gce-xfstests: automatically renew certificates close to expiring

Factor out the certificate handling functionality to a new script,
gce-setup-cert.  This centralizes the creation of new x.509
certificates, as well as renewing certificates as they approach their
renewal date.  Before launching a new test VM, ltm server, or kcs
server, if the certificates are nearing their expiration date, update
the certificate automatically.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>

6 files changed, 101 insertions, 28 deletions

diff --git a/run-fstests/gce-xfstests b/run-fstests/gce-xfstests
index b85d39fb..187b3bab 100755
--- a/run-fstests/gce-xfstests
+++ b/run-fstests/gce-xfstests
@@ -1208,6 +1208,15 @@ elif test -n "$RUN_ON_KCS"; then
     exit 0
 fi
 
+cert_file="$DIR/.gce_xfstests_cert_$GCE_PROJECT.pem"
+expire_seconds=$((60 * 60 * 24 * 7))
+if test -f "$cert_file"
+   ! openssl x509 -enddate -noout -in "$cert_file" \
+     -checkend $expire_seconds >& /dev/null
+then
+    "$DIR/util/gce-setup-cert"
+fi
+
 function launch_vm () {
     echo "Launching $INSTANCE using $GCE_MACHTYPE..."
 
@@ -1229,6 +1238,7 @@ fi
 	       "$IMAGE_FLAG" "$ROOT_FS"
     err=$?
 }
+
 ERRFILE=/tmp/gce-xfstests-err-$$
 RETRY_COUNTER=0
 while true
diff --git a/run-fstests/util/gce-do-setup b/run-fstests/util/gce-do-setup
index 077b7d99..076ca21e 100755
--- a/run-fstests/util/gce-do-setup
+++ b/run-fstests/util/gce-do-setup
@@ -281,10 +281,10 @@ unset rule rule_name
 if [ "$1" == "--regenerate-ssl-cert" ]
 then
   echo "Regenerating certificate."
-  REGEN_CERT="yes"
+  REGEN_OPTS="--force-regen"
 fi
 
-gce_gen_cert
+$DIR/util/gce-setup-cert $REGEN_OPTS
 gce_gen_ltm_pass
 
 exit 0
diff --git a/run-fstests/util/gce-launch-kcs b/run-fstests/util/gce-launch-kcs
index ec16e4e7..19c9faca 100755
--- a/run-fstests/util/gce-launch-kcs
+++ b/run-fstests/util/gce-launch-kcs
@@ -144,14 +144,6 @@ then
     ARG="$ARG enable-oslogin-2fa=GCE_OSLOGIN_2FA"
 fi
 
-if ! gsutil -q stat gs://$GS_BUCKET/gce-xfstests-cert.pem
-then
-    echo "You do not have a generated SSL certificate in your GCS bucket."
-    echo "It is not possible to communicate with the build server."
-    echo "Please run gce-xfstests setup and then restart the build server."
-    exit 1
-fi
-
 if ! gsutil -q stat gs://$GS_BUCKET/gce_xfstests.config
 then
     echo "You must run gce-xfstests setup to upload a .config file"
@@ -159,6 +151,8 @@ then
     exit 1
 fi
 
+"$DIR/util/gce-setup-cert"
+
 echo "Launching build server..."
 touch $DIR/.kcs_instance_$GCE_PROJECT
 LAUNCH_KCS_EXIT_STATUS=1
@@ -182,11 +176,6 @@ then
     exit 1
 fi
 
-if [ ! -f $DIR/.gce_xfstests_cert_$GCE_PROJECT.pem ]
-then
-    gsutil cat gs://$GS_BUCKET/gce-xfstests-cert.pem > $DIR/.gce_xfstests_cert_$GCE_PROJECT.pem
-fi
-
 echo "GCE_KCS_SERVER_CERT=$DIR/.gce_xfstests_cert_$GCE_PROJECT.pem" > $DIR/.kcs_instance_$GCE_PROJECT
 echo "GCE_KCS_NAME=$INSTANCE" >> $DIR/.kcs_instance_$GCE_PROJECT
 echo -n "GCE_KCS_EXT_IP=" >> $DIR/.kcs_instance_$GCE_PROJECT
diff --git a/run-fstests/util/gce-launch-ltm b/run-fstests/util/gce-launch-ltm
index b4c39400..b6b0aa3a 100755
--- a/run-fstests/util/gce-launch-ltm
+++ b/run-fstests/util/gce-launch-ltm
@@ -135,14 +135,6 @@ then
     ARG="$ARG enable-oslogin-2fa=GCE_OSLOGIN_2FA"
 fi
 
-if ! gsutil -q stat gs://$GS_BUCKET/gce-xfstests-cert.pem
-then
-    echo "You do not have a generated SSL certificate in your GCS bucket."
-    echo "It is not possible to communicate with the LTM."
-    echo "Please run gce-xfstests setup and then restart the LTM."
-    exit 1
-fi
-
 if ! gsutil -q stat gs://$GS_BUCKET/gce_xfstests.config
 then
     echo "You must run gce-xfstests setup to upload a .config file"
@@ -150,6 +142,8 @@ then
     exit 1
 fi
 
+"$DIR/util/gce-setup-cert"
+
 echo "Launching LTM server..."
 touch $DIR/.ltm_instance_$GCE_PROJECT
 LAUNCH_LTM_EXIT_STATUS=1
@@ -172,11 +166,6 @@ then
     exit 1
 fi
 
