utils: Add functions to sign and verify X509 certs using HMAC

[ganeti-local] / lib / constants.py

diff --git a/lib/constants.py b/lib/constants.py
index 8130257..24fc7ab 100644 (file)
--- a/lib/constants.py
+++ b/lib/constants.py
@@ -26,7 +26,7 @@ import re
 from ganeti import _autoconf
 
 # various versions
-PROTOCOL_VERSION = 20
+PROTOCOL_VERSION = 30
 RELEASE_VERSION = _autoconf.PACKAGE_VERSION
 OS_API_V10 = 10
 OS_API_V15 = 15
@@ -97,9 +97,10 @@ SUB_RUN_DIRS = [ RUN_GANETI_DIR, BDEV_CACHE_DIR, DISK_LINKS_DIR ]
 LOCK_DIR = _autoconf.LOCALSTATEDIR + "/lock"
 SSCONF_LOCK_FILE = LOCK_DIR + "/ganeti-ssconf.lock"
 CLUSTER_CONF_FILE = DATA_DIR + "/config.data"
-SSL_CERT_FILE = DATA_DIR + "/server.pem"
+NODED_CERT_FILE = DATA_DIR + "/server.pem"
 RAPI_CERT_FILE = DATA_DIR + "/rapi.pem"
-HMAC_CLUSTER_KEY = DATA_DIR + "/hmac.key"
+CONFD_HMAC_KEY = DATA_DIR + "/hmac.key"
+CLUSTER_DOMAIN_SECRET_FILE = DATA_DIR + "/cluster-domain-secret"
 WATCHER_STATEFILE = DATA_DIR + "/watcher.data"
 WATCHER_PAUSEFILE = DATA_DIR + "/watcher.pause"
 INSTANCE_UPFILE = RUN_GANETI_DIR + "/instance-status"
@@ -109,27 +110,35 @@ QUEUE_DIR = DATA_DIR + "/queue"
 DAEMON_UTIL = _autoconf.PKGLIBDIR + "/daemon-util"
 ETC_HOSTS = "/etc/hosts"
 DEFAULT_FILE_STORAGE_DIR = _autoconf.FILE_STORAGE_DIR
+ENABLE_FILE_STORAGE = _autoconf.ENABLE_FILE_STORAGE
 SYSCONFDIR = _autoconf.SYSCONFDIR
 TOOLSDIR = _autoconf.TOOLSDIR
 CONF_DIR = SYSCONFDIR + "/ganeti"
 
+ALL_CERT_FILES = frozenset([NODED_CERT_FILE, RAPI_CERT_FILE])
+
 MASTER_SOCKET = SOCKET_DIR + "/ganeti-master"
 
 NODED = "ganeti-noded"
 CONFD = "ganeti-confd"
 RAPI = "ganeti-rapi"
 MASTERD = "ganeti-masterd"
+# used in the ganeti-nbma project
+NLD = "ganeti-nld"
 
 DAEMONS_PORTS = {
   # daemon-name: ("proto", "default-port")
   NODED: ("tcp", 1811),
   CONFD: ("udp", 1814),
   RAPI: ("tcp", 5080),
-  }
-
+  # used in the ganeti-nbma project
+  NLD: ("udp", 1816),
+}
 DEFAULT_NODED_PORT = DAEMONS_PORTS[NODED][1]
 DEFAULT_CONFD_PORT = DAEMONS_PORTS[CONFD][1]
 DEFAULT_RAPI_PORT = DAEMONS_PORTS[RAPI][1]
+# used in the ganeti-nbma project
+DEFAULT_NLD_PORT = DAEMONS_PORTS[NLD][1]
 
 FIRST_DRBD_PORT = 11000
 LAST_DRBD_PORT = 14999
@@ -142,6 +151,8 @@ DAEMONS_LOGFILES = {
   CONFD: LOG_DIR + "conf-daemon.log",
   RAPI: LOG_DIR + "rapi-daemon.log",
   MASTERD: LOG_DIR + "master-daemon.log",
+  # used in the ganeti-nbma project
+  NLD: LOG_DIR + "nl-daemon.log",
   }
 
 LOG_OS_DIR = LOG_DIR + "os"
@@ -149,6 +160,13 @@ LOG_WATCHER = LOG_DIR + "watcher.log"
 LOG_COMMANDS = LOG_DIR + "commands.log"
 LOG_BURNIN = LOG_DIR + "burnin.log"
 
+# one of 'no', 'yes', 'only'
+SYSLOG_USAGE = _autoconf.SYSLOG_USAGE
+SYSLOG_NO = "no"
+SYSLOG_YES = "yes"
+SYSLOG_ONLY = "only"
+SYSLOG_SOCKET = "/dev/log"
+
 OS_SEARCH_PATH = _autoconf.OS_SEARCH_PATH
 EXPORT_DIR = _autoconf.EXPORT_DIR
 
@@ -163,6 +181,16 @@ SOCAT_PATH = _autoconf.SOCAT_PATH
 SOCAT_USE_ESCAPE = _autoconf.SOCAT_USE_ESCAPE
 SOCAT_ESCAPE_CODE = "0x1d"
 
+# For RSA keys more bits are better, but they also make operations more
+# expensive. NIST SP 800-131 recommends a minimum of 2048 bits from the year
+# 2010 on.
+RSA_KEY_BITS = 2048
+
+# Digest used to sign certificates ("openssl x509" uses SHA1 by default)
+X509_CERT_SIGN_DIGEST = "SHA1"
+
+X509_CERT_SIGNATURE_HEADER = "X-Ganeti-Signature"
+
 VALUE_DEFAULT = "default"
 VALUE_AUTO = "auto"
 VALUE_GENERATE = "generate"
@@ -178,6 +206,7 @@ HOOKS_BASE_DIR = CONF_DIR + "/hooks"
 HOOKS_PHASE_PRE = "pre"
 HOOKS_PHASE_POST = "post"
 HOOKS_NAME_CFGUPDATE = "config-update"
+HOOKS_NAME_WATCHER = "watcher"
 HOOKS_VERSION = 2
 
