Synnefo » snf-ganeti » ganeti-local

def _ReadAndVerifyCert(cert_filename, verify_private_key=False):

  """Reads and verifies an X509 certificate.

  @type cert_filename: string

  @param cert_filename: the path of the file containing the certificate to

                        verify encoded in PEM format

  @type verify_private_key: bool

  @param verify_private_key: whether to verify the private key in addition to

                             the public certificate

  @rtype: string

  @return: a string containing the PEM-encoded certificate.

  """

  try:

    pem = utils.ReadFile(cert_filename)

  except IOError, err:

    raise errors.X509CertError(cert_filename,

                               "Unable to read certificate: %s" % str(err))

  try:

    OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM, pem)

  except Exception, err:

    raise errors.X509CertError(cert_filename,

                               "Unable to load certificate: %s" % str(err))

  if verify_private_key:

    try:

      OpenSSL.crypto.load_privatekey(OpenSSL.crypto.FILETYPE_PEM, pem)

    except Exception, err:

      raise errors.X509CertError(cert_filename,

                                 "Unable to load private key: %s" % str(err))

  return pem

def _RenewCrypto(new_cluster_cert, new_rapi_cert, #pylint: disable=R0911

                 rapi_cert_filename, new_spice_cert, spice_cert_filename,

                 spice_cacert_filename, new_confd_hmac_key, new_cds,

                 cds_filename, force):

  @type new_spice_cert: bool

  @param new_spice_cert: Whether to generate a new SPICE certificate

  @type spice_cert_filename: string

  @param spice_cert_filename: Path to file containing new SPICE certificate

  @type spice_cacert_filename: string

  @param spice_cacert_filename: Path to file containing the certificate of the

                                CA that signed the SPICE certificate

  if new_spice_cert and (spice_cert_filename or spice_cacert_filename):

    ToStderr("When using --new-spice-certificate, the --spice-certificate"

             " and --spice-ca-certificate must not be used.")

    return 1

  if bool(spice_cacert_filename) ^ bool(spice_cert_filename):

    ToStderr("Both --spice-certificate and --spice-ca-certificate must be"

             " specified.")

    return 1

  rapi_cert_pem, spice_cert_pem, spice_cacert_pem = (None, None, None)

  try:

    if rapi_cert_filename:

      rapi_cert_pem = _ReadAndVerifyCert(rapi_cert_filename, True)

    if spice_cert_filename:

      spice_cert_pem = _ReadAndVerifyCert(spice_cert_filename, True)

      spice_cacert_pem = _ReadAndVerifyCert(spice_cacert_filename)

  except errors.X509CertError, err:

    ToStderr("Unable to load X509 certificate from %s: %s", err[0], err[1])

    return 1

    bootstrap.GenerateClusterCrypto(new_cluster_cert,

                                    new_rapi_cert,

                                    new_spice_cert,

                                    spice_cert_pem=spice_cert_pem,

                                    spice_cacert_pem=spice_cacert_pem,

    if new_spice_cert or spice_cert_pem:

      files_to_copy.append(constants.SPICE_CERT_FILE)

      files_to_copy.append(constants.SPICE_CACERT_FILE)

                      opts.new_spice_cert,

                      opts.spice_cert,

                      opts.spice_cacert,

     NEW_CLUSTER_DOMAIN_SECRET_OPT, CLUSTER_DOMAIN_SECRET_OPT,

     NEW_SPICE_CERT_OPT, SPICE_CERT_OPT, SPICE_CACERT_OPT],