tools: Move (Re)GenerateClientCert to common
[ganeti-github.git] / lib / tools / common.py
1 #
2 #
3
4 # Copyright (C) 2014 Google Inc.
5 # All rights reserved.
6 #
7 # Redistribution and use in source and binary forms, with or without
8 # modification, are permitted provided that the following conditions are
9 # met:
10 #
11 # 1. Redistributions of source code must retain the above copyright notice,
12 # this list of conditions and the following disclaimer.
13 #
14 # 2. Redistributions in binary form must reproduce the above copyright
15 # notice, this list of conditions and the following disclaimer in the
16 # documentation and/or other materials provided with the distribution.
17 #
18 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
19 # IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
20 # TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
21 # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
22 # CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
23 # EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
24 # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
25 # PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
26 # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
27 # NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
28 # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29
30 """Common functions for tool scripts.
31
32 """
33
34 import logging
35 import OpenSSL
36 import os
37 import time
38 from cStringIO import StringIO
39
40 from ganeti import constants
41 from ganeti import pathutils
42 from ganeti import utils
43 from ganeti import serializer
44 from ganeti import ssconf
45
46
47 def VerifyOptions(parser, opts, args):
48 """Verifies options and arguments for correctness.
49
50 """
51 if args:
52 parser.error("No arguments are expected")
53
54 return opts
55
56
57 def _VerifyCertificate(cert_pem, error_fn,
58 _check_fn=utils.CheckNodeCertificate):
59 """Verifies a certificate against the local node daemon certificate.
60
61 @type cert_pem: string
62 @param cert_pem: Certificate and key in PEM format
63 @type error_fn: callable
64 @param error_fn: function to call in case of an error
65 @rtype: string
66 @return: Formatted key and certificate
67
68 """
69 try:
70 cert = \
71 OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, cert_pem)
72 except Exception, err:
73 raise error_fn("(stdin) Unable to load certificate: %s" % err)
74
75 try:
76 key = OpenSSL.crypto.load_privatekey(OpenSSL.crypto.FILETYPE_PEM, cert_pem)
77 except OpenSSL.crypto.Error, err:
78 raise error_fn("(stdin) Unable to load private key: %s" % err)
79
80 # Check certificate with given key; this detects cases where the key given on
81 # stdin doesn't match the certificate also given on stdin
82 try:
83 utils.X509CertKeyCheck(cert, key)
84 except OpenSSL.SSL.Error:
85 raise error_fn("(stdin) Certificate is not signed with given key")
86
87 # Standard checks, including check against an existing local certificate
88 # (no-op if that doesn't exist)
89 _check_fn(cert)
90
91 key_encoded = OpenSSL.crypto.dump_privatekey(OpenSSL.crypto.FILETYPE_PEM, key)
92 cert_encoded = OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM,
93 cert)
94 complete_cert_encoded = key_encoded + cert_encoded
95 if not cert_pem == complete_cert_encoded:
96 logging.error("The certificate differs after being reencoded. Please"
97 " renew the certificates cluster-wide to prevent future"
98 " inconsistencies.")
99
100 # Format for storing on disk
101 buf = StringIO()
102 buf.write(cert_pem)
103 return buf.getvalue()
104
105
106 def VerifyCertificate(data, error_fn, _verify_fn=_VerifyCertificate):
107 """Verifies cluster certificate.
108
109 @type data: dict
110 @type error_fn: callable
111 @param error_fn: function to call in case of an error
112 @rtype: string
113 @return: Formatted key and certificate
114
115 """
116 cert = data.get(constants.NDS_NODE_DAEMON_CERTIFICATE)
117 if not cert:
118 raise error_fn("Node daemon certificate must be specified")
119
120 return _verify_fn(cert, error_fn)
121
122
123 def VerifyClusterName(data, error_fn,
124 _verify_fn=ssconf.VerifyClusterName):
125 """Verifies cluster name.
126
127 @type data: dict
128
129 """
130 name = data.get(constants.SSHS_CLUSTER_NAME)
131 if name:
132 _verify_fn(name)
133 else:
134 raise error_fn("Cluster name must be specified")
135
136
137 def LoadData(raw, data_check):
138 """Parses and verifies input data.
139
140 @rtype: dict
141
142 """
143 return serializer.LoadAndVerifyJson(raw, data_check)
144
145
146 def GenerateClientCertificate(
147 data, error_fn, client_cert=pathutils.NODED_CLIENT_CERT_FILE,
148 signing_cert=pathutils.NODED_CERT_FILE):
149 """Regenerates the client certificate of the node.
150
151 @type data: string
152 @param data: the JSON-formated input data
153
154 """
155 if not os.path.exists(signing_cert):
156 raise error_fn("The signing certificate '%s' cannot be found."
157 % signing_cert)
158
159 # TODO: This sets the serial number to the number of seconds
160 # since epoch. This is technically not a correct serial number
161 # (in the way SSL is supposed to be used), but it serves us well
162 # enough for now, as we don't have any infrastructure for keeping
163 # track of the number of signed certificates yet.
164 serial_no = int(time.time())
165
166 # The hostname of the node is provided with the input data.
167 hostname = data.get(constants.NDS_NODE_NAME)
168
169 utils.GenerateSignedSslCert(client_cert, serial_no, signing_cert,
170 common_name=hostname)