mooli tayer has uploaded a new change for review. Change subject: vdsm-tool: roll out self signed certificates in vdsm-tool. ......................................................................
vdsm-tool: roll out self signed certificates in vdsm-tool. This is handled in a new 'ModuleConfigure' named 'certificates'. Libvirt module now requires 'certificates'. certificates are not remove during removeConf. previously certificates where generated on init. Master patches were applied to 3.5 patch[1]. [1] http://gerrit.ovirt.org/#/c/31734/ Change-Id: Ic9179c246b5e3b7c57c64a26bd38c987a2f4f589 Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1127877 Signed-off-by: Mooli Tayer <[email protected]> --- M init/vdsmd_init_common.sh.in M lib/vdsm/tool/configurator.py M lib/vdsm/tool/configurators/Makefile.am A lib/vdsm/tool/configurators/certificates.py M lib/vdsm/tool/configurators/libvirt.py M vdsm.spec.in M vdsm/vdsm-gencerts.sh.in 7 files changed, 102 insertions(+), 48 deletions(-) git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/14/31914/1 diff --git a/init/vdsmd_init_common.sh.in b/init/vdsmd_init_common.sh.in index 19dea08..298b658 100644 --- a/init/vdsmd_init_common.sh.in +++ b/init/vdsmd_init_common.sh.in @@ -54,15 +54,6 @@ } -task_gencerts(){ - if ! "@LIBEXECDIR@/vdsm-gencerts.sh" --check; then - printf "Configuring a self-signed VDSM host certificate" - "@LIBEXECDIR@/vdsm-gencerts.sh" || return 1 - fi - return 0 -} - - task_check_is_configured() { "$VDSM_TOOL" is-configured } @@ -242,7 +233,6 @@ configure_coredump \ configure_vdsm_logs \ run_init_hooks \ - gencerts \ check_is_configured \ validate_configuration \ prepare_transient_repository \ diff --git a/lib/vdsm/tool/configurator.py b/lib/vdsm/tool/configurator.py index 751fba2..d88bc51 100644 --- a/lib/vdsm/tool/configurator.py +++ b/lib/vdsm/tool/configurator.py @@ -24,6 +24,7 @@ from . import service, expose, UsageError from .configurators import \ + certificates, \ CONFIGURED, \ InvalidConfig, \ InvalidRun, \ @@ -33,6 +34,7 @@ _CONFIGURATORS = dict((m.getName(), m) for m in ( + certificates.Certificates(), libvirt.Libvirt(), sanlock.Sanlock() )) diff --git a/lib/vdsm/tool/configurators/Makefile.am b/lib/vdsm/tool/configurators/Makefile.am index 36ddbe2..02c6f82 100644 --- a/lib/vdsm/tool/configurators/Makefile.am +++ b/lib/vdsm/tool/configurators/Makefile.am @@ -21,6 +21,7 @@ dist_configurators_PYTHON = \ __init__.py \ + certificates.py \ configfile.py \ libvirt.py \ sanlock.py \ diff --git a/lib/vdsm/tool/configurators/certificates.py b/lib/vdsm/tool/configurators/certificates.py new file mode 100644 index 0000000..7a9a7c6 --- /dev/null +++ b/lib/vdsm/tool/configurators/certificates.py @@ -0,0 +1,88 @@ +# Copyright 2014 Red Hat, Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +# +# Refer to the README and COPYING files for full details of the license +# +import os +import sys + +from vdsm.config import config + +from . import \ + CONFIGURED, \ + ModuleConfigure, \ + NOT_CONFIGURED +from .. import validate_ovirt_certs +from ...constants import \ + P_VDSM_EXEC, \ + SYSCONF_PATH +from ...utils import \ + execCmd, \ + isOvirtNode + +PKI_DIR = os.path.join(SYSCONF_PATH, 'pki/vdsm') +CA_FILE = os.path.join(PKI_DIR, 'certs/cacert.pem') +CERT_FILE = os.path.join(PKI_DIR, 'certs/vdsmcert.pem') +KEY_FILE = os.path.join(PKI_DIR, 'keys/vdsmkey.pem') + + +class Certificates(ModuleConfigure): + """ + Responsible for rolling out self signed certificates if vdsm's + configuration is ssl_enabled and no certificates exist. + """ + # Todo: validate_ovirt_certs.py + def getName(self): + return 'certificates' + + def validate(self): + return self._certsExist() + + def _exec_vdsm_gencerts(self): + rc, out, err = execCmd( + ( + os.path.join( + P_VDSM_EXEC, + 'vdsm-gencerts.sh' + ), + CA_FILE, + KEY_FILE, + CERT_FILE, + ), + raw=True, + ) + sys.stdout.write(out) + sys.stderr.write(err) + if rc != 0: + raise RuntimeError("Failed to perform vdsm-gencerts action.") + + def