mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-08-13 06:25:00 -05:00
Split x509.load_certificate() into PEM/DER functions
Splitting the load_certificate() function into two separate helps us word the requirements for the input explicitly. It also makes our backend similar to the one of python-cryptography so eventually we can swap python-cryptography for IPA x509 module. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
This commit is contained in:
Stanislav Laznicka
committed by
Pavel Vomacka
Pavel Vomacka
parent
284658e08e
commit
4375ef860f
@@ -799,7 +799,7 @@ class ModCertMapData(LDAPModAttribute):
|
||||
data.append(cls._build_mapdata(subject, issuer))
|
||||
|
||||
for dercert in certificates:
|
||||
cert = x509.load_certificate(dercert, x509.DER)
|
||||
cert = x509.load_der_x509_certificate(dercert)
|
||||
issuer = DN(cert.issuer)
|
||||
subject = DN(cert.subject)
|
||||
if not subject:
|
||||
|
||||
@@ -325,7 +325,7 @@ def ca_kdc_check(api_instance, hostname):
|
||||
|
||||
|
||||
def validate_certificate(value):
|
||||
return x509.validate_certificate(value, x509.DER)
|
||||
return x509.validate_der_x509_certificate(value)
|
||||
|
||||
|
||||
def bind_principal_can_manage_cert(cert):
|
||||
@@ -366,7 +366,7 @@ class BaseCertObject(Object):
|
||||
'certificate', validate_certificate,
|
||||
label=_("Certificate"),
|
||||
doc=_("Base-64 encoded certificate."),
|
||||
normalizer=x509.normalize_certificate,
|
||||
normalizer=x509.ensure_der_format,
|
||||
flags={'no_create', 'no_update', 'no_search'},
|
||||
),
|
||||
Bytes(
|
||||
@@ -490,7 +490,7 @@ class BaseCertObject(Object):
|
||||
|
||||
"""
|
||||
if 'certificate' in obj:
|
||||
cert = x509.load_certificate(obj['certificate'])
|
||||
cert = x509.load_pem_x509_certificate(obj['certificate'])
|
||||
obj['subject'] = DN(cert.subject)
|
||||
obj['issuer'] = DN(cert.issuer)
|
||||
obj['serial_number'] = cert.serial_number
|
||||
@@ -927,7 +927,7 @@ class cert_request(Create, BaseCertMethod, VirtualCommand):
|
||||
"used for krbtgt certificates")
|
||||
|
||||
if 'certificate_chain' in ca_obj:
|
||||
cert = x509.load_certificate(result['certificate'])
|
||||
cert = x509.load_pem_x509_certificate(result['certificate'])
|
||||
cert = cert.public_bytes(serialization.Encoding.DER)
|
||||
result['certificate_chain'] = [cert] + ca_obj['certificate_chain']
|
||||
|
||||
@@ -1191,7 +1191,7 @@ class cert_show(Retrieve, CertMethod, VirtualCommand):
|
||||
# we don't tell Dogtag the issuer (but we check the cert after).
|
||||
#
|
||||
result = self.Backend.ra.get_certificate(str(serial_number))
|
||||
cert = x509.load_certificate(result['certificate'])
|
||||
cert = x509.load_pem_x509_certificate(result['certificate'])
|
||||
|
||||
try:
|
||||
self.check_access()
|
||||
@@ -1270,7 +1270,8 @@ class cert_revoke(PKQuery, CertMethod, VirtualCommand):
|
||||
logger.debug("Not granted by ACI to revoke certificate, "
|
||||
"looking at principal")
|
||||
try:
|
||||
cert = x509.load_certificate(resp['result']['certificate'])
|
||||
cert = x509.load_pem_x509_certificate(
|
||||
resp['result']['certificate'])
|
||||
if not bind_principal_can_manage_cert(cert):
|
||||
raise acierr
|
||||
except errors.NotImplementedError:
|
||||
@@ -1435,7 +1436,7 @@ class cert_find(Search, CertMethod):
|
||||
|
||||
def _get_cert_key(self, cert):
|
||||
try:
|
||||
cert_obj = x509.load_certificate(cert, x509.DER)
|
||||
cert_obj = x509.load_der_x509_certificate(cert)
|
||||
except ValueError as e:
|
||||
message = messages.SearchResultTruncated(
|
||||
reason=_("failed to load certificate: %s") % e,
|
||||
@@ -1691,7 +1692,8 @@ class cert_find(Search, CertMethod):
|
||||
obj['certificate'].replace('\r\n', ''))
|
||||
|
||||
if 'certificate_chain' in ca_obj:
|
||||
cert = x509.load_certificate(obj['certificate'])
|
||||
cert = x509.load_der_x509_certificate(
