RDKE-900: Default to MTLS connection on all endpoints

lib/rdk/Start_MaintenanceTasks.sh

@@ -88,17 +88,6 @@ logUploadLog()
 }
 
 # Utility Function
-checkXpkiMtlsBasedLogUpload()
-{
-    dycredpath="/opt/lxy"
-    if [ -d "$dycredpath" ] && [ -f "/usr/bin/rdkssacli" ] && { [ -f "/opt/certs/devicecert_1.pk12" ] || [ -f "/etc/ssl/certs/staticXpkiCrt.pk12" ]; }; then
-        useXpkiMtlsLogupload="true"
-    else
-        useXpkiMtlsLogupload="false"
-    fi
-    logUploadLog "xpki based mtls support = $useXpkiMtlsLogupload"
-}
-
 runMaintenanceRFCTask()
 {
     if [ -f "$RFC_BIN" ]; then
@@ -143,7 +132,6 @@ runMaintenanceLogUploadTask()
 {
     # On Demand Log Upload and other initializations
     ON_DEMAND_LOG_UPLOAD=5
-    useXpkiMtlsLogupload=false
     TriggerType=$2 # Marked OnDemand LogUpload for second arg
     tftp_server=$LOG_SERVER # from dcm.properties
 
@@ -166,7 +154,6 @@ runMaintenanceLogUploadTask()
             logUploadLog "'LogUploadSettings:UploadRepository:URL' is not found in DCMSettings.conf"
         fi
 
-        checkXpkiMtlsBasedLogUpload
         if [ "$BUILD_TYPE" != "prod" ] && [ -f /opt/dcm.properties ]; then
             logUploadLog "opt override is present. Ignore settings from Bootstrap config"
         else

lib/rdk/UploadLogsNow.sh

@@ -5,7 +5,7 @@
 #
 # Copyright 2020 RDK Management
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
@@ -31,6 +31,11 @@
      . $RDK_PATH/interfaceCalls.sh
 fi
 
+if [ -f /lib/rdk/exec_curl_mtls.sh ]
+then
+   source /lib/rdk/exec_curl_mtls.sh
+fi
+
 MAC=`getMacAddressOnly`
 dt=`date "+%m-%d-%y-%I-%M%p"`
 LOG_FILE=$MAC"_Logs_$dt.tgz"
@@ -93,16 +98,19 @@
     EnableOCSP="/tmp/.EnableOCSPCA"
 
     if [ -f $EnableOCSPStapling ] || [ -f $EnableOCSP ]; then
-        CURL_CMD="curl -w '%{http_code}\n' -d \"filename=$1\" -o \"$FILENAME\" \"$CLOUD_URL\" --cert-status --connect-timeout 10 -m 10"
+        CURL_CMD=" -w '%{http_code}\n' -d \"filename=$1\" -o \"$FILENAME\" \"$CLOUD_URL\" --cert-status --connect-timeout 10 -m 10"
     else
-        CURL_CMD="curl -w '%{http_code}\n' -d \"filename=$1\" -o \"$FILENAME\" \"$CLOUD_URL\" --connect-timeout 10 -m 10"
+        CURL_CMD=" -w '%{http_code}\n' -d \"filename=$1\" -o \"$FILENAME\" \"$CLOUD_URL\" --connect-timeout 10 -m 10"
     fi
+	echo "`/bin/timestamp` MTLS defaulted" >> $LOG_PATH/dcmscript.log
+    msg_tls_source="mTLS certificate from xPKI"
+    echo "`/bin/timestamp` Connect with $msg_tls_source" >> $LOG_PATH/dcmscript.log
     echo "`/bin/timestamp` URL_CMD: $CURL_CMD" >> $LOG_PATH/dcmscript.log
 
