You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
202 lines
7.7 KiB
202 lines
7.7 KiB
From d8459ff67af8566583a4b33d151a182d48722078 Mon Sep 17 00:00:00 2001 |
|
From: Matej Habrnal <mhabrnal@redhat.com> |
|
Date: Wed, 27 May 2015 14:45:20 +0200 |
|
Subject: [PATCH] ureport: add functionality to use consumer certificate |
|
|
|
reporter-ureport uses consumer certificate instead of entitlement certificate, |
|
if the rhsm authentication is enabled. Also uses |
|
https://cert-api.access.redhat.com/rs/telemetry/abrt to report those |
|
autenticated uReports. |
|
|
|
Related to rhbz#1223805 |
|
|
|
Signed-off-by: Matej Habrnal <mhabrnal@redhat.com> |
|
--- |
|
src/lib/ureport.c | 121 +++++++++++++---------------------------------- |
|
src/plugins/ureport.conf | 2 +- |
|
2 files changed, 33 insertions(+), 90 deletions(-) |
|
|
|
diff --git a/src/lib/ureport.c b/src/lib/ureport.c |
|
index 5065a52..990ace6 100644 |
|
--- a/src/lib/ureport.c |
|
+++ b/src/lib/ureport.c |
|
@@ -31,13 +31,11 @@ |
|
|
|
#define BTHASH_URL_SFX "reports/bthash/" |
|
|
|
-#define RHSM_WEB_SERVICE_URL "https://api.access.redhat.com/rs/telemetry/abrt" |
|
+#define RHSM_WEB_SERVICE_URL "https://cert-api.access.redhat.com/rs/telemetry/abrt" |
|
|
|
-#define RHSMENT_PEM_DIR_PATH "/etc/pki/entitlement" |
|
-#define RHSMENT_ENT_DATA_BEGIN_TAG "-----BEGIN ENTITLEMENT DATA-----" |
|
-#define RHSMENT_ENT_DATA_END_TAG "-----END ENTITLEMENT DATA-----" |
|
-#define RHSMENT_SIG_DATA_BEGIN_TAG "-----BEGIN RSA SIGNATURE-----" |
|
-#define RHSMENT_SIG_DATA_END_TAG "-----END RSA SIGNATURE-----" |
|
+#define RHSMCON_PEM_DIR_PATH "/etc/pki/consumer" |
|
+#define RHSMCON_CERT_NAME "cert.pem" |
|
+#define RHSMCON_KEY_NAME "key.pem" |
|
|
|
|
|
static char * |
|
@@ -71,14 +69,14 @@ ureport_server_config_set_url(struct ureport_server_config *config, |
|
} |
|
|
|
static char * |
|
-rhsm_config_get_entitlement_cert_dir(void) |
|
+rhsm_config_get_consumer_cert_dir(void) |
|
{ |
|
- char *result = getenv("LIBREPORT_DEBUG_RHSMENT_PEM_DIR_PATH"); |
|
+ char *result = getenv("LIBREPORT_DEBUG_RHSMCON_PEM_DIR_PATH"); |
|
if (result != NULL) |
|
return xstrdup(result); |
|
|
|
result = run_in_shell_and_save_output(0, |
|
- "python -c \"from rhsm.config import initConfig; print(initConfig().get('rhsm', 'entitlementCertDir'))\"", |
|
+ "python -c \"from rhsm.config import initConfig; print(initConfig().get('rhsm', 'consumerCertDir'))\"", |
|
NULL, NULL); |
|
|
|
/* run_in_shell_and_save_output always returns non-NULL */ |
|
@@ -93,8 +91,19 @@ rhsm_config_get_entitlement_cert_dir(void) |
|
return result; |
|
error: |
|
free(result); |
|
- error_msg("Failed to get 'rhsm':'entitlementCertDir' from rhsm.config python module. Using "RHSMENT_PEM_DIR_PATH); |
|
- return xstrdup(RHSMENT_PEM_DIR_PATH); |
|
+ error_msg("Failed to get 'rhsm':'consumerCertDir' from rhsm.config python module. Using "RHSMCON_PEM_DIR_PATH); |
|
+ return xstrdup(RHSMCON_PEM_DIR_PATH); |
|
+} |
|
+ |
|
+static bool |
|
+certificate_exist(char *cert_name) |
|
+{ |
|
+ if (access(cert_name, F_OK) != 0) |
|
+ { |
|
+ log_notice("RHSM consumer certificate '%s' does not exist.", cert_name); |
|
+ return false; |
|
+ } |
|
+ return true; |
|
} |
|
|
|
void |
|
@@ -119,93 +128,27 @@ ureport_server_config_set_client_auth(struct ureport_server_config *config, |
|
if (config->ur_url == NULL) |
|
ureport_server_config_set_url(config, xstrdup(RHSM_WEB_SERVICE_URL)); |
|
|
|
- char *rhsm_dir = rhsm_config_get_entitlement_cert_dir(); |
|
- if (rhsm_dir == NULL) |
|
- { |
|
- log_notice("Not using client authentication"); |
|
- return; |
|
- } |
|
+ /* always returns non-NULL */ |
|
+ char *rhsm_dir = rhsm_config_get_consumer_cert_dir(); |
|
|
|
- GList *certs = get_file_list(rhsm_dir, "pem"); |
|
- if (g_list_length(certs) < 2) |
|
- { |
|
