certmaster/utils.py

   1 """
   2 Copyright 2007-2008, Red Hat, Inc
   3 see AUTHORS
   4
   5 This software may be freely redistributed under the terms of the GNU
   6 general public license.
   7
   8 You should have received a copy of the GNU General Public License
   9 along with this program; if not, write to the Free Software
  10 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  11 """
  12
  13 import os
  14 import string
  15 import sys
  16 import traceback
  17 import xmlrpclib
  18 import socket
  19 import time
  20 import glob
  21
  22 import codes
  23 import certs
  24 from config import read_config
  25 from commonconfig import MinionConfig
  26 import logger
  27 import sub_process
  28
  29 # FIXME: module needs better pydoc
  30
  31
  32 # FIXME: can remove this constant?
  33 REMOTE_ERROR = "REMOTE_ERROR"
  34
  35 # The standard I/O file descriptors are redirected to /dev/null by default.
  36 if (hasattr(os, "devnull")):
  37     REDIRECT_TO = os.devnull
  38 else:
  39     REDIRECT_TO = "/dev/null"
  40
  41
  42
  43
  44 def trace_me():
  45     x = traceback.extract_stack()
  46     bar = string.join(traceback.format_list(x))
  47     return bar
  48
  49 def daemonize(pidfile=None):
  50     """
  51     Daemonize this process with the UNIX double-fork trick.
  52     Writes the new PID to the provided file name if not None.
  53     """
  54
  55     pid = os.fork()
  56     if pid > 0:
  57         sys.exit(0)
  58     os.chdir("/")
  59     os.setsid()
  60     os.umask(077)
  61     pid = os.fork()
  62
  63     os.close(0)
  64     os.close(1)
  65     os.close(2)
  66
  67     # based on http://code.activestate.com/recipes/278731/
  68     os.open(REDIRECT_TO, os.O_RDWR)     # standard input (0)
  69
  70     os.dup2(0, 1)                       # standard output (1)
  71     os.dup2(0, 2)                       # standard error (2)
  72
  73
  74
  75     if pid > 0:
  76         if pidfile is not None:
  77             open(pidfile, "w").write(str(pid))
  78         sys.exit(0)
  79
  80
  81 def nice_exception(etype, evalue, etb):
  82     etype = str(etype)
  83     try:
  84         lefti = etype.index("'") + 1
  85         righti = etype.rindex("'")
  86         nicetype = etype[lefti:righti]
  87     except:
  88         nicetype = etype
  89     nicestack = string.join(traceback.format_list(traceback.extract_tb(etb)))
  90     return [ REMOTE_ERROR, nicetype, str(evalue), nicestack ]
  91
  92 def is_error(result):
  93     # FIXME: I believe we can remove this function
  94     if type(result) != list:
  95         return False
  96     if len(result) == 0:
  97         return False
  98     if result[0] == REMOTE_ERROR:
  99         return True
 100     return False
 101
 102 def get_hostname(talk_to_certmaster=True):
 103     """
 104     "localhost" is a lame hostname to use for a key, so try to get
 105     a more meaningful hostname. We do this by connecting to the certmaster
 106     and seeing what interface/ip it uses to make that connection, and looking
 107     up the hostname for that.
 108     """
 109     # FIXME: this code ignores http proxies (which granted, we don't
 110     #      support elsewhere either.
