Commit f4427cf4 authored by Julien Muchembled's avatar Julien Muchembled

Fix issues with DH parameters

- registry: make --dh mandatory
- node: retry if the registry returns nothing (instead of writing an empty file)
parent cc3b7794
import json, logging, os, sqlite3, socket, subprocess, time, zlib import json, logging, os, sqlite3, socket, subprocess, sys, time, zlib
from .registry import RegistryClient from .registry import RegistryClient
from . import utils, version, x509 from . import utils, version, x509
...@@ -129,16 +129,23 @@ class Cache(object): ...@@ -129,16 +129,23 @@ class Cache(object):
" you should update.") " you should update.")
def getDh(self, path): def getDh(self, path):
# We'd like to do a full check here but
# from OpenSSL import SSL
# SSL.Context(SSL.TLSv1_METHOD).load_tmp_dh(path)
# segfaults if file is corrupted.
if not os.path.exists(path): if not os.path.exists(path):
retry = 1 retry = 1
while True: while True:
try: try:
dh = self._registry.getDh(self._prefix) dh = self._registry.getDh(self._prefix)
if dh:
break break
except socket.error, e: e = None
except socket.error:
e = sys.exc_info()
logging.warning( logging.warning(
"Failed to get DH parameters from the registry." "Failed to get DH parameters from the registry."
" Will retry in %s seconds", retry, exc_info=1) " Will retry in %s seconds", retry, exc_info=e)
time.sleep(retry) time.sleep(retry)
retry = min(60, retry * 2) retry = min(60, retry * 2)
with open(path, "wb") as f: with open(path, "wb") as f:
......
...@@ -71,7 +71,7 @@ def main(): ...@@ -71,7 +71,7 @@ def main():
_('--db', default='/var/lib/re6stnet/registry.db', _('--db', default='/var/lib/re6stnet/registry.db',
help="Path to SQLite database file. It is automatically initialized" help="Path to SQLite database file. It is automatically initialized"
" if the file does not exist.") " if the file does not exist.")
_('--dh', _('--dh', required=True,
help="File containing Diffie-Hellman parameters in .pem format." help="File containing Diffie-Hellman parameters in .pem format."
" To generate them, you can use something like:\n" " To generate them, you can use something like:\n"
"openssl dhparam -out dh2048.pem 2048") "openssl dhparam -out dh2048.pem 2048")
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment