Merge branch 'master' of github.com:laurivosandi/certidude

certidude/api/__init__.py

@@ -16,7 +16,7 @@ from certidude.decorators import serialize, event_source, csrf_protection
 from cryptography.x509.oid import NameOID
 from certidude import const, config
 
-logger = logging.getLogger("api")
+logger = logging.getLogger(__name__)
 
 class CertificateStatusResource(object):
     """

certidude/api/attrib.py

@@ -7,7 +7,7 @@ from datetime import datetime
 from certidude import config, authority
 from certidude.decorators import serialize
 
-logger = logging.getLogger("api")
+logger = logging.getLogger(__name__)
 
 class AttributeResource(object):
     @serialize

certidude/api/bundle.py

@@ -3,7 +3,7 @@ import hashlib
 from certidude import config, authority
 from certidude.auth import login_required
 
-logger = logging.getLogger("api")
+logger = logging.getLogger(__name__)
 
 KEYWORDS = (
     (u"Android", u"android"),

certidude/api/cfg.py

@@ -9,8 +9,7 @@ from certidude.decorators import serialize
 from certidude.relational import RelationalMixin
 from jinja2 import Environment, FileSystemLoader
 
-logger = logging.getLogger("api")
-
+logger = logging.getLogger(__name__)
 env = Environment(loader=FileSystemLoader("/etc/certidude/scripts"), trim_blocks=True)
 
 SQL_SELECT_INHERITED = """

certidude/api/lease.py

@@ -1,5 +1,6 @@
 
 import click
+import logging
 import xattr
 from datetime import datetime
 from pyasn1.codec.der import decoder
@@ -7,6 +8,8 @@ from certidude import config, authority, push
 from certidude.auth import login_required, authorize_admin
 from certidude.decorators import serialize
 
+logger = logging.getLogger(__name__)
+
 # TODO: lease namespacing (?)
 
 class LeaseDetailResource(object):

certidude/api/request.py

@@ -19,7 +19,7 @@ from cryptography.exceptions import InvalidSignature
 from cryptography.x509.oid import NameOID
 from datetime import datetime
 
-logger = logging.getLogger("api")
+logger = logging.getLogger(__name__)
 
 class RequestListResource(object):
     @login_optional

certidude/api/revoked.py

@@ -9,7 +9,7 @@ from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.serialization import Encoding
 
-logger = logging.getLogger("api")
+logger = logging.getLogger(__name__)
 
 class RevocationListResource(object):
     def on_get(self, req, resp):

certidude/api/signed.py

@@ -7,7 +7,7 @@ from certidude import authority
 from certidude.auth import login_required, authorize_admin
 from certidude.decorators import csrf_protection
 
-logger = logging.getLogger("api")
+logger = logging.getLogger(__name__)
 
 class SignedCertificateDetailResource(object):
     def on_get(self, req, resp, cn):

certidude/api/tag.py

@@ -5,7 +5,7 @@ from certidude import authority, push
 from certidude.auth import login_required, authorize_admin
 from certidude.decorators import serialize, csrf_protection
 
-logger = logging.getLogger("api")
+logger = logging.getLogger(__name__)
 
 class TagResource(object):
     @serialize

certidude/cli.py

@@ -29,6 +29,7 @@ from jinja2 import Environment, PackageLoader
 from setproctitle import setproctitle
 import const
 
+logger = logging.getLogger(__name__)
 env = Environment(loader=PackageLoader("certidude", "templates"), trim_blocks=True)
 
 # http://www.mad-hacking.net/documentation/linux/security/ssl-tls/creating-ca.xml
@@ -863,7 +864,10 @@ def certidude_setup_authority(username, kerberos_keytab, nginx_config, country,
             ).not_valid_before(datetime.utcnow()
             ).not_valid_after(
                 datetime.utcnow() + timedelta(days=authority_lifetime)
-            ).serial_number(1
+            ).serial_number(
+                random.randint(
+                    0x100000000000000000000000000000000000000,
+                    0xfffffffffffffffffffffffffffffffffffffff)
             ).add_extension(x509.BasicConstraints(ca=True, path_length=0), critical=True,
             ).add_extension(x509.KeyUsage(
                 digital_signature=server_flags,
@@ -956,7 +960,6 @@ def certidude_list(verbose, show_key_type, show_extensions, show_path, show_sign
     #   r - revoked
 
