From 2ed6a7d6d93338dec9539cbb3ba4ad51f90aa303 Mon Sep 17 00:00:00 2001
From: Iustin Pop <iustin@google.com>
Date: Thu, 5 Feb 2009 14:09:06 +0000
Subject: [PATCH] rapi: fix SSL mode and use SSL by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This patch fixes the SSL mode (by actually constructing SSL parameters
from the command line options) and enables SSL by default; the old β-Sβ
option which enabled SSL is now changed to β--no-sslβ. The certificate
and key are by default pointing to the Ganeti auto-generated certificate
for rapi.
Reviewed-by: imsnah
---
daemons/ganeti-rapi | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/daemons/ganeti-rapi b/daemons/ganeti-rapi
index 2180a6139..57a184233 100755
--- a/daemons/ganeti-rapi
+++ b/daemons/ganeti-rapi
@@ -169,15 +169,15 @@ def ParseOptions():
help="Port to run API (%s default)." %
constants.RAPI_PORT,
default=constants.RAPI_PORT, type="int")
- parser.add_option("-S", "--https", dest="ssl",
- help="Secure HTTP protocol with SSL",
- default=False, action="store_true")
+ parser.add_option("--no-ssl", dest="ssl",
+ help="Do not secure HTTP protocol with SSL",
+ default=True, action="store_false")
parser.add_option("-K", "--ssl-key", dest="ssl_key",
help="SSL key",
- default=None, type="string")
+ default=constants.RAPI_CERT_FILE, type="string")
parser.add_option("-C", "--ssl-cert", dest="ssl_cert",
help="SSL certificate",
- default=None, type="string")
+ default=constants.RAPI_CERT_FILE, type="string")
parser.add_option("-f", "--foreground", dest="fork",
help="Don't detach from the current terminal",
default=True, action="store_false")
@@ -205,6 +205,13 @@ def main():
if options.fork:
utils.CloseFDs()
+ if options.ssl:
+ # Read SSL certificate
+ ssl_params = http.HttpSslParams(ssl_key_path=options.ssl_key,
+ ssl_cert_path=options.ssl_cert)
+ else:
+ ssl_params = None
+
ssconf.CheckMaster(options.debug)
if options.fork:
@@ -216,7 +223,8 @@ def main():
utils.WritePidFile(constants.RAPI_PID)
try:
mainloop = daemon.Mainloop()
- server = RemoteApiHttpServer(mainloop, "", options.port)
+ server = RemoteApiHttpServer(mainloop, "", options.port,
+ ssl_params=ssl_params, ssl_verify_peer=False)
server.Start()
try:
mainloop.Run()
--
GitLab