18 |
72 |
75 |
76 |
77 |
--------------------------------------------------------------------------------
/caramel/views.py:
--------------------------------------------------------------------------------
1 | #! /usr/bin/env python
2 | # vim: expandtab shiftwidth=4 softtabstop=4 tabstop=17 filetype=python :
3 | from datetime import datetime
4 | from hashlib import sha256
5 |
6 | from pyramid.httpexceptions import (
7 | HTTPBadRequest,
8 | HTTPError,
9 | HTTPForbidden,
10 | HTTPLengthRequired,
11 | HTTPNotFound,
12 | HTTPRequestEntityTooLarge,
13 | )
14 | from pyramid.response import Response
15 | from pyramid.view import view_config
16 | from sqlalchemy.exc import IntegrityError
17 | from sqlalchemy.orm.exc import NoResultFound
18 |
19 | from .models import (
20 | CSR,
21 | AccessLog,
22 | SigningCert,
23 | )
24 |
25 | # Maximum length allowed for csr uploads.
26 | # 2 kbyte should be enough for up to 4 kbit keys.
27 | # XXX: This should probably be handled outside of app (i.e. by the
28 | # server), or at least be configurable.
29 | _MAXLEN = 2 * 2**10
30 |
31 |
32 | def raise_for_length(req, limit=_MAXLEN):
33 | # two possible error cases: no length specified, or length exceeds limit
34 | # raise appropriate exception if either applies
35 | length = req.content_length
36 | if length is None:
37 | raise HTTPLengthRequired
38 | if length > limit:
39 | raise HTTPRequestEntityTooLarge("Max size: {0} kB".format(limit / 2**10))
40 |
41 |
42 | def raise_for_subject(components, required_prefix):
43 | if len(components) < len(required_prefix):
44 | raise ValueError("Too few subject components")
45 | result = [(x, y) for x, y in zip(components, required_prefix) if x != y]
46 | if result:
47 | given, required = zip(*result)
48 | raise ValueError("{0} do not match {1}".format(given, required))
49 |
50 |
51 | # XXX: Is this the right way? Catch-class JSON converter of Exceptions
52 | @view_config(context=HTTPError)
53 | def HTTPErrorToJson(exc, request):
54 | exc.json_body = {"status": exc.code, "title": exc.title, "detail": exc.detail}
55 | exc.content_type = "application/problem+json"
56 | request.response = exc
57 | return request.response
58 |
59 |
60 | @view_config(route_name="csr", request_method="POST", renderer="json")
61 | def csr_add(request):
62 | # XXX: do length check in middleware? server?
63 | raise_for_length(request)
64 | sha256sum = sha256(request.body).hexdigest()
65 | if sha256sum != request.matchdict["sha256"]:
66 | raise HTTPBadRequest("hash mismatch ({0})".format(sha256sum))
67 | try:
68 | csr = CSR(sha256sum, request.body)
69 | except ValueError as err:
70 | raise HTTPBadRequest("crypto error: {0}".format(err))
71 |
72 | # Verify the parts of the subject we care about
73 | ca = SigningCert.from_files(request.registry.settings["ca.cert"])
74 | CA_PREFIX = ca.get_ca_prefix()
75 | try:
76 | raise_for_subject(csr.subject_components, CA_PREFIX)
77 | except ValueError as err:
78 | raise HTTPBadRequest("Bad subject: {0}".format(err))
79 |
80 | # XXX: store things in DB
81 | try:
82 | csr.save()
83 | except IntegrityError:
84 | # XXX: is this what we want here?
85 | raise HTTPBadRequest("duplicate request")
86 | # We've accepted the signing request, but there's been no signing yet
87 | request.response.status_int = 202
88 | # JSON-rendered data (client could calculate this itself, and often will)
89 | return csr
90 |
91 |
92 | @view_config(route_name="cert", request_method="GET", renderer="json")
93 | def cert_fetch(request):
94 | # XXX: JSON-renderer at the moment, to dump
95 | sha256sum = request.matchdict["sha256"]
96 | try:
97 | csr = CSR.by_sha256sum(sha256sum)
98 | except NoResultFound:
99 | raise HTTPNotFound
100 | # XXX: Exceptions? remote_addr or client_addr?
