Skip to content

Merge feature/trusted-certs#7026

Open
minglumlu wants to merge 41 commits intomasterfrom
feature/trusted-certs
Open

Merge feature/trusted-certs#7026
minglumlu wants to merge 41 commits intomasterfrom
feature/trusted-certs

Conversation

@minglumlu
Copy link
Copy Markdown
Member

@minglumlu minglumlu commented Apr 22, 2026

After merge, once a new tag is ready, the following need to be done:

  1. update the datamodel_lifecycle (changed in ca2f0d6)
  2. update the doc status (introduced in fe0ae6e)
  3. add deprecation for Pool.install_ca_certificate and pool.uninstall_ca_certificate.

minglumlu and others added 30 commits January 19, 2026 16:50
@minglumlu
Merge master to feature branch (#6841)
b17233a
@minglumlu
Add 'purpose' field in Certificate datamodel
2f42df4 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Add 'pinned' in type of Certificate
139068c 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Add new APIs for trusted certificates (no impl.)
c36ed78 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Implement APIs in xapi_pool.ml
6128c1c 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Check if already exists when installing a certificate
632c50f 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Update host_install
09a0eb1 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Update host_uninstall
6c7b994 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Make CertificateProvider.store_path support multiple paths
6341455 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Add new constructors of certificate type for trusted certs
71b8c00 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Update copy_certs_to_host to include trusted certs
2e8a306 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Use Cert_distrib instead of sync* in Certificates
74a0a45 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Update how to update bundles
9509a1f 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Add collect_trusted_certs
608926c 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Add pool.exchange_trusted_certificates_on_join
df5b255 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Add collect_crls
2a3a759 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Add pool.exchange_crls_on_join
2fdfaf4 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Fix certificate error messages
bc6e11b 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Cleanup trusted on ejected host
23fbffc 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Bump up last_known_schema_hash
a6e390e 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
[doc] Update how to handle trusted certificates when pool.join
36890b6 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Improve handling of trusted certificates (#6826)
a6e1046 
The design is
https://github.com/xapi-project/xen-api/blob/master/doc/content/design/trusted-certificates.md
(It's a little bit out-of-date. Will update it later. And remaining
changes will be raised in following PRs)

Manual tests are done with a new purpose `testing` (change is not
included in this PR) like:
```
xe pool-install-trusted-certificate filename=root.pem ca=true purpose=licensing,testing
xe pool-install-trusted-certificate filename=root.pem ca=true purpose=licensing,testing # will report error
xe pool-install-trusted-certificate filename=root.pem ca=true
xe pool-install-trusted-certificate filename=leaf.pem ca=false purpose=licensing,testing
xe pool-install-trusted-certificate filename=leaf.pem ca=false # will report error
xe certificate-list
xe pool-uninstall-trusted-certificate certificate-uuid=<UUID>
xe pool-certificate-sync
xe pool-crl-install filename=crl01.pem
xe pool-crl-uninstall name=crl01.pem
```
And `pool.join` and `pool.eject` for exchanging trusted certificates and
CRLs.

The certificate stores under `/etc/trusted-certs/` on coordinator and
supporter hosts' dom0 filesystem.
@changlei-li
Sync master into feature/trusted-certs (#6903)
90dc197
@changlei-li
CP-310090 Stunnel lib: Expose unix socket path for TLS proxy
fd98c31 
Add a module UnixSocketProxy in stunnel lib to provide a unix socket
path that can proxy TLS. This can offer a unified mechanism for
differnt users.
Stunnel listens on the unix socket path, accepts the connection
from local request then forwards to remote host and port with TLS.
The certificate checking in TLS connection can be done by stunnel
with the new trusted-certs implementation.
Two set of APIs are provided:
1. long-running stunnel proxy for that the user want to use it
   multi-times and handle the proxy lifecycle itself.
```OCaml
let stunnel_proxy =
  Stunnel.UnixSocketProxy.start ~verify_cert ~remote_host ~remote_port ()
in
match stunnel_proxy with
| Error e -> (* handle error *)
| Ok proxy_handle ->
    let socket_path = Stunnel.UnixSocketProxy.socket_path proxy_handle in
    (* use socket_path with HTTP clients *)
    ...
    Stunnel.UnixSocketProxy.diagnose proxy_handle |> function
    | Ok () -> (* all good *)
    | Error err -> (* handle connection errors *)
    ...
    Stunnel.UnixSocketProxy.stop proxy_handle (* clean up when done *)
```
2. short-lived stunnel proxy for that the user just want to use
   one-shot with auto cleanup.
```OCaml
Stunnel.UnixSocketProxy.with_proxy ~verify_cert ~remote_host ~remote_port
  (fun proxy_handle ->
    let socket_path = Stunnel.UnixSocketProxy.socket_path proxy_handle in
    (* use socket_path with HTTP clients *)
    ...
    Stunnel.UnixSocketProxy.diagnose proxy_handle)
    ...
  )
```

