Add improved handling for TLS certificates for static builds. (#17605)
* Add improved handling for TLS certificates for static builds. * Properly replace symlinks. * Fix shellcheck warning. * Fix option handling. - Persist certificate handling mode and check URL across reinstalls. - Properly consume the arguments for the certificate handling options. * Add five minute hard timeout on certificate check. * Differentiate specific error results from curl. * Persist cert handling options regardless of how they’re passed in. * Escape slashes in REINSTALL_OPTIONS. * Fix escaping of reinstall options.
Austin S. Hemmelgarn committed
Jun 12, 2024 at 07:05 UTC
405a1635a57b4337d3006bf65708d9da1ea8cc8c
2 files changed
+88
-12
packaging/installer/kickstart.sh
+7
-1
@@ -1816,9 +1816,15 @@ try_static_install() {
1816
opts="${opts} --accept"
1817
fi
1818
1819
+ env_cmd="env NETDATA_CERT_TEST_URL=${NETDATA_CLAIM_URL} NETDATA_CERT_MODE=check"
1820
+
1821
+ if [ -n "${NETDATA_OFFLINE_INSTALL_SOURCE}" ]; then
1822
+ env_cmd="env NETDATA_CERT_TEST_URL=${NETDATA_CLAIM_URL} NETDATA_CERT_MODE=auto"
1823
+ fi
1824
+
1825
progress "Installing netdata"
1826
# shellcheck disable=SC2086
1821
- if ! run_as_root sh "${tmpdir}/${netdata_agent}" ${opts} -- ${NETDATA_INSTALLER_OPTIONS}; then
1827
+ if ! run_as_root ${env_cmd} /bin/sh "${tmpdir}/${netdata_agent}" ${opts} -- ${NETDATA_INSTALLER_OPTIONS}; then
1828
warning "Failed to install static build of Netdata on ${SYSARCH}."
1829
run rm -rf /opt/netdata
1830
return 2
packaging/makeself/install-or-update.sh
+81
-11
@@ -27,6 +27,8 @@ fi
27
28
STARTIT=1
29
REINSTALL_OPTIONS=""
30
+NETDATA_CERT_MODE="${NETDATA_CERT_MODE:-auto}"
31
+NETDATA_CERT_TEST_URL="${NETDATA_CERT_TEST_URL:-https://app.netdata.cloud}"
32
RELEASE_CHANNEL="nightly"
33
34
while [ "${1}" ]; do
@@ -48,6 +50,19 @@ while [ "${1}" ]; do
50
NETDATA_DISABLE_TELEMETRY=1
51
REINSTALL_OPTIONS="${REINSTALL_OPTIONS} ${1}"
52
;;
53
+ "--certificates")
54
+ case "${2}" in
55
+ auto|system) NETDATA_CERT_MODE="auto" ;;
56
+ check) NETDATA_CERT_MODE="check" ;;
57
+ bundled) NETDATA_CERT_MODE="bundled" ;;
58
+ *) run_failed "Unknown certificate handling mode '${2}'. Supported modes are auto, check, system, and bundled."; exit 1 ;;
59
+ esac
60
+ shift 1
61
+ ;;
62
+ "--certificate-test-url")
63
+ NETDATA_CERT_TEST_URL="${2}"
64
+ shift 1
65
+ ;;
66
67
*) echo >&2 "Unknown option '${1}'. Ignoring it." ;;
68
esac
@@ -62,6 +77,14 @@ if [ ! "${DISABLE_TELEMETRY:-0}" -eq 0 ] ||
77
REINSTALL_OPTIONS="${REINSTALL_OPTIONS} --disable-telemetry"
78
fi
79
80
+if [ -n "${NETDATA_CERT_MODE}" ]; then
81
+ REINSTALL_OPTIONS="${REINSTALL_OPTIONS} --certificates ${NETDATA_CERT_MODE}"
82
+fi
83
+
84
+if [ -n "${NETDATA_CERT_TEST_URL}" ]; then
85
+ REINSTALL_OPTIONS="${REINSTALL_OPTIONS} --certificate-test-url ${NETDATA_CERT_TEST_URL}"
86
+fi
87
+
88
# -----------------------------------------------------------------------------
89
progress "Attempt to create user/group netdata/netadata"
90
@@ -208,26 +231,73 @@ done
231
232
# -----------------------------------------------------------------------------
233
211
-echo "Configure TLS certificate paths"
212
