getRhevmCert(IP, port):
+def getRhevmCert(IP, port, output=None):
     """Aquire CA certificate from SSL handshake
 
     This certificate is saved to a file and later used
     to validate HTTPS connections with the engine web
     server.
 
+    Args:
+    IP -- IP address to collect the SSL chain
+    port -- Port to connect
+    output -- Path to save the ssl chain
+
+    Returns:
+    True or False
     """
     try:
         chain = getChainFromSSL((IP, int(port)))
         ca = chain[-1]
-        _, _, engineWebCACert = certPaths('')
+
+        if output is None:
+            _, _, engineWebCACert = certPaths('')
+        else:
+            engineWebCACert = output
+
         dirName = os.path.dirname(engineWebCACert)
         if not os.path.exists(dirName):
             os.makedirs(dirName)
diff --git a/vdsm_reg/vdsm-config b/vdsm_reg/vdsm-config
index 5e4d16c..711227c 100755
--- a/vdsm_reg/vdsm-config
+++ b/vdsm_reg/vdsm-config
@@ -90,22 +90,24 @@
 			sed --copy -i "s/\(^vdc_host_name=\)\(..*$\)/\1${vdc_managment_server}/" \
 				/etc/vdsm-reg/vdsm-reg.conf
 
-			res=`python "$DEPLOY_UTIL" --node-cleanup`
-			ret_val=$?
-			echo "$res" >> $LOG 2>&1
-			if [ ! $ret_val -eq 0 ];then
-				echo "Node cleanup failed" >> $LOG 2>&1
-			fi
-
 			if [ "$vdc_managment_server" != "$vdc_managment_port" ]; then
 				sed --copy -i "s/\(^vdc_host_port=\)\(..*$\)/\1${vdc_managment_port}/" \
 					/etc/vdsm-reg/vdsm-reg.conf
 			fi
 
-			res=`python "$DEPLOY_UTIL" --download-rhevm-cert --server-address="$vdc_managment_server" --server-port="$vdc_managment_port" --fingerprint="$management_server_fingerprint"`
+			if [ ! -z "$management_server_fingerprint" ]; then
+				echo "checkpoint 4::management_server_fingerprint: ${management_server_fingerprint}" >> $LOG 2>&1
+				sed --copy -i "/^fingerprint=/d" \
+					/etc/vdsm-reg/vdsm-reg.conf
+				echo "fingerprint=${management_server_fingerprint}" \
+					>> /etc/vdsm-reg/vdsm-reg.conf
+			fi
+
+			res=`python "$DEPLOY_UTIL" --node-cleanup`
 			ret_val=$?
 			echo "$res" >> $LOG 2>&1
 			if [ ! $ret_val -eq 0 ];then
+				echo "Node cleanup failed" >> $LOG 2>&1
 				mv "$tmp_vdsm_reg_conf" /etc/vdsm-reg/vdsm-reg.conf
 				echo "Rebooting ... " >> $LOG 2>&1
 				/sbin/reboot
diff --git a/vdsm_reg/vdsm-reg-setup.in b/vdsm_reg/vdsm-reg-setup.in
index b7d1a9b..0b70a3e 100644
--- a/vdsm_reg/vdsm-reg-setup.in
+++ b/vdsm_reg/vdsm-reg-setup.in
@@ -19,11 +19,16 @@
 import logging
 import logging.config
 import urllib
+import shutil
 import ssl
+import tempfile
 from config import config
 import deployUtil
 import createDaemon
 from deployUtil import MGT_BRIDGE_NAME
+
+from ConfigParser import NoOptionError
+from ovirtnode import ovirtfunctions
 
 TICKET_RETRIES=3
 DEFAULT_CONFIG_FILE="/etc/vdsm-reg/vdsm-reg.conf"
@@ -40,6 +45,14 @@
         self.fInitOK = True
         self.vdcURL = "None"
         self.vdcName = config.get('vars', 'vdc_host_name')
+
+        try:
+            self.cfg_fprint = config.get('vars', 'fingerprint')
+        except NoOptionError:
+            self.cfg_fprint = "None"
+
+        _, _, self.engineWebCACert = deployUtil.certPaths('')
+
         if self.vdcName != "None":
             try: self.vdcURL = socket.gethostbyname(self.vdcName)
             except: self.vdcURL = "None"
@@ -177,6 +190,41 @@
         logging.debug("registerVDS end.")
         return fReturn
 
