From 6aedd3b0d821adaf04b89cb7c958622c47d4f61f Mon Sep 17 00:00:00 2001 From: sayali Date: Tue, 25 Aug 2020 18:40:36 -0700 Subject: [PATCH 01/28] Datepicker enhancements --- lemur/certificates/models.py | 2 -- .../certificates/certificate/tracking.tpl.html | 4 +++- .../app/angular/certificates/services.js | 18 ++++++++++-------- .../angular/pending_certificates/services.js | 16 +++++++++------- 4 files changed, 22 insertions(+), 18 deletions(-) diff --git a/lemur/certificates/models.py b/lemur/certificates/models.py index 5f6c4ba9..9d4cda34 100644 --- a/lemur/certificates/models.py +++ b/lemur/certificates/models.py @@ -317,8 +317,6 @@ class Certificate(db.Model): if self.name.lower() in [ca.lower() for ca in public_CA]: return current_app.config.get("PUBLIC_CA_MAX_VALIDITY_DAYS", 397) - return current_app.config.get("DEFAULT_MAX_VALIDITY_DAYS", 1095) # 3 years default - @property def subject(self): return self.parsed_cert.subject diff --git a/lemur/static/app/angular/certificates/certificate/tracking.tpl.html b/lemur/static/app/angular/certificates/certificate/tracking.tpl.html index 07d6b0f4..6b2edee6 100644 --- a/lemur/static/app/angular/certificates/certificate/tracking.tpl.html +++ b/lemur/static/app/angular/certificates/certificate/tracking.tpl.html @@ -96,7 +96,7 @@ Certificate Authority
- + {{$select.selected.name}} -
-
-
-
+
-
+
Date: Mon, 31 Aug 2020 18:20:32 -0700 Subject: [PATCH 04/28] Logs during cert validity truncate for digicert --- lemur/plugins/lemur_digicert/plugin.py | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/lemur/plugins/lemur_digicert/plugin.py b/lemur/plugins/lemur_digicert/plugin.py index fd8c4e2d..4bd11bc8 100644 --- a/lemur/plugins/lemur_digicert/plugin.py +++ b/lemur/plugins/lemur_digicert/plugin.py @@ -18,8 +18,9 @@ import json import arrow import pem import requests +import sys from cryptography import x509 -from flask import current_app +from flask import current_app, g from lemur.common.utils import validate_conf from lemur.extensions import metrics from lemur.plugins import lemur_digicert as digicert @@ -129,6 +130,9 @@ def map_fields(options, csr): data["validity_years"] = determine_validity_years(options.get("validity_years")) elif options.get("validity_end"): data["custom_expiration_date"] = determine_end_date(options.get("validity_end")).format("YYYY-MM-DD") + # check if validity got truncated. If resultant validity is not equal to requested validity, it just got truncated + if data["custom_expiration_date"] != options.get("validity_end"): + log_validity_truncation(options, f"{__name__}.{sys._getframe().f_code.co_name}") else: data["validity_years"] = determine_validity_years(0) @@ -154,6 +158,9 @@ def map_cis_fields(options, csr): validity_end = determine_end_date(arrow.utcnow().shift(years=options["validity_years"])) elif options.get("validity_end"): validity_end = determine_end_date(options.get("validity_end")) + # check if validity got truncated. If resultant validity is not equal to requested validity, it just got truncated + if validity_end != options.get("validity_end"): + log_validity_truncation(options, f"{__name__}.{sys._getframe().f_code.co_name}") else: validity_end = determine_end_date(False) @@ -178,6 +185,16 @@ def map_cis_fields(options, csr): return data +def log_validity_truncation(options, function): + log_data = { + "cn": options["common_name"], + "creator": g.user.username + } + metrics.send("digicert_validity_truncated", "counter", 1, metric_tags=log_data) + + log_data["function"] = function + log_data["message"] = "Digicert Plugin truncated the validity of certificate, cn = {0}".format(options["common_name"]) + current_app.logger.info(log_data) def handle_response(response): """ From 8ad4448c85d7e1c15ab4dba404aa92c00bfe8fbf Mon Sep 17 00:00:00 2001 From: sayali Date: Tue, 1 Sep 2020 12:44:49 -0700 Subject: [PATCH 05/28] Match date format for comparison + expected new lines --- lemur/plugins/lemur_digicert/plugin.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lemur/plugins/lemur_digicert/plugin.py b/lemur/plugins/lemur_digicert/plugin.py index 4bd11bc8..ad4272dc 100644 --- a/lemur/plugins/lemur_digicert/plugin.py +++ b/lemur/plugins/lemur_digicert/plugin.py @@ -131,7 +131,7 @@ def map_fields(options, csr): elif options.get("validity_end"): data["custom_expiration_date"] = determine_end_date(options.get("validity_end")).format("YYYY-MM-DD") # check if validity got truncated. If resultant validity is not equal to requested validity, it just got truncated - if data["custom_expiration_date"] != options.get("validity_end"): + if data["custom_expiration_date"] != options.get("validity_end").format("YYYY-MM-DD"): log_validity_truncation(options, f"{__name__}.