From 5062bf1b841495f5aa69b76fae3054f75a169227 Mon Sep 17 00:00:00 2001 From: aszlig Date: Tue, 12 Apr 2016 04:57:03 +0200 Subject: [PATCH] nixos/taskserver/helper: Assert CA existence We want to make sure that the helper tool won't work if the automatic CA wasn't properly set up. This not only avoids race conditions if the tool is started before the actual service is running but it also fails if something during CA setup has failed so the user can investigate what went wrong. Signed-off-by: aszlig --- .../services/misc/taskserver/helper-tool.py | 30 ++++++++++--------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/nixos/modules/services/misc/taskserver/helper-tool.py b/nixos/modules/services/misc/taskserver/helper-tool.py index abc7362cf7c..e2c340fbd2a 100644 --- a/nixos/modules/services/misc/taskserver/helper-tool.py +++ b/nixos/modules/services/misc/taskserver/helper-tool.py @@ -24,6 +24,10 @@ TASKD_USER = "@user@" TASKD_GROUP = "@group@" FQDN = "@fqdn@" +CA_KEY = os.path.join(TASKD_DATA_DIR, "keys", "ca.key") +CA_CERT = os.path.join(TASKD_DATA_DIR, "keys", "ca.cert") +CRL_FILE = os.path.join(TASKD_DATA_DIR, "keys", "server.crl") + RE_CONFIGUSER = re.compile(r'^\s*user\s*=(.*)$') RE_USERKEY = re.compile(r'New user key: (.+)$', re.MULTILINE) @@ -151,8 +155,6 @@ def generate_key(org, user): privkey = os.path.join(basedir, "private.key") pubcert = os.path.join(basedir, "public.cert") - cakey = os.path.join(TASKD_DATA_DIR, "keys", "ca.key") - cacert = os.path.join(TASKD_DATA_DIR, "keys", "ca.cert") try: os.makedirs(basedir, mode=0700) @@ -172,8 +174,8 @@ def generate_key(org, user): certtool_cmd( "-c", "--load-privkey", privkey, - "--load-ca-privkey", cakey, - "--load-ca-certificate", cacert, + "--load-ca-privkey", CA_KEY, + "--load-ca-certificate", CA_CERT, "--template", template, "--outfile", pubcert ) @@ -183,10 +185,6 @@ def generate_key(org, user): def revoke_key(org, user): - cakey = os.path.join(TASKD_DATA_DIR, "keys", "ca.key") - cacert = os.path.join(TASKD_DATA_DIR, "keys", "ca.cert") - crl = os.path.join(TASKD_DATA_DIR, "keys", "server.crl") - basedir = os.path.join(TASKD_DATA_DIR, "keys", org, user) if not os.path.exists(basedir): raise OSError("Keyfile directory for {} doesn't exist.".format(user)) @@ -197,16 +195,16 @@ def revoke_key(org, user): with create_template([expiration]) as template: oldcrl = NamedTemporaryFile(mode="wb", prefix="old-crl") - oldcrl.write(open(crl, "rb").read()) + oldcrl.write(open(CRL_FILE, "rb").read()) oldcrl.flush() certtool_cmd( "--generate-crl", "--load-crl", oldcrl.name, - "--load-ca-privkey", cakey, - "--load-ca-certificate", cacert, + "--load-ca-privkey", CA_KEY, + "--load-ca-certificate", CA_CERT, "--load-certificate", pubcert, "--template", template, - "--outfile", crl + "--outfile", CRL_FILE ) oldcrl.close() rmtree(basedir) @@ -432,11 +430,15 @@ ORGANISATION = OrganisationType() @click.group() -def cli(): +@click.pass_context +def cli(ctx): """ Manage Taskserver users and certificates """ - pass + for path in (CA_KEY, CA_CERT, CRL_FILE): + if not os.path.exists(path): + msg = "CA setup not done or incomplete, missing file {}." + ctx.fail(msg.format(path)) @cli.command("list-users")