/[smeserver]/rpms/e-smith-base/sme10/e-smith-base-5.8.0.bz8156.wildcard-certificate-and-subjaltname.patch
ViewVC logotype

Contents of /rpms/e-smith-base/sme10/e-smith-base-5.8.0.bz8156.wildcard-certificate-and-subjaltname.patch

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.1 - (show annotations) (download)
Mon May 25 02:32:01 2020 UTC (4 years, 5 months ago) by jpp
Branch: MAIN
CVS Tags: e-smith-base-5_8_0-71_el7_sme, e-smith-base-5_8_0-67_el7_sme, e-smith-base-5_8_0-64_el7_sme, e-smith-base-5_8_0-69_el7_sme, e-smith-base-5_8_0-70_el7_sme, e-smith-base-5_8_0-60_el7_sme, e-smith-base-5_8_0-65_el7_sme, e-smith-base-5_8_0-83_el7_sme, e-smith-base-5_8_0-96_el7_sme, e-smith-base-5_8_0-95_el7_sme, e-smith-base-5_8_0-80_el7_sme, e-smith-base-5_8_0-85_el7_sme, e-smith-base-5_8_0-50_el7_sme, e-smith-base-5_8_0-81_el7_sme, e-smith-base-5_8_0-82_el7_sme, e-smith-base-5_8_0-88_el7_sme, e-smith-base-5_8_0-54_el7_sme, e-smith-base-5_8_0-99_el7_sme, e-smith-base-5_8_0-94_el7_sme, e-smith-base-5_8_0-98_el7_sme, e-smith-base-5_8_0-97_el7_sme, e-smith-base-5_8_0-92_el7_sme, e-smith-base-5_8_0-75_el7_sme, e-smith-base-5_8_0-78_el7_sme, e-smith-base-5_8_0-90_el7_sme, e-smith-base-5_8_0-93_el7_sme, e-smith-base-5_8_0-55_el7_sme, e-smith-base-5_8_0-61_el7_sme, e-smith-base-5_8_0-52_el7_sme, e-smith-base-5_8_0-46_el7_sme, e-smith-base-5_8_0-62_el7_sme, e-smith-base-5_8_0-74_el7_sme, e-smith-base-5_8_0-77_el7_sme, e-smith-base-5_8_0-63_el7_sme, e-smith-base-5_8_0-73_el7_sme, e-smith-base-5_8_0-76_el7_sme, e-smith-base-5_8_0-79_el7_sme, e-smith-base-5_8_0-91_el7_sme, e-smith-base-5_8_0-58_el7_sme, e-smith-base-5_8_0-86_el7_sme, e-smith-base-5_8_0-47_el7_sme, e-smith-base-5_8_0-59_el7_sme, e-smith-base-5_8_0-87_el7_sme, e-smith-base-5_8_0-53_el7_sme, e-smith-base-5_8_0-44_el7_sme, e-smith-base-5_8_0-49_el7_sme, e-smith-base-5_8_0-48_el7_sme, e-smith-base-5_8_0-66_el7_sme, e-smith-base-5_8_0-68_el7_sme, e-smith-base-5_8_0-45_el7_sme, e-smith-base-5_8_0-72_el7_sme, e-smith-base-5_8_0-84_el7_sme, e-smith-base-5_8_0-89_el7_sme, e-smith-base-5_8_0-51_el7_sme
* Sun May 24 2020 Jean-Philipe Pialasse <tests@pialasse.com> 5.8.0-44.sme
- wildcard self-signed certificate [SME: 8156]
  * ip in self-signed certificate
  * subject altname in self-signed certificate
  * ability to define Country code and State using
    modSSL{Country} and modSSL{State} properties
  * /etc/openssl.conf is used now and templated for self-signed certificate

1 diff -Nur e-smith-base-5.8.0.old/createlinks e-smith-base-5.8.0/createlinks
2 --- e-smith-base-5.8.0.old/createlinks 2020-05-24 21:54:20.596000000 -0400
3 +++ e-smith-base-5.8.0/createlinks 2020-05-24 22:27:18.340000000 -0400
4 @@ -110,6 +110,17 @@
5 templates2events("/etc/updatedb.conf", qw(
6 bootstrap-console-save
7 ));
8 +templates2events("/etc/openssl.conf", qw(
9 + console-save
10 + bootstrap-console-save
11 + post-install
12 + post-upgrade
13 + domain-create
14 + domain-delete
15 + network-create
16 + network-delete
17 + ip-change
18 + ));
19
20 # conf-routes
21 event_link("update-ifcfg", "network-create", "05");
22 diff -Nur e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/05config e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/05config
