be00e95da5
OS_CACERT was being added directly to the environment rather than usercc_early. This caused an untrusted CA error to be thrown. Ensure that SERVICE_HOST is in the Subject Alt. Names of the issued TLS server cert. The gate sets it to 127.0.0.1 which wasn't being handled. Only the FQDN of the host and actual IP address of the machine were being added. Change-Id: I8a91dffe1a5263d2bcc99ea406a8556045b52be2
485 lines
13 KiB
Bash
485 lines
13 KiB
Bash
#!/bin/bash
|
|
#
|
|
# lib/tls
|
|
# Functions to control the configuration and operation of the TLS proxy service
|
|
|
|
# !! source _before_ any services that use ``SERVICE_HOST``
|
|
#
|
|
# Dependencies:
|
|
#
|
|
# - ``functions`` file
|
|
# - ``DEST``, ``DATA_DIR`` must be defined
|
|
# - ``HOST_IP``, ``SERVICE_HOST``
|
|
# - ``KEYSTONE_TOKEN_FORMAT`` must be defined
|
|
|
|
# Entry points:
|
|
#
|
|
# - configure_CA
|
|
# - init_CA
|
|
# - cleanup_CA
|
|
|
|
# - configure_proxy
|
|
# - start_tls_proxy
|
|
|
|
# - stop_tls_proxy
|
|
# - cleanup_CA
|
|
|
|
# - make_root_CA
|
|
# - make_int_CA
|
|
# - make_cert ca-dir cert-name "common-name" ["alt-name" ...]
|
|
# - start_tls_proxy HOST_IP 5000 localhost 5000
|
|
# - ensure_certificates
|
|
# - is_ssl_enabled_service
|
|
# - enable_mod_ssl
|
|
|
|
|
|
# Defaults
|
|
# --------
|
|
|
|
if is_service_enabled tls-proxy; then
|
|
# TODO(dtroyer): revisit this below after the search for HOST_IP has been done
|
|
TLS_IP=${TLS_IP:-$SERVICE_IP}
|
|
fi
|
|
|
|
DEVSTACK_HOSTNAME=$(hostname -f)
|
|
DEVSTACK_CERT_NAME=devstack-cert
|
|
DEVSTACK_CERT=$DATA_DIR/$DEVSTACK_CERT_NAME.pem
|
|
|
|
# CA configuration
|
|
ROOT_CA_DIR=${ROOT_CA_DIR:-$DATA_DIR/CA/root-ca}
|
|
INT_CA_DIR=${INT_CA_DIR:-$DATA_DIR/CA/int-ca}
|
|
|
|
ORG_NAME="OpenStack"
|
|
ORG_UNIT_NAME="DevStack"
|
|
|
|
# Stud configuration
|
|
STUD_PROTO="--tls"
|
|
STUD_CIPHERS='TLSv1+HIGH:!DES:!aNULL:!eNULL:@STRENGTH'
|
|
|
|
|
|
# CA Functions
|
|
# ============
|
|
|
|
# There may be more than one, get specific
|
|
OPENSSL=${OPENSSL:-/usr/bin/openssl}
|
|
|
|
# Do primary CA configuration
|
|
function configure_CA {
|
|
# build common config file
|
|
|
|
# Verify ``TLS_IP`` is good
|
|
if [[ -n "$HOST_IP" && "$HOST_IP" != "$TLS_IP" ]]; then
|
|
# auto-discover has changed the IP
|
|
TLS_IP=$HOST_IP
|
|
fi
|
|
}
|
|
|
|
# Creates a new CA directory structure
|
|
# create_CA_base ca-dir
|
|
function create_CA_base {
|
|
local ca_dir=$1
|
|
|
|
if [[ -d $ca_dir ]]; then
|
|
# Bail out it exists
|
|
return 0
|
|
fi
|
|
|
|
local i
|
|
for i in certs crl newcerts private; do
|
|
mkdir -p $ca_dir/$i
|
|
done
|
|
chmod 710 $ca_dir/private
