fix!(cmapi): MCOL-5454: Self-signed certificate autorenew. (#3213)

[add] managers/certificate.py with CertificateManger class
[mv] creating self-signed certificate logic into CertificateManger class
[add] renew and days_before_expire methods to CertificateManger class
[mv] several certificate dependent constants to managers/certificate.py
[add] CherryPy BackgroundTask to invoke certificate check hourly (3600 secs)
[fix] tests
[fix] bug with txn timer clean (clean_txn_by_timeout, worker and invoking of it)

cmapi/cmapi_server/__main__.py

@@ -8,15 +8,10 @@ import logging
 import os
 import threading
 import time
-from datetime import datetime, timedelta
+from datetime import datetime
 
 import cherrypy
 from cherrypy.process import plugins
-from cryptography import x509
-from cryptography.hazmat.backends import default_backend
-from cryptography.hazmat.primitives import serialization, hashes
-from cryptography.hazmat.primitives.asymmetric import rsa
-from cryptography.x509.oid import NameOID
 
 # TODO: fix dispatcher choose logic because code executing in endpoints.py
 #       while import process, this cause module logger misconfiguration
@@ -27,28 +22,26 @@ from cmapi_server import helpers
 from cmapi_server.constants import DEFAULT_MCS_CONF_PATH, CMAPI_CONF_PATH
 from cmapi_server.controllers.dispatcher import dispatcher, jsonify_error
 from cmapi_server.failover_agent import FailoverAgent
-from cmapi_server.managers.process import MCSProcessManager
 from cmapi_server.managers.application import AppManager
+from cmapi_server.managers.process import MCSProcessManager
+from cmapi_server.managers.certificate import CertificateManager
 from failover.node_monitor import NodeMonitor
 from mcs_node_control.models.dbrm_socket import SOCK_TIMEOUT, DBRMSocketHandler
 from mcs_node_control.models.node_config import NodeConfig
 
 
-cert_filename = './cmapi_server/self-signed.crt'
-
-
-def worker():
+def worker(app):
     """Background Timer that runs clean_txn_by_timeout() every 5 seconds
     TODO: this needs to be fixed/optimized. I don't like creating the thread
     repeatedly.
     """
     while True:
-        t = threading.Timer(5.0, clean_txn_by_timeout)
+        t = threading.Timer(5.0, clean_txn_by_timeout, app)
         t.start()
         t.join()
 
 
-def clean_txn_by_timeout():
+def clean_txn_by_timeout(app):
     txn_section = app.config.get('txn', None)
     timeout_timestamp = txn_section.get('timeout') if txn_section is not None else None
     current_timestamp = int(datetime.now().timestamp())
@@ -82,7 +75,9 @@ class TxnBackgroundThread(plugins.SimplePlugin):
     def start(self):
         """Plugin entrypoint"""
 
-        self.t = threading.Thread(target=worker, name='TxnBackgroundThread')
+        self.t = threading.Thread(
+            target=worker, name='TxnBackgroundThread', args=(self.app)
+        )
         self.t.daemon = True
         self.t.start()
 
@@ -139,65 +134,14 @@ class FailoverBackgroundThread(plugins.SimplePlugin):
         self._stop()
 
 
-def create_self_signed_certificate():
-    key_filename = './cmapi_server/self-signed.key'
-
-    key = rsa.generate_private_key(
-        public_exponent=65537,
-        key_size=2048,
-        backend=default_backend()
-    )
-
-    with open(key_filename, "wb") as f:
-        f.write(key.private_bytes(
-            encoding=serialization.Encoding.PEM,
-            format=serialization.PrivateFormat.TraditionalOpenSSL,
-            encryption_algorithm=serialization.NoEncryption()),
-        )
-
-    subject = issuer = x509.Name([
-        x509.NameAttribute(NameOID.COUNTRY_NAME, 'US'),
-        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, 'California'),
-        x509.NameAttribute(NameOID.LOCALITY_NAME, 'Redwood City'),
-        x509.NameAttribute(NameOID.ORGANIZATION_NAME, 'MariaDB'),
-        x509.NameAttribute(NameOID.COMMON_NAME, 'mariadb.com'),
-    ])
-
-    basic_contraints = x509.BasicConstraints(ca=True, path_length=0)
-
-    cert = x509.CertificateBuilder(
-    ).subject_name(
-        subject
-    ).issuer_name(
-        issuer
-    ).public_key(
-        key.public_key()
-    ).serial_number(
-        x509.random_serial_number()
-    ).not_valid_before(
-        datetime.utcnow()
-    ).not_valid_after(
-        datetime.utcnow() + timedelta(days=365)
-    ).add_extension(
-        basic_contraints,
-        False
-    ).add_extension(
-        x509.SubjectAlternativeName([x509.DNSName('localhost')]),
-        critical=False
-    ).sign(key, hashes.SHA256(), default_backend())
-
-    with open(cert_filename, 'wb') as f:
-        f.write(cert.public_bytes(serialization.Encoding.PEM))
-
-
 if __name__ == '__main__':
     logging.info(f'CMAPI Version: {AppManager.get_version()}')
 
     # TODO: read cmapi config filepath as an argument
     helpers.cmapi_config_check()
 
-    if not os.path.exists(cert_filename):
-        create_self_signed_certificate()
+    CertificateManager.create_self_signed_certificate_if_not_exist()
+    CertificateManager.renew_certificate()
 
     app = cherrypy.tree.mount(root=None, config=CMAPI_CONF_PATH)
     app.config.update({
@@ -224,6 +168,10 @@ if __name__ == '__main__':
     # subscribe FailoverBackgroundThread plugin code to bus channels
     # code below not starting "real" failover background thread
     FailoverBackgroundThread(cherrypy.engine, turn_on_failover).subscribe()
+    cherrypy.engine.certificate_monitor = plugins.BackgroundTask(
+        3600, CertificateManager.renew_certificate
+    )
+    cherrypy.engine.certificate_monitor.start()
     cherrypy.engine.start()
     cherrypy.engine.wait(cherrypy.engine.states.STARTED)