cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

crypto/openssl_*: Standardize implementaton and add support keyUsage, extenededKeyUsage (#27281)

Browse source 
* openssl_csr: make subjectAltNames a list

* csr module now uses the new standard way to build openssl crypto modules

* add check functions for subject and subjectAltNames

* added support for keyUsage and extendedKeyUsage

* check if CSR signature is correct (aka the privatekey belongs to the CSR)

* fixes for first PR review

* fixes for second PR review

* openssl_csr: there is no need to pass on privatekey as it can be accessed directly

* openssl_csr: documentation fixes
This commit is contained in:
Christian Pointner 2017-08-03 13:27:17 +02:00 committed by John R Barker
parent e0f482a8c5
commit 1ce2bf56a2
2 changed files with 192 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
lib/ansible/module_utils/crypto.py
View file

@ -84,6 +84,39 @@ def load_certificate(path):
raise OpenSSLObjectError(exc)
def load_certificate_request(path):
"""Load the specified certificate signing request."""
try:
csr_content = open(path, 'rb').read()
csr = crypto.load_certificate_request(crypto.FILETYPE_PEM, csr_content)
return csr
except (IOError, OSError) as exc:
raise OpenSSLObjectError(exc)
keyUsageLong = {
"digitalSignature": "Digital Signature",
"nonRepudiation": "Non Repudiation",
"keyEncipherment": "Key Encipherment",
"dataEncipherment": "Data Encipherment",
"keyAgreement": "Key Agreement",
"keyCertSign": "Certificate Sign",
"cRLSign": "CRL Sign",
"encipherOnly": "Encipher Only",
"decipherOnly": "Decipher Only",
}
extendedKeyUsageLong = {
"serverAuth": "TLS Web Server Authentication",
"clientAuth": "TLS Web Client Authentication",
"codeSigning": "Code Signing",
"emailProtection": "E-mail Protection",
"timeStamping": "Time Stamping",
"OCSPSigning": "OCSP Signing",
}
@six.add_metaclass(abc.ABCMeta)
class OpenSSLObject(object):