     from certidude import authority
-    from pycountry import countries
 
     def dump_common(common_name, path, cert):
         click.echo("certidude revoke %s" % common_name)
@@ -980,7 +983,7 @@ def certidude_list(verbose, show_key_type, show_extensions, show_path, show_sign
             click.echo("=" * len(common_name))
             click.echo("State: ? " + click.style("submitted", fg="yellow") + " " + naturaltime(created) + click.style(", %s" %created,  fg="white"))
             click.echo("openssl req -in %s -text -noout" % path)
-            dump_common(common_name, path, cert)
+            dump_common(common_name, path, csr)
 
 
     if show_signed:
@@ -1061,6 +1064,7 @@ def certidude_serve(port, listen, fork):
     from certidude import const
     click.echo("Using configuration from: %s" % const.CONFIG_PATH)
 
+    log_handlers = []
 
     from certidude import config
 
@@ -1070,6 +1074,11 @@ def certidude_serve(port, listen, fork):
         _, _, uid, gid, gecos, root, shell = pwd.getpwnam("certidude")
         restricted_groups = []
         restricted_groups.append(gid)
+        from logging.handlers import RotatingFileHandler
+        rh = RotatingFileHandler("/var/log/certidude.log", maxBytes=1048576*5, backupCount=5)
+        rh.setFormatter(logging.Formatter("%(asctime)s - %(name)s - %(levelname)s - %(message)s"))
+        log_handlers.append(rh)
+
 
     """
     Spawn signer process
@@ -1168,8 +1177,6 @@ def certidude_serve(port, listen, fork):
 
 
     # Set up log handlers
-    log_handlers = []
-
     if config.LOGGING_BACKEND == "sql":
         from certidude.mysqllog import LogHandler
         from certidude.api.log import LogResource
@@ -1187,18 +1194,19 @@ def certidude_serve(port, listen, fork):
         from certidude.push import EventSourceLogHandler
         log_handlers.append(EventSourceLogHandler())
 
-    for facility in "api", "cli":
-        logger = logging.getLogger(facility)
-        logger.setLevel(logging.DEBUG)
+    for j in logging.Logger.manager.loggerDict.values():
+        if isinstance(j, logging.Logger): # PlaceHolder is what?
+            if j.name.startswith("certidude."):
+                j.setLevel(logging.DEBUG)
                 for handler in log_handlers:
-            logger.addHandler(handler)
+                    j.addHandler(handler)
 
 
     def exit_handler():
-        logging.getLogger("cli").debug("Shutting down Certidude")
+        logger.debug("Shutting down Certidude")
     import atexit
     atexit.register(exit_handler)
-    logging.getLogger("cli").debug("Started Certidude at %s", const.FQDN)
+    logger.debug("Started Certidude at %s", const.FQDN)
 
     if not fork or not os.fork():
         httpd.serve_forever()

tests/test_cli.py

@@ -13,7 +13,8 @@ def test_cli_setup_authority():
     from certidude import const, config
 
     from certidude import authority
-    assert authority.ca_cert.serial_number == 1
+    assert authority.ca_cert.serial_number >= 0x100000000000000000000000000000000000000
+    assert authority.ca_cert.serial_number <= 0xfffffffffffffffffffffffffffffffffffffff
     assert authority.ca_cert.not_valid_before < datetime.now()
     assert authority.ca_cert.not_valid_after > datetime.now() + timedelta(days=7000)
 
@@ -36,6 +37,9 @@ def test_cli_setup_authority():
     authority.store_request(
         csr.sign(key, hashes.SHA256(), default_backend()).public_bytes(serialization.Encoding.PEM))
 
+    result = runner.invoke(cli, ['list', '-srv'])
+    assert not result.exception
+
     result = runner.invoke(cli, ['sign', 'test', '-o'])
     assert not result.exception
 
@@ -44,3 +48,9 @@ def test_cli_setup_authority():
 
     authority.generate_ovpn_bundle(u"test2")
     authority.generate_pkcs12_bundle(u"test3")
+
+    result = runner.invoke(cli, ['list', '-srv'])
+    assert not result.exception
+
+    result = runner.invoke(cli, ['cron'])
+    assert not result.exception