certmaster/utils.py

   1 """
   2 Copyright 2007-2008, Red Hat, Inc
   3 see AUTHORS
   4
   5 This software may be freely redistributed under the terms of the GNU
   6 general public license.
   7
   8 You should have received a copy of the GNU General Public License
   9 along with this program; if not, write to the Free Software
  10 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  11 """
  12
  13 import os
  14 import string
  15 import sys
  16 import traceback
  17 import xmlrpclib
  18 import socket
  19 import time
  20 import glob
  21
  22 import codes
  23 import certs
  24 from config import read_config
  25 from commonconfig import MinionConfig
  26 import logger
  27 import sub_process
  28
  29 # FIXME: module needs better pydoc
  30
  31
  32 # FIXME: can remove this constant?
  33 REMOTE_ERROR = "REMOTE_ERROR"
  34
  35 # The standard I/O file descriptors are redirected to /dev/null by default.
  36 if (hasattr(os, "devnull")):
  37     REDIRECT_TO = os.devnull
  38 else:
  39     REDIRECT_TO = "/dev/null"
  40
  41
  42
  43
  44 def trace_me():
  45     x = traceback.extract_stack()
  46     bar = string.join(traceback.format_list(x))
  47     return bar
  48
  49 def daemonize(pidfile=None):
  50     """
  51     Daemonize this process with the UNIX double-fork trick.
  52     Writes the new PID to the provided file name if not None.
  53     """
  54
  55     pid = os.fork()
  56     if pid > 0:
  57         sys.exit(0)
  58     os.chdir("/")
  59     os.setsid()
  60     os.umask(0)
  61     pid = os.fork()
  62
  63     os.close(0)
  64     os.close(1)
  65     os.close(2)
  66
  67     # based on http://code.activestate.com/recipes/278731/
  68     os.open(REDIRECT_TO, os.O_RDWR)     # standard input (0)
  69
  70     os.dup2(0, 1)                       # standard output (1)
  71     os.dup2(0, 2)                       # standard error (2)
  72
  73
  74
  75     if pid > 0:
  76         if pidfile is not None:
  77             open(pidfile, "w").write(str(pid))
  78         sys.exit(0)
  79
  80
  81 def nice_exception(etype, evalue, etb):
  82     etype = str(etype)
  83     try:
  84         lefti = etype.index("'") + 1
  85         righti = etype.rindex("'")
  86         nicetype = etype[lefti:righti]
  87     except:
  88         nicetype = etype
  89     nicestack = string.join(traceback.format_list(traceback.extract_tb(etb)))
  90     return [ REMOTE_ERROR, nicetype, str(evalue), nicestack ]
  91
  92 def is_error(result):
  93     # FIXME: I believe we can remove this function
  94     if type(result) != list:
  95         return False
  96     if len(result) == 0:
  97         return False
  98     if result[0] == REMOTE_ERROR:
  99         return True
 100     return False
 101
 102 def get_hostname(talk_to_certmaster=True):
 103     """
 104     "localhost" is a lame hostname to use for a key, so try to get
 105     a more meaningful hostname. We do this by connecting to the certmaster
 106     and seeing what interface/ip it uses to make that connection, and looking
 107     up the hostname for that.
 108     """
 109     # FIXME: this code ignores http proxies (which granted, we don't
 110     #      support elsewhere either.