23 --- e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/05config 1969-12-31 19:00:00.000000000 -0500
24 +++ e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/05config 2020-05-24 21:56:25.742000000 -0400
25 @@ -0,0 +1,38 @@
26 +{
27 +# use Data::Validate::IP;
28 + use Net::IP qw(ip_is_ipv4 ip_is_ipv6);
29 + our $KeySize = $modSSL{KeySize} ||'4096';
30 + our $FQDN = "$SystemName.$DomainName";
31 + our $Country = $modSSL{Country} || "--";
32 + our $State = $modSSL{State} || "----";
33 + our $commonName = $modSSL{CommonName} || $FQDN;
34 + our $crt = "/home/e-smith/ssl.crt/$FQDN.crt";
35 + our $key = "/home/e-smith/ssl.key/$FQDN.key";
36 + our $defaultCity = $ldap{defaultCity};
37 + our $defaultCompany = $ldap{defaultCompany};
38 + our $defaultDepartment = $ldap{defaultDepartment};
39 + our $email = "admin\@$DomainName";
40 + our @subjectAlt = `/sbin/e-smith/generate-subjectaltnames`;
41 + chomp @subjectAlt;
42 + our $subjectAltName = "";
43 + my $i=0;
44 + for my $elem (@subjectAlt) {
45 + $subjectAltName .= ", " if $i>0;
46 + $i++;
47 + if (ip_is_ipv4($elem) || ip_is_ipv6($elem) ){
48 + $subjectAltName .= "IP:$elem";
49 + next;
50 + }
51 + $subjectAltName .= "DNS:$elem";
52 + }
53 + $subjectAltName = ( $subjectAltName eq "DNS: ")? "": $subjectAltName;
54 +
55 + # crop fields that are too long for X509:
56 + $Country = substr($Country, 0, 2);
57 + $defaultCity = substr($defaultCity, 0, 128);
58 + $defaultCompany = substr($defaultCompany, 0, 64);
59 + $defaultDepartment = substr($defaultDepartment, 0, 64);
60 + $email = substr($email, 0, 64);
61 + $commonName = substr($commonName, 0, 64);
62 + $OUT="";
63 +}
64 diff -Nur e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/40req e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/40req
65 --- e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/40req 1969-12-31 19:00:00.000000000 -0500
66 +++ e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/40req 2020-05-24 21:56:25.790000000 -0400
67 @@ -0,0 +1,10 @@
68 +[ req ]
69 +default_bits = {$KeySize}
70 +prompt = no
71 +default_md = sha256
72 +default_keyfile = {$key}
73 +distinguished_name = req_distinguished_name
74 +attributes = req_attributes
75 +x509_extensions = v3_ca
76 +req_extensions = v3_req
77 +
78 diff -Nur e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/45req_distinguished_name e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/45req_distinguished_name
79 --- e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/45req_distinguished_name 1969-12-31 19:00:00.000000000 -0500
80 +++ e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/45req_distinguished_name 2020-05-24 21:56:25.817000000 -0400
81 @@ -0,0 +1,9 @@
82 +[ req_distinguished_name ]
83 +C = {$Country}
84 +ST = {$State}
85 +L = {$defaultCity}
86 +O = {$defaultCompany}
87 +OU = {$defaultDepartment}
88 +CN = {$commonName}
89 +emailAddress = {$email}
90 +
91 diff -Nur e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/47req_attributes e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/47req_attributes
92 --- e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/47req_attributes 1969-12-31 19:00:00.000000000 -0500
93 +++ e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/47req_attributes 2020-05-24 21:56:25.840000000 -0400
94 @@ -0,0 +1,3 @@
