xapi: Improve error reporting when pool join fails on TLS verification

[LucienLassalle]

When a host joins a pool (pool.join_force), the process has two phases:

1. An unverified TLS connection is used to run pre-join checks and exchange host certificates. The joiner imports the pool bundle.
2. A verified TLS connection (verifyPeer=yes, SNI=pool) is opened using the freshly-generated pool bundle.

Previously, any failure at Phase 2 surfaced as:
INTERNAL_ERROR(Stunnel.Stunnel_verify_error(

This error is opaque and gives no actionable information to the administrator. The idea is to improve error handling in order to obtain something more precise.

[psafont]

Can this check be done inside the import_joining_pool_certs?

[LucienLassalle]

Yup, like this ?

[last-genius]

Does the script leave some errors in daemon.log to be able to investigate? or is the failure actually silent?

[LucienLassalle]

#!/bin/bash
#
# Copyright (c) Citrix Systems 2008. All rights reserved.
#

set -e

regen_bundle () {
  CERTS_DIR="$1"
  BUNDLE="$2"

  mkdir -p "$CERTS_DIR"
  CERTS=$(find "$CERTS_DIR" -not -name '*.new.pem' -name '*.pem')
  NEW_CERTS=$(find "$CERTS_DIR" -name '*.new.pem')

  rm -f "$BUNDLE.tmp"
  touch "$BUNDLE.tmp"
  for NEW_CERT in $NEW_CERTS; do
    # If cat new cert command fails, do not error and exit, just skip it
    if cat "$NEW_CERT" >> "$BUNDLE.tmp"; then
      echo "" >> "$BUNDLE.tmp"
    fi
  done
  for CERT in $CERTS; do
    cat "$CERT" >> "$BUNDLE.tmp"
    echo ""     >> "$BUNDLE.tmp"
  done
  mv "$BUNDLE.tmp" "$BUNDLE"
}

regen_bundle "/etc/stunnel/certs"      "/etc/stunnel/xapi-stunnel-ca-bundle.pem"
regen_bundle "/etc/stunnel/certs-pool" "/etc/stunnel/xapi-pool-ca-bundle.pem"

This script is silent...

[last-genius]

looks like a fairly simple script, I wonder why would cat new cert possibly fail???

[LucienLassalle]

I don't know..