|
|
echo "01" >$ca_dir/serial
|
|
cp /dev/null $ca_dir/index.txt
|
|
}
|
|
|
|
# Create a new CA configuration file
|
|
# create_CA_config ca-dir common-name
|
|
function create_CA_config {
|
|
local ca_dir=$1
|
|
local common_name=$2
|
|
|
|
echo "
|
|
[ ca ]
|
|
default_ca = CA_default
|
|
|
|
[ CA_default ]
|
|
dir = $ca_dir
|
|
policy = policy_match
|
|
database = \$dir/index.txt
|
|
serial = \$dir/serial
|
|
certs = \$dir/certs
|
|
crl_dir = \$dir/crl
|
|
new_certs_dir = \$dir/newcerts
|
|
certificate = \$dir/cacert.pem
|
|
private_key = \$dir/private/cacert.key
|
|
RANDFILE = \$dir/private/.rand
|
|
default_md = default
|
|
|
|
[ req ]
|
|
default_bits = 1024
|
|
default_md = sha1
|
|
|
|
prompt = no
|
|
distinguished_name = ca_distinguished_name
|
|
|
|
x509_extensions = ca_extensions
|
|
|
|
[ ca_distinguished_name ]
|
|
organizationName = $ORG_NAME
|
|
organizationalUnitName = $ORG_UNIT_NAME Certificate Authority
|
|
commonName = $common_name
|
|
|
|
[ policy_match ]
|
|
countryName = optional
|
|
stateOrProvinceName = optional
|
|
organizationName = match
|
|
organizationalUnitName = optional
|
|
commonName = supplied
|
|
|
|
[ ca_extensions ]
|
|
basicConstraints = critical,CA:true
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always, issuer
|
|
keyUsage = cRLSign, keyCertSign
|
|
|
|
" >$ca_dir/ca.conf
|
|
}
|
|
|
|
# Create a new signing configuration file
|
|
# create_signing_config ca-dir
|
|
function create_signing_config {
|
|
local ca_dir=$1
|
|
|
|
echo "
|
|
[ ca ]
|
|
default_ca = CA_default
|
|
|
|
[ CA_default ]
|
|
dir = $ca_dir
|
|
policy = policy_match
|
|
database = \$dir/index.txt
|
|
serial = \$dir/serial
|
|
certs = \$dir/certs
|
|
crl_dir = \$dir/crl
|
|
new_certs_dir = \$dir/newcerts
|
|
certificate = \$dir/cacert.pem
|
|
private_key = \$dir/private/cacert.key
|
|
RANDFILE = \$dir/private/.rand
|
|
default_md = default
|
|
|
|
[ req ]
|
|
default_bits = 1024
|
|
default_md = sha1
|
|
|
|
prompt = no
|
|
distinguished_name = req_distinguished_name
|
|
|
|
x509_extensions = req_extensions
|
|
|
|
[ req_distinguished_name ]
|
|
organizationName = $ORG_NAME
|
|
organizationalUnitName = $ORG_UNIT_NAME Server Farm
|
|
|
|
[ policy_match ]
|
|
countryName = optional
|
|
stateOrProvinceName = optional
|
|
organizationName = match
|
|
organizationalUnitName = optional
|
|
commonName = supplied
|
|
|
|
[ req_extensions ]
|
|
basicConstraints = CA:false
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always, issuer
|
|
keyUsage = digitalSignature, keyEncipherment, keyAgreement
|
|
extendedKeyUsage = serverAuth, clientAuth
|
|