95 +[ req_attributes ]
96 +
97 +
98 diff -Nur e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/50v3_req e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/50v3_req
99 --- e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/50v3_req 1969-12-31 19:00:00.000000000 -0500
100 +++ e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/50v3_req 2020-05-24 21:56:25.864000000 -0400
101 @@ -0,0 +1,3 @@
102 +[ v3_req ]
103 +subjectAltName = {$subjectAltName}
104 +
105 diff -Nur e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/60v3_ca e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/60v3_ca
106 --- e-smith-base-5.8.0.old/root/etc/e-smith/templates/etc/openssl.conf/60v3_ca 1969-12-31 19:00:00.000000000 -0500
107 +++ e-smith-base-5.8.0/root/etc/e-smith/templates/etc/openssl.conf/60v3_ca 2020-05-24 21:56:25.902000000 -0400
108 @@ -0,0 +1,5 @@
109 +[ v3_ca ]
110 +subjectKeyIdentifier=hash
111 +authorityKeyIdentifier=keyid:always,issuer:always
112 +basicConstraints = CA:true
113 +
114 diff -Nur e-smith-base-5.8.0.old/root/etc/e-smith/templates/home/e-smith/ssl.crt e-smith-base-5.8.0/root/etc/e-smith/templates/home/e-smith/ssl.crt
115 --- e-smith-base-5.8.0.old/root/etc/e-smith/templates/home/e-smith/ssl.crt 2020-05-24 21:54:20.613000000 -0400
116 +++ e-smith-base-5.8.0/root/etc/e-smith/templates/home/e-smith/ssl.crt 2020-05-24 22:00:04.300000000 -0400
117 @@ -1,9 +1,12 @@
118 {
119 - use constant KEYLIFEINDAYS => 365;
120 + use constant KEYLIFEINDAYS => $modSSL{KeyLifeInDays} || 365;
121 use Date::Parse;
122 use Cwd;
123 + use Net::IP qw(ip_is_ipv4 ip_is_ipv6);
124 my $here = getcwd;
125
126 + my $Country = $modSSL{Country} || "--";
127 + my $State = $modSSL{State} || "----";
128 my $FQDN = "$SystemName.$DomainName";
129 my $commonName = $modSSL{CommonName} || $FQDN;
130 my $crt = "/home/e-smith/ssl.crt/$FQDN.crt";
131 @@ -12,8 +15,23 @@
132 my $defaultCompany = $ldap{defaultCompany};
133 my $defaultDepartment = $ldap{defaultDepartment};
134 my $email = "admin\@$DomainName";
135 -
136 + my @subjectAlt = `/sbin/e-smith/generate-subjectaltnames`;
137 + chomp @subjectAlt;
138 + our $subjectAltName = "";
139 + my $i=0;
140 + for my $elem (@subjectAlt) {
141 + $subjectAltName .= "," if $i>0;
142 + $i++;
143 + if (ip_is_ipv4($elem) || ip_is_ipv6($elem) ){
144 + $subjectAltName .= "IP Address:$elem";
145 + next;
146 + }
147 + $subjectAltName .= "DNS:$elem";
148 + }
149 + $subjectAltName = ( $subjectAltName eq "DNS: ")? "": $subjectAltName;
150 + chomp $subjectAltName;
151 # crop fields that are too long for X509:
152 + $Country = substr($Country, 0, 2);
153 $defaultCity = substr($defaultCity, 0, 128);
154 $defaultCompany = substr($defaultCompany, 0, 64);
155 $defaultDepartment = substr($defaultDepartment, 0, 64);
156 @@ -26,10 +44,12 @@
157 $expire =~ s/^notAfter=//;
158 $expire = str2time($expire);
159 my $ttl_days = ($expire - time()) / 60 / 60 / 24;
160 + my $crt_md5 = `openssl x509 -noout -modulus -in $crt | openssl md5`;
161 + my $key_md5 = `openssl rsa -noout -modulus -in $key | openssl md5`;
162
163 - if ( $ttl_days > 2 ) {
164 - my $expected_issuer = '/C=--' .
165 - '/ST=----';
166 + if ( ($ttl_days > 2) && ( "$crt_md5" eq "$key_md5" ) ) {
167 + my $expected_issuer = '/C='.$Country .