-if [ ! -L /opt/netdata/etc/ssl ] && [ -d /opt/netdata/etc/ssl ] ; then
213
- echo "Preserving existing user configuration for TLS"
214
-else
234
+replace_symlink() {
235
+ target="${1}"
236
+ name="${2}"
237
+ rm -f "${name}"
238
+ ln -s "${target}" "${name}"
239
+}
240
+
241
+select_system_certs() {
242
if [ -d /etc/pki/tls ] ; then
216
- echo "Using /etc/pki/tls for TLS configuration and certificates"
217
- ln -sf /etc/pki/tls /opt/netdata/etc/ssl
243
+ echo "${1} /etc/pki/tls for TLS configuration and certificates"
244
+ replace_symlink /etc/pki/tls /opt/netdata/etc/ssl
245
elif [ -d /etc/ssl ] ; then
219
- echo "Using /etc/ssl for TLS configuration and certificates"
220
- ln -sf /etc/ssl /opt/netdata/etc/ssl
221
- else
222
- echo "Using bundled TLS configuration and certificates"
223
- ln -sf /opt/netdata/share/ssl /opt/netdata/etc/ssl
246
+ echo "${1} /etc/ssl for TLS configuration and certificates"
247
+ replace_symlink /etc/ssl /opt/netdata/etc/ssl
248
fi
249
+}
250
+
251
+select_internal_certs() {
252
+ echo "Using bundled TLS configuration and certificates"
253
+ replace_symlink /opt/netdata/share/ssl /opt/netdata/etc/ssl
254
+}
255
+
256
+certs_selected() {
257
+ [ -L /opt/netdata/etc/ssl ] || return 1
258
+}
259
+
260
+test_certs() {
261
+ /opt/netdata/bin/curl --fail --max-time 300 --silent --output /dev/null "${NETDATA_CERT_TEST_URL}"
262
+
263
+ case "$?" in
264
+ 35|77) echo "Failed to load certificate files for test." ; return 1 ;;
265
+ 60|82|83) echo "Certificates cannot be used to connect to ${NETDATA_CERT_TEST_URL}" ; return 1 ;;
266
+ 53|54|66) echo "Unable to use OpenSSL configuration associated with certificates" ; return 1 ;;
267
+ 0) echo "Successfully connected to ${NETDATA_CERT_TEST_URL} using certificates" ;;
268
+ *) echo "Unable to test certificates due to networking problems, blindly assuming they work" ;;
269
+ esac
270
+}
271
+
272
+# If the user has manually set up certificates, don’t mess with it.
273
+if [ ! -L /opt/netdata/etc/ssl ] && [ -d /opt/netdata/etc/ssl ] ; then
274
+ echo "Preserving existing user configuration for TLS"
275
+else
276
+ echo "Configure TLS certificate paths (mode: ${NETDATA_CERT_MODE})"
277
+ case "${NETDATA_CERT_MODE}" in
278
+ check)
279
+ select_system_certs "Testing"
280
+ if certs_selected && test_certs; then
281
+ select_system_certs "Using"
282
+ else
283
+ select_internal_certs
284
+ fi
285
+ ;;
286
+ bundled) select_internal_certs ;;
287
+ *)
288
+ select_system_certs "Using"
289
+ if ! certs_selected; then
290
+ select_internal_certs
291
+ fi
292
+ ;;
293
+ esac
294
fi
295
296
# -----------------------------------------------------------------------------
297
298
echo "Save install options"
299
grep -qv 'IS_NETDATA_STATIC_BINARY="yes"' "${NETDATA_PREFIX}/etc/netdata/.environment" || echo IS_NETDATA_STATIC_BINARY=\"yes\" >> "${NETDATA_PREFIX}/etc/netdata/.environment"
300
+REINSTALL_OPTIONS="$(echo "${REINSTALL_OPTIONS}" | awk '{gsub("/", "\\/"); print}')"
301
sed -i "s/REINSTALL_OPTIONS=\".*\"/REINSTALL_OPTIONS=\"${REINSTALL_OPTIONS}\"/" "${NETDATA_PREFIX}/etc/netdata/.environment"
302
303
# -----------------------------------------------------------------------------