certmaster/utils.py

   1 """
   2 Copyright 2007-2008, Red Hat, Inc
   3 see AUTHORS
   4
   5 This software may be freely redistributed under the terms of the GNU
   6 general public license.
   7
   8 You should have received a copy of the GNU General Public License
   9 along with this program; if not, write to the Free Software
  10 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  11 """
  12
  13 import os
  14 import string
  15 import sys
  16 import traceback
  17 import xmlrpclib
  18 import socket
  19 import time
  20 import glob
  21
  22 import codes
  23 import certs
  24 from config import read_config
  25 from commonconfig import MinionConfig
  26 import logger
  27 import sub_process
  28
  29 # FIXME: module needs better pydoc
  30
  31
  32 # FIXME: can remove this constant?
  33 REMOTE_ERROR = "REMOTE_ERROR"
  34
  35 # The standard I/O file descriptors are redirected to /dev/null by default.
  36 if (hasattr(os, "devnull")):
  37     REDIRECT_TO = os.devnull
  38 else:
  39     REDIRECT_TO = "/dev/null"
  40
  41
  42
  43
  44 def trace_me():
  45     x = traceback.extract_stack()
  46     bar = string.join(traceback.format_list(x))
  47     return bar
  48
  49 def daemonize(pidfile=None):
  50     """
  51     Daemonize this process with the UNIX double-fork trick.
  52     Writes the new PID to the provided file name if not None.
  53     """
  54
  55     pid = os.fork()
  56     if pid > 0:
  57         sys.exit(0)
  58     os.chdir("/")
  59     os.setsid()
  60     os.umask(077)
  61     pid = os.fork()
  62
  63     os.close(0)
  64     os.close(1)
  65     os.close(2)
  66
  67     # based on http://code.activestate.com/recipes/278731/
  68     os.open(REDIRECT_TO, os.O_RDWR)     # standard input (0)
  69
  70     os.dup2(0, 1)                       # standard output (1)
  71     os.dup2(0, 2)                       # standard error (2)
  72
  73
  74
  75     if pid > 0:
  76         if pidfile is not None:
  77             open(pidfile, "w").write(str(pid))
  78         sys.exit(0)
  79
  80
  81 def nice_exception(etype, evalue, etb):
  82     etype = str(etype)
  83     try:
  84         lefti = etype.index("'") + 1
  85         righti = etype.rindex("'")
  86         nicetype = etype[lefti:righti]
  87     except:
  88         nicetype = etype
  89     nicestack = string.join(traceback.format_list(traceback.extract_tb(etb)))
  90     return [ REMOTE_ERROR, nicetype, str(evalue), nicestack ]
  91
  92 def is_error(result):
  93     # FIXME: I believe we can remove this function
  94     if type(result) != list:
  95         return False
  96     if len(result) == 0:
  97         return False
  98     if result[0] == REMOTE_ERROR:
  99         return True
 100     return False
 101
 102 def get_hostname(talk_to_certmaster=True):
 103     """
 104     "localhost" is a lame hostname to use for a key, so try to get
 105     a more meaningful hostname. We do this by connecting to the certmaster
 106     and seeing what interface/ip it uses to make that connection, and looking
 107     up the hostname for that.
 108     """
 109     # FIXME: this code ignores http proxies (which granted, we don't
 110     #      support elsewhere either.