168 + '/ST='.$State;
169 $expected_issuer .= '/L=' . ($defaultCity ? $defaultCity : 'Default City');
170 $expected_issuer .= '/O=' . ($defaultCompany ? $defaultCompany : 'Default Company Ltd');
171 $expected_issuer .= "/OU=$defaultDepartment" if $defaultDepartment;
172 @@ -41,10 +61,15 @@
173 my $signatureAlg = `openssl x509 -text -noout -in $crt | grep "Signature Algorithm" | head -1`;
174 chomp $signatureAlg;
175 $signatureAlg =~ s/^ *Signature Algorithm: //;
176 -
177 +
178 + # Test for expected subjectAltName
179 + # openssl x509 -text -noout -in /etc/dehydrated/certs/itx.pialasse.com/cert.pem | sed -ne '/X509v3 Subject Alternative Name/{ N;s/^.*\n//;:a;s/^\( *\)\(.*\), /\2,\1/;ta;p;q; }'
180 + $expected_subjectAltName = `openssl x509 -text -noout -in $crt | sed -ne '/X509v3 Subject Alternative Name/{ N;s/^.*\\n//;:a;s/^\\( *\\)\\(.*\\), /\\2,\\1/;ta;p;q; }'`;
181 + chomp $expected_subjectAltName;
182 if (
183 ($issuer eq $expected_issuer)
184 && ($signatureAlg ne "sha1WithRSAEncryption")
185 + && ($subjectAltName eq $expected_subjectAltName)
186 )
187 {
188 # Old key file is still good. Read it out - processTemplate will work
189 @@ -70,38 +95,17 @@
190
191 unless (open(SSL,"-|"))
192 {
193 - my $pid = open(RSACERT, "|-");
194 - if ($pid)
195 - {
196 - # parent
197 -
198 - foreach (
199 - "--",
200 - "----",
201 - "$defaultCity",
202 - "$defaultCompany",
203 - "$defaultDepartment",
204 - "$commonName",
205 - "$email"
206 - )
207 - {
208 - print RSACERT "$_\n";
209 - }
210 - close(RSACERT) || die "RSACERT kid exited $?";
211 - exit (0);
212 - }
213 - else
214 - {
215 # child
216 exec("/usr/bin/openssl",
217 qw(req -new -key),
218 $key,
219 - qw(-sha256 -x509 -days), KEYLIFEINDAYS,
220 + qw( -sha256 -x509 -days), KEYLIFEINDAYS,
221 qw(-set_serial), time(),
222 + qw(-extensions v3_req),
223 + qw(-config), "/etc/openssl.conf"
224 )
225 || die "can't exec program: $!";
226 # NOTREACHED
227 - }
228 }
229 while (<SSL>)
230 {
231 diff -Nur e-smith-base-5.8.0.old/root/etc/e-smith/templates/home/e-smith/ssl.key e-smith-base-5.8.0/root/etc/e-smith/templates/home/e-smith/ssl.key
232 --- e-smith-base-5.8.0.old/root/etc/e-smith/templates/home/e-smith/ssl.key 2014-03-23 22:47:23.000000000 -0400
233 +++ e-smith-base-5.8.0/root/etc/e-smith/templates/home/e-smith/ssl.key 2020-05-24 22:02:57.282000000 -0400
234 @@ -2,18 +2,25 @@
235 use Cwd;
236 my $here = getcwd;
237
238 + my $KeySize = $modSSL{KeySize} ||'4096';
239 my $FQDN = "$SystemName.$DomainName";
240 my $key = "/home/e-smith/ssl.key/$FQDN.key";
241 if ( -f $key )
242 {
243 - # Old key file is still good. Read it out - processTemplate will work
244 - # out that it hasn't changed, and leave the old one in place
245 - open(K, "$key") or die "Couldn't open key file: $!";
246 - my @key = <K>;
247 - chomp @key;
248 - $OUT = join "\n", @key;
249 - close(K);
250 - return;
251 + # check key size openssl rsa -in /home/e-smith/ssl.key/sme10.test10.pialasse.com.key -text -noout | sed -rn "s/Private-Key: \((.*) bit\)/\1/p"
252 + my $signatureKeySize = `openssl rsa -in $key -text -noout | grep "Private-Key" | head -1`;
253 + chomp $signatureKeySize;
254 + $signatureKeySize =~ s/^ *Private-Key: \((.*) bit\)/$1/p;
255 + if ( $signatureKeySize == $KeySize ) {
256 + # Old key file is still good. Read it out - processTemplate will work
257 + # out that it hasn't changed, and leave the old one in place
258 + open(K, "$key") or die "Couldn't open key file: $!";
259 + my @key = <K>;
260 + chomp @key;
261 + $OUT = join "\n", @key;
262 + close(K);
263 + return;
264 + }
265 }
266 # go to somewhere private and safe where we can run programs
267 # as root
268 @@ -42,7 +49,7 @@
269 /proc/rtc
270 /proc/uptime
271 )),
272 - '2048')
273 + "$KeySize")
274 || die "can't exec program: $!";
275 }
276 while (<SSL>)
277 diff -Nur e-smith-base-5.8.0.old/root/etc/e-smith/templates/home/e-smith/ssl.pem/10openssl e-smith-base-5.8.0/root/etc/e-smith/templates/home/e-smith/ssl.pem/10openssl
278 --- e-smith-base-5.8.0.old/root/etc/e-smith/templates/home/e-smith/ssl.pem/10openssl 1969-12-31 19:00:00.000000000 -0500
