ganeti.utils.security

module documentation

Utility functions for security features of Ganeti.

Function GenerateNewClientSslCert Creates a new server SSL certificate and backups the old one.
Function GenerateNewSslCert Creates a new server SSL certificate and backups the old one.
Function GetCertificateDigest Reads the SSL certificate and returns the sha1 digest.
Function IsCertificateSelfSigned Checks whether the certificate issuer is the same as the owner.
Function UuidToInt Undocumented
Function VerifyCertificate Verifies a SSL certificate.
def GenerateNewClientSslCert(cert_filename, signing_cert_filename, hostname):

Creates a new server SSL certificate and backups the old one.

Parameters
cert_filename:stringfilename of the certificate file
signing_cert_filename:stringname of the certificate to be used for signing
hostname:stringname of the machine whose cert is created
def GenerateNewSslCert(new_cert, cert_filename, serial_no, log_msg, uid=-1, gid=-1):

Creates a new server SSL certificate and backups the old one.

Parameters
new_cert:booleanwhether a new certificate should be created
cert_filename:stringfilename of the certificate file
serial_no:intserial number of the certificate
log_msg:stringlog message to be written on certificate creation
uid:intthe user ID of the user who will be owner of the certificate file
gid:intthe group ID of the group who will own the certificate file
def GetCertificateDigest(cert_filename=pathutils.NODED_CLIENT_CERT_FILE):

Reads the SSL certificate and returns the sha1 digest.

def IsCertificateSelfSigned(cert_filename):

Checks whether the certificate issuer is the same as the owner.

Note that this does not actually verify the signature, it simply compares the certificates common name and the issuer's common name. This is sufficient, because now that Ganeti started creating non-self-signed client-certificates, it uses their hostnames as common names and thus they are distinguishable by common name from the server certificates.

Parameters
cert_filename:stringfilename of the certificate to examine
def UuidToInt(uuid):

Undocumented

def VerifyCertificate(filename):

Verifies a SSL certificate.

Parameters
filename:stringPath to PEM file