MSVSphere Packaging Team
1 year ago
parent
a884ee1285
commit
a32aee017a
@ -0,0 +1,48 @@
|
||||
diff --git a/keylime/registrar_common.py b/keylime/registrar_common.py
|
||||
index fb37e5b..6b550d0 100644
|
||||
--- a/keylime/registrar_common.py
|
||||
+++ b/keylime/registrar_common.py
|
||||
@@ -2,7 +2,9 @@ import base64
|
||||
import http.server
|
||||
import ipaddress
|
||||
import os
|
||||
+import select
|
||||
import signal
|
||||
+import ssl
|
||||
import sys
|
||||
import threading
|
||||
from http.server import BaseHTTPRequestHandler, HTTPServer
|
||||
@@ -30,6 +32,24 @@ except SQLAlchemyError as err:
|
||||
|
||||
|
||||
class ProtectedHandler(BaseHTTPRequestHandler, SessionManager):
|
||||
+ def handle(self) -> None:
|
||||
+ """ Need to perform SSL handshake here, as do_handshake_on_connect=False for non-blocking SSL socket """
|
||||
+ while True:
|
||||
+ try:
|
||||
+ self.request.do_handshake()
|
||||
+ break
|
||||
+ except ssl.SSLWantReadError:
|
||||
+ select.select([self.request], [], [])
|
||||
+ except ssl.SSLWantWriteError:
|
||||
+ select.select([], [self.request], [])
|
||||
+ except ssl.SSLError as e:
|
||||
+ logger.error("SSL connection error: %s", e)
|
||||
+ return
|
||||
+ except Exception as e:
|
||||
+ logger.error("General communication failure: %s", e)
|
||||
+ return
|
||||
+ BaseHTTPRequestHandler.handle(self)
|
||||
+
|
||||
def do_HEAD(self):
|
||||
"""HEAD not supported"""
|
||||
web_util.echo_json_response(self, 405, "HEAD not supported")
|
||||
@@ -490,7 +510,7 @@ def start(host, tlsport, port):
|
||||
protected_server = RegistrarServer((host, tlsport), ProtectedHandler)
|
||||
context = web_util.init_mtls("registrar", logger=logger)
|
||||
if context is not None:
|
||||
- protected_server.socket = context.wrap_socket(protected_server.socket, server_side=True)
|
||||
+ protected_server.socket = context.wrap_socket(protected_server.socket, server_side=True, do_handshake_on_connect=False)
|
||||
thread_protected_server = threading.Thread(target=protected_server.serve_forever)
|
||||
|
||||
# Set up the unprotected registrar server
|
||||
@ -0,0 +1,20 @@
|
||||
--- a/keylime/registrar_common.py 2023-07-19 17:26:50.320894695 +0200
|
||||
+++ b/keylime/registrar_common.py 2023-07-19 17:27:16.797790852 +0200
|
||||
@@ -456,7 +456,16 @@
|
||||
logger.error("SQLAlchemy Error: %s", e)
|
||||
raise
|
||||
else:
|
||||
- raise Exception(f"Auth tag {auth_tag} does not match expected value {ex_mac}")
|
||||
+ if agent_id and session.query(RegistrarMain).filter_by(agent_id=agent_id).delete():
|
||||
+ try:
|
||||
+ session.commit()
|
||||
+ except SQLAlchemyError as e:
|
||||
+ logger.error("SQLAlchemy Error: %s", e)
|
||||
+ raise
|
||||
+
|
||||
+ raise Exception(
|
||||
+ f"Auth tag {auth_tag} for agent {agent_id} does not match expected value. The agent has been deleted from database, and a restart of it will be required"
|
||||
+ )
|
||||
|
||||
web_util.echo_json_response(self, 200, "Success")
|
||||
logger.info("PUT activated: %s", agent_id)
|
||||
Loading…
Reference in new issue