209
lib/ansible/modules/crypto/openssl_csr.py
View file

@ -21,9 +21,10 @@ version_added: "2.4"
short_description: Generate OpenSSL Certificate Signing Request (CSR)
description:
- "This module allows one to (re)generates OpenSSL certificate signing requests.
It uses the pyOpenSSL python library to interact with openssl. This module support
the subjectAltName extension. Note: At least one of commonName or subjectAltName must
be specified. This module uses file common arguments to specify generated file permissions."
It uses the pyOpenSSL python library to interact with openssl. This module supports
the subjectAltName as well as the keyUsage and extendedKeyUsage extensions.
Note: At least one of commonName or subjectAltName must be specified.
This module uses file common arguments to specify generated file permissions."
requirements:
- "python-pyOpenSSL"
options:
@ -62,10 +63,6 @@ options:
required: true
description:
- Name of the folder in which the generated OpenSSL certificate signing request will be written
subjectAltName:
required: false
description:
- SAN extension to attach to the certificate signing request
countryName:
required: false
aliases: [ 'C' ]
@ -101,6 +98,29 @@ options:
aliases: [ 'E' ]
description:
- emailAddress field of the certificate signing request subject
subjectAltName:
required: false
description:
- SAN extension to attach to the certificate signing request
- This can either be a 'comma separated string' or a YAML list.
keyUsage:
required: false
description:
- This defines the purpose (e.g. encipherment, signature, certificate signing)
of the key contained in the certificate.
- This can either be a 'comma separated string' or a YAML list.
extendedKeyUsage:
required: false
aliases: [ 'extKeyUsage' ]
description:
- Additional restrictions (e.g. client authentication, server authentication)
on the allowed purposes for which the public key may be used.
- This can either be a 'comma separated string' or a YAML list.
notes:
- "If the certificate signing request already exists it will be checked whether subjectAltName,
keyUsage and extendedKeyUsage only contain the requested values and if the request was signed
by the given private key"
'''
@ -140,11 +160,27 @@ EXAMPLES = '''
privatekey_path: /etc/ssl/private/ansible.com.pem
force: True
commonName: www.ansible.com
# Generate an OpenSSL Certificate Signing Request with special key usages
- openssl_csr:
path: /etc/ssl/csr/www.ansible.com.csr
privatekey_path: /etc/ssl/private/ansible.com.pem
commonName: www.ansible.com
keyUsage:
- digitlaSignature
- keyAgreement
extKeyUsage:
- clientAuth
'''
RETURN = '''
csr:
privatekey:
description: Path to the TLS/SSL private key the CSR was generated for
returned: changed or success
type: string
sample: /etc/ssl/private/ansible.com.pem
filename:
description: Path to the generated Certificate Signing Request
returned: changed or success
type: string
@ -157,13 +193,26 @@ subject:
subjectAltName:
description: The alternative names this CSR is valid for
returned: changed or success
type: string
sample: 'DNS:www.ansible.com,DNS:m.ansible.com'
type: list
sample: [ 'DNS:www.ansible.com', 'DNS:m.ansible.com' ]
keyUsage:
description: Purpose for which the public key may be used
returned: changed or success
type: list
sample: [ 'digitalSignature', 'keyAgreement' ]
extendedKeyUsage:
description: Additional restriction on the public key purposes
returned: changed or success
type: list
sample: [ 'clientAuth' ]
'''
import errno
import os
from ansible.module_utils import crypto as crypto_utils
from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils._text import to_native
try:
from OpenSSL import crypto
except ImportError:
@ -171,27 +220,27 @@ except ImportError:
else:
pyopenssl_found = True
from ansible.module_utils import crypto as crypto_utils
from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils._text import to_native
class CertificateSigningRequestError(Exception):
class CertificateSigningRequestError(crypto_utils.OpenSSLObjectError):
pass
class CertificateSigningRequest(object):
class CertificateSigningRequest(crypto_utils.OpenSSLObject):
def __init__(self, module):
self.state = module.params['state']
super(CertificateSigningRequest, self).__init__(
module.params['path'],
module.params['state'],
module.params['force'],
module.check_mode
)
self.digest = module.params['digest']
self.force = module.params['force']
self.subjectAltName = module.params['subjectAltName']
self.path = module.params['path']
self.privatekey_path = module.params['privatekey_path']
self.privatekey_passphrase = module.params['privatekey_passphrase']
self.version = module.params['version']
self.changed = True
self.subjectAltName = module.params['subjectAltName']
self.keyUsage = module.params['keyUsage']
self.extendedKeyUsage = module.params['extendedKeyUsage']
self.request = None
self.privatekey = None
@ -205,15 +254,15 @@ class CertificateSigningRequest(object):
'emailAddress': module.params['emailAddress'],
}
if self.subjectAltName is None:
self.subjectAltName = 'DNS:%s' % self.subject['CN']
if not self.subjectAltName:
self.subjectAltName = ['DNS:%s' % self.subject['CN']]
self.subject = dict((k, v) for k, v in self.subject.items() if v)
def generate(self, module):
'''Generate the certificate signing request.'''
if not os.path.exists(self.path) or self.force:
if not self.check(module, perms_required=False) or self.force:
req = crypto.X509Req()
req.set_version(self.version)
subject = req.get_subject()
@ -221,13 +270,18 @@ class CertificateSigningRequest(object):
if value is not None:
setattr(subject, key, value)
if self.subjectAltName is not None:
req.add_extensions([crypto.X509Extension(b"subjectAltName", False, self.subjectAltName.encode('ascii'))])
