Merge lp:~vds/charms/trusty/neutron-contrail/tls-patch into lp:~sdn-charmers/charms/trusty/neutron-contrail/trunk

[Vincenzo Di Somma]

Port of TLS support from DTAG.

[Gábor Mészáros (gabor.meszaros)]

obsolete, and the patch contains also TLS support which works in an incorfrect way. The TLS support is not used anywhere at the moment.

review: Disapprove

Unmerged revisions

73. By Vincenzo Di Somma on 2017-09-26

Port of TLS patch from DTAG

=== modified file 'hooks/neutron_contrail_hooks.py'
--- hooks/neutron_contrail_hooks.py	2017-09-20 19:59:00 +0000
+++ hooks/neutron_contrail_hooks.py	2017-09-26 14:06:23 +0000
@@ -21,7 +21,8 @@
     log,
     relation_get,
     relation_ids,
-    relation_set
+    relation_set,
+    local_unit,
 )
 
 from charmhelpers.core.host import (
@@ -44,6 +45,7 @@
     CONTRAIL_VERSION,
     OPENSTACK_VERSION,
     configure_vrouter,
+    control_network_ip,
     disable_vrouter_vgw,
     dpkg_version,
     drop_caches,
@@ -72,11 +74,13 @@
     write_nodemgr_config,
     write_vnc_api_config,
     write_vrouter_config,
-    write_vrouter_vgw_interfaces
+    write_vrouter_vgw_interfaces,
+    write_xmpp_tls_files,
 )
 
-PACKAGES = [ "contrail-utils", "python-jinja2", "python-netifaces",
-             "python-netaddr", "contrail-nodemgr" ]
+PACKAGES = ["contrail-vrouter-dkms", "contrail-vrouter-agent",
+            "contrail-utils", "python-jinja2", "python-netifaces",
+            "python-netaddr", "contrail-nodemgr"]
 
 PACKAGES_DPDK = [ "contrail-dpdk-kernel-modules-dkms", "contrail-vrouter-dpdk",
                   "contrail-vrouter-dpdk-init", "contrail-vrouter-agent",
@@ -435,6 +439,49 @@
         settings = { "metadata-shared-secret": config["local-metadata-secret"] }
         relation_set(relation_settings=settings)
 
[e-mail]('tls-certificates-relation-joined')
+def tls_certificates_relation_joined():
+    # a hostname could also be provided as a SAN
+    # (Subject Alternative Name) but having this one
+    # has certain implications
+    # https://tools.ietf.org/html/rfc2818#section-3.1
+    # "If a subjectAltName extension of type dNSName
+    # is present, that MUST be used as the identity"
+    # Therefore it is not used here as we don't need
+    # a DNS infrastructure dependency
+    ip_san = control_network_ip()
+    settings = {
+        'sans': json.dumps([ip_san, '127.0.0.1']),
+        'common_name': ip_san,
+        'certificate_name': local_unit().replace('/', '_')
+    }
+    relation_set(relation_settings=settings)
+
+
[e-mail]('tls-certificates-relation-changed')
+def tls_certificates_relation_changed():
+    # check that the -provides side have set the data we need
+    # and render the affected files
+    unitname = local_unit().replace('/', '_')
+    cert = '{0}.server.cert'.format(unitname)
+    key = '{0}.server.key'.format(unitname)
+    certv = relation_get(cert)
+    keyv = relation_get(key)
+    ca = relation_get('ca')
+
+    if certv and keyv and ca:
+        write_xmpp_tls_files(certv, keyv, ca)
+        config["tls-certificates-ready"] = True
+    else:
+        log('tls-certificates relation data is not fully available')
+        config["tls-certificates-ready"] = False
+
+
[e-mail]('tls-certificates-relation-departed')
+def tls_certificates_relation_departed():
+        config["tls-certificates-ready"] = False
+
+
 def main():
     try:
         hooks.execute(sys.argv)
 
=== modified file 'hooks/neutron_contrail_utils.py'
--- hooks/neutron_contrail_utils.py	2017-09-20 19:59:00 +0000
+++ hooks/neutron_contrail_utils.py	2017-09-26 14:06:23 +0000
@@ -27,7 +27,9 @@
     relation_get,
     relation_ids,
     relation_type,
-    remote_unit
+    remote_unit,
+    unit_private_ip,
+    network_get_primary_address,
 )
 
 from charmhelpers.core.host import (
@@ -572,6 +574,50 @@
     render("contrail-vrouter-agent.conf",
            "/etc/contrail/contrail-vrouter-agent.conf", ctx, perms=0440)
 
