corosync-qnetd-certutl: Improvements

- Location of certificates is now correctly set depending on operation
  (qnetd/node)
- Added quick start mode

Signed-off-by: Jan Friesse <jfriesse@redhat.com>

qdevices/Makefile.am

@@ -59,6 +59,7 @@ corosync_qdevice_net_LDADD	= $(nss_LIBS) $(LIBQB_LIBS) $(top_builddir)/lib/libcm
 corosync-qnetd-certutil: corosync-qnetd-certutil.sh
 	sed -e 's#@''DATADIR@#${datadir}#g' \
 	    -e 's#@''BASHPATH@#${BASHPATH}#g' \
+	    -e 's#@''COROSYSCONFDIR@#${COROSYSCONFDIR}#g' \
 	    $< > $@
 
 TESTS				= qnetd-cluster-list.test

qdevices/corosync-qdevice-net.c

@@ -68,7 +68,7 @@
 #include "timer-list.h"
 #include "send-buffer-list.h"
 
-#define NSS_DB_DIR	COROSYSCONFDIR "/qdevice-net/nssdb"
+#define NSS_DB_DIR	COROSYSCONFDIR "/qdevice/net/node/nssdb"
 
 /*
  * It's usually not a good idea to change following defines

qdevices/corosync-qnetd-certutil.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!@BASHPATH@
 
 #
 # Copyright (c) 2015 Red Hat, Inc.
@@ -34,7 +34,9 @@
 # THE POSSIBILITY OF SUCH DAMAGE.
 #
 
-DB_DIR=nssdb
+BASE_DIR="@COROSYSCONFDIR@/qdevice/net"
+DB_DIR_QNETD="$BASE_DIR/qnetd/nssdb"
+DB_DIR_NODE="$BASE_DIR/node/nssdb"
 # Validity of certificate (months)
 CRT_VALIDITY=120
 CA_NICKNAME="QNet CA"
@@ -42,18 +44,18 @@ SERVER_NICKNAME="QNetd Cert"
 CLUSTER_NICKNAME="Cluster Cert"
 CA_SUBJECT="CN=QNet CA"
 SERVER_SUBJECT="CN=Qnetd Server"
-PWD_FILE="$DB_DIR/pwdfile.txt"
-NOISE_FILE="$DB_DIR/noise.txt"
-SERIAL_NO_FILE="$DB_DIR/serial.txt"
-CA_EXPORT_FILE="$DB_DIR/qnetd-cacert.crt"
-CRQ_FILE="$DB_DIR/qnetd-node.crq"
-CRT_FILE="" # Generated from cluster name
-P12_FILE="$DB_DIR/qnetd-node.p12"
+PWD_FILE_BASE="pwdfile.txt"
+NOISE_FILE_BASE="noise.txt"
+SERIAL_NO_FILE_BASE="serial.txt"
+CA_EXPORT_FILE="$DB_DIR_QNETD/qnetd-cacert.crt"
+CRQ_FILE_BASE="qnetd-node.crq"
+CRT_FILE_BASE="" # Generated from cluster name
+P12_FILE_BASE="qnetd-node.p12"
 
 usage() {
-    echo "$0: [-I|-i|-m|-M|-r|-s] [-c certificate] [-n cluster_name]"
+    echo "$0: [-I|-i|-m|-M|-r|-s|-Q] [-c certificate] [-n cluster_name]"
     echo
-    echo " -I      Initialize server CA and generate server certificate"
+    echo " -I      Initialize QNetd CA and generate server certificate"
     echo " -i      Initialize node CA. Needs CA certificate from server"
     echo ""
     echo " -m      Import cluster certificate on node (needs pk12 certificate)"
@@ -61,6 +63,7 @@ usage() {
     echo " -r      Generate cluster certificate request"
     echo " -s      Sign cluster certificate on qnetd server (needs cluster certificate)"
     echo " -M      Import signed cluster certificate and export certificate with key to pk12 file"
+    echo " -Q      Quick start. Uses ssh/scp to initialze both qnetd and nodes."
     echo ""
     echo " -c certificate      Ether CA, CRQ, CRT or pk12 certificate (operation dependant)"
     echo " -n cluster_name     Name of cluster (for -r and -s operations)"
@@ -69,15 +72,18 @@ usage() {
     echo "- Initialize database on QNetd server by running $0 -I"
     echo "- Copy exported QNetd CA certificate ($CA_EXPORT_FILE) to every node"
     echo "- On one of cluster node initialize database by running $0 -i -c `basename $CA_EXPORT_FILE`"
-    echo "- Generate certificate request: $0 -r -n Cluster"
+    echo "- Generate certificate request: $0 -r -n Cluster (Cluster name must match cluster_name key in the corosync.conf)"
     echo "- Copy exported CRQ to QNetd server"
-    echo "- On QNetd server sign and export cluster certificate by running $0 -s -c `basename $CRQ_FILE` -n Cluster"
+    echo "- On QNetd server sign and export cluster certificate by running $0 -s -c `basename $CRQ_FILE_BASE` -n Cluster"
     echo "- Copy exported CRT to node where certificate request was created"
-    echo "- Import certificate on node where certificate request was created by running $0 -M -c qnetd-cluster-Cluster.crt"
-    echo "- Copy output $P12_FILE to all other cluster nodes"
+    echo "- Import certificate on node where certificate request was created by running $0 -M -c cluster-Cluster.crt"
+    echo "- Copy output $P12_FILE_BASE to all other cluster nodes"
     echo "- On all other nodes in cluster:"
     echo "  - Init database by running $0 -i -c `basename $CA_EXPORT_FILE`"
-    echo "  - Import cluster certificate and key: $0 -m -c `basename $P12_FILE`"
+    echo "  - Import cluster certificate and key: $0 -m -c `basename $P12_FILE_BASE`"
+    echo ""
+    echo "It is also possible to use Quick start (-Q). This needs properly configured ssh."
+    echo "  $0 -Q -n Cluster qnetd_server node1 node2 ... nodeN"
 