 111     hostname = None
 112     hostname = socket.gethostname()
 113     # print "DEBUG: HOSTNAME TRY1: %s" % hostname
 114     try:
 115         ip = socket.gethostbyname(hostname)
 116     except:
 117         return hostname
 118     if ip != "127.0.0.1":
 119         return hostname
 120
 121
 122 # FIXME: move to requestor module and also create a verbose mode
 123 # prints to the screen for usage by /usr/bin/certmaster-request
 124
 125 def create_minion_keys(hostname=None):
 126     log = logger.Logger().logger
 127
 128     # FIXME: paths should not be hard coded here, move to settings universally
 129     config_file = '/etc/certmaster/minion.conf'
 130     config = read_config(config_file, MinionConfig)
 131     cert_dir = config.cert_dir
 132     master_uri = 'http://%s:%s/' % (config.certmaster, config.certmaster_port)
 133
 134     hn = hostname
 135     if hn is None:
 136         hn = get_hostname()
 137
 138     if hn is None:
 139         raise codes.CMException("Could not determine a hostname other than localhost")
 140
 141     key_file = '%s/%s.pem' % (cert_dir, hn)
 142     csr_file = '%s/%s.csr' % (cert_dir, hn)
 143     cert_file = '%s/%s.cert' % (cert_dir, hn)
 144     ca_cert_file = '%s/ca.cert' % cert_dir
 145
 146
 147     if os.path.exists(cert_file) and os.path.exists(ca_cert_file):
 148         # print "DEBUG: err, no cert_file"
 149         return
 150
 151     keypair = None
 152     try:
 153         if not os.path.exists(cert_dir):
 154             os.makedirs(cert_dir)
 155         if not os.path.exists(key_file):
 156             keypair = certs.make_keypair(dest=key_file)
 157         if not os.path.exists(csr_file):
 158             if not keypair:
 159                 keypair = certs.retrieve_key_from_file(key_file)
 160             csr = certs.make_csr(keypair, dest=csr_file, hostname=hn)
 161     except Exception, e:
 162         traceback.print_exc()
 163         raise codes.CMException, "Could not create local keypair or csr for session"
 164
 165     result = False
 166
 167     while not result:
 168         try:
 169             # print "DEBUG: submitting CSR to certmaster: %s" % master_uri
 170             log.debug("submitting CSR: %s  to certmaster %s" % (csr_file, master_uri))
 171             result, cert_string, ca_cert_string = submit_csr_to_master(csr_file, master_uri)
 172         except socket.gaierror, e:
 173             raise codes.CMException, "Could not locate certmaster at %s" % master_uri
 174
 175         # logging here would be nice
 176         if not result:
 177             # print "DEBUG: no response from certmaster, sleeping 10 seconds"
 178             log.warning("no response from certmaster %s, sleeping 10 seconds" % master_uri)
 179             time.sleep(10)
 180
 181
 182     if result:
 183         # print "DEBUG: recieved certificate from certmaster"
 184         log.debug("received certificate from certmaster %s, storing to %s" % (master_uri, cert_file))
 185         if not keypair:
 186             keypair = certs.retrieve_key_from_file(key_file)
 187         valid = certs.check_cert_key_match(cert_string, keypair)
 188         if not valid:
 189             log.info("certificate does not match key (run certmaster-ca --clean first?)")
 190             sys.stderr.write("certificate does not match key (run certmaster-ca --clean first?)\n")
 191             return
 192         cert_fd = os.open(cert_file, os.O_RDWR|os.O_CREAT, 0644)
 193         os.write(cert_fd, cert_string)
 194         os.close(cert_fd)
 195
 196         ca_cert_fd = os.open(ca_cert_file, os.O_RDWR|os.O_CREAT, 0644)
 197         os.write(ca_cert_fd, ca_cert_string)
 198         os.close(ca_cert_fd)
 199
 200 def run_triggers(ref, globber):
 201     """
 202     Runs all the trigger scripts in a given directory.
 203     ref can be a certmaster object, if not None, the name will be passed
 204     to the script.  If ref is None, the script will be called with
 205     no argumenets.  Globber is a wildcard expression indicating which
 206     triggers to run.  Example:  "/var/lib/certmaster/triggers/blah/*"
 207     """
 208
 209     log = logger.Logger().logger
 210     triggers = glob.glob(globber)
 211     triggers.sort()
 212     for file in triggers:
 213         log.debug("Executing trigger: %s" % file)
 214         try:
 215             if file.find(".rpm") != -1:
 216                 # skip .rpmnew files that may have been installed
 217                 # in the triggers directory
 218                 continue
 219             if ref:
 220                 rc = sub_process.call([file, ref], shell=False)
 221             else:
 222                 rc = sub_process.call([file], shell=False)
 223         except:
 224             log.warning("Warning: failed to execute trigger: %s" % file)
 225             continue
 226
 227         if rc != 0:
 228             raise codes.CMException, "certmaster trigger failed: %(file)s returns %(code)d" % { "file" : file, "code" : rc }
 229
 230
 231 def submit_csr_to_master(csr_file, master_uri):
 232     """"
 233     gets us our cert back from the certmaster.wait_for_cert() method
 234     takes csr_file as path location and master_uri
 235     returns Bool, str(cert), str(ca_cert)
 236     """
 237
 238     fo = open(csr_file)
 239     csr = fo.read()
 240     s = xmlrpclib.ServerProxy(master_uri)
 241
 242     # print "DEBUG: waiting for cert"
 243     return s.wait_for_cert(csr)
 244