Signed-off-by: Changlei Li <changlei.li@cloud.com>
@changlei-li
Improve certificate_verity errors
0430475 
Currently, the verify_error relies on "certificate verify failed"
and "No certificate or private key specified" in the stunnel log
file.
In fact, "No certificate or private key specified" is a normal
log for stunnel_proxy. It happens on stunnel configuration
fail with verbose log enabled. We can remove it and it is covered
by "Configuration failed".
For "certificate verify failed", it is a indicator for certificate
verify fail, but the detail reasons is in previous lines like
"CERT: Pre-verification error: unable to get local issuer certificate"
"CERT: Subject checks failed". So the "CERT: " line is collected,
if "certificate verify failed" is found, the details can be raised
out as reason.

Signed-off-by: Changlei Li <changlei.li@cloud.com>
@changlei-li
Support check stunnel log with input channel
9e8f41a 
In long time running proxy, every time to call diagnose
need to read entire the stunnel log. It is inficient.
Store the input channel of log file in the proxy t, then
the diagnose can read the log from position after the last
it is called.

Signed-off-by: Changlei Li <changlei.li@cloud.com>
@changlei-li
Add unit test for stunnel_log_scanner
f9abe00 
Signed-off-by: Changlei Li <changlei.li@cloud.com>
@changlei-li
CP-310090 Stunnel lib: Expose unix socket path for TLS proxy (#6886)
7fd25d7 
Add a module UnixSocketProxy in stunnel lib to provide a unix socket
path that can proxy TLS. This can offer a unified mechanism for
differnt users.
Stunnel listens on the unix socket path, accepts the connection
from local request then forwards to remote host and port with TLS.
The certificate checking in TLS connection can be done by stunnel
with the new trusted-certs implementation.
Two set of APIs are provided:
1. long-running stunnel proxy for that the user want to use it
    multi-times and handle the proxy lifecycle itself.
```OCaml
let stunnel_proxy =
  Stunnel.UnixSocketProxy.start ~verify_cert ~remote_host ~remote_port ()
in
match stunnel_proxy with
| Error e -> (* handle error *)
| Ok proxy_handle ->
    let socket_path = Stunnel.UnixSocketProxy.socket_path proxy_handle in
    (* use socket_path with HTTP clients *)
    ...
    Stunnel.UnixSocketProxy.diagnose proxy_handle |> function
    | Ok () -> (* all good *)
    | Error err -> (* handle connection errors *)
    ...
    Stunnel.UnixSocketProxy.stop proxy_handle (* clean up when done *)
```
2. short-lived stunnel proxy for that the user just want to use
    one-shot with auto cleanup.
```OCaml
Stunnel.UnixSocketProxy.with_proxy ~verify_cert ~remote_host ~remote_port
  (fun proxy_handle ->
    let socket_path = Stunnel.UnixSocketProxy.socket_path proxy_handle in
    (* use socket_path with HTTP clients *)
    ...
    Stunnel.UnixSocketProxy.diagnose proxy_handle)
    ...
  )
```
@changlei-li
Merge branch 'master' into feature/trusted-certs
b2cbd68
@changlei-li
Sync master into feature/trusted-certs (#6926)
2a28060
changlei-li and others added 9 commits February 27, 2026 14:49
@changlei-li
CA-423556: print full checkout error msg in xe apply-edition
8f2abd1 
A new LICENSE_SERVER_CERT_CHECK_FAILED is added in LICENSE_CHECKOUT_ERROR
with second string of <The unknown leaf server certificate in PEM format>.
Now the xe command only prints the second string in this case, it is
hard to understand and distinguish with the existing CERTIFICATE_INVALID.
So concact the two strings and print.