     exit 0
 }
@@ -109,7 +115,7 @@ get_serial_no() {
     echo "$serial_no"
 }
 
-init_server_ca() {
+init_qnetd_ca() {
     if [ -f "$DB_DIR/cert8.db" ];then
         echo "Certificate database already exists. Delete it to continue" >&2
 
@@ -118,7 +124,7 @@ init_server_ca() {
 
     if ! [ -d "$DB_DIR" ];then
         echo "Creating $DB_DIR"
-        mkdir "$DB_DIR"
+        mkdir -p "$DB_DIR"
         chown root:root "$DB_DIR"
         chmod 700 "$DB_DIR"
     fi
@@ -143,7 +149,7 @@ init_server_ca() {
     certutil -S -n "$SERVER_NICKNAME" -s "$SERVER_SUBJECT" -c "$CA_NICKNAME" -t "u,u,u" -m `get_serial_no` \
         -v $CRT_VALIDITY -d "$DB_DIR" -z "$NOISE_FILE" -f "$PWD_FILE"
 
-    echo "QNetd CA is exported as $CA_EXPORT_FILE"
+    echo "QNetd CA certificate is exported as $CA_EXPORT_FILE"
 }
 
 init_node_ca() {
@@ -155,7 +161,7 @@ init_node_ca() {
 
     if ! [ -d "$DB_DIR" ];then
         echo "Creating $DB_DIR"
-        mkdir "$DB_DIR"
+        mkdir -p "$DB_DIR"
         chown root:root "$DB_DIR"
         chmod 700 "$DB_DIR"
     fi
@@ -227,17 +233,71 @@ import_pk12() {
     pk12util -i "$CERTIFICATE_FILE" -d "$DB_DIR" -W ""
 }
 
+#    echo "- On QNetd server sign and export cluster certificate by running $0 -s -c `basename $CRQ_FILE_BASE` -n Cluster"
+#    echo "- Copy exported CRT to node where certificate request was created"
+#    echo "- Import certificate on node where certificate request was created by running $0 -M -c cluster-Cluster.crt"
+#    echo "- Copy output $P12_FILE_BASE to all other cluster nodes"
+#    echo "- On all other nodes in cluster:"
+#    echo "  - Init database by running $0 -i -c `basename $CA_EXPORT_FILE`"
+#    echo "  - Import cluster certificate and key: $0 -m -c `basename $P12_FILE_BASE`"
+
+quick_start() {
+    qnetd_addr="$1"
+    master_node="$2"
+    other_nodes="$3"
+
+set -x
+    # Sanity check
+    for i in "$qnetd_addr" "$master_node" $other_nodes;do
+        if ssh root@$i "[ -d \"$DB_DIR_QNETD\" ] || [ -d \"$DB_DIR_NODE\" ]";then
+            echo "Node $i seems to be already initialized. Please delete $DB_DIR_QNETD and $DB_DIR_NODE" >&2
+
+            exit 1
+        fi
+
+        if ! ssh "root@$i" "$0" > /dev/null;then
+            echo "Node $i doesn't have $0 installed" >&2
+
+            exit 1
+        fi
+    done
+
+    # Initialize qnetd server
+    ssh "root@$qnetd_addr" "$0 -I"
+
+    # Copy CA cert to all nodes and initialize them
+    for node in "$master_node" $other_nodes;do
+        scp "root@$qnetd_addr:$CA_EXPORT_FILE" "$node:/tmp"
+        ssh "root@$node" "$0 -i -c \"/tmp/`basename $CA_EXPORT_FILE`\" && rm /tmp/`basename $CA_EXPORT_FILE`"
+    done
+
+    # Generate cert request
+    ssh "root@$master_node" "$0 -r -n \"$CLUSTER_NAME\""
+
+    # Copy exported cert request to qnetd server
+    scp "root@$master_node:$DB_DIR_NODE/$CRQ_FILE_BASE" "root@$qnetd_addr:/tmp"
+
+    # Sign and export cluster certificate
+    ssh "root@$qnetd_addr" "$0 -s -c \"/tmp/$CRQ_FILE_BASE\" -n \"$CLUSTER_NAME\""
+
+    # Copy exported CRT to master node
+    scp "root@$qnetd_addr:$DB_DIR_QNETD/cluster-$CLUSTER_NAME.crt" "root@master_node:$DB_DIR_NODE"
+
+    # Import certificate
+    ssh "root@$master_node" "$0 -M -c \"$DB_DIR_NODE/cluster-$CLUSTER_NAME.crt\""
+}
+
 OPERATION=""
 CERTIFICATE_FILE=""
 CLUSTER_NAME=""
 
