mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-09-21 08:33:20 +00:00
Daniel Hilst
772f11c257
A compute node that boots the legacy Genesis image built on el10 stops after
"Getting initial certificate --> <mn>:3001". /etc/xcat is empty, getdestiny never runs and
the node reports no destiny, so xcatd leaves nodelist.status at powering-on. On the node,
openssl reports "command not found" and the getcert process stays alive.
xCAT-genesis-base.spec never build-requires openssl. el8 and el9 hold /usr/bin/openssl in
the build root as a dependency of another package, and el10 does not, so dracut_install in
dracut_105/el/module-setup.sh installed nothing and reported nothing. getcert line 8 waits
for openssl with no bound, which turns the missing command into a wait instead of an error.
The spec now build-requires openssl on every release. verify-genesis-payload reads the
command names back from the dracut module with --commands-from and requires each one in the
payload, so the next name the build root does not supply fails the build. getcert reports a
missing openssl and stops, and bounds the wait for /etc/xcat/certkey.pem at 600 seconds,
which is far longer than the background 4096 bit key needs.
The spec read %{_target_cpu} after BuildArch: noarch, where rpm has already set it to
noarch, so the dmidecode and efibootmgr build-requires never applied and a sed deleted their
dracut_install line on every architecture. Every shipped image lacks both. The spec now
reads %{tarch}, and the dracut module installs whichever of the two the build root carries,
because ppc64le packages neither.
xCAT-test/unit/genesis_getcert_missing_openssl.t, genesis_payload_verification.t and
genesis_base_spec_buildrequires.t fail on the test commit before this one.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
61 lines
2.2 KiB
Bash
Executable File
61 lines
2.2 KiB
Bash
Executable File
#!/bin/bash
|
|
allowcred.awk &
|
|
CREDPID=$!
|
|
if [ -z "$XCATDEST" ]; then
|
|
XCATDEST=$1
|
|
fi
|
|
# doxcat runs getcert in the foreground and ignores its status, so a wait with no bound stops
|
|
# the boot and prints nothing.
|
|
give_up() {
|
|
logger -s -t xcat -p local4.err "getcert: $1"
|
|
kill $CREDPID
|
|
exit 1
|
|
}
|
|
|
|
if ! command -v openssl > /dev/null 2>&1; then
|
|
give_up "this Genesis image carries no openssl, so no certificate is requested"
|
|
fi
|
|
|
|
#retry in case certkey.pem is not right, yet
|
|
# doxcat writes /etc/xcat/certkey.pem in the background with a 4096 bit key, so the first
|
|
# requests fail. An emulated node needs minutes for that key.
|
|
CSR_TIMEOUT=${GETCERT_CSR_TIMEOUT:-600}
|
|
CSR_DEADLINE=$((SECONDS + CSR_TIMEOUT))
|
|
while ! openssl req -new -key /etc/xcat/certkey.pem -out /tmp/tls.csr -subj "/CN=$(hostname)" >& /dev/null; do
|
|
if [ "$SECONDS" -ge "$CSR_DEADLINE" ]; then
|
|
give_up "no certificate request after ${CSR_TIMEOUT}s; /etc/xcat/certkey.pem is not usable"
|
|
fi
|
|
sleep 1
|
|
done
|
|
echo "<xcatrequest>
|
|
<command>getcredentials</command>
|
|
<arg>x509cert</arg>
|
|
<callback_port>300</callback_port>
|
|
<csr>" > /tmp/certreq.xml
|
|
cat /tmp/tls.csr >> /tmp/certreq.xml
|
|
echo "</csr>
|
|
<sha512sig>
|
|
</sha512sig>
|
|
</xcatrequest>" >> /tmp/certreq.xml
|
|
openssl dgst -sha512 -out /tmp/certreq.sha512 -sign /etc/xcat/privkey.pem /tmp/certreq.xml #chain off the switch published key
|
|
openssl enc -e -a -in /tmp/certreq.sha512 > /tmp/certreq.b64sig
|
|
while read -r line; do
|
|
if [ "$line" = "</sha512sig>" ]; then
|
|
cat /tmp/certreq.b64sig >> /tmp/certreq.xml.new
|
|
fi
|
|
echo "$line" >> /tmp/certreq.xml.new
|
|
done < /tmp/certreq.xml
|
|
mv /tmp/certreq.xml.new /tmp/certreq.xml
|
|
rm /tmp/certreq.b64sig /tmp/certreq.sha512
|
|
openssl s_client -connect "$XCATDEST" -quiet 2> /dev/null < /tmp/certreq.xml > /tmp/certresp.xml
|
|
if grep 'BEGIN CERTIFICATE' /tmp/certresp.xml > /dev/null; then
|
|
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' < /tmp/certresp.xml > /etc/xcat/cert.pem
|
|
#stop transmitting sysDesc, allowing the public key to age out of validity
|
|
for iface in $(grep '^ e' /var/lib/lldpad/lldpad.conf|awk '{print $1}'); do
|
|
lldptool -T -i "$iface" -V sysDesc enableTx=no >& /dev/null
|
|
done
|
|
fi
|
|
rm /tmp/certreq.xml
|
|
rm /tmp/certresp.xml
|
|
kill $CREDPID
|