? 2011?07?27? 14:58, Guannan Ren ??: Hardcode these paths might not be good idea, there is new parameter for libvirt connection URI to define where the keys and CA locates. See http://libvirt.org/remote.html [pkipath] <http://libvirt.org/remote.html>

ACK Thanks! Best Regards! Wayne Sun Redhat QE, Beijing, China +86-10-6260-8238 ----- Original Message ----- From: "Guannan Ren" <gren(a)redhat.com&gt; To: libvir-list(a)redhat.com Sent: Wednesday, July 27, 2011 5:31:10 PM Subject: [libvirt] [libvirt-test-API][PATCH V2] add remoteAccess directory and tls authentication testcase --- repos/remoteAccess/tls_setup.py | 386 +++++++++++++++++++++++++++++++++++++++ 1 files changed, 386 insertions(+), 0 deletions(-) create mode 100644 repos/remoteAccess/__init__.py create mode 100644 repos/remoteAccess/tls_setup.py diff --git a/repos/remoteAccess/__init__.py b/repos/remoteAccess/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/repos/remoteAccess/tls_setup.py b/repos/remoteAccess/tls_setup.py new file mode 100644 index 0000000..6d0b27c --- /dev/null +++ b/repos/remoteAccess/tls_setup.py @@ -0,0 +1,386 @@ +#!/usr/bin/env python +""" Setup tls authentication between two hosts and configure libvirt + to use it for connection. + remoteAccess:tls_setup + target_machine + xx.xx.xx.xx + username + root + password + xxxxxx + pkipath(optional) + /tmp/pkipath +""" + +__author__ = 'Guannan Ren: gren(a)redhat.com&#39; +__date__ = 'Mon July 25, 2011' +__version__ = '0.1.0' +__credits__ = 'Copyright (C) 2011 Red Hat, Inc.' +__all__ = ['usage'] + +import os +import re +import sys +import pexpect +import string +import commands +import shutil + +def append_path(path): + """Append root path of package""" + if path in sys.path: + pass + else: + sys.path.append(path) + +pwd = os.getcwd() +result = re.search('(.*)libvirt-test-API', pwd) +append_path(result.group(0)) + +from lib import connectAPI +from utils.Python import utils +from exception import LibvirtAPI + +CERTTOOL = "/usr/bin/certtool" +CP = "/bin/cp" +MKDIR = "/bin/mkdir" +CA_FOLDER = "/etc/pki/CA" +PRIVATE_KEY_FOLDER = "/etc/pki/libvirt/private" +CERTIFICATE_FOLDER = "/etc/pki/libvirt" + +TEMP_TLS_FOLDER = "/tmp/libvirt_test_API_tls" +CAKEY = os.path.join(TEMP_TLS_FOLDER, 'cakey.pem') +CACERT = os.path.join(TEMP_TLS_FOLDER, 'cacert.pem') +SERVERKEY = os.path.join(TEMP_TLS_FOLDER, 'serverkey.pem') +SERVERCERT = os.path.join(TEMP_TLS_FOLDER, 'servercert.pem') +CLIENTKEY = os.path.join(TEMP_TLS_FOLDER, 'clientkey.pem') +CLIENTCERT = os.path.join(TEMP_TLS_FOLDER, 'clientcert.pem') + +def check_params(params): + """check out the arguments requried for migration""" + logger = params['logger'] + keys = ['target_machine', 'username', 'password'] + for key in keys: + if key not in params: + logger.error("Argument %s is required" % key) + return 1 + return 0 + +def CA_setting_up(util, logger): + """ setting up a Certificate Authority """ + # Create a private key for CA + logger.info("generate CA certificates") + + cakey_fd = open(CAKEY, 'w') + ret, out = util.exec_cmd([CERTTOOL, '--generate-privkey'], outfile=cakey_fd) + cakey_fd.close() + if ret != 0: + logger.error("failed to create CA private key") + return 1 + + + # ca.info file + cainfo = os.path.join(TEMP_TLS_FOLDER, 'ca.info') + cainfo_fd = open(cainfo, 'w') + cainfo_str = "cn = Libvirt_test_API\n" + \ + "ca\n" + \ + "cert_signing_key\n" + + cainfo_fd.write(cainfo_str) + cainfo_fd.close() + + # Generate cacert.pem + cacert_args = [CERTTOOL, '--generate-self-signed', '--load-privkey', CAKEY, '--template', cainfo] + cacert_fd = open(CACERT, 'w') + ret, out = util.exec_cmd(cacert_args, outfile=cacert_fd) + cacert_fd.close() + if ret != 0: + logger.error("failed to create cacert.pem") + return 1 + + logger.info("done the CA certificates job") + return 0 + +def tls_server_cert(target_machine, util, logger): + """ generating server certificates """ + # Create tls server key + logger.info("generate server certificates") + + serverkey_fd = open(SERVERKEY, 