 111     hostname = None
 112     hostname = socket.gethostname()
 113     # print "DEBUG: HOSTNAME TRY1: %s" % hostname
 114     try:
 115         ip = socket.gethostbyname(hostname)
 116     except:
 117         return hostname
 118     if ip != "127.0.0.1":
 119         return hostname
 120
 121
 122 # FIXME: move to requestor module and also create a verbose mode
 123 # prints to the screen for usage by /usr/bin/certmaster-request
 124
 125 def create_minion_keys():
 126     # FIXME: paths should not be hard coded here, move to settings universally
 127     config_file = '/etc/certmaster/minion.conf'
 128     config = read_config(config_file, MinionConfig)
 129     cert_dir = config.cert_dir
 130     master_uri = 'http://%s:%s/' % (config.certmaster, config.certmaster_port)
 131     # print "DEBUG: acquiring hostname"
 132     hn = get_hostname()
 133     # print "DEBUG: hostname = %s\n" % hn
 134
 135     if hn is None:
 136         raise codes.CMException("Could not determine a hostname other than localhost")
 137
 138     key_file = '%s/%s.pem' % (cert_dir, hn)
 139     csr_file = '%s/%s.csr' % (cert_dir, hn)
 140     cert_file = '%s/%s.cert' % (cert_dir, hn)
 141     ca_cert_file = '%s/ca.cert' % cert_dir
 142
 143
 144     if os.path.exists(cert_file) and os.path.exists(ca_cert_file):
 145         # print "DEBUG: err, no cert_file"
 146         return
 147
 148     keypair = None
 149     try:
 150         if not os.path.exists(cert_dir):
 151             os.makedirs(cert_dir)
 152         if not os.path.exists(key_file):
 153             keypair = certs.make_keypair(dest=key_file)
 154         if not os.path.exists(csr_file):
 155             if not keypair:
 156                 keypair = certs.retrieve_key_from_file(key_file)
 157             csr = certs.make_csr(keypair, dest=csr_file)
 158     except Exception, e:
 159         traceback.print_exc()
 160         raise codes.CMException, "Could not create local keypair or csr for session"
 161
 162     result = False
 163     log = logger.Logger().logger
 164     while not result:
 165         try:
 166             # print "DEBUG: submitting CSR to certmaster: %s" % master_uri
 167             log.debug("submitting CSR to certmaster %s" % master_uri)
 168             result, cert_string, ca_cert_string = submit_csr_to_master(csr_file, master_uri)
 169         except socket.gaierror, e:
 170             raise codes.CMException, "Could not locate certmaster at %s" % master_uri
 171
 172         # logging here would be nice
 173         if not result:
 174             # print "DEBUG: no response from certmaster, sleeping 10 seconds"
 175             log.warning("no response from certmaster %s, sleeping 10 seconds" % master_uri)
 176             time.sleep(10)
 177
 178
 179     if result:
 180         # print "DEBUG: recieved certificate from certmaster"
 181         log.debug("received certificate from certmaster %s, storing to %s" % (master_uri, cert_file))
 182         cert_fd = os.open(cert_file, os.O_RDWR|os.O_CREAT, 0644)
 183         os.write(cert_fd, cert_string)
 184         os.close(cert_fd)
 185
 186         ca_cert_fd = os.open(ca_cert_file, os.O_RDWR|os.O_CREAT, 0644)
 187         os.write(ca_cert_fd, ca_cert_string)
 188         os.close(ca_cert_fd)
 189
 190 def run_triggers(ref, globber):
 191     """
 192     Runs all the trigger scripts in a given directory.
 193     ref can be a certmaster object, if not None, the name will be passed
 194     to the script.  If ref is None, the script will be called with
 195     no argumenets.  Globber is a wildcard expression indicating which
 196     triggers to run.  Example:  "/var/lib/certmaster/triggers/blah/*"
 197     """
 198
 199     log = logger.Logger().logger
 200     triggers = glob.glob(globber)
 201     triggers.sort()
 202     for file in triggers:
 203         log.debug("Executing trigger: %s" % file)
 204         try:
 205             if file.find(".rpm") != -1:
 206                 # skip .rpmnew files that may have been installed
 207                 # in the triggers directory
 208                 continue
 209             if ref:
 210                 rc = sub_process.call([file, ref], shell=False)
 211             else:
 212                 rc = sub_process.call([file], shell=False)
 213         except:
 214             log.warning("Warning: failed to execute trigger: %s" % file)
 215             continue
 216
 217         if rc != 0:
 218             raise codes.CMException, "certmaster trigger failed: %(file)s returns %(code)d" % { "file" : file, "code" : rc }
 219
 220
 221 def submit_csr_to_master(csr_file, master_uri):
 222     """"
 223     gets us our cert back from the certmaster.wait_for_cert() method
 224     takes csr_file as path location and master_uri
 225     returns Bool, str(cert), str(ca_cert)
 226     """
 227
 228     fo = open(csr_file)
 229     csr = fo.read()
 230     s = xmlrpclib.ServerProxy(master_uri)
 231
 232     # print "DEBUG: waiting for cert"
 233     return s.wait_for_cert(csr)
 234