mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-24 16:10:02 -06:00
4cc9451271
The x509.subject_base() function is only used in tests. During the recent certificate refactoring, we had to get rid of the ipalib.x509 import from the module scope so that there were no circular dependecies and add it exactly to this funcion which is not used in the production code. Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
132 lines
3.6 KiB
Python
132 lines
3.6 KiB
Python
#
|
|
# Authors:
|
|
# Rob Crittenden <rcritten@redhat.com>
|
|
#
|
|
# Copyright (C) 2011 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
"""
|
|
Provide a custom certificate used in the service tests.
|
|
|
|
The certificate in cached in a global variable so it only has to be created
|
|
once per test run.
|
|
"""
|
|
|
|
import os
|
|
import tempfile
|
|
import shutil
|
|
import six
|
|
import base64
|
|
import re
|
|
|
|
from ipalib import api, x509
|
|
from ipaserver.plugins import rabase
|
|
from ipapython import ipautil
|
|
from ipapython.dn import DN
|
|
from ipaplatform.paths import paths
|
|
|
|
if six.PY3:
|
|
unicode = str
|
|
|
|
|
|
_subject_base = None
|
|
|
|
|
|
def subject_base():
|
|
global _subject_base
|
|
|
|
if _subject_base is None:
|
|
config = api.Command['config_show']()['result']
|
|
_subject_base = DN(config['ipacertificatesubjectbase'][0])
|
|
|
|
return _subject_base
|
|
|
|
|
|
def strip_cert_header(pem):
|
|
"""
|
|
Remove the header and footer from a certificate.
|
|
"""
|
|
regexp = (
|
|
r"^-----BEGIN CERTIFICATE-----(.*?)-----END CERTIFICATE-----"
|
|
)
|
|
s = re.search(regexp, pem, re.MULTILINE | re.DOTALL)
|
|
if s is not None:
|
|
return s.group(1)
|
|
else:
|
|
return pem
|
|
|
|
|
|
def get_testcert(subject, principal):
|
|
"""Get the certificate, creating it if it doesn't exist"""
|
|
reqdir = tempfile.mkdtemp(prefix="tmp-")
|
|
try:
|
|
_testcert = makecert(reqdir, subject,
|
|
principal)
|
|
finally:
|
|
shutil.rmtree(reqdir)
|
|
return strip_cert_header(_testcert.decode('utf-8'))
|
|
|
|
|
|
def run_certutil(reqdir, args, stdin=None):
|
|
"""
|
|
Run an NSS certutil command
|
|
"""
|
|
new_args = [paths.CERTUTIL, "-d", reqdir]
|
|
new_args = new_args + args
|
|
return ipautil.run(new_args, stdin)
|
|
|
|
|
|
def generate_csr(reqdir, pwname, subject):
|
|
"""
|
|
Create a CSR for the given subject.
|
|
"""
|
|
req_path = os.path.join(reqdir, 'req')
|
|
run_certutil(reqdir, ["-R", "-s", subject,
|
|
"-o", req_path,
|
|
"-z", paths.GROUP,
|
|
"-f", pwname,
|
|
"-a"])
|
|
with open(req_path, "r") as fp:
|
|
return fp.read()
|
|
|
|
|
|
def makecert(reqdir, subject, principal):
|
|
"""
|
|
Generate a certificate that can be used during unit testing.
|
|
"""
|
|
|
|
ra = rabase.rabase(api)
|
|
if (not os.path.exists(ra.client_certfile) and
|
|
api.env.xmlrpc_uri == 'http://localhost:8888/ipa/xml'):
|
|
raise AssertionError('The self-signed CA is not configured, '
|
|
'see ipatests/test_xmlrpc/test_cert.py')
|
|
|
|
pwname = os.path.join(reqdir, "pwd")
|
|
|
|
# Create an empty password file
|
|
with open(pwname, "w") as fp:
|
|
fp.write("\n")
|
|
|
|
# Generate NSS cert database to store the private key for our CSR
|
|
run_certutil(reqdir, ["-N", "-f", pwname])
|
|
|
|
csr = unicode(generate_csr(reqdir, pwname, str(subject)))
|
|
|
|
res = api.Command['cert_request'](csr, principal=principal, add=True)
|
|
cert = x509.load_der_x509_certificate(
|
|
base64.b64decode(res['result']['certificate']))
|
|
return cert.public_bytes(x509.Encoding.PEM)
|