'w') + ret, out = util.exec_cmd([CERTTOOL, '--generate-privkey'], outfile=serverkey_fd) + serverkey_fd.close() + if ret != 0: + logger.error("failed to create server key") + return 1 + + # server.info + serverinfo = os.path.join(TEMP_TLS_FOLDER, 'server.info') + serverinfo_fd = open(serverinfo, 'w') + serverinfo_str = "organization = Libvirt_test_API\n" + \ + "cn = %s\n" % target_machine + \ + "tls_www_server\n" + \ + "encryption_key\n" + \ + "signing_key\n" + + serverinfo_fd.write(serverinfo_str) + serverinfo_fd.close() + + # Generate servercert.pem + servercert_args = [CERTTOOL, + '--generate-certificate', + '--load-privkey', SERVERKEY, + '--load-ca-certificate', CACERT, + '--load-ca-privkey', CAKEY, + '--template', serverinfo + ] + servercert_fd = open(SERVERCERT, 'w') + ret, out = util.exec_cmd(servercert_args, outfile=servercert_fd) + servercert_fd.close() + if ret != 0: + logger.error("failed to create servercert.pem") + return 1 + + logger.info("done the server certificates job") + return 0 + +def tls_client_cert(local_machine, util, logger): + """ generating client certificates """ + # Create tls client key + logger.info("generate client certificates") + + clientkey_fd = open(CLIENTKEY, 'w') + ret, out = util.exec_cmd([CERTTOOL, '--generate-privkey'], outfile=clientkey_fd) + clientkey_fd.close() + if ret != 0: + logger.error("failed to create client key") + return 1 + + # client.info + clientinfo = os.path.join(TEMP_TLS_FOLDER, 'client.info') + clientinfo_fd = open(clientinfo, 'w') + clientinfo_str = "country = xxx\n" + \ + "state = xxx\n" + \ + "locality = xxx\n" + \ + "organization = Libvirt_test_API\n" + \ + "cn = %s\n" % local_machine + \ + "tls_www_client\n" + \ + "encryption_key\n" + \ + "signing_key\n" + + clientinfo_fd.write(clientinfo_str) + clientinfo_fd.close() + + # Generate clientcert.pem + clientcert_args = [CERTTOOL, + '--generate-certificate', + '--load-privkey', CLIENTKEY, + '--load-ca-certificate', CACERT, + '--load-ca-privkey', CAKEY, + '--template', clientinfo, + ] + + clientcert_fd = open(CLIENTCERT, 'w') + ret, out = util.exec_cmd(clientcert_args, outfile=clientcert_fd) + clientcert_fd.close() + if ret != 0: + logger.error("failed to create client certificates") + return 1 + + logger.info("done the client certificates job") + return 0 + +def deliver_cert(target_machine, username, password, pkipath, util, logger): + """ deliver CA, server and client certificates """ + # transmit cacert.pem to remote host + logger.info("deliver CA, server and client certificates to both local and remote server") + ret = util.scp_file(target_machine, username, password, CA_FOLDER, CACERT) + if ret: + logger.error("scp cacert.pem to %s error" % target_machine) + return 1 + + # copy cacert.pem to local CA folder + cacert_cp = [CP, '-f', CACERT, (pkipath and pkipath) or CA_FOLDER] + ret, out = util.exec_cmd(cacert_cp) + if ret: + logger.error("copying cacert.pem to %s error" % CA_FOLDER) + return 1 + + # mkdir /etc/pki/libvirt/private on remote host + libvirt_priv_cmd = "mkdir -p %s" % PRIVATE_KEY_FOLDER + ret = util.remote_exec_pexpect(target_machine, username, password, libvirt_priv_cmd) + if ret: + logger.error("failed to make /etc/pki/libvirt/private on %s" % target_machine) + return 1 + + # transmit serverkey.pem to remote host + ret = util.scp_file(target_machine, username, password, PRIVATE_KEY_FOLDER, SERVERKEY) + if ret: + logger.error("failed to scp serverkey.pem to %s" % target_machine) + return 1 + + # transmit servercert.pem to remote host + ret = util.scp_file(target_machine, username, password, CERTIFICATE_FOLDER, SERVERCERT) + if ret: + logger.error("failed to scp servercert.pem to %s" % target_machine) + return 1 + + libvirt_priv_cmd_local = [MKDIR, '-p', PRIVATE_KEY_FOLDER] + ret, out = util.exec_cmd(libvirt_priv_cmd_local) + if ret: + logger.error("failed to make %s on local" % PRIVATE_KEY_FOLDER) + return 1 + + # copy clientkey.pem to local folder + clientkey_cp = [CP, '-f', CLIENTKEY, (pkipath