configure(self): + self._exec_vdsm_gencerts() + if isOvirtNode(): + validate_ovirt_certs.validate_ovirt_certs() + + def isconfigured(self): + return CONFIGURED if self._certsExist() else NOT_CONFIGURED + + def _certsExist(self): + config.read( + os.path.join( + SYSCONF_PATH, + 'vdsm/vdsm.conf' + ) + ) + return not config.getboolean('vars', 'ssl') or\ + os.path.isfile(CERT_FILE) diff --git a/lib/vdsm/tool/configurators/libvirt.py b/lib/vdsm/tool/configurators/libvirt.py index f98d8b1..ae94026 100644 --- a/lib/vdsm/tool/configurators/libvirt.py +++ b/lib/vdsm/tool/configurators/libvirt.py @@ -37,6 +37,10 @@ from . configfile import \ ConfigFile, \ ParserWrapper +from . certificates import \ + CA_FILE, \ + CERT_FILE, \ + KEY_FILE from ... import utils from ... import constants @@ -72,11 +76,6 @@ config.read(self._getFile('VDSM_CONF')) vdsmConfiguration = { - 'certs_exist': all(os.path.isfile(f) for f in [ - self.CA_FILE, - self.CERT_FILE, - self.KEY_FILE - ]), 'ssl_enabled': config.getboolean('vars', 'ssl'), 'sanlock_enabled': constants.SANLOCK_ENABLED, 'libvirt_selinux': constants.LIBVIRT_SELINUX @@ -110,6 +109,9 @@ def removeConf(self): for cfile, content in Libvirt.FILES.items(): content['removeConf'](self, content['path']) + + def getRequires(self): + return set(['certificates']) def _getPersistedFiles(self): """ @@ -298,9 +300,6 @@ CONF_VERSION = '4.13.0' PKI_DIR = os.path.join(constants.SYSCONF_PATH, 'pki/vdsm') - CA_FILE = os.path.join(PKI_DIR, 'certs/cacert.pem') - CERT_FILE = os.path.join(PKI_DIR, 'certs/vdsmcert.pem') - KEY_FILE = os.path.join(PKI_DIR, 'keys/vdsmkey.pem') LS_CERT_DIR = os.path.join(PKI_DIR, 'libvirt-spice') # be sure to update CONF_VERSION accordingly when updating FILES. @@ -359,7 +358,6 @@ { 'conditions': { "ssl_enabled": True, - "certs_exist": True, }, 'content': { 'ca_file': '\"' + CA_FILE + '\"', @@ -368,18 +366,6 @@ }, }, - { - 'conditions': { - "ssl_enabled": True, - "certs_exist": False, - }, - 'content': { - 'auth_tcp': '"none"', - 'listen_tcp': 1, - 'listen_tls': 0, - }, - - } ] }, @@ -418,15 +404,6 @@ }, 'content': { 'spice_tls': 1, - }, - - }, - { - 'conditions': { - "ssl_enabled": True, - "certs_exist": True, - }, - 'content': { 'spice_tls_x509_cert_dir': '\"' + LS_CERT_DIR + '\"', }, diff --git a/vdsm.spec.in b/vdsm.spec.in index 4ebbedf..a07ce56 100644 --- a/vdsm.spec.in +++ b/vdsm.spec.in @@ -1176,6 +1176,7 @@ %{python_sitearch}/%{vdsm_name}/tool/configurator.py* %{python_sitearch}/%{vdsm_name}/tool/configurators/__init__* %{python_sitearch}/%{vdsm_name}/tool/configurators/configfile.py* +%{python_sitearch}/%{vdsm_name}/tool/configurators/certificates.py* %{python_sitearch}/%{vdsm_name}/tool/configurators/libvirt.py* %{python_sitearch}/%{vdsm_name}/tool/configurators/sanlock.py* %{python_sitearch}/%{vdsm_name}/tool/passwd.py* diff --git a/vdsm/vdsm-gencerts.sh.in b/vdsm/vdsm-gencerts.sh.in index adfd56e..4ad59a8 100755 --- a/vdsm/vdsm-gencerts.sh.in +++ b/vdsm/vdsm-gencerts.sh.in @@ -19,10 +19,9 @@ # Refer to the README and COPYING files for full details of the license # -VDSM_PKI="@TRUSTSTORE@" -VDSM_KEY="$VDSM_PKI/keys/vdsmkey.pem" -VDSM_CRT="$VDSM_PKI/certs/vdsmcert.pem" -VDSM_CA="$VDSM_PKI/certs/cacert.pem" +VDSM_CA="$1" +VDSM_KEY="$2" +VDSM_CRT="$3" VDSM_TEMPLATE="$(mktemp)" @@ -32,10 +31,6 @@ VDSM_PERMS="@VDSMUSER@:@VDSMGROUP@" umask 077 - -if [ "$1" = "--check" ]; then - [ -s "$VDSM_KEY" -a -s "$VDSM_CA" -a -s "$VDSM_CRT" ] && exit 0 || exit 1 -fi if [ ! -f "$VDSM_KEY" ]; then /usr/bin/certtool --generate-privkey --outfile "$VDSM_KEY" 2> /dev/null -- To view, visit http://gerrit.ovirt.org/31914 To unsubscribe, visit http://gerrit.ovirt.org/settings Gerrit-MessageType: newchange Gerrit-Change-Id: Ic9179c246b5e3b7c57c64a26bd38c987a2f4f589 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: ovirt-3.5 Gerrit-Owner: mooli tayer <[email protected]> _______________________________________________ vdsm-patches mailing list [email protected] https://lists.fedorahosted.org/mailman/listinfo/vdsm-patches