101 | AccessLog(csr, request.remote_addr).save()
102 | if csr.rejected:
103 | raise HTTPForbidden
104 | cert = csr.certificates.first()
105 | if cert:
106 | if datetime.utcnow() < cert.not_after:
107 | # XXX: appropriate content-type is ... ?
108 | return Response(
109 | cert.pem, content_type="application/octet-stream", charset="UTF-8"
110 | )
111 | request.response.status_int = 202
112 | return csr
113 |
114 |
115 | @view_config(route_name="ca", request_method="GET", renderer="string", http_cache=3600)
116 | def ca_fetch(request):
117 | ca_file = request.registry.settings["ca.cert"]
118 | ca = SigningCert.from_files(ca_file)
119 | return ca.pem.decode("utf8")
120 |
121 |
122 | @view_config(
123 | route_name="cabundle", request_method="GET", renderer="string", http_cache=3600
124 | )
125 | def ca_bundle_fetch(request):
126 | """Attempt to return a bunle of all our intermediates"""
127 | bundle = ca_fetch(request)
128 | return bundle
129 |
--------------------------------------------------------------------------------
/development.ini:
--------------------------------------------------------------------------------
1 | ###
2 | # app configuration
3 | # http://docs.pylonsproject.org/projects/pyramid/en/latest/narr/environment.html
4 | ###
5 | [app:main]
6 | use = egg:caramel
7 |
8 | # Point the following two settings on where you want your CA certificate & Key to live
9 | ca.cert = %(here)s/example_ca/caramel.ca.cert
10 | ca.key = %(here)s/example_ca/caramel.ca.key
11 |
12 | # This causes all certs to be backdated to the age of the start cert.
13 | # This is an ugly workaround for our embedded systems that lack RTC.
14 | backdate = False
15 | # Default to 48 hour certs
16 | lifetime.short = 48
17 | # Long term certs are for 30 days
18 | lifetime.long = 720
19 |
20 |
21 | # Change this to match your database
22 | # http://docs.sqlalchemy.org/en/rel_0_9/core/engines.html#database-urls
23 | sqlalchemy.url = sqlite:///%(here)s/caramel.sqlite
24 |
25 |
26 | pyramid.reload_templates = true
27 | pyramid.debug_authorization = false
28 | pyramid.debug_notfound = false
29 | pyramid.debug_routematch = false
30 | pyramid.default_locale_name = en
31 | pyramid.includes =
32 | pyramid_tm
33 |
34 | ###
35 | # wsgi server configuration
36 | ###
37 | [server:main]
38 | use = egg:waitress#main
39 | host = localhost
40 | port = 6543
41 |
42 | ###
43 | # logging configuration
44 | # http://docs.pylonsproject.org/projects/pyramid/en/latest/narr/logging.html
45 | ###
46 |
47 | [loggers]
48 | keys = root, caramel, sqlalchemy
49 |
50 | [handlers]
51 | keys = console
52 |
53 | [formatters]
54 | keys = generic
55 |
56 | [logger_root]
57 | level = INFO
58 | handlers = console
59 |
60 | [logger_caramel]
61 | level = DEBUG
62 | handlers =
63 | qualname = caramel
64 |
65 | [logger_sqlalchemy]
66 | level = INFO
67 | handlers =
68 | qualname = sqlalchemy.engine
69 | # "level = INFO" logs SQL queries.
70 | # "level = DEBUG" logs SQL queries and results.
71 | # "level = WARN" logs neither. (Recommended for production systems.)