-if [ ! -f $DIR/.gce_xfstests_cert_$GCE_PROJECT.pem ]
-then
-    gsutil cat gs://$GS_BUCKET/gce-xfstests-cert.pem > $DIR/.gce_xfstests_cert_$GCE_PROJECT.pem
-fi
-
 echo "GCE_LTM_SERVER_CERT=$DIR/.gce_xfstests_cert_$GCE_PROJECT.pem" > $DIR/.ltm_instance_$GCE_PROJECT
 echo "GCE_LTM_NAME=$INSTANCE" >> $DIR/.ltm_instance_$GCE_PROJECT
 echo -n "GCE_LTM_EXT_IP=" >> $DIR/.ltm_instance_$GCE_PROJECT
diff --git a/run-fstests/util/gce-setup-cert b/run-fstests/util/gce-setup-cert
new file mode 100755
index 00000000..fe72f28d
--- /dev/null
+++ b/run-fstests/util/gce-setup-cert
@@ -0,0 +1,84 @@
+#!/bin/bash -e
+
+XFSTESTS_FLAVOR=gce
+if test -n "$GCE_XFSTESTS_DIR"
+then
+    DIR="$GCE_XFSTESTS_DIR"
+else
+    DIR="$(dirname "$(dirname "$0")")"
+fi
+if test ! -f "$DIR/util/get-config"
+then
+    echo "$(basename "$0"): couldn't find $DIR/util/get-config"
+    exit 1
+fi
+
+FORCE_REGEN=
+FORCE_RENEW=
+UPDATE_COMBINED=
+EXPIRE_DAYS=365
+CHECKENDSECS=$((60 * 60 * 24 * 120))
+
+. "$DIR/util/get-config"
+
+while [ "$1" != "" ];
+do
+    case $1 in
+	--force-regen|--force-regenerate-certificates)
+	    FORCE_REGEN=yes
+	    ;;
+	--force-renew)
+	    FORCE_RENEW=yes
+	    ;;
+	--expire-days) shift
+	    EXPIRE_DAYS="$1"
+	    ;;
+	*)
+	    echo "unknown option: $1"
+	    exit 1
+	    ;;
+    esac
+    shift
+done
+
+tmpdir=$(mktemp -d)
+if test -n "$FORCE_REGEN" ||
+	! gsutil cp gs://$GS_BUCKET/gce-xfstests-cert.pem $tmpdir/ 2>/dev/null ||
+	! gsutil cp gs://$GS_BUCKET/gce-xfstests-key.pem $tmpdir/ 2>/dev/null
+then
+    echo "Regenerating GCE certificate files"
+
+    openssl req -x509 -newkey rsa:4096 -keyout "$tmpdir/gce-xfstests-key.pem" \
+	    -noenc -out "$tmpdir/gce-xfstests-cert.pem" -days $EXPIRE_DAYS \
+	    -subj "/CN=*.$GCE_PROJECT.gce-xfstests"
+
+    UPDATE_COMBINED=yes
+else
+    if test -n "$FORCE_REGEN" ||
+	    ! openssl x509 -enddate -noout -in $tmpdir/gce-xfstests-cert.pem \
+	      -checkend $CHECKENDSECS >& /dev/null
+    then
+	echo "Certificates will expire soon, renewing"
+	openssl x509 -days 365 -in $tmpdir/gce-xfstests-cert.pem \
+		-signkey $tmpdir/gce-xfstests-key.pem \
+		-out $tmpdir/gce-xfstests-cert.pem.new
+	mv $tmpdir/gce-xfstests-cert.pem.new $tmpdir/gce-xfstests-cert.pem
+	UPDATE_COMBINED=yes
+    fi
+fi
+    
+if test -n "$UPDATE_COMBINED" ||
+	! gsutil -q stat gs://$GS_BUCKET/gce-xfstests-server.pem
+then
+    cat "$tmpdir/gce-xfstests-key.pem" "$tmpdir/gce-xfstests-cert.pem" \
+	> "$tmpdir/gce-xfstests-server.pem"
+
+    gsutil -m cp "$tmpdir/*" gs://$GS_BUCKET/
+fi
+if test -n "$UPDATE_COMBINED" -o \
+	 ! -f $DIR/.gce_xfstests_cert_$GCE_PROJECT.pem
+then
+    cp "$tmpdir/gce-xfstests-cert.pem" $DIR/.gce_xfstests_cert_$GCE_PROJECT.pem
+fi
+rm -rf "$tmpdir"
+
diff --git a/test-appliance/gce-create-image b/test-appliance/gce-create-image
index fe457708..f70a22ff 100755
--- a/test-appliance/gce-create-image
+++ b/test-appliance/gce-create-image
@@ -233,6 +233,7 @@ cp ../run-fstests/util/gce-kcs-funcs	$kvm_xfs_dir/util/
 cp ../run-fstests/util/gce-launch-kcs	$kvm_xfs_dir/util/
 cp ../run-fstests/util/gce-launch-ltm	$kvm_xfs_dir/util/
 cp ../run-fstests/util/gce-ltm-funcs	$kvm_xfs_dir/util/
+cp ../run-fstests/util/gce-setup-cert	$kvm_xfs_dir/util/
 cp ../run-fstests/util/get-config		$kvm_xfs_dir/util/
 cp ../run-fstests/util/parse_cli		$kvm_xfs_dir/util/
 cp ../run-fstests/util/parse_opt_funcs	$kvm_xfs_dir/util/