Refactor algorithm reporting via /api/bootstrap
This commit is contained in:
parent
f7017b9eed
commit
25fe6f36cc
@ -6,6 +6,17 @@ from pinecrypt.server.mongolog import LogHandler
|
|||||||
|
|
||||||
logger = LogHandler()
|
logger = LogHandler()
|
||||||
|
|
||||||
|
# Algorithm mappings for pki.js
|
||||||
|
SIGNATURE_ALGO_MAPPING = {
|
||||||
|
"rsassa_pkcs1v15": "RSASSA-PKCS1-v1_5",
|
||||||
|
"ecdsa": "ECDSA",
|
||||||
|
}
|
||||||
|
|
||||||
|
HASH_ALGO_MAPPING = {
|
||||||
|
"sha256": "SHA-256",
|
||||||
|
"sha384": "SHA-384",
|
||||||
|
"sha512": "SHA-512",
|
||||||
|
}
|
||||||
|
|
||||||
class BootstrapResource(object):
|
class BootstrapResource(object):
|
||||||
@serialize
|
@serialize
|
||||||
@ -33,8 +44,8 @@ class BootstrapResource(object):
|
|||||||
certificate=dict(
|
certificate=dict(
|
||||||
key_size=const.KEY_SIZE,
|
key_size=const.KEY_SIZE,
|
||||||
curve=const.CURVE_NAME,
|
curve=const.CURVE_NAME,
|
||||||
hash_algorithm=const.CERTIFICATE_HASH_ALGORITHM,
|
hash_algorithm=HASH_ALGO_MAPPING[authority.certificate.hash_algo],
|
||||||
key_type_specific = const.KEY_TYPE_SPECIFIC,
|
signature_algorithm=SIGNATURE_ALGO_MAPPING[authority.certificate.signature_algo],
|
||||||
algorithm=authority.public_key.algorithm,
|
algorithm=authority.public_key.algorithm,
|
||||||
common_name=authority.certificate.subject.native["common_name"],
|
common_name=authority.certificate.subject.native["common_name"],
|
||||||
distinguished_name=cert_to_dn(authority.certificate),
|
distinguished_name=cert_to_dn(authority.certificate),
|
||||||
|
@ -55,7 +55,7 @@ def self_enroll(skip_notify=False):
|
|||||||
return
|
return
|
||||||
|
|
||||||
builder = CSRBuilder({"common_name": common_name}, self_public_key)
|
builder = CSRBuilder({"common_name": common_name}, self_public_key)
|
||||||
builder.hash_algo = const.CERTIFICATE_HASH_ALGORITHM
|
builder.hash_algo = certificate.hash_algo # Copy from CA cert
|
||||||
request = builder.build(private_key)
|
request = builder.build(private_key)
|
||||||
|
|
||||||
now = datetime.utcnow().replace(tzinfo=pytz.UTC)
|
now = datetime.utcnow().replace(tzinfo=pytz.UTC)
|
||||||
@ -390,9 +390,7 @@ def sign(profile, skip_notify=False, overwrite=False, signer=None, namespace=con
|
|||||||
builder = CertificateBuilder(cn_to_dn(common_name,
|
builder = CertificateBuilder(cn_to_dn(common_name,
|
||||||
ou=profile["ou"]), csr_pubkey)
|
ou=profile["ou"]), csr_pubkey)
|
||||||
builder.serial_number = generate_serial()
|
builder.serial_number = generate_serial()
|
||||||
|
builder.hash_algo = certificate.hash_algo # Copy hash algorithm from CA cert
|
||||||
if csr["signature_algorithm"].hash_algo == const.CERTIFICATE_HASH_ALGORITHM:
|
|
||||||
builder.hash_algo = const.CERTIFICATE_HASH_ALGORITHM
|
|
||||||
|
|
||||||
now = datetime.utcnow().replace(tzinfo=pytz.UTC)
|
now = datetime.utcnow().replace(tzinfo=pytz.UTC)
|
||||||
builder.begin_date = now - const.CLOCK_SKEW_TOLERANCE
|
builder.begin_date = now - const.CLOCK_SKEW_TOLERANCE
|
||||||
|
@ -35,14 +35,6 @@ REPLICAS = [j for j in os.getenv("REPLICAS", "").split(",") if j]
|
|||||||
if not MONGO_URI:
|
if not MONGO_URI:
|
||||||
MONGO_URI = "mongodb://127.0.0.1:27017/default?replicaSet=rs0"
|
MONGO_URI = "mongodb://127.0.0.1:27017/default?replicaSet=rs0"
|
||||||
|
|
||||||
# Are set later, based on key type
|
|
||||||
KEY_SIZE = None
|
|
||||||
CURVE_NAME = None
|
|
||||||
KEY_TYPE_CLIENTS = None
|
|
||||||
|
|
||||||
# python CSRbuilder supports right now sha1, sha256 sha512
|
|
||||||
CERTIFICATE_HASH_ALGORITHM = "sha512"
|
|
||||||
|
|
||||||
# Kerberos-like clock skew tolerance
|
# Kerberos-like clock skew tolerance
|
||||||
CLOCK_SKEW_TOLERANCE = timedelta(minutes=5)
|
CLOCK_SKEW_TOLERANCE = timedelta(minutes=5)
|
||||||
|
|
||||||
@ -105,14 +97,12 @@ AUTHORITY_OCSP_URL = "http://%s/api/ocsp/" % AUTHORITY_NAMESPACE
|
|||||||
AUTHORITY_OCSP_DISABLED = os.getenv("AUTHORITY_OCSP_DISABLED", False)
|
AUTHORITY_OCSP_DISABLED = os.getenv("AUTHORITY_OCSP_DISABLED", False)
|
||||||
AUTHORITY_KEYTYPE = getenv_in("AUTHORITY_KEYTYPE", "rsa", "ec")
|
AUTHORITY_KEYTYPE = getenv_in("AUTHORITY_KEYTYPE", "rsa", "ec")
|
||||||
|
|
||||||
if AUTHORITY_KEYTYPE == "rsa":
|
|
||||||
KEY_SIZE = 4096
|
|
||||||
# Keytype for web JS pki.js wants specific key type
|
|
||||||
KEY_TYPE_SPECIFIC = "RSASSA-PKCS1-v1_5"
|
|
||||||
|
|
||||||
if AUTHORITY_KEYTYPE == "ec":
|
# Key parameter defaults for now
|
||||||
CURVE_NAME = "secp384r1"
|
# Subject to change in future, make sure changing these won't break any existing deployments!
|
||||||
KEY_TYPE_SPECIFIC = "ECDSA"
|
KEY_SIZE = 4096 # Key size for RSA based certificates
|
||||||
|
CURVE_NAME = "secp384r1" # Curve name for EC based certificates
|
||||||
|
CERTIFICATE_HASH_ALGORITHM = "sha512" # Certificate hashing algorithm
|
||||||
|
|
||||||
# Tokens
|
# Tokens
|
||||||
TOKEN_URL = "https://%(authority_name)s/#action=enroll&title=dev.lan&token=%(token)s&subject=%(subject_username)s&protocols=%(protocols)s"
|
TOKEN_URL = "https://%(authority_name)s/#action=enroll&title=dev.lan&token=%(token)s&subject=%(subject_username)s&protocols=%(protocols)s"
|
||||||
|
Loading…
Reference in New Issue
Block a user