+    def _compare_fingerprint(self, ca_path):
+        """ Compare fingerprint provided configration against
+        provided certificate.
+
+        Args:
+        ca_path -- Path to CA certificate
+
+        Returns:
+        True -- Fingerprint matched
+        False -- Fingerprint didn't match
+        """
+        ret = False
+
+        if self.cfg_fprint == "None":
+            ret = True
+        else:
+            if not os.path.exists(ca_path):
+                logging.error(
+                    "Fingerprint requested but no certificate"
+                )
+            else:
+                engine_fprint = deployUtil.generateFingerPrint(ca_path)
+                ret = self.cfg_fprint.upper() == engine_fprint
+
+                if not ret:
+                    logging.error(
+                        "Fingerprint differs from Engine\n"
+                        "vdsm-reg.conf fingerprint [%s]\n"
+                        "Engine fingerprint [%s]",
+                        self.cfg_fprint.upper(),
+                        engine_fprint
+                    )
+
+        return ret
+
     def execute(self):
         fOK = True
         fOKNow = True
@@ -189,6 +237,65 @@
             fOK = self.renameBridge()
             logging.debug("execute: after renameBridge: %s", fOK)
 
+        #
+        # make sure we have correct
+        # certificate at trust store
+        # delete it if not.
+        #
+        if fOK and not self._compare_fingerprint(self.engineWebCACert) and \
+                    os.path.exists(self.engineWebCACert):
+                ovirtfunctions.ovirt_safe_delete_config(
+                    self.engineWebCACert
+                )
+                os.unlink(self.engineWebCACert)
+
+        #
+        # Attempt to download certificate if not available.
+        #
+        if fOK and not os.path.exists(self.engineWebCACert):
+            fd_tmp, file_tmp = tempfile.mkstemp()
+            os.close(fd_tmp)
+
+            try:
+                #
+                # this will only succeed if certificate
+                # available via the ssl session
+                #
+                if not deployUtil.getRhevmCert(
+                    IP=self.vdcName,
+                    port=self.vdcPORT,
+                    output=file_tmp
+                ):
+                    logging.info(
+                        "Cannot download Engine Web CA certificate file: "
+                        "%s:%s",
+                        self.vdcName,
+                        self.vdcPORT
+                    )
+                    os.unlink(file_tmp)
+
+                #
+                # if the fingerprint is incorrect, there
+                # is no reason to re-try, just exit.
+                #
+                if fOK and not self._compare_fingerprint(file_tmp):
+                    fOK = False
+                    sys.exit(1)
+
+                #
+                # if we have certificate and all ok, then
+                # we move to trust store.
+                #
+                if fOK and os.path.exists(file_tmp):
+                    shutil.move(file_tmp, self.engineWebCACert)
+                    ovirtfunctions.ovirt_store_config(
+                        self.engineWebCACert
+                    )
+
+            finally:
+                if os.path.exists(file_tmp):
+                    os.unlink(file_tmp)
+
         if fOK:
             strKey = deployUtil.getAuthKeysFile(self.vdcURL, self.vdcPORT)
             if strKey is not None:
diff --git a/vdsm_reg/vdsm-reg.conf.in b/vdsm_reg/vdsm-reg.conf.in
index 2e9df0d..114edce 100644
--- a/vdsm_reg/vdsm-reg.conf.in
+++ b/vdsm_reg/vdsm-reg.conf.in
@@ -18,3 +18,5 @@
 upgrade_mount_point=/live
 # registration ticket
 ticket=
+# Fingerprint of oVirt Engine CA
+fingerprint=None


-- 
To view, visit http://gerrit.ovirt.org/28164
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ia2c025eedd2be92b9418ddbe01efc02c913af2a7
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: ovirt-3.4
Gerrit-Owner: Douglas Schilling Landgraf <dougsland at redhat.com>
Gerrit-Reviewer: Alon Bar-Lev <alonbl at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>


More information about the vdsm-patches mailing list