{sys._getframe().f_code.co_name}") else: data["validity_years"] = determine_validity_years(0) @@ -185,6 +185,7 @@ def map_cis_fields(options, csr): return data + def log_validity_truncation(options, function): log_data = { "cn": options["common_name"], @@ -196,6 +197,7 @@ def log_validity_truncation(options, function): log_data["message"] = "Digicert Plugin truncated the validity of certificate, cn = {0}".format(options["common_name"]) current_app.logger.info(log_data) + def handle_response(response): """ Handle the DigiCert API response and any errors it might have experienced. From de0c38e9ba90a6709a1e5a3e88ea36f2dd1de2f2 Mon Sep 17 00:00:00 2001 From: Hossein Shafagh Date: Wed, 9 Sep 2020 19:47:51 -0700 Subject: [PATCH 06/28] mapping of curve name to key_type --- lemur/common/utils.py | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/lemur/common/utils.py b/lemur/common/utils.py index c33722b2..528a6a57 100644 --- a/lemur/common/utils.py +++ b/lemur/common/utils.py @@ -114,6 +114,41 @@ def get_authority_key(body): return authority_key.hex() +def get_key_type_from_ec_curve(curve_name): + """ + Give an EC curve name, return the matching key_type. + + :param: curve_name + :return: key_type + """ + + _CURVE_TYPES = { + ec.SECP192R1().name: "ECCPRIME192V1", + ec.SECP256R1().name: "ECCPRIME256V1", + ec.SECP192R1().name: "ECCSECP192R1", + ec.SECP224R1().name: "ECCSECP224R1", + ec.SECP256R1().name: "ECCSECP256R1", + ec.SECP384R1().name: "ECCSECP384R1", + ec.SECP521R1().name: "ECCSECP521R1", + ec.SECP256K1().name: "ECCSECP256K1", + ec.SECT163K1().name: "ECCSECT163K1", + ec.SECT233K1().name: "ECCSECT233K1", + ec.SECT283K1().name: "ECCSECT283K1", + ec.SECT409K1().name: "ECCSECT409K1", + ec.SECT571K1().name: "ECCSECT571K1", + ec.SECT163R2().name: "ECCSECT163R2", + ec.SECT233R1().name: "ECCSECT233R1", + ec.SECT283R1().name: "ECCSECT283R1", + ec.SECT409R1().name: "ECCSECT409R1", + ec.SECT571R1().name: "ECCSECT571R2", + } + + if curve_name in _CURVE_TYPES.keys(): + return _CURVE_TYPES[curve_name] + else: + return None + + def generate_private_key(key_type): """ Generates a new private key based on key_type. From 6fa15c4cb3b9f4387ba7d93614e238c706e1bd91 Mon Sep 17 00:00:00 2001 From: Hossein Shafagh Date: Wed, 9 Sep 2020 19:48:21 -0700 Subject: [PATCH 07/28] methods to extract cn and key_type from csr --- lemur/certificates/utils.py | 44 +++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/lemur/certificates/utils.py b/lemur/certificates/utils.py index 4e6cc4f1..e642e058 100644 --- a/lemur/certificates/utils.py +++ b/lemur/certificates/utils.py @@ -12,6 +12,8 @@ Utils to parse certificate data. from cryptography import x509 from cryptography.hazmat.backends import default_backend from marshmallow.exceptions import ValidationError +from cryptography.hazmat.primitives.asymmetric import rsa, ec +from lemur.common.utils import get_key_type_from_ec_curve def get_sans_from_csr(data): @@ -39,3 +41,45 @@ def get_sans_from_csr(data): pass return sub_alt_names + + +def get_cn_from_csr(data): + """ + Fetches common name (CN) from CSR. + Works with any kind of SubjectAlternativeName + :param data: PEM-encoded string with CSR + :return: the common name + """ + try: + request = x509.load_pem_x509_csr(data.encode("utf-8"), default_backend()) + except Exception: + raise ValidationError("CSR presented is not valid.") + + common_name = request.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME) + return common_name[0].value + + +def get_key_type_from_csr(data): + """ + Fetches key_type from CSR. + Works with any kind of SubjectAlternativeName + :param data: PEM-encoded string with CSR + :return: key_type + """ + try: + request = x509.load_pem_x509_csr(data.encode("utf-8"), default_backend()) + except Exception: + raise ValidationError("CSR presented is not valid.") + + try: + if isinstance(request.public_key(), rsa.RSAPublicKey): + return "RSA{key_size}".format( + key_size=request.public_key().key_size + ) + elif isinstance(request.public_key(), ec.EllipticCurvePublicKey): + return get_key_type_from_ec_curve(request.public_key().curve.name) + else: + raise Exception("Unsupported key type") + + except NotImplemented: + raise NotImplemented() From 5ab9626cbd67c4fee01b41ecc8a5e2a288e63f39 Mon Sep 17 00:00:00 2001 From: Hossein Shafagh Date: Wed, 9 Sep 2020 19:52:59 -0700 Subject: [PATCH 08/28] overwriting cn and key_type values from CSR, as they take precedence --- lemur/certificates/schemas.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lemur/certificates/schemas.py b/lemur/certificates/schemas.py index 42e444bc..56c91196 100644 --- a/lemur/certificates/schemas.py +++ b/lemur/certificates/schemas.py @@ -148,6 +148,13 @@ class CertificateInputSchema(CertificateCreationSchema): data["extensions"]["subAltNames"]["names"] = [] data["extensions"]["subAltNames"]["names"] = csr_sans + + common_name = cert_utils.get_cn_from_csr(data["csr"]) + if common_name: + data["common_name"] = common_name + key_type = cert_utils.get_key_type_from_csr(data["csr"]) + if key_type: + data["key_type"] = key_type return missing.convert_validity_years(data) From 60fd2134ca3913a712a801fb5748cdc95d24a6e8 Mon Sep 17 00:00:00 2001 From: Hossein Shafagh Date: Wed, 9 Sep 2020 19:53:35 -0700 Subject: [PATCH 09/28] removing duplicate curves, and marking them in existing mapping --- lemur/common/utils.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/lemur/common/utils.py b/lemur/common/utils.py index 528a6a57..01cc64ae 100644 --- a/lemur/common/utils.py +++ b/lemur/common/utils.py @@ -125,9 +125,7 @@ def get_key_type_from_ec_curve(curve_name): _CURVE_TYPES = { ec.SECP192R1().name: "ECCPRIME192V1", ec.SECP256R1().name: "ECCPRIME256V1", - ec.SECP192R1().name: "ECCSECP192R1", ec.SECP224R1().name: "ECCSECP224R1", - ec.SECP256R1().name: "ECCSECP256R1", ec.SECP384R1().name: "ECCSECP384R1", ec.SECP521R1().name: "ECCSECP521R1", ec.SECP256K1().name: "ECCSECP256K1", @@ -163,11 +161,11 @@ def generate_private_key(key_type): """ _CURVE_TYPES = { - "ECCPRIME192V1": ec.SECP192R1(), - "ECCPRIME256V1": ec.SECP256R1(), - "ECCSECP192R1": ec.SECP192R1(), + "ECCPRIME192V1": ec.SECP192R1(), # duplicate + "ECCPRIME256V1": ec.SECP256R1(), # duplicate + "ECCSECP192R1": ec.SECP192R1(), # duplicate "ECCSECP224R1": ec.SECP224R1(), - "ECCSECP256R1": ec.SECP256R1(), + "ECCSECP256R1": ec.SECP256R1(), # duplicate "ECCSECP384R1": ec.SECP384R1(), "ECCSECP521R1": ec.SECP521R1(), "ECCSECP256K1": ec.SECP256K1(), From aff7ad7ea250fd3e20fdb490946f2e0e31e8a05c Mon Sep 17 00:00:00 2001 From: Hossein Shafagh Date: Wed, 9 Sep 2020 19:53:59 -0700 Subject: [PATCH 10/28] testing --- lemur/tests/test_utils.