+
 def write_vrouter_vgw_interfaces():
     ctx = vrouter_vgw_ctx()
     render("vrouter-vgw.cfg", "/etc/network/interfaces.d/vrouter-vgw.cfg", ctx)
+
+
+def control_network_ip():
+    '''
+    With Juju 2.x, uses an endpoint (relation)
+    network space binding if unspecified will use a "unit private address"
+    which is far less explicit if you look at the Juju implementation.
+    If you use Juju 2.x and above - bind the control-node endpoint to a network
+    space to get a proper address in this function.
+
+    If network-get throws an exception (juju 1.x or spaces are not supported)
+    will try to fall back to a private-address as returned by Juju.
+    '''
+    try:
+        address = network_get_primary_address('control-node')
+    except NotImplementedError:
+        log('Network spaces are not implemented - falling back to'
+            ' getting a private address')
+        address = unit_private_ip()
+    return address
+
+
+def write_xmpp_tls_files(serv_cert, priv_key, ca):
+    prefix = '/etc/contrail/ssl'
+    certs = os.path.join(prefix, 'certs')
+    private = os.path.join(prefix, 'private')
+
+    entry = pwd.getpwnam('contrail')
+    for p in [prefix, certs, private]:
+        if not os.path.exists(p):
+            os.makedirs(p, 0o750)
+            os.chown(p, entry.pw_uid, entry.pw_gid)
+
+    fcontent = {
+        os.path.join(certs, 'server.pem'): serv_cert,
+        os.path.join(private, 'server-privkey.pem'): priv_key,
+        os.path.join(certs, 'ca-cert.pem'): ca,
+    }
+
+    for filepath, content in fcontent.iteritems():
+        with open(filepath, 'w+') as f:
+            f.truncate(0)
+            f.write(content)
 
=== added symlink 'hooks/tls-certificates-relation-changed'
=== target is u'neutron_contrail_hooks.py'
=== added symlink 'hooks/tls-certificates-relation-departed'
=== target is u'neutron_contrail_hooks.py'
=== added symlink 'hooks/tls-certificates-relation-joined'
=== target is u'neutron_contrail_hooks.py'
=== modified file 'metadata.yaml'
--- metadata.yaml	2015-10-13 11:03:57 +0000
+++ metadata.yaml	2017-09-26 14:06:23 +0000
@@ -37,3 +37,5 @@
     interface: keystone-admin
   neutron-metadata:
     interface: neutron-metadata
+  tls-certificates:
+    interface: tls-certificates
 
=== added file 'scripts/vhost-phys.sh'
--- scripts/vhost-phys.sh	1970-01-01 00:00:00 +0000
+++ scripts/vhost-phys.sh	2017-09-26 14:06:23 +0000
@@ -0,0 +1,6 @@
+#!/bin/sh -e
+#
+# Script used to determine physical interface of vhost0
+
+mac=$(cat /sys/class/net/vhost0/address)
+vif --list | awk -v mac=$mac 'BEGIN { RS="\n\n" }; $3 != "vhost0" && $0 ~ "HWaddr:" mac { print $3; exit 0 }'
 
=== modified file 'templates/contrail-vrouter-agent.conf'
--- templates/contrail-vrouter-agent.conf	2017-07-17 05:03:53 +0000
+++ templates/contrail-vrouter-agent.conf	2017-09-26 14:06:23 +0000
@@ -3,6 +3,14 @@
 # Configuration file maintained by Juju. Local changes may be overwritten.
 ###############################################################################
 
+{% if tls_implemented -%}
+[DEFAULT]
+xmpp_auth_enable=true
+xmpp_server_cert=/etc/contrail/ssl/certs/server.pem
+xmpp_server_key=/etc/contrail/ssl/private/server-privkey.pem
+xmpp_ca_cert=/etc/contrail/ssl/certs/ca-cert.pem
+{% endif -%}
+
 {%- if control_nodes %}
 
 [CONTROL-NODE]