diff --git a/certidude/api/request.py b/certidude/api/request.py index da374da..42a8a55 100644 --- a/certidude/api/request.py +++ b/certidude/api/request.py @@ -11,7 +11,7 @@ from asn1crypto.csr import CertificationRequest from base64 import b64decode from certidude import config, authority, push, errors from certidude.auth import login_required, login_optional, authorize_admin -from certidude.decorators import csrf_protection, MyEncoder +from certidude.decorators import csrf_protection, MyEncoder, serialize from certidude.firewall import whitelist_subnets, whitelist_content_types from datetime import datetime from oscrypto import asymmetric @@ -38,8 +38,14 @@ class RequestListResource(object): reasons = [] body = req.stream.read(req.content_length) - header, _, der_bytes = pem.unarmor(body) - csr = CertificationRequest.load(der_bytes) + try: + header, _, der_bytes = pem.unarmor(body) + csr = CertificationRequest.load(der_bytes) + except ValueError: + raise falcon.HTTPBadRequest( + "Bad request", + "Malformed certificate signing request") + common_name = csr["certification_request_info"]["subject"].native["common_name"] """ @@ -164,6 +170,9 @@ class RequestListResource(object): # Request was accepted, but not processed resp.status = falcon.HTTP_202 resp.body = ". ".join(reasons) + if req.client_accepts("application/json"): + resp.body = json.dumps({"title":"Accepted", "description":resp.body}, + cls=MyEncoder) class RequestDetailResource(object): diff --git a/certidude/decorators.py b/certidude/decorators.py index 00a0826..638151c 100644 --- a/certidude/decorators.py +++ b/certidude/decorators.py @@ -67,13 +67,15 @@ def serialize(func): """ import falcon def wrapped(instance, req, resp, **kwargs): - if not req.client_accepts("application/json"): - logger.debug("Client did not accept application/json") - raise falcon.HTTPUnsupportedMediaType( - "Client did not accept application/json") - resp.set_header("Cache-Control", "no-cache, no-store, must-revalidate") - resp.set_header("Pragma", "no-cache") - resp.set_header("Expires", "0") - resp.body = json.dumps(func(instance, req, resp, **kwargs), cls=MyEncoder) + retval = func(instance, req, resp, **kwargs) + if not resp.body and not resp.location: + if not req.client_accepts("application/json"): + logger.debug("Client did not accept application/json") + raise falcon.HTTPUnsupportedMediaType( + "Client did not accept application/json") + resp.set_header("Cache-Control", "no-cache, no-store, must-revalidate") + resp.set_header("Pragma", "no-cache") + resp.set_header("Expires", "0") + resp.body = json.dumps(retval, cls=MyEncoder) return wrapped diff --git a/certidude/static/js/certidude.js b/certidude/static/js/certidude.js index 8fb34f1..ae5069b 100644 --- a/certidude/static/js/certidude.js +++ b/certidude/static/js/certidude.js @@ -220,6 +220,27 @@ function onAttributeUpdated(e) { }) } +function onSubmitRequest() { + $.ajax({ + method: "POST", + url: "/api/request/", + headers: { + "Accept": "application/json; charset=utf-8", + "Content-Type": "application/pkcs10" + }, + data: $("#request_body").val(), + + success:function(attributes, status, xhr) { + // Close the modal + $("[data-dismiss=modal]").trigger({ type: "click" }); + }, + error: function(xhr, status, e) { + console.info("Submitting request failed with:", status, e); + alert(e); + } + }) +} + function onServerStarted() { console.info("Server started"); location.reload(); diff --git a/certidude/static/views/authority.html b/certidude/static/views/authority.html index d85affa..058efd7 100644 --- a/certidude/static/views/authority.html +++ b/certidude/static/views/authority.html @@ -5,34 +5,34 @@

Request submission

-
+
+
+
Certidude client
-
Certidude client
- -

Submit a certificate signing request from Mac OS X, Ubuntu or Fedora:

-
- 
easy_install pip;
+            
Submit a certificate signing request from Mac OS X, Ubuntu or Fedora:

+            

+              
easy_install pip;
 pip3 install certidude;
 certidude bootstrap {{session.authority.common_name}}
-

-          

+
+
-
UNIX & UNIX-like
+
UNIX & UNIX-like
-

On other UNIX-like machines generate key pair and submit the signing request using OpenSSL and cURL:

-
- 
NAME=$(hostname);
+            
On other UNIX-like machines generate key pair and submit the signing request using OpenSSL and cURL:

+            

+              
NAME=$(hostname);
 openssl genrsa -out client_key.pem 2048;
 openssl req -new -sha256 -key client_key.pem -out client_req.pem -subj "/CN=$NAME";
 curl -f -L -H "Content-type: application/pkcs10" --data-binary @client_req.pem \
   http://{{ window.location.hostname }}/api/request/?wait=yes > client_cert.pem

-          

+
-
OpenWrt/LEDE
+
OpenWrt/LEDE
-

On OpenWrt/LEDE router to convert it into VPN gateway:

-
- 
mkdir -p /var/lib/certidude/{{ window.location.hostname }}; \
+            
On OpenWrt/LEDE router to convert it into VPN gateway:

+            

+              
mkdir -p /var/lib/certidude/{{ window.location.hostname }}; \
 grep -c certidude /etc/sysupgrade.conf || echo /var/lib/certidude >> /etc/sysupgrade.conf; \
 curl -f http://{{ window.location.hostname }}/api/certificate/ -o /var/lib/certidude/{{ window.location.hostname }}/ca_cert.pem; \
 test -e /var/lib/certidude/{{ window.location.hostname }}/client_key.pem || openssl genrsa -out /var/lib/certidude/{{ window.location.hostname }}/client_key.pem 2048; \
@@ -43,25 +43,25 @@ curl -f -L -H "Content-type: application/pkcs10" \
   --data-binary @/var/lib/certidude/{{ window.location.hostname }}/client_req.pem \
   -o /var/lib/certidude/{{ window.location.hostname }}/client_cert.pem \
   http://{{ window.location.hostname }}/api/request/?wait=yes

+            

+
+            
SCEP

+            
Use following as the enrollment URL: http://{{ window.location.hostname }}/cgi-bin/pkiclient.exe

+
+            
Copy & paste

+
+            
Use whatever tools you have available on your platform to generate
+            keypair and just paste ASCII armored PEM file contents here and hit submit:

+
+
- -
SCEP
-

Use following as the enrollment URL: http://{{ window.location.hostname }}/cgi-bin/pkiclient.exe

- -
Copy & paste
- -

Use whatever tools you have available on your platform to generate - keypair and just paste ASCII armored PEM file contents here and hit submit:

- - -
-
-
- - +
+
+ + +
-
+