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lemur/tests/test_utils.py b/lemur/tests/test_utils.py index 2e117d25..1dac39bb 100644 --- a/lemur/tests/test_utils.py +++ b/lemur/tests/test_utils.py @@ -11,6 +11,12 @@ from lemur.tests.vectors import ( ) +def test_get_key_type_from_ec_curve(): + from lemur.common.utils import get_key_type_from_ec_curve + + assert get_key_type_from_ec_curve("secp256r1") == "ECCPRIME256V1" + + def test_generate_private_key(): from lemur.common.utils import generate_private_key From 4923157dc21759edc929b6eab968b94dbdceebfa Mon Sep 17 00:00:00 2001 From: Hossein Shafagh Date: Wed, 9 Sep 2020 19:54:20 -0700 Subject: [PATCH 11/28] expanding key_type to with EC support --- lemur/certificates/models.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lemur/certificates/models.py b/lemur/certificates/models.py index 5f6c4ba9..a52ec1a8 100644 --- a/lemur/certificates/models.py +++ b/lemur/certificates/models.py @@ -9,9 +9,10 @@ from datetime import timedelta import arrow from cryptography import x509 -from cryptography.hazmat.primitives.asymmetric import rsa +from cryptography.hazmat.primitives.asymmetric import rsa, ec from flask import current_app from idna.core import InvalidCodepoint +from lemur.common.utils import get_key_type_from_ec_curve from sqlalchemy import ( event, Integer, @@ -302,6 +303,8 @@ class Certificate(db.Model): return "RSA{key_size}".format( key_size=self.parsed_cert.public_key().key_size ) + elif isinstance(self.parsed_cert.public_key(), ec.EllipticCurvePublicKey): + return get_key_type_from_ec_curve(self.parsed_cert.public_key().curve.name) @property def validity_remaining(self): From a7be8b6dceb1e71c2db93cea3e298ad849fe69d6 Mon Sep 17 00:00:00 2001 From: Hossein Shafagh Date: Wed, 9 Sep 2020 19:54:53 -0700 Subject: [PATCH 12/28] adding support for different types of CSR encodings --- .../app/angular/certificates/certificate/options.tpl.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lemur/static/app/angular/certificates/certificate/options.tpl.html b/lemur/static/app/angular/certificates/certificate/options.tpl.html index 7e47cf18..7e6ad428 100644 --- a/lemur/static/app/angular/certificates/certificate/options.tpl.html +++ b/lemur/static/app/angular/certificates/certificate/options.tpl.html @@ -20,7 +20,7 @@ name="certificate signing request" ng-model="certificate.csr" placeholder="PEM encoded string..." class="form-control" - ng-pattern="/^-----BEGIN CERTIFICATE REQUEST-----/"> + ng-pattern="/(^-----BEGIN CERTIFICATE REQUEST-----[\S\s]*-----END CERTIFICATE REQUEST-----)|(^-----BEGIN NEW CERTIFICATE REQUEST-----[\S\s]*-----END NEW CERTIFICATE REQUEST-----)/">

Enter a valid certificate signing request.

From f47f108f43e0e9d452db0ff9185a4c9fc6306ee1 Mon Sep 17 00:00:00 2001 From: sirferl Date: Thu, 10 Sep 2020 16:03:29 +0200 Subject: [PATCH 13/28] ientrust plgin - first version --- lemur/plugins/lemur_entrust/plugin.py | 172 ++++++++++++++++++++++++++ 1 file changed, 172 insertions(+) create mode 100644 lemur/plugins/lemur_entrust/plugin.py diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py new file mode 100644 index 00000000..d1f4a301 --- /dev/null +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -0,0 +1,172 @@ +from lemur.plugins.bases import IssuerPlugin, SourcePlugin +import arrow +import requests +import json +from lemur.plugins import lemur_entrust as ENTRUST +from OpenSSL import crypto +from flask import current_app +from lemur.extensions import metrics, sentry + + + +def log_status_code(r, *args, **kwargs): + """ + Is a request hook that logs all status codes to the ENTRUST api. + + :param r: + :param args: + :param kwargs: + :return: + """ + metrics.send("ENTRUST_status_code_{}".format(r.status_code), "counter", 1) + +def process_options(options): + """ + Processes and maps the incoming issuer options to fields/options that + Entrust understands + + :param options: + :return: dict of valid entrust options + """ + # if there is a config variable ENTRUST_PRODUCT_ + # take the value as Cert product-type + # else default to "STANDARD_SSL" + authority = options.get("authority").name.upper() + product_type = current_app.config.get("ENTRUST_PRODUCT_{0}".format(authority), "STANDARD_SSL") + expiry_date = arrow.utcnow().shift(years=1, days=+10).format('YYYY-MM-DD') + + tracking_data = { + "requesterName": current_app.config.get("ENTRUST_NAME"), + "requesterEmail": current_app.config.get("ENTRUST_EMAIL"), + "requesterPhone": current_app.config.get("ENTRUST_PHONE") + } + + data = { + "signingAlg": "SHA-2", + "eku": "SERVER_AND_CLIENT_AUTH", + "certType": product_type, + "certExpiryDate" : expiry_date, + "tracking": tracking_data + } + return data + +class EntrustIssuerPlugin(IssuerPlugin): + title = "ENTRUST" + slug = "entrust-issuer" + description = "Enables the creation of certificates by ENTRUST" + version = ENTRUST.VERSION + + author = "sirferl" + author_url = "https://github.com/sirferl/lemur" + + def __init__(self, *args, **kwargs): + """Initialize the issuer with the appropriate details.""" + self.session = requests.Session() + cert_file_path = current_app.config.get("ENTRUST_API_CERT") + key_file_path = current_app.config.get("ENTRUST_API_KEY") + user = current_app.config.get("ENTRUST_API_USER") + passw = current_app.config.get("ENTRUST_API_PASS") + self.session.cert = (cert_file_path, key_file_path) + self.session.auth = (user,passw) + self.session.hooks = dict(response=log_status_code) + # self.session.config['keep_alive'] = False + super(EntrustIssuerPlugin, self).