279 +++ e-smith-base-5.8.0/root/etc/e-smith/templates/home/e-smith/ssl.pem/10openssl 2020-05-24 22:26:40.181000000 -0400
280 @@ -0,0 +1,13 @@
281 +{
282 + $OUT = '';
283 + # if key is defined, we do not need to geenrate a self signed certificate
284 + # so we do not need to expand openssl.conf
285 + my $key = $modSSL{'key'};
286 + unless ($key)
287 + {
288 + use esmith::templates;
289 + esmith::templates::processTemplate({
290 + TEMPLATE_PATH => "/etc/openssl.conf"
291 + });
292 + }
293 +}
294 diff -Nur e-smith-base-5.8.0.old/root/sbin/e-smith/generate-subjectaltnames e-smith-base-5.8.0/root/sbin/e-smith/generate-subjectaltnames
295 --- e-smith-base-5.8.0.old/root/sbin/e-smith/generate-subjectaltnames 1969-12-31 19:00:00.000000000 -0500
296 +++ e-smith-base-5.8.0/root/sbin/e-smith/generate-subjectaltnames 2020-05-24 21:59:09.488000000 -0400
297 @@ -0,0 +1,91 @@
298 +#!/usr/bin/perl -w
299 +
300 +#----------------------------------------------------------------------
301 +#
302 +# generate-subjectaltnames
303 +#
304 +# This script returns a list of hostnames and IP addresses that
305 +# can be used to construct the list of subjectAltName entries
306 +# for a web server certificate.
307 +#
308 +# Usage: generate-subjectaltnames
309 +#
310 +# Copyright 1999-2003 Mitel Networks Corporation
311 +# This program is free software; you can redistribute it and/or
312 +# modify it under the same terms as Perl itself.
313 +#
314 +#----------------------------------------------------------------------
315 +
316 +use esmith::ConfigDB;
317 +
318 +my $configuration = esmith::ConfigDB->open_ro('configuration')
319 + or die "Couldn't open configuration DB\n";
320 +
321 +my %results_dict = ();
322 +
323 +#----------------------------------------------------------------------
324 +# Add FQDN, system name and the domain name.
325 +#----------------------------------------------------------------------
326 +
327 +$SystemName = $configuration->get('SystemName')->value;
328 +$DomainName = $configuration->get('DomainName')->value;
329 +
330 +$results_dict{$SystemName . '.' . $DomainName} = 1;
331 +$results_dict{$SystemName} = 1;
332 +$results_dict{$DomainName} = 1;
333 +
334 +#----------------------------------------------------------------------
335 +# Add a wildcard entry for domain name.
336 +#----------------------------------------------------------------------
337 +
338 +$results_dict{'*.' . $DomainName} = 1;
339 +
340 +#----------------------------------------------------------------------
341 +# Add IP addresses for the various interfaces.
342 +#----------------------------------------------------------------------
343 +
344 +foreach $Interface ('InternalInterface',
345 + 'ExternalInterface',
346 + 'ExternalInterface2')
347 +{
348 + $Interface_Record = $configuration->get($Interface);
349 + if ($Interface_Record)
350 + {
351 + if ($Interface_Record->prop('Configuration') eq 'static')
352 + {
353 + if ($Interface_Record->prop('IPAddress'))
354 + {
355 + $results_dict{$Interface_Record->prop('IPAddress')} = 1;
356 + }
357 + }
358 + }
359 +}
360 +
361 +#----------------------------------------------------------------------
362 +# Add any alternate names specified in the modSSL config DB.
363 +#----------------------------------------------------------------------
364 +
365 +$modSSL = $configuration->get('modSSL');
366 +if ($modSSL)
367 +{
368 + $AlternateNames = $modSSL->prop('AlternateNames');
369 + if ($AlternateNames)
370 + {
371 + foreach $AlternateName (split(',', $AlternateNames))
372 + {
373 + $AlternateName =~ s/\s//g;
374 + $results_dict{$AlternateName} = 1;
375 + }
376 + }
377 +}
378 +
379 +#----------------------------------------------------------------------
380 +# Output the sorted list of entries.
381 +#----------------------------------------------------------------------
382 +
383 +foreach (sort keys %results_dict)
384 +{
385 + print "$_\n";
386 +}
387 +
388 +exit(0);

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed