service.py 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125
  1. # This file is part of acme-updater, written by Helmut Pozimski 2016-2017.
  2. #
  3. # stov is free software: you can redistribute it and/or modify
  4. # it under the terms of the GNU General Public License as published by
  5. # the Free Software Foundation, version 2 of the License.
  6. #
  7. # stov is distributed in the hope that it will be useful,
  8. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. # GNU General Public License for more details.
  11. #
  12. # You should have received a copy of the GNU General Public License
  13. # along with stov. If not, see <http://www.gnu.org/licenses/>.
  14. # -*- coding: utf8 -*-
  15. """ Contains the service module which manages certificates for generic
  16. services that don't need any special configuration. The configuration
  17. needs to at least contain the keys "certificate_path", "key_path",
  18. "tlsa"and "tlsa_ports".
  19. """
  20. import logging
  21. import os
  22. import subprocess
  23. import shutil
  24. from amulib import helpers
  25. import OpenSSL
  26. LOGGER = logging.getLogger("acme-updater")
  27. def run(service_name, config, acme_dir="/var/lib/acme",
  28. named_key_path="/run/named/session.key"):
  29. """
  30. :param service_name: name of the service
  31. :type service_name: str
  32. :param config: configuration for the service
  33. :type config: dict
  34. :param acme_dir: path to the acme state dir
  35. :type acme_dir: str
  36. :param named_key_path: path to the named session.key
  37. :type named_key_path: str
  38. """
  39. certificate_path = config["certificate_path"]
  40. key_path = config["key_path"]
  41. tlsa = config["tlsa"]
  42. tlsa_ports = config["tlsa_ports"]
  43. renewal_successful = False
  44. try:
  45. with open(certificate_path, "r") as cert_file:
  46. cert_text = cert_file.read()
  47. except IOError:
  48. LOGGER.error("Error while opening the %s certificate", service_name)
  49. else:
  50. current_cert = OpenSSL.crypto.load_certificate(
  51. OpenSSL.crypto.FILETYPE_PEM, cert_text
  52. )
  53. cert_alt_names = helpers.get_subject_alt_name(current_cert)
  54. fqdn = cert_alt_names[0]
  55. acme_cert_path = os.path.join(acme_dir, "live", fqdn,
  56. "cert")
  57. acme_fullchain_path = os.path.join(acme_dir, "live", fqdn,
  58. "fullchain")
  59. if helpers.check_renewal(current_cert, acme_cert_path):
  60. try:
  61. with open(acme_cert_path, "r") as acme_cert_file:
  62. acme_cert_text = acme_cert_file.read()
  63. except IOError:
  64. LOGGER.error("Error while opening new %s "
  65. "certificate file", service_name)
  66. else:
  67. acme_cert = OpenSSL.crypto.load_certificate(
  68. OpenSSL.crypto.FILETYPE_PEM, acme_cert_text
  69. )
  70. if tlsa:
  71. for name in cert_alt_names:
  72. for port in tlsa_ports:
  73. helpers.create_tlsa_records(name, port, acme_cert,
  74. named_key_path)
  75. newkey_path = os.path.join(acme_dir, "live",
  76. fqdn, "privkey")
  77. if certificate_path == key_path:
  78. if helpers.create_backup_copy(certificate_path):
  79. try:
  80. with open(certificate_path, "wb") as target:
  81. with open(acme_fullchain_path, "rb") as chain:
  82. with open(newkey_path, "rb") as newkey:
  83. shutil.copyfileobj(newkey,
  84. target)
  85. shutil.copyfileobj(chain, target)
  86. except IOError:
  87. LOGGER.error("Renewal of cert for %s failed, "
  88. "please clean up manually and "
  89. "check the backup files!",
  90. service_name)
  91. else:
  92. renewal_successful = True
  93. else:
  94. LOGGER.error("Renewal of cert for %s failed, "
  95. "please clean up manually and "
  96. "check the backup files!", service_name)
  97. else:
  98. if helpers.copy_file(acme_fullchain_path,
  99. certificate_path):
  100. if helpers.copy_file(newkey_path, key_path):
  101. renewal_successful = True
  102. else:
  103. LOGGER.error("Renewal of cert for %s failed, "
  104. "please clean up manually and "
  105. "check the backup files!",
  106. service_name)
  107. else:
  108. LOGGER.error("Renewal of cert for %s failed, "
  109. "please clean up manually and "
  110. "check the backup files!", service_name)
  111. if renewal_successful:
  112. LOGGER.info("Certificate for %s successfully "
  113. "renewed, restarting service.",
  114. service_name)
  115. subprocess.call(["/etc/init.d/%s" % service_name,
  116. "restart"])