|
||||
obj['certificate'])
|
||||
cert_der = (
|
||||
cert.public_bytes(serialization.Encoding.DER))
|
||||
obj['certificate_chain'] = (
|
||||
|
||||
@@ -691,7 +691,7 @@ class host_add(LDAPCreate):
|
||||
# save the password so it can be displayed in post_callback
|
||||
setattr(context, 'randompassword', entry_attrs['userpassword'])
|
||||
certs = options.get('usercertificate', [])
|
||||
certs_der = [x509.normalize_certificate(c) for c in certs]
|
||||
certs_der = [x509.ensure_der_format(c) for c in certs]
|
||||
entry_attrs['usercertificate'] = certs_der
|
||||
entry_attrs['managedby'] = dn
|
||||
entry_attrs['objectclass'].append('ieee802device')
|
||||
@@ -895,7 +895,7 @@ class host_mod(LDAPUpdate):
|
||||
|
||||
# verify certificates
|
||||
certs = entry_attrs.get('usercertificate') or []
|
||||
certs_der = [x509.normalize_certificate(c) for c in certs]
|
||||
certs_der = [x509.ensure_der_format(c) for c in certs]
|
||||
|
||||
# revoke removed certificates
|
||||
ca_is_enabled = self.api.Command.ca_is_enabled()['result']
|
||||
@@ -905,7 +905,7 @@ class host_mod(LDAPUpdate):
|
||||
except errors.NotFound:
|
||||
self.obj.handle_not_found(*keys)
|
||||
old_certs = entry_attrs_old.get('usercertificate', [])
|
||||
old_certs_der = [x509.normalize_certificate(c) for c in old_certs]
|
||||
old_certs_der = [x509.ensure_der_format(c) for c in old_certs]
|
||||
removed_certs_der = set(old_certs_der) - set(certs_der)
|
||||
for der in removed_certs_der:
|
||||
rm_certs = api.Command.cert_find(certificate=der)['result']
|
||||
|
||||
@@ -220,7 +220,7 @@ def validate_certificate(ugettext, cert):
|
||||
Check whether the certificate is properly encoded to DER
|
||||
"""
|
||||
if api.env.in_server:
|
||||
x509.validate_certificate(cert, datatype=x509.DER)
|
||||
x509.validate_der_x509_certificate(cert)
|
||||
|
||||
|
||||
def revoke_certs(certs):
|
||||
@@ -269,8 +269,8 @@ def set_certificate_attrs(entry_attrs):
|
||||
cert = entry_attrs['usercertificate'][0]
|
||||
else:
|
||||
cert = entry_attrs['usercertificate']
|
||||
cert = x509.normalize_certificate(cert)
|
||||
cert = x509.load_certificate(cert, datatype=x509.DER)
|
||||
cert = x509.ensure_der_format(cert)
|
||||
cert = x509.load_der_x509_certificate(cert)
|
||||
entry_attrs['subject'] = unicode(DN(cert.subject))
|
||||
entry_attrs['serial_number'] = unicode(cert.serial_number)
|
||||
entry_attrs['serial_number_hex'] = u'0x%X' % cert.serial_number
|
||||
@@ -633,7 +633,7 @@ class service_add(LDAPCreate):
|
||||
self.obj.validate_ipakrbauthzdata(entry_attrs)
|
||||
|
||||
certs = options.get('usercertificate', [])
|
||||
certs_der = [x509.normalize_certificate(c) for c in certs]
|
||||
certs_der = [x509.ensure_der_format(c) for c in certs]
|
||||
entry_attrs['usercertificate'] = certs_der
|
||||
|
||||
if not options.get('force', False):
|
||||
@@ -705,7 +705,7 @@ class service_mod(LDAPUpdate):
|
||||
|
||||
# verify certificates
|
||||
certs = entry_attrs.get('usercertificate') or []
|
||||
certs_der = [x509.normalize_certificate(c) for c in certs]
|
||||
certs_der = [x509.ensure_der_format(c) for c in certs]
|
||||
# revoke removed certificates
|
||||
ca_is_enabled = self.api.Command.ca_is_enabled()['result']
|
||||
if 'usercertificate' in options and ca_is_enabled:
|
||||
@@ -714,7 +714,7 @@ class service_mod(LDAPUpdate):
|
||||
except errors.NotFound:
|
||||
self.obj.handle_not_found(*keys)
|
||||
old_certs = entry_attrs_old.get('usercertificate', [])
|
||||
old_certs_der = [x509.normalize_certificate(c) for c in old_certs]
|
||||
old_certs_der = [x509.ensure_der_format(c) for c in old_certs]
|
||||
removed_certs_der = set(old_certs_der) - set(certs_der)
|
||||
for der in removed_certs_der:
|
||||
rm_certs = api.Command.cert_find(certificate=der)['result']
|
||||
|
||||
Reference in New Issue
Block a user