and pkipath) or PRIVATE_KEY_FOLDER] + ret, out = util.exec_cmd(clientkey_cp) + if ret: + logger.error("failed to copy clientkey.pem to %s" % PRIVATE_KEY_FOLDER) + return 1 + + # copy clientcert.pem to local folder + clientcert_cp = [CP, '-f', CLIENTCERT, (pkipath and pkipath) or CERTIFICATE_FOLDER] + ret, out = util.exec_cmd(clientcert_cp) + if ret: + logger.error("failed to copy clientcert.pem to %s" % CERTIFICATE_FOLDER) + return 1 + + logger.info("done to delivery") + return 0 + +def tls_libvirtd_set(target_machine, username, password, util, logger): + """ configure libvirtd.conf on tls server """ + logger.info("setting libvirtd.conf on tls server") + # open libvirtd --listen option + listen_open_cmd = "echo 'LIBVIRTD_ARGS=\"--listen\"' >> /etc/sysconfig/libvirtd" + ret = util.remote_exec_pexpect(target_machine, username, password, listen_open_cmd) + if ret: + logger.error("failed to uncomment --listen in /etc/sysconfig/libvirtd") + return 1 + + listen_tcp_cmd = "echo \"listen_tcp = 1\" >> /etc/libvirt/libvirtd.conf" + ret = util.remote_exec_pexpect(target_machine, username, password, listen_tcp_cmd) + if ret: + logger.error("failed to uncomment listen_tcp in /etc/libvirt/libvirtd.conf") + return 1 + + # restart remote libvirtd service + libvirtd_restart_cmd = "service libvirtd restart" + ret = util.remote_exec_pexpect(target_machine, username, password, libvirtd_restart_cmd) + if ret: + logger.error("failed to restart libvirtd service") + return 1 + + logger.info("done to libvirtd configuration") + return 0 + +def iptables_stop(target_machine, username, password, util, logger): + """ This is a temprory method in favor of migration """ + logger.info("stop local and remote iptables temprorily") + iptables_stop_cmd = "service iptables stop" + ret = util.remote_exec_pexpect(target_machine, username, password, iptables_stop_cmd) + if ret: + logger.error("failed to stop remote iptables service") + return 1 + + iptables_stop = ["service", "iptables", "stop"] + ret, out = util.exec_cmd(iptables_stop) + if ret: + logger.error("failed to stop local iptables service") + return 1 + + logger.info("done the iptables stop job") + return 0 + +def tls_setup(params): + """ generate tls certificates and configure libvirt """ + logger = params['logger'] + params_check_result = check_params(params) + if params_check_result: + return 1 + + target_machine = params['target_machine'] + username = params['username'] + password = params['password'] + + pkipath = "" + if params.has_key('pkipath'): + pkipath = params['pkipath'] + if os.path.exists(pkipath): + shutil.rmtree(pkipath) + + os.mkdir(pkipath) + + util = utils.Utils() + local_machine = util.get_local_hostname() + + logger.info("the hostname of server is %s" % target_machine) + logger.info("the hostname of local machine is %s" % local_machine) + + if not util.do_ping(target_machine, 0): + logger.error("failed to ping host %s" % target_machine) + return 1 + + if os.path.exists(TEMP_TLS_FOLDER): + shutil.rmtree(TEMP_TLS_FOLDER) + + os.mkdir(TEMP_TLS_FOLDER) + + if iptables_stop(target_machine, username, password, util, logger): + return 1 + + if CA_setting_up(util, logger): + return 1 + + if tls_server_cert(target_machine, util, logger): + return 1 + + if tls_client_cert(local_machine, util, logger): + return 1 + + if deliver_cert(target_machine, username, password, pkipath, util, logger): + return 1 + + if tls_libvirtd_set(target_machine, username, password, util, logger): + return 1 + + uri = "qemu://%s/system" % target_machine + if pkipath: + uri += "?pkipath=%s" % pkipath + + try: + conn = connectAPI.ConnectAPI() + virconn = conn.open(uri) + virconn.close() + logger.info("tls authentication success") + except LibvirtAPI, e: + logger.error("API error message: %s, error code is %s" % \ + (e.response()['message'], e.response()['code'])) + logger.error("tls authentication failed") + return 1 + + return 0 + +def tls_setup_clean(params): + """ cleanup testing enviroment """ + if