Commit f4427cf4 authored by Julien Muchembled's avatar Julien Muchembled

Fix issues with DH parameters

- registry: make --dh mandatory
- node: retry if the registry returns nothing (instead of writing an empty file)
parent cc3b7794
import json, logging, os, sqlite3, socket, subprocess, time, zlib
import json, logging, os, sqlite3, socket, subprocess, sys, time, zlib
from .registry import RegistryClient
from . import utils, version, x509
......@@ -129,16 +129,23 @@ class Cache(object):
" you should update.")
def getDh(self, path):
# We'd like to do a full check here but
# from OpenSSL import SSL
# SSL.Context(SSL.TLSv1_METHOD).load_tmp_dh(path)
# segfaults if file is corrupted.
if not os.path.exists(path):
retry = 1
while True:
try:
dh = self._registry.getDh(self._prefix)
if dh:
break
except socket.error, e:
e = None
except socket.error:
e = sys.exc_info()
logging.warning(
"Failed to get DH parameters from the registry."
" Will retry in %s seconds", retry, exc_info=1)
" Will retry in %s seconds", retry, exc_info=e)
time.sleep(retry)
retry = min(60, retry * 2)
with open(path, "wb") as f:
......
......@@ -71,7 +71,7 @@ def main():
_('--db', default='/var/lib/re6stnet/registry.db',
help="Path to SQLite database file. It is automatically initialized"
" if the file does not exist.")
_('--dh',
_('--dh', required=True,
help="File containing Diffie-Hellman parameters in .pem format."
" To generate them, you can use something like:\n"
"openssl dhparam -out dh2048.pem 2048")
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment