<s> """<STR_LIT>""" <EOL> import logging <EOL> import OpenSSL <EOL> import os <EOL> import time <EOL> from cStringIO import StringIO <EOL> from ganeti import constants <EOL> from ganeti import errors <EOL> from ganeti import pathutils <EOL> from ganeti import utils <EOL> from ganeti import serializer <EOL> from ganeti import ssconf <EOL> from ganeti import ssh <EOL> def VerifyOptions ( parser , opts , args ) : <EOL> """<STR_LIT>""" <EOL> if args : <EOL> parser . error ( "<STR_LIT>" ) <EOL> return opts <EOL> def _VerifyCertificateStrong ( cert_pem , error_fn , <EOL> _check_fn = utils . CheckNodeCertificate ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> cert = OpenSSL . crypto . load_certificate ( OpenSSL . crypto . FILETYPE_PEM , cert_pem ) <EOL> except Exception , err : <EOL> raise error_fn ( "<STR_LIT>" % err ) <EOL> try : <EOL> key = OpenSSL . crypto . load_privatekey ( OpenSSL . crypto . FILETYPE_PEM , cert_pem ) <EOL> except OpenSSL . crypto . Error , err : <EOL> raise error_fn ( "<STR_LIT>" % err ) <EOL> try : <EOL> utils . X509CertKeyCheck ( cert , key ) <EOL> except OpenSSL . SSL . Error : <EOL> raise error_fn ( "<STR_LIT>" ) <EOL> _check_fn ( cert ) <EOL> key_encoded = OpenSSL . crypto . dump_privatekey ( OpenSSL . crypto . FILETYPE_PEM , key ) <EOL> cert_encoded = OpenSSL . crypto . dump_certificate ( OpenSSL . crypto . FILETYPE_PEM , <EOL> cert ) <EOL> complete_cert_encoded = key_encoded + cert_encoded <EOL> if not cert_pem == complete_cert_encoded : <EOL> logging . error ( "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> "<STR_LIT>" ) <EOL> buf = StringIO ( ) <EOL> buf . write ( cert_pem ) <EOL> return buf . getvalue ( ) <EOL> def _VerifyCertificateSoft ( cert_pem , error_fn , <EOL> _check_fn = utils . CheckNodeCertificate ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> OpenSSL . crypto . load_privatekey ( OpenSSL . crypto . FILETYPE_PEM , cert_pem ) <EOL> except OpenSSL . crypto . Error , err : <EOL> pass <EOL> else : <EOL> raise error_fn ( "<STR_LIT>" ) <EOL> try : <EOL> cert = OpenSSL . crypto . load_certificate ( OpenSSL . crypto . FILETYPE_PEM , cert_pem ) <EOL> except Exception , err : <EOL> raise errors . X509CertError ( "<STR_LIT>" , <EOL> "<STR_LIT>" % err ) <EOL> _check_fn ( cert ) <EOL> def VerifyCertificateSoft ( data , error_fn , _verify_fn = _VerifyCertificateSoft ) : <EOL> """<STR_LIT>""" <EOL> cert = data . get ( constants . SSHS_NODE_DAEMON_CERTIFICATE ) <EOL> if cert : <EOL> _verify_fn ( cert , error_fn ) <EOL> def VerifyCertificateStrong ( data , error_fn , <EOL> _verify_fn = _VerifyCertificateStrong ) : <EOL> """<STR_LIT>""" <EOL> cert = data . get ( constants . NDS_NODE_DAEMON_CERTIFICATE ) <EOL> if not cert : <EOL> raise error_fn ( "<STR_LIT>" ) <EOL> return _verify_fn ( cert , error_fn ) <EOL> def VerifyClusterName ( data , error_fn , cluster_name_constant , <EOL> _verify_fn = ssconf . VerifyClusterName ) : <EOL> """<STR_LIT>""" <EOL> name = data . get ( cluster_name_constant ) <EOL> if name : <EOL> _verify_fn ( name ) <EOL> else : <EOL> raise error_fn ( "<STR_LIT>" ) <EOL> return name <EOL> def VerifyHmac ( data , error_fn ) : <EOL> """<STR_LIT>""" <EOL> hmac = data . get ( constants . NDS_HMAC ) <EOL> if not hmac : <EOL> raise error_fn ( "<STR_LIT>" ) <EOL> return hmac <EOL> def LoadData ( raw , data_check ) : <EOL> """<STR_LIT>""" <EOL> result = None <EOL> try : <EOL> result = serializer . LoadAndVerifyJson ( raw , data_check ) <EOL> logging . debug ( "<STR_LIT>" , serializer . DumpJson ( result ) ) <EOL> except Exception as e : <EOL> logging . warn ( "<STR_LIT>" , str ( raw ) ) <EOL> raise e <EOL> return result <EOL> def GenerateRootSshKeys ( key_type , key_bits , error_fn , _suffix = "<STR_LIT>" , <EOL> _homedir_fn = None ) : <EOL> """<STR_LIT>""" <EOL> ssh . InitSSHSetup ( key_type , key_bits , error_fn = error_fn , <EOL> _homedir_fn = _homedir_fn , _suffix = _suffix ) <EOL> def GenerateClientCertificate ( <EOL> data , error_fn , client_cert = pathutils . NODED_CLIENT_CERT_FILE , <EOL> signing_cert = pathutils . NODED_CERT_FILE ) : <EOL> """<STR_LIT>""" <EOL> if not os . path . exists ( signing_cert ) : <EOL> raise error_fn ( "<STR_LIT>" <EOL> % signing_cert ) <EOL> serial_no = int ( time . time ( ) ) <EOL> hostname = data . get ( constants . NDS_NODE_NAME ) <EOL> if not hostname : <EOL> raise error_fn ( "<STR_LIT>" ) <EOL> utils . GenerateSignedSslCert ( client_cert , serial_no , signing_cert , <EOL> common_name = hostname ) </s>