os.path.exists(TEMP_TLS_FOLDER): + shutil.rmtree(TEMP_TLS_FOLDER) + + logger = params['logger'] + target_machine = params['target_machine'] + username = params['username'] + password = params['password'] + + util = utils.Utils() + cacert_rm = "rm -f %s/cacert.pem" % CA_FOLDER + ret = util.remote_exec_pexpect(target_machine, username, password, cacert_rm) + if ret: + logger.error("failed to remove cacert.pem on remote machine") + + ca_libvirt_rm = "rm -rf %s" % CERTIFICATE_FOLDER + ret = util.remote_exec_pexpect(target_machine, username, password, ca_libvirt_rm) + if ret: + logger.error("failed to remove libvirt folder") + + os.remove("%s/cacert.pem" % CA_FOLDER) + shutil.rmtree(CERTIFICATE_FOLDER) + -- 1.7.1 -- libvir-list mailing list libvir-list(a)redhat.com https://www.redhat.com/mailman/listinfo/libvir-list

ACK Thanks! Best Regards! Wayne Sun Redhat QE, Beijing, China +86-10-6260-8238 ----- Original Message ----- From: "Guannan Ren" <gren(a)redhat.com&gt; To: libvir-list(a)redhat.com Sent: Wednesday, July 27, 2011 2:58:33 PM Subject: [libvirt] [libvirt-test-API][PATCH 2/2] Add four helpful functions in utils.py. * get_local_hostname() get hostname on local machine * exec_cmd() execute shell command * remote_exec_pexpect() execture command on remote host * scp_file() copy file to remote host --- utils/Python/utils.py | 69 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 69 insertions(+), 0 deletions(-) diff --git a/utils/Python/utils.py b/utils/Python/utils.py index eaa8eab..6787e87 100644 --- a/utils/Python/utils.py +++ b/utils/Python/utils.py @@ -26,6 +26,9 @@ import commands import socket import fcntl import struct +import pexpect +import string +import subprocess from xml.dom import minidom class Utils(object): @@ -58,6 +61,10 @@ class Utils(object): arch = ret.split(" ")[-2] return arch + def get_local_hostname(self): + """ get local host name """ + return socket.gethostname() + def get_libvirt_version(self, ver = ''): ver = commands.getoutput("rpm -q libvirt|head -1") if ver.split('-')[0] == 'libvirt': @@ -364,3 +371,65 @@ class Utils(object): (ret, out) = commands.getstatusoutput(cmd) return ret + def exec_cmd(self, command, sudo=False, cwd=None, infile=None, outfile=None, shell=False, data=None): + """ + Executes an external command, optionally via sudo. + """ + if sudo: + if type(command) == type(""): + command = "sudo " + command + else: + command = ["sudo"] + command + if infile == None: + infile = subprocess.PIPE + if outfile == None: + outfile = subprocess.PIPE + p = subprocess.Popen(command, shell=shell, close_fds=True, cwd=cwd, + stdin=infile, stdout=outfile, stderr=subprocess.PIPE) + (out, err) = p.communicate(data) + if out == None: + # Prevent splitlines() from barfing later on + out = "" + return (p.returncode, out.splitlines()) + + def remote_exec_pexpect(self, hostname, username, password, cmd): + """ Remote exec function via pexpect """ + user_hostname = "%s@%s" % (username, hostname) + child = pexpect.spawn("/usr/bin/ssh", [user_hostname, cmd], + timeout = 60, maxread = 2000, logfile = None) + while True: + index = child.expect(['(yes\/no)', 'password:', pexpect.EOF, + pexpect.TIMEOUT]) + if index == 0: + child.sendline("yes") + elif index == 1: + child.sendline(password) + elif index == 2: + child.close() + return 0 + elif index == 3: + child.close() + return 1 + + return 0 + + def scp_file(self, hostname, username, password, target_path, file): + """ Scp file to remote host """ + user_hostname = "%s@%s:%s" % (username, hostname, target_path) + child = pexpect.spawn("/usr/bin/scp", [file, user_hostname]) + while True: + index = child.expect(['yes\/no', 'password: ', + pexpect.EOF, + pexpect.TIMEOUT]) + if index == 0: + child.sendline("yes") + elif index == 1: + child.sendline(password) + elif index == 2: + child.close() + return 0 + elif index == 3: + child.close() + return 1 + + return 0 -- 1.7.1 -- libvir-list mailing list libvir-list(a)redhat.com https://www.redhat.com/mailman/listinfo/libvir-list