Revision 22114677
| b/lib/backend.py | ||
|---|---|---|
| 1192 | 1192 |
@return: list of tuples of the token type and the public crypto token |
| 1193 | 1193 |
|
| 1194 | 1194 |
""" |
| 1195 |
getents = runtime.GetEnts() |
|
| 1195 | 1196 |
_VALID_CERT_FILES = [pathutils.NODED_CERT_FILE, |
| 1196 | 1197 |
pathutils.NODED_CLIENT_CERT_FILE, |
| 1197 | 1198 |
pathutils.NODED_CLIENT_CERT_FILE_TMP] |
| ... | ... | |
| 1237 | 1238 |
|
| 1238 | 1239 |
utils.GenerateNewSslCert( |
| 1239 | 1240 |
True, cert_filename, serial_no, |
| 1240 |
"Create new client SSL certificate in %s." % cert_filename) |
|
| 1241 |
"Create new client SSL certificate in %s." % cert_filename, |
|
| 1242 |
uid=getents.masterd_uid, gid=getents.masterd_gid) |
|
| 1241 | 1243 |
tokens.append((token_type, |
| 1242 | 1244 |
utils.GetCertificateDigest( |
| 1243 | 1245 |
cert_filename=cert_filename))) |
| b/lib/tools/ensure_dirs.py | ||
|---|---|---|
| 151 | 151 |
getent.noded_uid, getent.masterd_gid, False), |
| 152 | 152 |
(pathutils.NODED_CERT_FILE, FILE, pathutils.NODED_CERT_MODE, |
| 153 | 153 |
getent.masterd_uid, getent.masterd_gid, False), |
| 154 |
(pathutils.NODED_CLIENT_CERT_FILE, FILE, pathutils.NODED_CERT_MODE, |
|
| 155 |
getent.masterd_uid, getent.masterd_gid, False), |
|
| 154 | 156 |
(pathutils.WATCHER_PAUSEFILE, FILE, 0644, |
| 155 | 157 |
getent.masterd_uid, getent.masterd_gid, False), |
| 156 | 158 |
] |
| b/lib/utils/security.py | ||
|---|---|---|
| 100 | 100 |
return cert.digest("sha1")
|
| 101 | 101 |
|
| 102 | 102 |
|
| 103 |
def GenerateNewSslCert(new_cert, cert_filename, serial_no, log_msg): |
|
| 103 |
def GenerateNewSslCert(new_cert, cert_filename, serial_no, log_msg, |
|
| 104 |
uid=-1, gid=-1): |
|
| 104 | 105 |
"""Creates a new SSL certificate and backups the old one. |
| 105 | 106 |
|
| 106 | 107 |
@type new_cert: boolean |
| ... | ... | |
| 111 | 112 |
@param serial_no: serial number of the certificate |
| 112 | 113 |
@type log_msg: string |
| 113 | 114 |
@param log_msg: log message to be written on certificate creation |
| 115 |
@type uid: int |
|
| 116 |
@param uid: the user ID of the user who will be owner of the certificate file |
|
| 117 |
@type gid: int |
|
| 118 |
@param gid: the group ID of the group who will own the certificate file |
|
| 114 | 119 |
|
| 115 | 120 |
""" |
| 116 | 121 |
cert_exists = os.path.exists(cert_filename) |
| ... | ... | |
| 119 | 124 |
io.CreateBackup(cert_filename) |
| 120 | 125 |
|
| 121 | 126 |
logging.debug(log_msg) |
| 122 |
x509.GenerateSelfSignedSslCert(cert_filename, serial_no) |
|
| 127 |
x509.GenerateSelfSignedSslCert(cert_filename, serial_no, uid=uid, gid=gid)
|
|
| 123 | 128 |
|
| 124 | 129 |
|
| 125 | 130 |
def VerifyCertificate(filename): |
| b/lib/utils/x509.py | ||
|---|---|---|
| 288 | 288 |
|
| 289 | 289 |
def GenerateSelfSignedSslCert(filename, serial_no, |
| 290 | 290 |
common_name=constants.X509_CERT_CN, |
| 291 |
validity=constants.X509_CERT_DEFAULT_VALIDITY): |
|
| 291 |
validity=constants.X509_CERT_DEFAULT_VALIDITY, |
|
| 292 |
uid=-1, gid=-1): |
|
| 292 | 293 |
"""Legacy function to generate self-signed X509 certificate. |
| 293 | 294 |
|
| 294 | 295 |
@type filename: str |
| ... | ... | |
| 297 | 298 |
@param common_name: commonName value |
| 298 | 299 |
@type validity: int |
| 299 | 300 |
@param validity: validity of certificate in number of days |
| 301 |
@type uid: int |
|
| 302 |
@param uid: the user ID of the user who will be owner of the certificate file |
|
| 303 |
@type gid: int |
|
| 304 |
@param gid: the group ID of the group who will own the certificate file |
|
| 300 | 305 |
@return: a tuple of strings containing the PEM-encoded private key and |
| 301 | 306 |
certificate |
| 302 | 307 |
|
| ... | ... | |
| 307 | 312 |
(key_pem, cert_pem) = GenerateSelfSignedX509Cert( |
| 308 | 313 |
common_name, validity * 24 * 60 * 60, serial_no) |
| 309 | 314 |
|
| 310 |
utils_io.WriteFile(filename, mode=0400, data=key_pem + cert_pem) |
|
| 315 |
utils_io.WriteFile(filename, mode=0440, data=key_pem + cert_pem, |
|
| 316 |
uid=uid, gid=gid) |
|
| 311 | 317 |
return (key_pem, cert_pem) |
| 312 | 318 |
|
| 313 | 319 |
|
Also available in: Unified diff