__init__(*args, **kwargs) + + def create_certificate(self, csr, issuer_options): + """ + Creates an Entrust certificate. + + :param csr: + :param issuer_options: + :return: :raise Exception: + """ + current_app.logger.info( + "Requesting options: {0}".format(issuer_options) + ) + + url = current_app.config.get("ENTRUST_URL") + "/certificates" + + data = process_options(issuer_options) + data["csr"] = csr + current_req = arrow.utcnow().format('YYYY-MM-DD HH:mm:ss') + current_app.logger.info( + "Entrust-Request Data (id: {1}) : {0}".format(data, current_req) + ) + + + try: + response = self.session.post(url, json=data, timeout=(15, 40)) + except requests.exceptions.Timeout: + raise Exception("Timeout Error while posting to ENTRUST (ID: {0})".format(current_req)) + except requests.exceptions.RequestException as e: + raise Exception("Error while posting to ENTRUST (ID: {1}): {0}".format(e,current_req)) + + current_app.logger.info( + "After Post and Errorhandling (ID: {1}) : {0}".format(response.status_code, current_req) + ) + + response_dict = json.loads(response.content) + if response.status_code != 201: + raise Exception("Error with ENTRUST (ID: {1}): {0}".format(response_dict['errors'], current_req)) + current_app.logger.info("Response: {0}, {1} ".format(response.status_code, response_dict)) + external_id = response_dict['trackingId'] + cert = response_dict['endEntityCert'] + chain = response_dict['chainCerts'][1] + current_app.logger.info( + "Received Chain: {0}".format(chain) + ) + + return cert, chain, external_id + + @staticmethod + def create_authority(options): + """Create an authority. + Creates an authority, this authority is then used by Lemur to + allow a user to specify which Certificate Authority they want + to sign their certificate. + + :param options: + :return: + """ + entrust_root = current_app.config.get("ENTRUST_ROOT") + entrust_issuing = current_app.config.get("ENTRUST_ISSUING") + role = {"username": "", "password": "", "name": "entrust"} + current_app.logger.info("Creating Auth: {0} {1}".format(options, entrust_issuing)) + return entrust_root, "" , [role] + + + def revoke_certificate(self, certificate, comments): + raise NotImplementedError("Not implemented\n", self, certificate, comments) + + def get_ordered_certificate(self, order_id): + raise NotImplementedError("Not implemented\n", self, order_id) + + def canceled_ordered_certificate(self, pending_cert, **kwargs): + raise NotImplementedError("Not implemented\n", self, pending_cert, **kwargs) + + +class EntrustSourcePlugin(SourcePlugin): + title = "ENTRUST" + slug = "entrust-source" + description = "Enables the collecion of certificates" + version = ENTRUST.VERSION + + author = "sirferl" + author_url = "https://github.com/sirferl/lemur" + options = [ + { + "name": "dummy", + "type": "str", + "required": False, + "validation": "/^[0-9]{12,12}$/", + "helpMessage": "Just to prevent error", + } + ] + + def get_certificates(self, options, **kwargs): + #Not needed for ENTRUST + raise NotImplementedError("Not implemented\n", self, options, **kwargs) + def get_endpoints(self, options, **kwargs): + # There are no endpoints in ENTRUST + raise NotImplementedError("Not implemented\n", self, options, **kwargs) + From a99a84b0b2c222920ccc6e8779cbe2fdfc15d7c0 Mon Sep 17 00:00:00 2001 From: sirferl Date: Thu, 10 Sep 2020 16:04:31 +0200 Subject: [PATCH 14/28] entrust plugin inital edit --- lemur/plugins/lemur_entrust/__init__.py | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 lemur/plugins/lemur_entrust/__init__.py diff --git a/lemur/plugins/lemur_entrust/__init__.py b/lemur/plugins/lemur_entrust/__init__.py new file mode 100644 index 00000000..9186ef13 --- /dev/null +++ b/lemur/plugins/lemur_entrust/__init__.py @@ -0,0 +1,6 @@ +"""Set the version information.""" +try: + VERSION = __import__("pkg_resources").get_distribution(__name__).version +except Exception as e: + VERSION = "unknown" + From aa0a31f90e5ae5ad8bc5d75bae8875fb366fe7f5 Mon Sep 17 00:00:00 2001 From: sirferl <41906265+sirferl@users.noreply.github.com> Date: Fri, 11 Sep 2020 11:16:23 +0200 Subject: [PATCH 15/28] Added entrust plugin --- setup.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/setup.py b/setup.py index a612cd18..4da14c3d 100644 --- a/setup.py +++ b/setup.py @@ -153,7 +153,9 @@ setup( 'vault_source = lemur.plugins.lemur_vault_dest.plugin:VaultSourcePlugin', 'vault_desination = lemur.plugins.lemur_vault_dest.plugin:VaultDestinationPlugin', 'adcs_issuer = lemur.plugins.lemur_adcs.plugin:ADCSIssuerPlugin', - 'adcs_source = lemur.plugins.lemur_adcs.plugin:ADCSSourcePlugin' + 'adcs_source = lemur.plugins.lemur_adcs.plugin:ADCSSourcePlugin', + 'entrust_issuer = lemur.plugins.lemur_entrust.plugin:EntrustIssuerPlugin', + 'entrust_source = lemur.plugins.lemur_entrust.plugin:EntrustSourcePlugin' ], }, classifiers=[ From de9ad82011e1c101dc9454b19da07cb5f4ddf39a Mon Sep 17 00:00:00 2001 From: sirferl <41906265+sirferl@users.noreply.github.com> Date: Fri, 11 Sep 2020 12:24:33 +0200 Subject: [PATCH 16/28] Fixed Lint complaints --- lemur/plugins/lemur_entrust/plugin.py | 36 +++++++++++++-------------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index d1f4a301..b1ba723d 