IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Test external CA with DNS name constraints

Browse Source 
Verify that FreeIPA can be installed with an external CA that has a name
constraints extension.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Christian Heimes
2019-08-06 09:56:35 +02:00
parent adcf04255c
commit 69138c848d
8 changed files with 44 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ipatests/create_external_ca.py
View File

@@ -63,7 +63,7 @@ class ExternalCA:
backend=default_backend(),
)
def create_ca(self, cn=ISSUER_CN, path_length=None):
def create_ca(self, cn=ISSUER_CN, path_length=None, extensions=()):
"""Create root CA.
:returns: bytes -- Root CA in PEM format.
@@ -114,6 +114,9 @@ class ExternalCA:
critical=False,
)
for extension in extensions:
builder = builder.add_extension(extension, critical=False)
cert = builder.sign(self.ca_key, hashes.SHA256(), default_backend())
return cert.public_bytes(serialization.Encoding.PEM)

2
ipatests/prci_definitions/gating.yaml
View File

@@ -70,7 +70,7 @@ jobs:
class: RunPytest
args:
build_url: '{fedora-30/build_url}'
test_suite: test_integration/test_external_ca.py::TestExternalCA
test_suite: test_integration/test_external_ca.py::TestExternalCA test_integration/test_external_ca.py::TestExternalCAConstraints
template: *ci-master-f30
timeout: 4800
topology: *master_1repl_1client

2
ipatests/prci_definitions/nightly_f28.yaml
View File

@@ -58,7 +58,7 @@ jobs:
class: RunPytest
args:
build_url: '{fedora-28/build_url}'
test_suite: test_integration/test_external_ca.py::TestExternalCA
test_suite: test_integration/test_external_ca.py::TestExternalCA test_integration/test_external_ca.py::TestExternalCAConstraints
template: *ci-master-f28
timeout: 4800
topology: *master_1repl_1client

2
ipatests/prci_definitions/nightly_f29.yaml
View File

@@ -62,7 +62,7 @@ jobs:
class: RunPytest
args:
build_url: '{fedora-29/build_url}'
test_suite: test_integration/test_external_ca.py::TestExternalCA
test_suite: test_integration/test_external_ca.py::TestExternalCA test_integration/test_external_ca.py::TestExternalCAConstraints
template: *ci-master-f29
timeout: 4800
topology: *master_1repl_1client

2
ipatests/prci_definitions/nightly_master.yaml
View File

@@ -62,7 +62,7 @@ jobs:
class: RunPytest
args:
build_url: '{fedora-30/build_url}'
test_suite: test_integration/test_external_ca.py::TestExternalCA
test_suite: test_integration/test_external_ca.py::TestExternalCA test_integration/test_external_ca.py::TestExternalCAConstraints
template: *ci-master-f30
timeout: 4800
topology: *master_1repl_1client

2
ipatests/prci_definitions/nightly_rawhide.yaml
View File

@@ -62,7 +62,7 @@ jobs:
class: RunPytest
args:
build_url: '{fedora-rawhide/build_url}'
test_suite: test_integration/test_external_ca.py::TestExternalCA
test_suite: test_integration/test_external_ca.py::TestExternalCA test_integration/test_external_ca.py::TestExternalCAConstraints
template: *ci-master-frawhide
timeout: 4800
topology: *master_1repl_1client

7
ipatests/pytest_ipa/integration/tasks.py
View File

@@ -1696,7 +1696,7 @@ def add_dns_zone(master, zone, skip_overlap_check=False,
def sign_ca_and_transport(host, csr_name, root_ca_name, ipa_ca_name,
root_ca_path_length=None, ipa_ca_path_length=1,
key_size=None,):
key_size=None, root_ca_extensions=()):
"""
Sign ipa csr and save signed CA together with root CA back to the host.
Returns root CA and IPA CA paths on the host.
@@ -1709,7 +1709,10 @@ def sign_ca_and_transport(host, csr_name, root_ca_name, ipa_ca_name,
external_ca = ExternalCA(key_size=key_size)
# Create root CA
root_ca = external_ca.create_ca(path_length=root_ca_path_length)
root_ca = external_ca.create_ca(
path_length=root_ca_path_length,
extensions=root_ca_extensions,
)
# Sign CSR
ipa_ca = external_ca.sign_csr(ipa_csr, path_length=ipa_ca_path_length)

30
ipatests/test_integration/test_external_ca.py
View File

@@ -190,6 +190,36 @@ class TestExternalCA(IntegrationTest):
'-U'])
class TestExternalCAConstraints(IntegrationTest):
"""Test of FreeIPA server installation with external CA and constraints
"""
num_replicas = 0
num_clients = 1
def test_external_ca_constrained(self):
install_server_external_ca_step1(self.master)
# name constraints for IPA DNS domain (dot prefix)
nameconstraint = x509.NameConstraints(
permitted_subtrees=[
x509.DNSName("." + self.master.domain.name),
],
excluded_subtrees=None
)
root_ca_fname, ipa_ca_fname = tasks.sign_ca_and_transport(
self.master, paths.ROOT_IPA_CSR, ROOT_CA, IPA_CA,
root_ca_extensions=[nameconstraint],
)
install_server_external_ca_step2(
self.master, ipa_ca_fname, root_ca_fname
)
tasks.kinit_admin(self.master)
self.master.run_command(['ipa', 'ping'])
def verify_caentry(host, cert):
"""
Verify the content of cn=DOMAIN IPA CA,cn=certificates,cn=ipa,cn=etc,basedn