subjectAltName = \$ENV::SUBJECT_ALT_NAME
|
|
|
|
" >$ca_dir/signing.conf
|
|
}
|
|
|
|
# Create root and intermediate CAs
|
|
# init_CA
|
|
function init_CA {
|
|
fix_system_ca_bundle_path
|
|
# Ensure CAs are built
|
|
make_root_CA $ROOT_CA_DIR
|
|
make_int_CA $INT_CA_DIR $ROOT_CA_DIR
|
|
|
|
# Create the CA bundle
|
|
cat $ROOT_CA_DIR/cacert.pem $INT_CA_DIR/cacert.pem >>$INT_CA_DIR/ca-chain.pem
|
|
cat $INT_CA_DIR/ca-chain.pem >> $SSL_BUNDLE_FILE
|
|
|
|
if is_fedora; then
|
|
sudo cp $INT_CA_DIR/ca-chain.pem /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
|
|
sudo update-ca-trust
|
|
elif is_ubuntu; then
|
|
sudo cp $INT_CA_DIR/ca-chain.pem /usr/local/share/ca-certificates/devstack-int.crt
|
|
sudo cp $ROOT_CA_DIR/cacert.pem /usr/local/share/ca-certificates/devstack-root.crt
|
|
sudo update-ca-certificates
|
|
fi
|
|
}
|
|
|
|
# Clean up the CA files
|
|
# cleanup_CA
|
|
function cleanup_CA {
|
|
if is_fedora; then
|
|
sudo rm -f /usr/share/pki/ca-trust-source/anchors/devstack-chain.pem
|
|
sudo update-ca-trust
|
|
elif is_ubuntu; then
|
|
sudo rm -f /usr/local/share/ca-certificates/devstack-int.crt
|
|
sudo rm -f /usr/local/share/ca-certificates/devstack-root.crt
|
|
sudo update-ca-certificates
|
|
fi
|
|
}
|
|
|
|
# Create an initial server cert
|
|
# init_cert
|
|
function init_cert {
|
|
if [[ ! -r $DEVSTACK_CERT ]]; then
|
|
if [[ -n "$TLS_IP" ]]; then
|
|
# Lie to let incomplete match routines work
|
|
TLS_IP="DNS:$TLS_IP"
|
|
fi
|
|
make_cert $INT_CA_DIR $DEVSTACK_CERT_NAME $DEVSTACK_HOSTNAME "$TLS_IP"
|
|
|
|
# Create a cert bundle
|
|
cat $INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key $INT_CA_DIR/$DEVSTACK_CERT_NAME.crt $INT_CA_DIR/cacert.pem >$DEVSTACK_CERT
|
|
fi
|
|
}
|
|
|
|
# make_cert creates and signs a new certificate with the given commonName and CA
|
|
# make_cert ca-dir cert-name "common-name" ["alt-name" ...]
|
|
function make_cert {
|
|
local ca_dir=$1
|
|
local cert_name=$2
|
|
local common_name=$3
|
|
local alt_names=$4
|
|
|
|
if [ "$common_name" != "$SERVICE_HOST" ]; then
|
|
if [[ -z "$alt_names" ]]; then
|
|
alt_names="DNS:$SERVICE_HOST"
|
|
else
|
|
alt_names="$alt_names,DNS:$SERVICE_HOST"
|
|
fi
|
|
fi
|
|
|
|
# Only generate the certificate if it doesn't exist yet on the disk
|
|
if [ ! -r "$ca_dir/$cert_name.crt" ]; then
|
|
# Generate a signing request
|
|
$OPENSSL req \
|
|
-sha1 \
|
|
-newkey rsa \
|
|
-nodes \
|
|
-keyout $ca_dir/private/$cert_name.key \
|
|
-out $ca_dir/$cert_name.csr \
|
|
-subj "/O=${ORG_NAME}/OU=${ORG_UNIT_NAME} Servers/CN=${common_name}"
|
|
|
|
if [[ -z "$alt_names" ]]; then
|
|
alt_names="DNS:${common_name}"
|
|
else