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -3,10 +3,8 @@ import arrow import requests import json from lemur.plugins import lemur_entrust as ENTRUST -from OpenSSL import crypto from flask import current_app -from lemur.extensions import metrics, sentry - +from lemur.extensions import metrics def log_status_code(r, *args, **kwargs): @@ -20,6 +18,7 @@ def log_status_code(r, *args, **kwargs): """ metrics.send("ENTRUST_status_code_{}".format(r.status_code), "counter", 1) + def process_options(options): """ Processes and maps the incoming issuer options to fields/options that @@ -28,13 +27,13 @@ def process_options(options): :param options: :return: dict of valid entrust options """ - # if there is a config variable ENTRUST_PRODUCT_ + # if there is a config variable ENTRUST_PRODUCT_ # take the value as Cert product-type # else default to "STANDARD_SSL" authority = options.get("authority").name.upper() product_type = current_app.config.get("ENTRUST_PRODUCT_{0}".format(authority), "STANDARD_SSL") expiry_date = arrow.utcnow().shift(years=1, days=+10).format('YYYY-MM-DD') - + tracking_data = { "requesterName": current_app.config.get("ENTRUST_NAME"), "requesterEmail": current_app.config.get("ENTRUST_EMAIL"), @@ -44,12 +43,13 @@ def process_options(options): data = { "signingAlg": "SHA-2", "eku": "SERVER_AND_CLIENT_AUTH", - "certType": product_type, - "certExpiryDate" : expiry_date, + "certType": product_type, + "certExpiryDate": expiry_date, "tracking": tracking_data } return data + class EntrustIssuerPlugin(IssuerPlugin): title = "ENTRUST" slug = "entrust-issuer" @@ -67,7 +67,7 @@ class EntrustIssuerPlugin(IssuerPlugin): user = current_app.config.get("ENTRUST_API_USER") passw = current_app.config.get("ENTRUST_API_PASS") self.session.cert = (cert_file_path, key_file_path) - self.session.auth = (user,passw) + self.session.auth = (user, passw) self.session.hooks = dict(response=log_status_code) # self.session.config['keep_alive'] = False super(EntrustIssuerPlugin, self).__init__(*args, **kwargs) @@ -93,13 +93,12 @@ class EntrustIssuerPlugin(IssuerPlugin): "Entrust-Request Data (id: {1}) : {0}".format(data, current_req) ) - try: - response = self.session.post(url, json=data, timeout=(15, 40)) + response = self.session.post(url, json=data, timeout=(15, 40)) except requests.exceptions.Timeout: - raise Exception("Timeout Error while posting to ENTRUST (ID: {0})".format(current_req)) + raise Exception("Timeout Error while posting to ENTRUST (ID: {0})".format(current_req)) except requests.exceptions.RequestException as e: - raise Exception("Error while posting to ENTRUST (ID: {1}): {0}".format(e,current_req)) + raise Exception("Error while posting to ENTRUST (ID: {1}): {0}".format(e, current_req)) current_app.logger.info( "After Post and Errorhandling (ID: {1}) : {0}".format(response.status_code, current_req) @@ -107,7 +106,7 @@ class EntrustIssuerPlugin(IssuerPlugin): response_dict = json.loads(response.content) if response.status_code != 201: - raise Exception("Error with ENTRUST (ID: {1}): {0}".format(response_dict['errors'], current_req)) + raise Exception("Error with ENTRUST (ID: {1}): {0}".format(response_dict['errors'], current_req)) current_app.logger.info("Response: {0}, {1} ".format(response.status_code, response_dict)) external_id = response_dict['trackingId'] cert = response_dict['endEntityCert'] @@ -116,7 +115,7 @@ class EntrustIssuerPlugin(IssuerPlugin): "Received Chain: {0}".format(chain) ) - return cert, chain, external_id + return cert, chain, external_id @staticmethod def create_authority(options): @@ -132,8 +131,7 @@ class EntrustIssuerPlugin(IssuerPlugin): entrust_issuing = current_app.config.get("ENTRUST_ISSUING") role = {"username": "", "password": "", "name": "entrust"} current_app.logger.info("Creating Auth: {0} {1}".format(options, entrust_issuing)) - return entrust_root, "" , [role] - + return entrust_root, "", [role] def revoke_certificate(self, certificate, comments): raise NotImplementedError("Not implemented\n", self, certificate, comments) @@ -164,9 +162,9 @@ class EntrustSourcePlugin(SourcePlugin): ] def get_certificates(self, options, **kwargs): - #Not needed for ENTRUST - raise NotImplementedError("Not implemented\n", self, options, **kwargs) + # Not needed for ENTRUST + raise NotImplementedError("Not implemented\n", self, options, **kwargs + def get_endpoints(self, options, **kwargs): # There are no endpoints in ENTRUST raise NotImplementedError("Not implemented\n", self, options, **kwargs) - From fd52438d61a7489963da968b32607d1e575feaeb Mon Sep 17 00:00:00 2001 From: sirferl <41906265+sirferl@users.noreply.github.com> Date: Fri, 11 Sep 2020 12:30:53 +0200 Subject: [PATCH 17/28] yet lint errors --- lemur/plugins/lemur_entrust/plugin.