From: Justin Caratzas <jcaratza@ibm.com>
Date: Mon, 6 Oct 2025 23:25:43 +0000 (-0400)
Subject: python-common/cryptotools: fix error path in verify tls function
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=88324664f8fc9a7d5db4173a3e6e83505f82da89;p=ceph-ci.git

python-common/cryptotools: fix error path in verify tls function

The remote verify_tls function was not raising errors when it should.
Fix the function so that it always returns an object when it succeeds or
fails gracefully. Always parse that function in the crypto caller class.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
(cherry picked from commit 96a7a72cf414a3dc5c8587d34e80838cc64b71a4)

Resolves: rhbz#2401206
---

diff --git a/src/python-common/ceph/cryptotools/cryptotools.py b/src/python-common/ceph/cryptotools/cryptotools.py
index e021cf82ad6..c38ee44fec4 100644
--- a/src/python-common/ceph/cryptotools/cryptotools.py
+++ b/src/python-common/ceph/cryptotools/cryptotools.py
@@ -129,12 +129,11 @@ def get_cert_issuer_info(args: Namespace) -> None:
 
 
 def _fail_message(msg: str) -> None:
-    json.dump({'error': msg}, sys.stderr)
-    sys.exit(1)
+    json.dump({'error': msg}, sys.stdout)
+    sys.exit(0)
 
 
 def verify_tls(args: Namespace) -> None:
-
     data = json.loads(sys.stdin.read())
 
     crt = data['crt']
@@ -163,6 +162,7 @@ def verify_tls(args: Namespace) -> None:
         _fail_message('Private key and certificate do not match up: %s' % str(e))
     except SSL.Error as e:
         _fail_message(f'Invalid cert/key pair: {e}')
+    json.dump({'ok': True}, sys.stdout)  # need to emit something on success
 
 
 if __name__ == "__main__":
diff --git a/src/python-common/ceph/cryptotools/remote.py b/src/python-common/ceph/cryptotools/remote.py
index 9a668ca4bfa..3271ac847a8 100644
--- a/src/python-common/ceph/cryptotools/remote.py
+++ b/src/python-common/ceph/cryptotools/remote.py
@@ -121,12 +121,13 @@ class CryptoCaller:
         """Given a TLS certificate and a private key raise an error
         if the combination is not valid.
         """
-        self._run(
+        result = self._run(
             ['verify_tls'],
             input_data=json.dumps({'crt': crt, 'key': key}),
             capture_output=True,
             check=True,
         )
+        self._result_json(result)  # for errors only
 
     def verify_cacrt_content(self, crt: str) -> int:
         """Verify a CA Certificate return the number of days until expiration."""