     retries=0
     while [ "$retries" -lt 3 ]
     do        
-        ret= eval $CURL_CMD > $HTTP_CODE
+        ret=` exec_curl_mtls "$CURL_CMD" "echo"`
         http_code=$(awk -F\" '{print $1}' $HTTP_CODE)
         if [ $http_code -eq 200 ];then
             break
@@ -117,13 +125,13 @@
         #Get the url from FILENAME
         NewUrl=$(awk -F\" '{print $1}' $FILENAME)
         if [ -f $EnableOCSPStapling ] || [ -f $EnableOCSP ]; then
-            CURL_CMD="curl -w '%{http_code}\n' -T \"$1\" -o \"$FILENAME\" \"$NewUrl\" --cert-status --connect-timeout 60 -m 120 -v"
+            CURL_CMD=" -w '%{http_code}\n' -T \"$1\" -o \"$FILENAME\" \"$NewUrl\" --cert-status --connect-timeout 60 -m 120 -v"
         else
-            CURL_CMD="curl -w '%{http_code}\n' -T \"$1\" -o \"$FILENAME\" \"$NewUrl\" --connect-timeout 60 -m 120 -v"
+            CURL_CMD=" -w '%{http_code}\n' -T \"$1\" -o \"$FILENAME\" \"$NewUrl\" --connect-timeout 60 -m 120 -v"
         fi
         echo "`/bin/timestamp` URL_CMD: $CURL_CMD" >> $LOG_PATH/dcmscript.log
 
-        ret= eval $CURL_CMD > $HTTP_CODE
+        ret=` exec_curl_mtls "$CURL_CMD" "echo"`
         http_code=$(awk -F\" '{print $1}' $HTTP_CODE)
         if [ $http_code -eq 200 ];then
             result=0

lib/rdk/uploadSTBLogs.sh

@@ -70,7 +70,6 @@ TLS=""
 CLOUD_URL=""
 CURL_TLS_TIMEOUT=30
 CURL_TIMEOUT=10
-useXpkiMtlsLogupload=false
 encryptionEnable=false
 CB_NUM_UPLOAD_ATTEMPTS=1
 DIRECT_BLOCK_FILENAME="/tmp/.lastdirectfail_upl"
@@ -157,14 +156,6 @@ flock -n 200 || {
 }
 
 
-#MTLS Upload Check
-checkXpkiMtlsBasedLogUpload()
-{
-   useXpkiMtlsLogupload=$(check_MtlsBasedLogUpload)
-   uploadLog "xpki based mtls support = $useXpkiMtlsLogupload"
-}
-
-
 #Direct and Codebig Communication Functions
 IsDirectBlocked()
 {
@@ -360,23 +351,16 @@ sendTLSSSRRequest()
         URLENCODE_STRING="--data-urlencode \"md5=$S3_MD5SUM\""
     fi
 
-    uploadLog "Attempting $TLS connection to SSR server"
-    checkXpkiMtlsBasedLogUpload
-
-    uploadLog "Log Upload requires Mutual Authentication"
-    if [ "$useXpkiMtlsLogupload" == "true" ]; then
-          msg_tls_source="mTLS certificate from xPKI"
-          uploadLog "Connect with $msg_tls_source"
-          t2CountNotify "SYST_INFO_mtls_xpki"
-          CURL_CMD="-w '%{http_code} %{remote_ip} %{remote_port}\n' -d \"filename=$1\" $URLENCODE_STRING -o \"$FILENAME\" \"$CLOUD_URL\" --connect-timeout $CURL_TLS_TIMEOUT -m 10"
-    fi
+    uploadLog "MTLS defaulted"
+    msg_tls_source="mTLS certificate from xPKI"
+    uploadLog "Connect with $msg_tls_source"
+    t2CountNotify "SYST_INFO_mtls_xpki"
+    CURL_CMD="-w '%{http_code} %{remote_ip} %{remote_port}\n' -d \"filename=$1\" $URLENCODE_STRING -o \"$FILENAME\" \"$CLOUD_URL\" --connect-timeout $CURL_TLS_TIMEOUT -m 10"
     if [ -f $EnableOCSPStapling ] || [ -f $EnableOCSP ]; then
         CURL_CMD="$CURL_CMD --cert-status"
     fi
-    if [ "$useXpkiMtlsLogupload" == "true" ]; then
-          TLSRet=` exec_curl_mtls "$CURL_CMD" "uploadLog"`
-          cat $HTTP_CODE > $CURL_INFO
-    fi
+    TLSRet=` exec_curl_mtls "$CURL_CMD" "uploadLog"`
+    cat $HTTP_CODE > $CURL_INFO
     FQDN=`echo "$CLOUD_URL" |awk -F/ '{print $3}'`
     http_code=$(awk '{print $1}' $CURL_INFO)
     server_ip=$(awk '{print $2}' $CURL_INFO)