- g_list_free_full(certs, (GDestroyNotify)free_file_obj); |
|
+ char *cert_full_name = concat_path_file(rhsm_dir, RHSMCON_CERT_NAME); |
|
+ char *key_full_name = concat_path_file(rhsm_dir, RHSMCON_KEY_NAME); |
|
|
|
- log_notice("'%s' does not contain a cert-key files pair", rhsm_dir); |
|
- log_notice("Not using client authentication"); |
|
- free(rhsm_dir); |
|
- return; |
|
- } |
|
- |
|
- /* Use the last non-key file found. */ |
|
- file_obj_t *cert = NULL; |
|
- for (GList *iter = certs; iter != NULL; iter = g_list_next(iter)) |
|
+ if (certificate_exist(cert_full_name) && certificate_exist(key_full_name)) |
|
{ |
|
- file_obj_t *tmp = (file_obj_t *)iter->data; |
|
- const char *file_name = fo_get_filename(tmp); |
|
- |
|
- if (suffixcmp(file_name, "-key")) |
|
- cert = tmp; |
|
+ config->ur_client_cert = cert_full_name; |
|
+ config->ur_client_key = key_full_name; |
|
+ log_debug("Using cert files: '%s' : '%s'", config->ur_client_cert, config->ur_client_key); |
|
} |
|
- |
|
- if (cert == NULL) |
|
+ else |
|
{ |
|
- g_list_free_full(certs, (GDestroyNotify)free_file_obj); |
|
- |
|
- log_notice("'%s' does not contain a cert file (only keys)", rhsm_dir); |
|
- log_notice("Not using client authentication"); |
|
- free(rhsm_dir); |
|
- return; |
|
+ free(cert_full_name); |
|
+ free(key_full_name); |
|
+ log_notice("Using the default configuration for uReports."); |
|
} |
|
|
|
- config->ur_client_cert = xstrdup(fo_get_fullpath(cert)); |
|
- /* Yes, the key file may not exists. I over took this code from |
|
- * sos-uploader and they are pretty happy with this approach, so why |
|
- * shouldn't we?. */ |
|
- config->ur_client_key = xasprintf("%s/%s-key.pem", rhsm_dir, fo_get_filename(cert)); |
|
free(rhsm_dir); |
|
|
|
- log_debug("Using cert files: '%s' : '%s'", config->ur_client_cert, config->ur_client_key); |
|
- |
|
- g_list_free_full(certs, (GDestroyNotify)free_file_obj); |
|
- |
|
- char *certdata = xmalloc_open_read_close(config->ur_client_cert, /*no size limit*/NULL); |
|
- if (certdata != NULL) |
|
- { |
|
- char *ent_data = xstrdup_between(certdata, |
|
- RHSMENT_ENT_DATA_BEGIN_TAG, RHSMENT_ENT_DATA_END_TAG); |
|
- |
|
- char *sig_data = xstrdup_between(certdata, |
|
- RHSMENT_SIG_DATA_BEGIN_TAG, RHSMENT_SIG_DATA_END_TAG); |
|
- |
|
- if (ent_data != NULL && sig_data != NULL) |
|
- { |
|
- ent_data = strremovech(ent_data, '\n'); |
|
- insert_map_string(config->ur_http_headers, |
|
- xstrdup("X-RH-Entitlement-Data"), |
|
- xasprintf(RHSMENT_ENT_DATA_BEGIN_TAG"%s"RHSMENT_ENT_DATA_END_TAG, ent_data)); |
|
- |
|
- sig_data = strremovech(sig_data, '\n'); |
|
- insert_map_string(config->ur_http_headers, |
|
- xstrdup("X-RH-Entitlement-Sig"), |
|
- xasprintf(RHSMENT_SIG_DATA_BEGIN_TAG"%s"RHSMENT_SIG_DATA_END_TAG, sig_data)); |
|
- } |
|
- else |
|
- { |
|
- log_notice("Cert file '%s' doesn't contain Entitlement and RSA Signature sections", config->ur_client_cert); |
|
- log_notice("Not using client authentication"); |
|
- |
|
- free(config->ur_client_cert); |
|
- config->ur_client_cert = NULL; |
|
- |
|
- free(config->ur_client_key); |
|
- config->ur_client_key = NULL; |
|
- } |
|
- |
|
- free(sig_data); |
|
- free(ent_data); |
|
- free(certdata); |
|
- } |
|
} |
|
else if (strcmp(client_auth, "puppet") == 0) |
|
{ |
|
diff --git a/src/plugins/ureport.conf b/src/plugins/ureport.conf |
|
index e04bf56..2256a7f 100644 |
|
--- a/src/plugins/ureport.conf |
|
+++ b/src/plugins/ureport.conf |
|
@@ -22,7 +22,7 @@ AuthDataItems = hostname, machineid |
|
# 'IncludeAuthData' to 'yes'. |
|
# None (default): |
|
# SSLClientAuth = |
|
-# Using RH subscription management entitlement certificate: |
|
+# Using RH subscription management consumer certificate: |
|
# SSLClientAuth = rhsm |
|
# Using Puppet certificate: |
|
# SSLClientAuth = puppet |
|
-- |
|
2.4.3 |
|
|
|
|