Signed-off-by: Changlei Li <changlei.li@cloud.com>
@changlei-li
CA-423556: print full checkout error msg in xe apply-edition (#6925)
4a142ac 
A new LICENSE_SERVER_CERT_CHECK_FAILED is added in
LICENSE_CHECKOUT_ERROR with second string of `<The unknown leaf server
certificate in PEM format>`. Now the xe command only prints the second
string in this case, it is hard to understand and distinguish with the
existing CERTIFICATE_INVALID. So concact the two strings and print.
@minglumlu
Merge master to feature branch (#6943)
d69dc1d
@minglumlu
[Master to feature] Merge master to feature branch (#6961)
1c49383
@minglumlu
Merge branch 'master' into private/mingl/feature/trusted-certs
4da9ef6
@minglumlu
Merge master to feature/trusted-certs (#7010)
31944c9 
```diff
commit 4da9ef6
Merge: 1c49383 043e6bd
Author: Ming Lu <ming.lu@cloud.com>
Date:   Wed Apr 15 09:56:22 2026 +0800

    Merge branch 'master' into private/mingl/feature/trusted-certs

diff --cc ocaml/idl/datamodel_common.ml
index 93a3fbc,0fe08b11c..25e689f
--- a/ocaml/idl/datamodel_common.ml
+++ b/ocaml/idl/datamodel_common.ml
@@@ -3,21 -3,21 +3,21 @@@
  open Datamodel_types
  open Lifecycle
  open Datamodel_roles
  
  (* IMPORTANT: Please bump schema vsn if you change/add/remove a _field_.
                You do not have to bump vsn if you change/add/remove a message
                When introducing a new release, bump the schema minor version to the next hundred
                to leave a gap for potential hotfixes needing to increment the schema version.*)
  let schema_major_vsn = 5
  
- let schema_minor_vsn = 794
 -let schema_minor_vsn = 901
++let schema_minor_vsn = 902
  
  (* Historical schema versions just in case this is useful later *)
  let rio_schema_major_vsn = 5
  
  let rio_schema_minor_vsn = 19
  
  let miami_release_schema_major_vsn = 5
  
  let miami_release_schema_minor_vsn = 35
  
diff --cc ocaml/idl/schematest.ml
index e92f9e9,c963c8f11..a7fc9bd
--- a/ocaml/idl/schematest.ml
+++ b/ocaml/idl/schematest.ml
@@@ -1,16 -1,16 +1,16 @@@
  let hash x = Digest.string x |> Digest.to_hex
  
  (* BEWARE: if this changes, check that schema has been bumped accordingly in
     ocaml/idl/datamodel_common.ml, usually schema_minor_vsn *)
  
- let last_known_schema_hash = "ce90c659723cbcd5265e4dd856802b74"
 -let last_known_schema_hash = "32bbba07579ca8844fa6162164530268"
++let last_known_schema_hash = "a64e7e1133a10add1b39d22cd6bbc352"
  
  let current_schema_hash : string =
    let open Datamodel_types in
    let hash_of_obj x =
      List.map rpc_of_content x.contents
      |> List.map Jsonrpc.to_string
      |> String.concat ""
      |> hash
    in
    Datamodel.all_system |> List.map hash_of_obj |> String.concat ":" |> hash
@minglumlu
Merge branch 'master' into feature/trusted-certs
42d921c
@minglumlu
Update datamodel_lifecycle for feature/trusted-certs
ca2f0d6 
Signed-off-by: Ming Lu <ming.lu@cloud.com>
@minglumlu
Merge master into feature/trusted-certs (#7025)
81be3d9
@minglumlu minglumlu mentioned this pull request Apr 27, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@changlei-li changlei-li changlei-li approved these changes

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@minglumlu @changlei-li