-while getopts ":hIiMmrsc:n:" opt; do
+while getopts ":hIiMmQrsc:n:" opt; do
     case $opt in
         r)
             OPERATION=gen_cluster_cert_req
             ;;
         I)
-            OPERATION=init_server_ca
+            OPERATION=init_qnetd_ca
             ;;
         i)
             OPERATION=init_node_ca
@@ -251,6 +311,9 @@ while getopts ":hIiMmrsc:n:" opt; do
         M)
             OPERATION=import_signed_cert
             ;;
+        Q)
+            OPERATION=quick_start
+            ;;
         n)
             CLUSTER_NAME="$OPTARG"
             ;;
@@ -274,8 +337,42 @@ while getopts ":hIiMmrsc:n:" opt; do
 done
 
 case "$OPERATION" in
-    "init_server_ca")
-        init_server_ca
+    "init_qnetd_ca")
+        DB_DIR="$DB_DIR_QNETD"
+    ;;
+    "init_node_ca")
+        DB_DIR="$DB_DIR_NODE"
+    ;;
+    "gen_cluster_cert_req")
+        DB_DIR="$DB_DIR_NODE"
+    ;;
+    "sign_cluster_cert")
+        DB_DIR="$DB_DIR_QNETD"
+    ;;
+    "import_signed_cert")
+        DB_DIR="$DB_DIR_NODE"
+    ;;
+    "import_pk12")
+        DB_DIR="$DB_DIR_NODE"
+    ;;
+    "quick_start")
+	DB_DIR=""
+    ;;
+    *)
+        usage
+    ;;
+esac
+
+PWD_FILE="$DB_DIR/$PWD_FILE_BASE"
+NOISE_FILE="$DB_DIR/$NOISE_FILE_BASE"
+SERIAL_NO_FILE="$DB_DIR/$SERIAL_NO_FILE_BASE"
+CRQ_FILE="$DB_DIR/$CRQ_FILE_BASE"
+CRT_FILE="$DB_DIR/cluster-$CLUSTER_NAME.crt"
+P12_FILE="$DB_DIR/$P12_FILE_BASE"
+
+case "$OPERATION" in
+    "init_qnetd_ca")
+        init_qnetd_ca
     ;;
     "init_node_ca")
         if ! [ -e "$CERTIFICATE_FILE" ];then
@@ -308,7 +405,6 @@ case "$OPERATION" in
             exit 2
         fi
 
-        CRT_FILE="$DB_DIR/qnetd-cluster-$CLUSTER_NAME.crt"
         sign_cluster_cert
     ;;
     "import_signed_cert")
@@ -329,6 +425,37 @@ case "$OPERATION" in
 
         import_pk12
     ;;
+    "quick_start")
+        shift $((OPTIND-1))
+
+        qnetd_addr="$1"
+
+        shift 1
+
+        master_node="$1"
+        shift 1
+        other_nodes="$@"
+
+        if [ "$CLUSTER_NAME" == "" ];then
+            echo "You have to specify cluster name" >&2
+
+            exit 2
+        fi
+
+	if [ "$qnetd_addr" == "" ];then
+            echo "No QNetd server address provided." >&2
+
+            exit 2
+        fi
+
+	if [ "$master_node" == "" ];then
+            echo "No nodes provided." >&2
+
+            exit 2
+        fi
+
+        quick_start "$qnetd_addr" "$master_node" "$other_nodes"
+    ;;
     *)
         usage
     ;;

qdevices/corosync-qnetd.c

@@ -71,7 +71,7 @@
 #define QNETD_MAX_CLIENT_SEND_SIZE	(1 << 15)
 #define QNETD_MAX_CLIENT_RECEIVE_SIZE	(1 << 15)
 
-#define NSS_DB_DIR      COROSYSCONFDIR "/qnetd/nssdb"
+#define NSS_DB_DIR      COROSYSCONFDIR "/qdevice/net/qnetd/nssdb"
 #define QNETD_CERT_NICKNAME	"QNetd Cert"
 
 #define QNETD_TLS_SUPPORTED			TLV_TLS_SUPPORTED