72 |
73 | [handler_console]
74 | class = StreamHandler
75 | args = (sys.stderr,)
76 | level = NOTSET
77 | formatter = generic
78 |
79 | [formatter_generic]
80 | format = %(asctime)s %(levelname)-5.5s [%(name)s][%(threadName)s] %(message)s
81 |
--------------------------------------------------------------------------------
/doc/TODO.txt:
--------------------------------------------------------------------------------
1 |
2 | Serial:
3 | We need a serial storage (pref. associated with the root cert)
4 | serial should be unique to a certificate. The question is if we should re-use the serial-number for each cert we sign ( reissuing the same cert + sig with new timestamps ) or not.
5 | Revocation is always done based on Serial number.
6 |
7 | Quoth the RFC:
8 | The serial number is an integer assigned by the CA to each
9 | certificate. It MUST be unique for each certificate issued by a
10 | given CA (i.e., the issuer name and serial number identify a unique
11 | certificate).
12 |
--------------------------------------------------------------------------------
/doc/deployment_notes.txt:
--------------------------------------------------------------------------------
1 | Deployment notes
2 | ----------------
3 |
4 | These are mostly notes from deploying, also see
5 | http://pyramid-cookbook.readthedocs.org/en/latest/deployment/
6 |
7 |
8 | Deploying on RHEL 6/ CentOS (to be tested/Verified)
9 | ---------------------------------------------------
10 |
11 | Install Apache & mod_fcgid
12 | Install SCL ( Software Collections Library, https://www.softwarecollections.org/ ) python33
13 | $ scl enable python33 bash
14 | $ virtualenv-3.3 /srv/ca.example.com/Environment
15 | $ chcon -t httpd_sys_content_t -R Environment
16 | $ chcon --ref /usr/bin/python Environment/bin/python
17 | $ chcon -R --ref /opt/rh/python33/root/usr/lib/python3.3/ Environment/li*/python3.3/
18 |
19 |
20 | SELinux context inside the Virtualenv should be:
21 | ------------------------------------------------
22 | drwxrwxr-x. admin_user git unconfined_u:object_r:var_t:s0 bin
23 | -rwxrwxr-x. admin_user git system_u:object_r:bin_t:s0 bin/python3
24 | drwxrwxr-x. admin_user git system_u:object_r:lib_t:s0 lib
25 | -rw-rw-r--. admin_user git unconfined_u:object_r:httpd_sys_content_t:s0 bin/activate
26 | -rw-rw-r--. admin_user git unconfined_u:object_r:httpd_sys_content_t:s0 bin/activate_this.py
27 | drwxrwxr-x. admin_user git system_u:object_r:lib_t:s0 lib/python3.3/
28 | -rw-rw-r--. admin_user git system_u:object_r:lib_t:s0 lib/python3.3/site.py
29 |
30 |
31 |
32 | SELinux module that allows setpgid might be needed:
33 | [root@devel test]# cat setpgid.te
34 |
35 | module setpgid 1.0;
36 |
37 | require {
38 | type httpd_sys_script_t;
39 | class process setpgid;
40 | }
41 |
42 | #============= httpd_sys_script_t ==============
43 | allow httpd_sys_script_t self:process setpgid;
44 |
45 |
46 | ---------------------------------------
47 | # Above module was generated with audit2allow
48 |
49 |
50 | Apache 2.2 configuration
51 | ------------------------
52 |
53 | Alias / /srv/ca.example.com/test/Foobar.launcher
54 |
19 |
23 |
20 | })
21 |
22 |
24 |
31 |
25 |
30 |
26 | Welcome to ${project}, an application generated by
27 | the Pyramid web application development framework.
28 |
32 |
71 |
33 |
70 |
34 |
40 | Search documentation
35 | 39 |
41 |
69 | Pyramid links
42 |-
43 |
- 44 | Pylons Website 45 | 46 |
- 47 | Narrative Documentation 48 | 49 |
- 50 | API Documentation 51 | 52 |
- 53 | Tutorials 54 | 55 |
- 56 | Change History 57 | 58 |
- 59 | Sample Applications 60 | 61 |
- 62 | Support and Development 63 | 64 |
- 65 | IRC Channel 66 | 67 |