|
|
alt_names="DNS:${common_name},${alt_names}"
|
|
fi
|
|
|
|
# Sign the request valid for 1 year
|
|
SUBJECT_ALT_NAME="$alt_names" \
|
|
$OPENSSL ca -config $ca_dir/signing.conf \
|
|
-extensions req_extensions \
|
|
-days 365 \
|
|
-notext \
|
|
-in $ca_dir/$cert_name.csr \
|
|
-out $ca_dir/$cert_name.crt \
|
|
-subj "/O=${ORG_NAME}/OU=${ORG_UNIT_NAME} Servers/CN=${common_name}" \
|
|
-batch
|
|
fi
|
|
}
|
|
|
|
# Make an intermediate CA to sign everything else
|
|
# make_int_CA ca-dir signing-ca-dir
|
|
function make_int_CA {
|
|
local ca_dir=$1
|
|
local signing_ca_dir=$2
|
|
|
|
# Create the root CA
|
|
create_CA_base $ca_dir
|
|
create_CA_config $ca_dir 'Intermediate CA'
|
|
create_signing_config $ca_dir
|
|
|
|
if [ ! -r "$ca_dir/cacert.pem" ]; then
|
|
# Create a signing certificate request
|
|
$OPENSSL req -config $ca_dir/ca.conf \
|
|
-sha1 \
|
|
-newkey rsa \
|
|
-nodes \
|
|
-keyout $ca_dir/private/cacert.key \
|
|
-out $ca_dir/cacert.csr \
|
|
-outform PEM
|
|
|
|
# Sign the intermediate request valid for 1 year
|
|
$OPENSSL ca -config $signing_ca_dir/ca.conf \
|
|
-extensions ca_extensions \
|
|
-days 365 \
|
|
-notext \
|
|
-in $ca_dir/cacert.csr \
|
|
-out $ca_dir/cacert.pem \
|
|
-batch
|
|
fi
|
|
}
|
|
|
|
# Make a root CA to sign other CAs
|
|
# make_root_CA ca-dir
|
|
function make_root_CA {
|
|
local ca_dir=$1
|
|
|
|
# Create the root CA
|
|
create_CA_base $ca_dir
|
|
create_CA_config $ca_dir 'Root CA'
|
|
|
|
# Create a self-signed certificate valid for 5 years
|
|
$OPENSSL req -config $ca_dir/ca.conf \
|
|
-x509 \
|
|
-nodes \
|
|
-newkey rsa \
|
|
-days 21360 \
|
|
-keyout $ca_dir/private/cacert.key \
|
|
-out $ca_dir/cacert.pem \
|
|
-outform PEM
|
|
}
|
|
|
|
# If a non-system python-requests is installed then it will use the
|
|
# built-in CA certificate store rather than the distro-specific
|
|
# CA certificate store. Detect this and symlink to the correct
|
|
# one. If the value for the CA is not rooted in /etc then we know
|
|
# we need to change it.
|
|
function fix_system_ca_bundle_path {
|
|
if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
|
|
local capath
|
|
capath=$(python -c $'try:\n from requests import certs\n print certs.where()\nexcept ImportError: pass')
|
|
|
|
if [[ ! $capath == "" && ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
|
|
if is_fedora; then
|
|
sudo rm -f $capath
|
|
sudo ln -s /etc/pki/tls/certs/ca-bundle.crt $capath
|
|
elif is_ubuntu; then
|
|
sudo rm -f $capath
|
|
sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath
|
|
else
|
|
echo "Don't know how to set the CA bundle, expect the install to fail."
