Page MenuHomeClusterLabs Projects
Files F1841514

No OneTemporary
Actions

View Options

diff --git a/tools/cibsecret.in b/tools/cibsecret.in
index 7996c232f5..3157d2ac31 100644
--- a/tools/cibsecret.in
+++ b/tools/cibsecret.in
@@ -1,365 +1,365 @@
#!/bin/sh
# Copyright (C) 2011 Dejan Muhamedagic <dmuhamedagic@suse.de>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# This software is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# cibsecret
#
# Manage the secrets directory (by default, /var/lib/pacemaker/lrm/secrets).
# Secrets are ASCII files, holding one value per file:
# <secrets-directory>/<rsc>/<param>
. @OCF_ROOT_DIR@/lib/heartbeat/ocf-shellfuncs
LRM_CIBSECRETS=@LRM_CIBSECRETS_DIR@
PROG=`basename $0`
SSH_OPTS="-o StrictHostKeyChecking=no"
usage() {
echo "cibsecret - A tool for managing cib secrets";
echo "";
echo "usage: $PROG [-C] <command> <parameters>";
echo "--version Display version information, then exit";
echo "";
echo "-C: don't read/write the CIB"
echo ""
echo "command: set | delete | stash | unstash | get | check | sync"
echo ""
echo " set <rsc> <param> <value>"
echo ""
echo " get <rsc> <param>"
echo ""
echo " check <rsc> <param>"
echo ""
echo " stash <rsc> <param> (if not -C)"
echo ""
echo " unstash <rsc> <param> (if not -C)"
echo ""
echo " delete <rsc> <param>"
echo ""
echo " sync"
echo ""
echo "stash/unstash: move the parameter from/to the CIB (if you already"
echo "have the parameter set in the CIB)."
echo ""
echo "set/delete: add/remove a parameter from the local file."
echo ""
echo "get: display the parameter from the local file."
echo ""
echo "check: verify MD5 hash of the parameter from the local file and the CIB."
echo ""
echo "sync: copy $LRM_CIBSECRETS to other nodes."
echo ""
echo "Examples:"
echo ""
echo " $PROG set ipmi_node1 passwd SecreT_PASS"
echo ""
echo " $PROG stash ipmi_node1 passwd"
echo ""
echo " $PROG get ipmi_node1 passwd"
echo ""
echo " $PROG check ipmi_node1 passwd"
echo ""
echo " $PROG sync"
exit $1
}
fatal() {
echo "ERROR: $*"
exit 1
}
warn() {
echo "WARNING: $*"
}
info() {
echo "INFO: $*"
}
check_env() {
which md5sum >/dev/null 2>&1 ||
fatal "please install md5sum to run $PROG"
if which pssh >/dev/null 2>&1; then
rsh=pssh_fun
rcp=pscp_fun
elif which pdsh >/dev/null 2>&1; then
rsh=pdsh_fun
rcp=pdcp_fun
elif which ssh >/dev/null 2>&1; then
rsh=ssh_fun
rcp=scp_fun
else
fatal "please install pssh, pdsh, or ssh to run $PROG"
fi
- ps -ef | grep '[c]rmd' >/dev/null ||
+ ps -ef | grep '[p]acemaker-controld' >/dev/null ||
fatal "pacemaker not running? $PROG needs pacemaker"
}
get_other_nodes() {
crm_node -l | awk '{print $2}' | grep -v `uname -n`
}
get_live_nodes() {
if [ `id -u` = 0 ] && which fping >/dev/null 2>&1; then
fping -a $@ 2>/dev/null
else
local h
for h; do ping -c 2 -q $h >/dev/null 2>&1 && echo $h; done
fi
}
check_down_nodes() {
local n down_nodes
down_nodes=`(for n; do echo $n; done) | sort | uniq -u`
if [ -n "$down_nodes" ]; then
if [ `echo $down_nodes | wc -w` = 1 ]; then
warn "node $down_nodes is down"
warn "you'll need to update it using $PROG sync later"
else
warn "nodes `echo $down_nodes` are down"
warn "you'll need to update them using $PROG sync later"
fi
fi
}
pssh_fun() {
pssh -qi -H "$nodes" -x "$SSH_OPTS" $*
}
pscp_fun() {
pscp -q -H "$nodes" -x "-pr" -x "$SSH_OPTS" $*
}
pdsh_fun() {
local pdsh_nodes=`echo $nodes | tr ' ' ','`
export PDSH_SSH_ARGS_APPEND="$SSH_OPTS"
pdsh -w $pdsh_nodes $*
}
pdcp_fun() {
local pdsh_nodes=`echo $nodes | tr ' ' ','`
export PDSH_SSH_ARGS_APPEND="$SSH_OPTS"
pdcp -pr -w $pdsh_nodes $*
}
ssh_fun() {
local h
for h in $nodes; do
ssh $SSH_OPTS $h $* || return
done
}
scp_fun() {
local h src="$1" dest=$2
for h in $nodes; do
scp -pr -q $SSH_OPTS $src $h:$dest || return
done
}
# TODO: this procedure should be replaced with csync2
# provided that csync2 has already been configured
sync_files() {
local crm_nodes=`get_other_nodes`
local nodes=`get_live_nodes $crm_nodes`
check_down_nodes $nodes $crm_nodes
[ "$nodes" = "" ] && {
info "no other nodes live"
return
}
info "syncing $LRM_CIBSECRETS to `echo $nodes` ..."
$rsh rm -rf $LRM_CIBSECRETS &&
$rsh mkdir -p `dirname $LRM_CIBSECRETS` &&
$rcp $LRM_CIBSECRETS `dirname $LRM_CIBSECRETS`