 111     hostname = None
 112     hostname = socket.gethostname()
 113     # print "DEBUG: HOSTNAME TRY1: %s" % hostname
 114     try:
 115         ip = socket.gethostbyname(hostname)
 116     except:
 117         return hostname
 118     if ip != "127.0.0.1":
 119         return hostname
 120
 121
 122 # FIXME: move to requestor module and also create a verbose mode
 123 # prints to the screen for usage by /usr/bin/certmaster-request
 124
 125 def create_minion_keys(hostname=None):
 126     log = logger.Logger().logger
 127
 128     # FIXME: paths should not be hard coded here, move to settings universally
 129     config_file = '/etc/certmaster/minion.conf'
 130     config = read_config(config_file, MinionConfig)
 131     cert_dir = config.cert_dir
 132     master_uri = 'http://%s:%s/' % (config.certmaster, config.certmaster_port)
 133
 134     hn = hostname
 135     if hn is None:
 136         hn = get_hostname()
 137
 138     if hn is None:
 139         raise codes.CMException("Could not determine a hostname other than localhost")
 140     else:
 141         # use lowercase letters for hostnames
 142         hn = hn.lower()
 143
 144     key_file = '%s/%s.pem' % (cert_dir, hn)
 145     csr_file = '%s/%s.csr' % (cert_dir, hn)
 146     cert_file = '%s/%s.cert' % (cert_dir, hn)
 147     ca_cert_file = '%s/ca.cert' % cert_dir
 148
 149
 150     if os.path.exists(cert_file) and os.path.exists(ca_cert_file):
 151         # print "DEBUG: err, no cert_file"
 152         return
 153
 154     keypair = None
 155     try:
 156         if not os.path.exists(cert_dir):
 157             os.makedirs(cert_dir)
 158         if not os.path.exists(key_file):
 159             keypair = certs.make_keypair(dest=key_file)
 160         if not os.path.exists(csr_file):
 161             if not keypair:
 162                 keypair = certs.retrieve_key_from_file(key_file)
 163             csr = certs.make_csr(keypair, dest=csr_file, hostname=hn)
 164     except Exception, e:
 165         traceback.print_exc()
 166         raise codes.CMException, "Could not create local keypair or csr for session"
 167
 168     result = False
 169
 170     while not result:
 171         try:
 172             # print "DEBUG: submitting CSR to certmaster: %s" % master_uri
 173             log.debug("submitting CSR: %s  to certmaster %s" % (csr_file, master_uri))
 174             result, cert_string, ca_cert_string = submit_csr_to_master(csr_file, master_uri)
 175         except socket.error, e:
 176             log.warning("Could not locate certmaster at %s" % master_uri)
 177
 178         # logging here would be nice
 179         if not result:
 180             # print "DEBUG: no response from certmaster, sleeping 10 seconds"
 181             log.warning("no response from certmaster %s, sleeping 10 seconds" % master_uri)
 182             time.sleep(10)
 183
 184
 185     if result:
 186         # print "DEBUG: recieved certificate from certmaster"
 187         log.debug("received certificate from certmaster %s, storing to %s" % (master_uri, cert_file))
 188         if not keypair:
 189             keypair = certs.retrieve_key_from_file(key_file)
 190         valid = certs.check_cert_key_match(cert_string, keypair)
 191         if not valid:
 192             log.info("certificate does not match key (run certmaster-ca --clean first?)")
 193             sys.stderr.write("certificate does not match key (run certmaster-ca --clean first?)\n")
 194             return
 195         cert_fd = os.open(cert_file, os.O_RDWR|os.O_CREAT, 0644)
 196         os.write(cert_fd, cert_string)
 197         os.close(cert_fd)
 198
 199         ca_cert_fd = os.open(ca_cert_file, os.O_RDWR|os.O_CREAT, 0644)
 200         os.write(ca_cert_fd, ca_cert_string)
 201         os.close(ca_cert_fd)
 202
 203 def run_triggers(ref, globber):
 204     """
 205     Runs all the trigger scripts in a given directory.
 206     ref can be a certmaster object, if not None, the name will be passed
 207     to the script.  If ref is None, the script will be called with
 208     no argumenets.  Globber is a wildcard expression indicating which
 209     triggers to run.  Example:  "/var/lib/certmaster/triggers/blah/*"
 210     """
 211
 212     log = logger.Logger().logger
 213     triggers = glob.glob(globber)
 214     triggers.sort()
 215     for file in triggers:
 216         log.debug("Executing trigger: %s" % file)
 217         try:
 218             if file.find(".rpm") != -1:
 219                 # skip .rpmnew files that may have been installed
 220                 # in the triggers directory
 221                 continue
 222             if ref:
 223                 rc = sub_process.call([file, ref], shell=False)
 224             else:
 225                 rc = sub_process.call([file], shell=False)
 226         except:
 227             log.warning("Warning: failed to execute trigger: %s" % file)
 228             continue
 229
 230         if rc != 0:
 231             raise codes.CMException, "certmaster trigger failed: %(file)s returns %(code)d" % { "file" : file, "code" : rc }
 232
 233
 234 def submit_csr_to_master(csr_file, master_uri):
 235     """"
 236     gets us our cert back from the certmaster.wait_for_cert() method
 237     takes csr_file as path location and master_uri
 238     returns Bool, str(cert), str(ca_cert)
 239     """
 240
 241     fo = open(csr_file)
 242     csr = fo.read()
 243     s = xmlrpclib.ServerProxy(master_uri)
 244
 245     # print "DEBUG: waiting for cert"
 246     return s.wait_for_cert(csr)