altnames = ', '.join(self.subjectAltName)
extensions = [crypto.X509Extension(b"subjectAltName", False, altnames.encode('ascii'))]
self.privatekey = crypto_utils.load_privatekey(
self.privatekey_path,
self.privatekey_passphrase
)
if self.keyUsage:
usages = ', '.join(self.keyUsage)
extensions.append(crypto.X509Extension(b"keyUsage", False, usages.encode('ascii')))
if self.extendedKeyUsage:
usages = ', '.join(self.extendedKeyUsage)
extensions.append(crypto.X509Extension(b"extendedKeyUsage", False, usages.encode('ascii')))
req.add_extensions(extensions)
req.set_pubkey(self.privatekey)
req.sign(self.privatekey, self.digest)
@ -239,31 +293,86 @@ class CertificateSigningRequest(object):
csr_file.close()
except (IOError, OSError) as exc:
raise CertificateSigningRequestError(exc)
else:
self.changed = False
self.changed = True
file_args = module.load_file_common_arguments(module.params)
if module.set_fs_attributes_if_different(file_args, False):
self.changed = True
def remove(self):
'''Remove the Certificate Signing Request.'''
def check(self, module, perms_required=True):
"""Ensure the resource is in its desired state."""
state_and_perms = super(CertificateSigningRequest, self).check(module, perms_required)
try:
os.remove(self.path)
except OSError as exc:
if exc.errno != errno.ENOENT:
raise CertificateSigningRequestError(exc)
self.privatekey = crypto_utils.load_privatekey(self.privatekey_path, self.privatekey_passphrase)
def _check_subject(csr):
subject = csr.get_subject()
for (key, value) in self.subject.items():
if getattr(subject, key, None) != value:
return False
return True
def _check_subjectAltName(extensions):
altnames_ext = next((ext.__str__() for ext in extensions if ext.get_short_name() == b'subjectAltName'), '')
altnames = [altname.strip() for altname in altnames_ext.split(',')]
# apperently openssl returns 'IP address' not 'IP' as specifier when converting the subjectAltName to string
# although it won't accept this specifier when generating the CSR. (https://github.com/openssl/openssl/issues/4004)
altnames = [name if not name.startswith('IP Address:') else "IP:" + name.split(':', 1)[1] for name in altnames]
if self.subjectAltName:
if set(altnames) != set(self.subjectAltName):
return False
else:
self.changed = False
if altnames:
return False
return True
def _check_keyUsage_(extensions, extName, expected, long):
usages_ext = [str(ext) for ext in extensions if ext.get_short_name() == extName]
if (not usages_ext and expected) or (usages_ext and not expected):
return False
elif not usages_ext and not expected:
return True
else:
current = [usage.strip() for usage in usages_ext[0].split(',')]
expected = [long[usage] if usage in long else usage for usage in expected]
return current == expected
def _check_keyUsage(extensions):
return _check_keyUsage_(extensions, b'keyUsage', self.keyUsage, crypto_utils.keyUsageLong)
def _check_extenededKeyUsage(extensions):
return _check_keyUsage_(extensions, b'extendedKeyUsage', self.extendedKeyUsage, crypto_utils.extendedKeyUsageLong)
def _check_extensions(csr):
extensions = csr.get_extensions()
return _check_subjectAltName(extensions) and _check_keyUsage(extensions) and _check_extenededKeyUsage(extensions)
def _check_signature(csr):
try:
return csr.verify(self.privatekey)
except crypto.Error:
return False
if not state_and_perms:
return False
csr = crypto_utils.load_certificate_request(self.path)
return _check_subject(csr) and _check_extensions(csr) and _check_signature(csr)
def dump(self):
'''Serialize the object into a dictionary.'''
result = {
'csr': self.path,
'privatekey': self.privatekey_path,
'filename': self.path,
'subject': self.subject,
'subjectAltName': self.subjectAltName,
'keyUsage': self.keyUsage,
'extendedKeyUsage': self.extendedKeyUsage,
'changed': self.changed
}
@ -279,7 +388,6 @@ def main():
privatekey_passphrase=dict(type='str', no_log=True),
version=dict(default='3', type='int'),
force=dict(default=False, type='bool'),
subjectAltName=dict(aliases=['subjectAltName'], type='str'),
path=dict(required=True, type='path'),
countryName=dict(aliases=['C'], type='str'),
stateOrProvinceName=dict(aliases=['ST'], type='str'),
@ -288,6 +396,9 @@ def main():
organizationalUnitName=dict(aliases=['OU'], type='str'),
commonName=dict(aliases=['CN'], type='str'),
emailAddress=dict(aliases=['E'], type='str'),
subjectAltName=dict(type='list'),
keyUsage=dict(type='list'),
extendedKeyUsage=dict(aliases=['extKeyUsage'], type='list'),
),
add_file_common_args=True,
supports_check_mode=True,
@ -297,11 +408,9 @@ def main():
if not pyopenssl_found:
module.fail_json(msg='the python pyOpenSSL module is required')
path = module.params['path']
base_dir = os.path.dirname(module.params['path'])
if not os.path.isdir(base_dir):
module.fail_json(name=path, msg='The directory %s does not exist' % path)
module.fail_json(name=base_dir, msg='The directory %s does not exist or the file is not a directory' % base_dir)
csr = CertificateSigningRequest(module)
@ -309,24 +418,24 @@ def main():
if module.check_mode:
result = csr.dump()
result['changed'] = module.params['force'] or not os.path.exists(path)
result['changed'] = module.params['force'] or not csr.check(module)
module.exit_json(**result)
try:
csr.generate(module)
except CertificateSigningRequestError as exc:
except (CertificateSigningRequestError, crypto_utils.OpenSSLObjectError) as exc:
module.fail_json(msg=to_native(exc))
else:
if module.check_mode:
result = csr.dump()
result['changed'] = os.path.exists(path)
result['changed'] = os.path.exists(module.params['path'])
module.exit_json(**result)
try:
csr.remove()
except CertificateSigningRequestError as exc:
except (CertificateSigningRequestError, crypto_utils.OpenSSLObjectError) as exc:
module.fail_json(msg=to_native(exc))
result = csr.dump()