def _csr_check(self, csr):
""" check CSR against definied whitelists """
self.logger.debug('CAhandler._csr_check()')
if self.allowed_domainlist:
result = False
# get sans and build a list
_san_list = csr_san_get(self.logger, csr)
check_list = []
san_list = []
if _san_list:
for san in _san_list:
try:
# SAN list must be modified/filtered)
(_san_type, san_value) = san.lower().split(':')
san_list.append(san_value)
except Exception:
# force check to fail as something went wrong during parsing
check_list.append(False)
self.logger.debug(
'CAhandler._csr_check(): san_list parsing failed at entry: {0}'
.format(san))
# get common name and attach it to san_list
cn_ = csr_cn_get(self.logger, csr)
if cn_:
cn_ = cn_.lower()
if cn_ not in san_list:
# append cn to san_list
self.logger.debug(
'Ahandler._csr_check(): append cn to san_list')
san_list.append(cn_)
# go over the san list and check each entry
for san in san_list:
check_list.append(
self._list_check(san, self.allowed_domainlist))
if check_list:
# cover a cornercase with empty checklist (no san, no cn)
if False in check_list:
result = False
else:
result = True
else:
result = True
self.logger.debug(
'CAhandler._csr_check() ended with: {0}'.format(result))
return result
def _requestname_get(self, csr):
""" enroll certificate """
self.logger.debug('CAhandler._request_name_get()')
# try to get cn for a name in database
request_name = csr_cn_get(self.logger, csr)
if not request_name:
san_list = csr_san_get(self.logger, csr)
try:
(_identifiier, request_name,) = san_list[0].split(':')
except BaseException:
pass
self.logger.debug('CAhandler._request_name_get() ended with: {0}'.format(request_name))
return request_name
def enroll(self, csr):
""" enroll certificate from NCLM """
self.logger.debug('CAhandler.enroll()')
cert_bundle = None
error = None
cert_raw = None
# recode csr
csr = b64_url_recode(self.logger, csr)
if not self.error:
if self.tsg_info_dic['id']:
ca_id = self._ca_id_lookup()
if ca_id and self.template_info_dic[
'name'] and not self.template_info_dic['id']:
self._template_id_lookup()
# get common name of CSR
csr_cn = csr_cn_get(self.logger, csr)
csr_san_list = csr_san_get(self.logger, csr)
# import csr to NCLM
self._request_import(csr)
# lookup csr id
csr_id = self._csr_id_lookup(csr_cn, csr_san_list)
if ca_id and csr_id and self.tsg_info_dic['id']:
data_dic = {
"targetSystemGroupID": self.tsg_info_dic['id'],
"caID": ca_id,
"requestID": csr_id
}
# add template if correctly configured
if 'id' in self.template_info_dic and self.template_info_dic[
'id']:
data_dic['templateID'] = self.template_info_dic['id']
self._api_post(
self.api_host + '/targetsystemgroups/' +
str(self.tsg_info_dic['id']) + '/enroll/ca/' +
str(ca_id), data_dic)
# wait for certificate enrollment to get finished
time.sleep(self.wait_interval)
cert_id = self._cert_id_lookup(csr_cn, csr_san_list)
if cert_id:
(error, cert_bundle,
cert_raw) = self._cert_bundle_build(cert_id)
else:
error = 'certifcate id lookup failed for: {0}, {1}'.format(
csr_cn, csr_san_list)
self.logger.error(
'CAhandler.eroll(): certifcate id lookup failed for: {0}, {1}'
.format(csr_cn, csr_san_list))
else:
error = 'enrollment aborted. ca_id: {0}, csr_id: {1}, tsg_id: {2}'.format(
ca_id, csr_id, self.tsg_info_dic['id'])
self.logger.error(
'CAhandler.eroll(): enrollment aborted. ca_id: {0}, csr_id: {1}, tsg_id: {2}'
.format(ca_id, csr_id, self.tsg_info_dic['id']))
else:
error = 'CAhandler.eroll(): ID lookup for targetSystemGroup "{0}" failed.'.format(
self.tsg_info_dic['name'])
else:
self.logger.error(self.error)
self.logger.debug('CAhandler.enroll() ended')
return (error, cert_bundle, cert_raw, None)