|
|
fi
|
|
fi
|
|
fi
|
|
}
|
|
|
|
|
|
# Certificate Input Configuration
|
|
# ===============================
|
|
|
|
# check to see if the service(s) specified are to be SSL enabled.
|
|
#
|
|
# Multiple services specified as arguments are ``OR``'ed together; the test
|
|
# is a short-circuit boolean, i.e it returns on the first match.
|
|
#
|
|
# Uses global ``SSL_ENABLED_SERVICES``
|
|
function is_ssl_enabled_service {
|
|
local services=$@
|
|
local service=""
|
|
if [ "$USE_SSL" == "False" ]; then
|
|
return 1
|
|
fi
|
|
for service in ${services}; do
|
|
[[ ,${SSL_ENABLED_SERVICES}, =~ ,${service}, ]] && return 0
|
|
done
|
|
return 1
|
|
}
|
|
|
|
# Ensure that the certificates for a service are in place. This function does
|
|
# not check that a service is SSL enabled, this should already have been
|
|
# completed.
|
|
#
|
|
# The function expects to find a certificate, key and CA certificate in the
|
|
# variables ``{service}_SSL_CERT``, ``{service}_SSL_KEY`` and ``{service}_SSL_CA``. For
|
|
# example for keystone this would be ``KEYSTONE_SSL_CERT``, ``KEYSTONE_SSL_KEY`` and
|
|
# ``KEYSTONE_SSL_CA``.
|
|
#
|
|
# If it does not find these certificates then the DevStack-issued server
|
|
# certificate, key and CA certificate will be associated with the service.
|
|
#
|
|
# If only some of the variables are provided then the function will quit.
|
|
function ensure_certificates {
|
|
local service=$1
|
|
|
|
local cert_var="${service}_SSL_CERT"
|
|
local key_var="${service}_SSL_KEY"
|
|
local ca_var="${service}_SSL_CA"
|
|
|
|
local cert=${!cert_var}
|
|
local key=${!key_var}
|
|
local ca=${!ca_var}
|
|
|
|
if [[ -z "$cert" && -z "$key" && -z "$ca" ]]; then
|
|
local cert="$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt"
|
|
local key="$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key"
|
|
local ca="$INT_CA_DIR/ca-chain.pem"
|
|
eval ${service}_SSL_CERT=\$cert
|
|
eval ${service}_SSL_KEY=\$key
|
|
eval ${service}_SSL_CA=\$ca
|
|
return # the CA certificate is already in the bundle
|
|
elif [[ -z "$cert" || -z "$key" || -z "$ca" ]]; then
|
|
die $LINENO "Missing either the ${cert_var} ${key_var} or ${ca_var}" \
|
|
"variable to enable SSL for ${service}"
|
|
fi
|
|
|
|
cat $ca >> $SSL_BUNDLE_FILE
|
|
}
|
|
|
|
# Enable the mod_ssl plugin in Apache
|
|
function enable_mod_ssl {
|
|
echo "Enabling mod_ssl"
|
|
|
|
if is_ubuntu; then
|
|
sudo a2enmod ssl
|
|
elif is_fedora; then
|
|
# Fedora enables mod_ssl by default
|
|
:
|
|
fi
|
|
if ! sudo `which httpd || which apache2ctl` -M | grep -w -q ssl_module; then
|
|
die $LINENO "mod_ssl is not enabled in apache2/httpd, please check for it manually and run stack.sh again"
|
|
fi
|
|
}
|
|
|
|
|
|
# Proxy Functions
|
|
# ===============
|
|
|
|
# Starts the TLS proxy for the given IP/ports
|
|
# start_tls_proxy front-host front-port back-host back-port
|
|
function start_tls_proxy {
|
|
local f_host=$1
|
|
local f_port=$2
|
|
local b_host=$3
|
|
local b_port=$4
|
|
|
|
stud $STUD_PROTO -f $f_host,$f_port -b $b_host,$b_port $DEVSTACK_CERT 2>/dev/null
|
|
}
|
|
|
|
|
|
# Cleanup Functions
|
|
# =================
|
|
|
|
# Stops all stud processes. This should be done only after all services
|
|
# using tls configuration are down.
|
|
function stop_tls_proxy {
|
|
killall stud
|
|
}
|
|
|
|
# Remove CA along with configuration, as well as the local server certificate
|
|
function cleanup_CA {
|
|
rm -rf "$DATA_DIR/CA" "$DEVSTACK_CERT"
|
|
}
|
|
|
|
# Tell emacs to use shell-script-mode
|
|
## Local variables:
|
|
## mode: shell-script
|
|
## End:
|