python-common/cryptotools: fix error path in verify tls function

The remote verify_tls function was not raising errors when it should.
Fix the function so that it always returns an object when it succeeds or
fails gracefully. Always parse that function in the crypto caller class.

Signed-off-by: John Mulligan <jmulligan@redhat.com>

diff --git a/src/python-common/ceph/cryptotools/cryptotools.py b/src/python-common/ceph/cryptotools/cryptotools.py
index e021cf82ad6b74c4dd148835bc16f596c6e34d48..c38ee44fec48a438713f7f4ef095525fa66e1a7e 100644 (file)
--- a/src/python-common/ceph/cryptotools/cryptotools.py
+++ b/src/python-common/ceph/cryptotools/cryptotools.py
@@ -129,12 +129,11 @@ def get_cert_issuer_info(args: Namespace) -> None:
 
 
 def _fail_message(msg: str) -> None:
-    json.dump({'error': msg}, sys.stderr)
-    sys.exit(1)
+    json.dump({'error': msg}, sys.stdout)
+    sys.exit(0)
 
 
 def verify_tls(args: Namespace) -> None:
-
     data = json.loads(sys.stdin.read())
 
     crt = data['crt']
@@ -163,6 +162,7 @@ def verify_tls(args: Namespace) -> None:
         _fail_message('Private key and certificate do not match up: %s' % str(e))
     except SSL.Error as e:
         _fail_message(f'Invalid cert/key pair: {e}')
+    json.dump({'ok': True}, sys.stdout)  # need to emit something on success
 
 
 if __name__ == "__main__":

diff --git a/src/python-common/ceph/cryptotools/remote.py b/src/python-common/ceph/cryptotools/remote.py
index 9a668ca4bfa26e36a3b3ebe50d2beb6f728b0a65..3271ac847a87aab3eacd565abaed8bf286b78639 100644 (file)
--- a/src/python-common/ceph/cryptotools/remote.py
+++ b/src/python-common/ceph/cryptotools/remote.py
@@ -121,12 +121,13 @@ class CryptoCaller:
         """Given a TLS certificate and a private key raise an error
         if the combination is not valid.
         """
-        self._run(
+        result = self._run(
             ['verify_tls'],
             input_data=json.dumps({'crt': crt, 'key': key}),
             capture_output=True,
             check=True,
         )
+        self._result_json(result)  # for errors only
 
     def verify_cacrt_content(self, crt: str) -> int:
         """Verify a CA Certificate return the number of days until expiration."""