}
sync_one() {
local f=$1 f_all="$1 $1.sign"
local crm_nodes=`get_other_nodes`
local nodes=`get_live_nodes $crm_nodes`
check_down_nodes $nodes $crm_nodes
[ "$nodes" = "" ] && {
info "no other nodes live"
return
}
info "syncing $f to `echo $nodes` ..."
$rsh mkdir -p `dirname $f` &&
if [ -f "$f" ]; then
$rcp "$f_all" `dirname $f`
else
$rsh rm -f $f_all
fi
}
is_secret() {
# assume that the secret is in the CIB if we cannot talk to
# cib
[ "$NO_CRM" ] ||
test "$1" = "$MAGIC"
}
check_cib_rsc() {
local rsc=$1 output
output=`$NO_CRM crm_resource -r $rsc -W >/dev/null 2>&1` ||
fatal "resource $rsc doesn't exist: $output"
}
get_cib_param() {
local rsc=$1 param=$2
check_cib_rsc $rsc
$NO_CRM crm_resource -r $rsc -g $param 2>/dev/null
}
set_cib_param() {
local rsc=$1 param=$2 value=$3
check_cib_rsc $rsc
$NO_CRM crm_resource -r $rsc -p $param -v "$value" 2>/dev/null
}
remove_cib_param() {
local rsc=$1 param=$2
check_cib_rsc $rsc
$NO_CRM crm_resource -r $rsc -d $param 2>/dev/null
}
localfiles() {
local cmd=$1
local rsc=$2 param=$3 value=$4
local local_file=$LRM_CIBSECRETS/$rsc/$param
case $cmd in
"get")
cat $local_file 2>/dev/null
true
;;
"getsum")
cat $local_file.sign 2>/dev/null
true
;;
"set")
local md5sum
md5sum=`printf $value | md5sum` ||
fatal "md5sum failed to produce hash for resource $rsc parameter $param"
md5sum=`echo $md5sum | awk '{print $1}'`
mkdir -p `dirname $local_file` &&
echo $value > $local_file &&
echo $md5sum > $local_file.sign &&
sync_one $local_file
;;
"remove")
rm -f $local_file
rm -f $local_file.sign
sync_one $local_file
;;
*)
# not reached, this is local interface
;;
esac
}
get_local_param() {
local rsc=$1 param=$2
localfiles get $rsc $param
}
set_local_param() {
local rsc=$1 param=$2 value=$3
localfiles set $rsc $param $value
}
remove_local_param() {
local rsc=$1 param=$2
localfiles remove $rsc $param
}
cibsecret_set() {
local value=$1
if [ -z "$NO_CRM" ]; then
[ "$current" -a "$current" != "$MAGIC" -a "$current" != "$value" ] &&
fatal "CIB value <$current> different for $rsc parameter $param; please delete it first"
fi
set_local_param $rsc $param $value &&
set_cib_param $rsc $param "$MAGIC"
}
cibsecret_check() {
local md5sum local_md5sum
is_secret "$current" ||
fatal "resource $rsc parameter $param not set as secret, nothing to check"
local_md5sum=`localfiles getsum $rsc $param`
[ "$local_md5sum" ] ||
fatal "no MD5 hash for resource $rsc parameter $param"
md5sum=`printf "$current_local" | md5sum | awk '{print $1}'`
[ "$md5sum" = "$local_md5sum" ] ||
fatal "MD5 hash mismatch for resource $rsc parameter $param"
}
cibsecret_get() {
cibsecret_check
echo "$current_local"
}
cibsecret_delete() {
remove_local_param $rsc $param &&
remove_cib_param $rsc $param
}
cibsecret_stash() {
[ "$NO_CRM" ] &&
fatal "no access to Pacemaker, stash not supported"
[ "$current" = "" ] &&
fatal "nothing to stash for resource $rsc parameter $param"
is_secret "$current" &&
fatal "resource $rsc parameter $param already set as secret, nothing to stash"
cibsecret_set "$current"
}
cibsecret_unstash() {
[ "$NO_CRM" ] &&
fatal "no access to Pacemaker, unstash not supported"
[ "$current_local" = "" ] &&
fatal "nothing to unstash for resource $rsc parameter $param"
is_secret "$current" ||
warn "resource $rsc parameter $param not set as secret, but we have local value so proceeding anyway"
remove_local_param $rsc $param &&
set_cib_param $rsc $param $current_local
}
cibsecret_sync() {
sync_files
}
-check_env
-
MAGIC="lrm://"
umask 0077
if [ "$1" = "-C" ]; then
NO_CRM=':'
shift 1
fi
cmd=$1
rsc=$2
param=$3
value=$4
case "$cmd" in
set) [ $# -ne 4 ] && usage 1;;
get) [ $# -ne 3 ] && usage 1;;
check) [ $# -ne 3 ] && usage 1;;
stash) [ $# -ne 3 ] && usage 1;;
unstash) [ $# -ne 3 ] && usage 1;;
delete) [ $# -ne 3 ] && usage 1;;
sync) [ $# -ne 1 ] && usage 1;;
--help) usage 0;;
--version)
crm_attribute --version
exit $?;;
*) usage 1;
esac
+check_env
+
# we'll need these two often
current=`get_cib_param $rsc $param`
current_local=`get_local_param $rsc $param`
cibsecret_$cmd $value

File Metadata

Mime Type
text/x-diff
Expires
Sat, Nov 23, 4:31 AM (8 h, 49 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1018233
Default Alt Text
(9 KB)

Event Timeline