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index b1ba723d..d8466513 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -33,7 +33,7 @@ def process_options(options): authority = options.get("authority").name.upper() product_type = current_app.config.get("ENTRUST_PRODUCT_{0}".format(authority), "STANDARD_SSL") expiry_date = arrow.utcnow().shift(years=1, days=+10).format('YYYY-MM-DD') - + tracking_data = { "requesterName": current_app.config.get("ENTRUST_NAME"), "requesterEmail": current_app.config.get("ENTRUST_EMAIL"), @@ -163,7 +163,7 @@ class EntrustSourcePlugin(SourcePlugin): def get_certificates(self, options, **kwargs): # Not needed for ENTRUST - raise NotImplementedError("Not implemented\n", self, options, **kwargs + raise NotImplementedError("Not implemented\n", self, options, **kwargs) def get_endpoints(self, options, **kwargs): # There are no endpoints in ENTRUST From 1c9c377751e6ff591fb1197f8511126ecda158e6 Mon Sep 17 00:00:00 2001 From: sirferl <41906265+sirferl@users.noreply.github.com> Date: Fri, 11 Sep 2020 12:31:15 +0200 Subject: [PATCH 18/28] Lint errors --- lemur/plugins/lemur_entrust/__init__.py | 1 - 1 file changed, 1 deletion(-) diff --git a/lemur/plugins/lemur_entrust/__init__.py b/lemur/plugins/lemur_entrust/__init__.py index 9186ef13..b902ed7a 100644 --- a/lemur/plugins/lemur_entrust/__init__.py +++ b/lemur/plugins/lemur_entrust/__init__.py @@ -3,4 +3,3 @@ try: VERSION = __import__("pkg_resources").get_distribution(__name__).version except Exception as e: VERSION = "unknown" - From 09a2a8fc76801c1a04b0ace0265bf31345f58a1c Mon Sep 17 00:00:00 2001 From: sayali Date: Fri, 11 Sep 2020 15:53:05 -0700 Subject: [PATCH 19/28] Log message change PR comments --- lemur/plugins/lemur_digicert/plugin.py | 2 +- .../app/angular/certificates/certificate/tracking.tpl.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lemur/plugins/lemur_digicert/plugin.py b/lemur/plugins/lemur_digicert/plugin.py index ad4272dc..3948acbb 100644 --- a/lemur/plugins/lemur_digicert/plugin.py +++ b/lemur/plugins/lemur_digicert/plugin.py @@ -194,7 +194,7 @@ def log_validity_truncation(options, function): metrics.send("digicert_validity_truncated", "counter", 1, metric_tags=log_data) log_data["function"] = function - log_data["message"] = "Digicert Plugin truncated the validity of certificate, cn = {0}".format(options["common_name"]) + log_data["message"] = "Digicert Plugin truncated the validity of certificate" current_app.logger.info(log_data) diff --git a/lemur/static/app/angular/certificates/certificate/tracking.tpl.html b/lemur/static/app/angular/certificates/certificate/tracking.tpl.html index e024972b..d60a1a6a 100644 --- a/lemur/static/app/angular/certificates/certificate/tracking.tpl.html +++ b/lemur/static/app/angular/certificates/certificate/tracking.tpl.html @@ -133,7 +133,7 @@
From b217a68512d819b7f6dc423d9ee6be199fb59ea8 Mon Sep 17 00:00:00 2001 From: sirferl Date: Mon, 14 Sep 2020 08:53:17 +0200 Subject: [PATCH 20/28] added entrust to setup.py --- setup.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/setup.py b/setup.py index a612cd18..467a3d8f 100644 --- a/setup.py +++ b/setup.py @@ -153,7 +153,10 @@ setup( 'vault_source = lemur.plugins.lemur_vault_dest.plugin:VaultSourcePlugin', 'vault_desination = lemur.plugins.lemur_vault_dest.plugin:VaultDestinationPlugin', 'adcs_issuer = lemur.plugins.lemur_adcs.plugin:ADCSIssuerPlugin', - 'adcs_source = lemur.plugins.lemur_adcs.plugin:ADCSSourcePlugin' + 'adcs_source = lemur.plugins.lemur_adcs.plugin:ADCSSourcePlugin', + 'entrust_issuer = lemur.plugins.lemur_entrust.plugin:EntrustIssuerPlugin', + 'entrust_source = lemur.plugins.lemur_entrust.plugin:EntrustSourcePlugin' + ], }, classifiers=[ From 01678a714f47153e094c0b28365226659b45667f Mon Sep 17 00:00:00 2001 From: sirferl Date: Mon, 14 Sep 2020 09:50:55 +0200 Subject: [PATCH 21/28] added required vars check --- lemur/plugins/lemur_entrust/plugin.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index d8466513..d5216caa 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -5,6 +5,7 @@ import json from lemur.plugins import lemur_entrust as ENTRUST from flask import current_app from lemur.extensions import metrics +from lemur.common.utils import validate_conf def log_status_code(r, *args, **kwargs): @@ -61,6 +62,20 @@ class EntrustIssuerPlugin(IssuerPlugin): def __init__(self, *args, **kwargs): """Initialize the issuer with the appropriate details.""" + required_vars = [ + "ENTRUST_API_CERT", + "ENTRUST_API_KEY", + "ENTRUST_API_USER", + "ENTRUST_API_PASS", + "ENTRUST_URL", + "ENTRUST_ROOT", + "ENTRUST_NAME", + "ENTRUST_EMAIL", + "ENTRUST_PHONE", + "ENTRUST_ISSUING", + ] + validate_conf(current_app, required_vars) + self.session = requests.Session() cert_file_path = current_app.config.get("ENTRUST_API_CERT") key_file_path = current_app.config.get("ENTRUST_API_KEY") From b337b271469f3a762368e999d12095523d756c19 Mon Sep 17 00:00:00 2001 From: sirferl Date: Mon, 14 Sep 2020 12:23:58 +0200 Subject: [PATCH 22/28] added response handler --- lemur/plugins/lemur_entrust/plugin.py | 42 +++++++++++++++++---------- 1 file changed, 26 insertions(+), 16 deletions(-) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index d5216caa..e6a51d3f 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -50,6 +50,27 @@ def process_options(options): } return data +def handle_response(my_response): + """ + Helper function for parsing responses from the Entrust API. + :param content: + :return: :raise Exception: + """ + msg = { + 200: "The request had the validateOnly flag set to true and validation was successful.", + 201: "Certificate created", + 202: "Request accepted and queued for approval", + 400: "Invalid request parameters", + 404: "Unknown jobId", + 429: "Too many requests" + } + d = json.loads(my_response.content) + s = my_response.status_code + if s != 201: + raise Exception("ENTRUST error : {0}\n{1}".format(msg.get(s,"unknown"),d['errors'])) + current_app.logger.info("Response: {0}, {1} ".format(s, d)) + return d + class EntrustIssuerPlugin(IssuerPlugin): title = "ENTRUST" @@ -66,12 +87,12 @@ class EntrustIssuerPlugin(IssuerPlugin): "ENTRUST_API_CERT", "ENTRUST_API_KEY", "ENTRUST_API_USER", - "ENTRUST_API_PASS", + "ENTRUST_API_PASS", "ENTRUST_URL", "ENTRUST_ROOT", "ENTRUST_NAME", "ENTRUST_EMAIL", - "ENTRUST_PHONE", + "ENTRUST_PHONE", "ENTRUST_ISSUING", ] validate_conf(current_app, required_vars) @@ -103,26 +124,15 @@ class EntrustIssuerPlugin(IssuerPlugin): data = process_options(issuer_options) data["csr"] = csr - current_req = arrow.utcnow().format('YYYY-MM-DD HH:mm:ss') - current_app.logger.info( - "Entrust-Request Data (id: {1}) : {0}".format(data, current_req) - ) try: response = self.session.post(url, json=data, timeout=(15, 40)) except requests.exceptions.Timeout: - raise Exception("Timeout Error while posting to ENTRUST (ID: {0})".format(current_req)) + raise Exception("Timeout for POST") except requests.exceptions.RequestException as e: - raise Exception("Error while posting to ENTRUST (ID: {1}): {0}".format(e, current_req)) + raise Exception("Error for POST {0}".format(e)) - current_app.logger.info( - "After Post and Errorhandling (ID: {1}) : {0}".format(response.status_code, current_req) - ) - - response_dict = json.loads(response.content) - if response.status_code != 201: - raise Exception("Error with ENTRUST (ID: {1}): {0}".format(response_dict['errors'], current_req)) - current_app.logger.info("Response: {0}, {1} ".format(response.status_code, response_dict)) + response_dict = handle_response(response) external_id = response_dict['trackingId'] cert = response_dict['endEntityCert'] chain = response_dict['chainCerts'][1] From b8e3162c5f690a932f18bee7927e0fbb9a0b09d1 Mon Sep 17 00:00:00 2001 From: sirferl Date: Mon, 14 Sep 2020 14:20:11 +0200 Subject: [PATCH 23/28] added revoke functionality --- lemur/plugins/lemur_entrust/plugin.py | 28 +++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index e6a51d3f..e0fd1c2a 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -50,6 +50,7 @@ def process_options(options): } return data + def handle_response(my_response): """ Helper function for parsing responses from the Entrust API. @@ -64,10 +65,13 @@ def handle_response(my_response): 404: "Unknown jobId", 429: "Too many requests" } - d = json.loads(my_response.content) + try: + d = json.loads(my_response.content) + except: + d = {'errors': 'No error message'} s = my_response.status_code - if s != 201: - raise Exception("ENTRUST error : {0}\n{1}".format(msg.get(s,"unknown"),d['errors'])) + if s > 399: + raise Exception("ENTRUST error: {0}\n{1}".format(msg.get(s, s), d['errors'])) current_app.logger.info("Response: {0}, {1} ".format(s, d)) return d @@ -142,6 +146,21 @@ class EntrustIssuerPlugin(IssuerPlugin): return cert, chain, external_id + def revoke_certificate(self, certificate, comments): + """Revoke a Digicert certificate.""" + base_url = current_app.config.get("ENTRUST_URL") + + # make certificate revoke request + create_url = "{0}/certificates/{1}/revocations".format( + base_url, certificate.external_id + ) + metrics.send("entrust_revoke_certificate", "counter", 1) + response = self.session.put(create_url, + data=json.dumps({"crlReason": "superseded", "comments": comments})) + + data = handle_response(response) + + @staticmethod def create_authority(options): """Create an authority. @@ -158,9 +177,6 @@ class EntrustIssuerPlugin(IssuerPlugin): current_app.logger.info("Creating Auth: {0} {1}".format(options, entrust_issuing)) return entrust_root, "", [role] - def revoke_certificate(self, certificate, comments): - raise NotImplementedError("Not implemented\n", self, certificate, comments) - def get_ordered_certificate(self, order_id): raise NotImplementedError("Not implemented\n", self, order_id) From 84496b0f553e8ae9c1b82cbb86bdb6ec9a24bed4 Mon Sep 17 00:00:00 2001 From: sirferl Date: Mon, 14 Sep 2020 15:18:46 +0200 Subject: [PATCH 24/28] fixed a few problems --- lemur/plugins/lemur_entrust/plugin.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index e0fd1c2a..64219774 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -68,7 +68,7 @@ def handle_response(my_response): try: d = json.loads(my_response.content) except: - d = {'errors': 'No error message'} + d = {'errors': 'No detailled message'} s = my_response.status_code if s > 399: raise Exception("ENTRUST error: {0}\n{1}".format(msg.get(s, s), d['errors'])) @@ -151,12 +151,17 @@ class EntrustIssuerPlugin(IssuerPlugin): base_url = current_app.config.get("ENTRUST_URL") # make certificate revoke request - create_url = "{0}/certificates/{1}/revocations".format( + revoke_url = "{0}/certificates/{1}/revocations".format( base_url, certificate.external_id ) metrics.send("entrust_revoke_certificate", "counter", 1) - response = self.session.put(create_url, - data=json.dumps({"crlReason": "superseded", "comments": comments})) + if comments == '' or comments == None: + comments = "revoked via API" + data = { + "crlReason": "superseded", + "revocationComment": comments + } + response = self.session.post(revoke_url, json = data) data = handle_response(response) From 5bb0143da4af632e1471969e93837b1204d58971 Mon Sep 17 00:00:00 2001 From: sirferl Date: Mon, 14 Sep 2020 15:42:36 +0200 Subject: [PATCH 25/28] lint errors and removed _path from the API-Cert variables --- lemur/plugins/lemur_entrust/plugin.