 # hooks subject type (what object type does the LU deal with)
@@ -249,6 +278,7 @@ LDS_BLOCK = frozenset([LD_LV, LD_DRBD8])
 # drbd constants
 DRBD_HMAC_ALG = "md5"
 DRBD_NET_PROTOCOL = "C"
+DRBD_BARRIERS = _autoconf.DRBD_BARRIERS
 
 # file backend driver
 FD_LOOP = "loop"
@@ -321,6 +351,13 @@ LVM_STRIPECOUNT = _autoconf.LVM_STRIPECOUNT
 DEFAULT_SHUTDOWN_TIMEOUT = 120
 NODE_MAX_CLOCK_SKEW = 150
 
+# runparts results
+(RUNPARTS_SKIP,
+ RUNPARTS_RUN,
+ RUNPARTS_ERR) = range(3)
+
+RUNPARTS_STATUS = frozenset([RUNPARTS_SKIP, RUNPARTS_RUN, RUNPARTS_ERR])
+
 # RPC constants
 (RPC_ENCODING_NONE,
  RPC_ENCODING_ZLIB_BASE64) = range(2)
@@ -337,10 +374,10 @@ OS_API_FILE = 'ganeti_api_version'
 OS_VARIANTS_FILE = 'variants.list'
 
 # ssh constants
-SSH_CONFIG_DIR = "/etc/ssh/"
-SSH_HOST_DSA_PRIV = SSH_CONFIG_DIR + "ssh_host_dsa_key"
+SSH_CONFIG_DIR = _autoconf.SSH_CONFIG_DIR
+SSH_HOST_DSA_PRIV = SSH_CONFIG_DIR + "/ssh_host_dsa_key"
 SSH_HOST_DSA_PUB = SSH_HOST_DSA_PRIV + ".pub"
-SSH_HOST_RSA_PRIV = SSH_CONFIG_DIR + "ssh_host_rsa_key"
+SSH_HOST_RSA_PRIV = SSH_CONFIG_DIR + "/ssh_host_rsa_key"
 SSH_HOST_RSA_PUB = SSH_HOST_RSA_PRIV + ".pub"
 SSH = "ssh"
 SCP = "scp"
@@ -391,6 +428,8 @@ HV_INIT_SCRIPT = "init_script"
 HV_MIGRATION_PORT = "migration_port"
 HV_USE_LOCALTIME = "use_localtime"
 HV_DISK_CACHE = "disk_cache"
+HV_SECURITY_MODEL = "security_model"
+HV_SECURITY_DOMAIN = "security_domain"
 
 HVS_PARAMETER_TYPES = {
   HV_BOOT_ORDER: VTYPE_STRING,
@@ -418,6 +457,8 @@ HVS_PARAMETER_TYPES = {
   HV_MIGRATION_PORT: VTYPE_INT,
   HV_USE_LOCALTIME: VTYPE_BOOL,
   HV_DISK_CACHE: VTYPE_STRING,
+  HV_SECURITY_MODEL: VTYPE_STRING,
+  HV_SECURITY_DOMAIN: VTYPE_STRING,
   }
 
 HVS_PARAMETERS = frozenset(HVS_PARAMETER_TYPES.keys())
@@ -519,6 +560,13 @@ HT_BO_NETWORK = "network"
 
 HT_KVM_VALID_BO_TYPES = frozenset([HT_BO_CDROM, HT_BO_DISK, HT_BO_NETWORK])
 
+# Security models
+HT_SM_NONE = "none"
+HT_SM_USER = "user"
+HT_SM_POOL = "pool"
+
+HT_KVM_VALID_SM_TYPES = frozenset([HT_SM_NONE, HT_SM_USER, HT_SM_POOL])
+
 # Cluster Verify steps
 VERIFY_NPLUSONE_MEM = 'nplusone_mem'
 VERIFY_OPTIONAL_CHECKS = frozenset([VERIFY_NPLUSONE_MEM])
@@ -538,12 +586,17 @@ NV_DRBDLIST = "drbd-list"
 NV_NODESETUP = "nodesetup"
 NV_TIME = "time"
 
+# SSL certificate check constants (in days)
+SSL_CERT_EXPIRATION_WARN = 30
+SSL_CERT_EXPIRATION_ERROR = 7
+
 # Allocator framework constants
 IALLOCATOR_VERSION = 2
 IALLOCATOR_DIR_IN = "in"
 IALLOCATOR_DIR_OUT = "out"
 IALLOCATOR_MODE_ALLOC = "allocate"
 IALLOCATOR_MODE_RELOC = "relocate"
+IALLOCATOR_MODE_MEVAC = "multi-evacuate"
 IALLOCATOR_SEARCH_PATH = _autoconf.IALLOCATOR_SEARCH_PATH
 
 # Job queue
@@ -657,6 +710,8 @@ HVC_DEFAULTS = {
     HV_MIGRATION_PORT: 8102,
     HV_USE_LOCALTIME: False,
     HV_DISK_CACHE: HT_CACHE_DEFAULT,
+    HV_SECURITY_MODEL: HT_SM_NONE,
+    HV_SECURITY_DOMAIN: '',
     },
   HT_FAKE: {
     },