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index 64219774..c28e8350 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -67,7 +67,8 @@ def handle_response(my_response): } try: d = json.loads(my_response.content) - except: + except Exception as e: + # catch an empty jason object here d = {'errors': 'No detailled message'} s = my_response.status_code if s > 399: @@ -102,12 +103,12 @@ class EntrustIssuerPlugin(IssuerPlugin): validate_conf(current_app, required_vars) self.session = requests.Session() - cert_file_path = current_app.config.get("ENTRUST_API_CERT") - key_file_path = current_app.config.get("ENTRUST_API_KEY") + cert_file = current_app.config.get("ENTRUST_API_CERT") + key_file = current_app.config.get("ENTRUST_API_KEY") user = current_app.config.get("ENTRUST_API_USER") - passw = current_app.config.get("ENTRUST_API_PASS") + password = current_app.config.get("ENTRUST_API_PASS") self.session.cert = (cert_file_path, key_file_path) - self.session.auth = (user, passw) + self.session.auth = (user, password) self.session.hooks = dict(response=log_status_code) # self.session.config['keep_alive'] = False super(EntrustIssuerPlugin, self).__init__(*args, **kwargs) @@ -155,16 +156,15 @@ class EntrustIssuerPlugin(IssuerPlugin): base_url, certificate.external_id ) metrics.send("entrust_revoke_certificate", "counter", 1) - if comments == '' or comments == None: + if comments == '' or not comments: comments = "revoked via API" data = { "crlReason": "superseded", "revocationComment": comments } - response = self.session.post(revoke_url, json = data) + response = self.session.post(revoke_url, json=data) data = handle_response(response) - @staticmethod def create_authority(options): From 9778eb7b25d85ba453a3b0b2f89aa53fadfe276e Mon Sep 17 00:00:00 2001 From: sirferl Date: Mon, 14 Sep 2020 15:56:02 +0200 Subject: [PATCH 26/28] fixed lint errors --- lemur/plugins/lemur_entrust/plugin.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index c28e8350..ae0dbc66 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -68,7 +68,7 @@ def handle_response(my_response): try: d = json.loads(my_response.content) except Exception as e: - # catch an empty jason object here + # catch an empty jason object here d = {'errors': 'No detailled message'} s = my_response.status_code if s > 399: @@ -107,7 +107,7 @@ class EntrustIssuerPlugin(IssuerPlugin): key_file = current_app.config.get("ENTRUST_API_KEY") user = current_app.config.get("ENTRUST_API_USER") password = current_app.config.get("ENTRUST_API_PASS") - self.session.cert = (cert_file_path, key_file_path) + self.session.cert = (cert_file, key_file) self.session.auth = (user, password) self.session.hooks = dict(response=log_status_code) # self.session.config['keep_alive'] = False From e011cc92514267e8e0cc7c5c5ecc239898119b83 Mon Sep 17 00:00:00 2001 From: sirferl Date: Mon, 14 Sep 2020 16:24:53 +0200 Subject: [PATCH 27/28] added several enhancements following advice from peer --- lemur/plugins/lemur_entrust/plugin.py | 32 ++++++++++++++++++--------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index ae0dbc66..75658305 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -19,6 +19,21 @@ def log_status_code(r, *args, **kwargs): """ metrics.send("ENTRUST_status_code_{}".format(r.status_code), "counter", 1) +def determine_end_date(end_date): + """ + Determine appropriate end date + :param end_date: + :return: validity_end + """ + #ENTRUST only allows 13 months of max certificate duration + max_validity_end = arrow.utcnow().shift(years=1, months=+1).format('YYYY-MM-DD') + + if not end_date: + end_date = max_validity_end + + if end_date > max_validity_end: + end_date = max_validity_end + return end_date def process_options(options): """ @@ -33,7 +48,11 @@ def process_options(options): # else default to "STANDARD_SSL" authority = options.get("authority").name.upper() product_type = current_app.config.get("ENTRUST_PRODUCT_{0}".format(authority), "STANDARD_SSL") - expiry_date = arrow.utcnow().shift(years=1, days=+10).format('YYYY-MM-DD') + + if options.get("validity_end"): + validity_end = determine_end_date(options.get("validity_end")) + else: + validity_end = determine_end_date(False) tracking_data = { "requesterName": current_app.config.get("ENTRUST_NAME"), @@ -45,7 +64,7 @@ def process_options(options): "signingAlg": "SHA-2", "eku": "SERVER_AND_CLIENT_AUTH", "certType": product_type, - "certExpiryDate": expiry_date, + "certExpiryDate": validity_end, "tracking": tracking_data } return data @@ -197,15 +216,6 @@ class EntrustSourcePlugin(SourcePlugin): author = "sirferl" author_url = "https://github.com/sirferl/lemur" - options = [ - { - "name": "dummy", - "type": "str", - "required": False, - "validation": "/^[0-9]{12,12}$/", - "helpMessage": "Just to prevent error", - } - ] def get_certificates(self, options, **kwargs): # Not needed for ENTRUST From 02c7a5ca7c03fc80b15786ae94e6a8259ff2dc63 Mon Sep 17 00:00:00 2001 From: sirferl Date: Mon, 14 Sep 2020 16:34:56 +0200 Subject: [PATCH 28/28] another round of lint errors --- lemur/plugins/lemur_entrust/plugin.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lemur/plugins/lemur_entrust/plugin.py b/lemur/plugins/lemur_entrust/plugin.py index 75658305..315da8bd 100644 --- a/lemur/plugins/lemur_entrust/plugin.py +++ b/lemur/plugins/lemur_entrust/plugin.py @@ -19,22 +19,24 @@ def log_status_code(r, *args, **kwargs): """ metrics.send("ENTRUST_status_code_{}".format(r.status_code), "counter", 1) + def determine_end_date(end_date): """ Determine appropriate end date :param end_date: :return: validity_end """ - #ENTRUST only allows 13 months of max certificate duration + # ENTRUST only allows 13 months of max certificate duration max_validity_end = arrow.utcnow().shift(years=1, months=+1).format('YYYY-MM-DD') if not end_date: - end_date = max_validity_end + end_date = max_validity_end if end_date > max_validity_end: end_date = max_validity_end return end_date + def process_options(options): """ Processes and maps the incoming issuer options to fields/options that