crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[bind] Ajout d'enregistrement tls depuis la base ldap

Browse source
This commit is contained in:
Valentin Samir 2014-02-23 00:22:38 +01:00
parent 17199ba900
commit 47ee3eed1c
1 changed files with 21 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

24
gestion/gen_confs/bind.py
View file

@ -51,17 +51,18 @@ class ResourceRecord(object):
return str(self) return str(self)
class TLSA(ResourceRecord): class TLSA(ResourceRecord):
def __init__(self, name, port, proto, cert, certtype, reftype, compat=True, ttl=None): def __init__(self, name, port, proto, cert, certtype, reftype, selector=0, compat=True, format='pem', ttl=None):
""" """
name: nom du domaine du certificat name: nom du domaine du certificat
port: port où écoute le service utilisant le certificat port: port où écoute le service utilisant le certificat
proto: udp ou tcp proto: udp ou tcp
cert: le certificat au format pem (selector est donc toujours à 0) cert: le certificat au format ``format`` (pem ou der) (selector est donc toujours à 0)
certtype: type d'enregistrement 0 = CA pinning, 1 = cert pinning, 2 = self trusted CA, 3 = self trusted cert certtype: type d'enregistrement 0 = CA pinning, 1 = cert pinning, 2 = self trusted CA, 3 = self trusted cert
reftype: 0 = plain cert, 1 = sha256, 2 = sha512 reftype: 0 = plain cert, 1 = sha256, 2 = sha512
compat: on génère un enregistement compris même par les serveurs dns n'implémentant pas TLSA compat: on génère un enregistement compris même par les serveurs dns n'implémentant pas TLSA
""" """
selector = 0 if not format in ['pem', 'der']:
raise ValueError("format should be pem or der")
if cert is None and proto == 'tcp' and name[-1] == '.': if cert is None and proto == 'tcp' and name[-1] == '.':
try: try:
cert = ssl.get_server_certificate((name[:-1], port), ca_certs='/etc/ssl/certs/ca-certificates.crt') cert = ssl.get_server_certificate((name[:-1], port), ca_certs='/etc/ssl/certs/ca-certificates.crt')
@ -69,10 +70,13 @@ class TLSA(ResourceRecord):
raise ValueError("Unable de retrieve cert dynamically: %s" % e) raise ValueError("Unable de retrieve cert dynamically: %s" % e)
elif cert is None: elif cert is None:
raise ValueError("cert can only be retrive if proto is tcp and name fqdn") raise ValueError("cert can only be retrive if proto is tcp and name fqdn")
if format is not 'der':
dercert = ssl.PEM_cert_to_DER_cert(cert) dercert = ssl.PEM_cert_to_DER_cert(cert)
else:
dercert = cert
if not dercert: if not dercert:
raise ValueError("Impossible de convertir le certificat au format DER %s %s %s\n%s" % (name, port, proto, cert)) raise ValueError("Impossible de convertir le certificat au format DER %s %s %s\n%s" % (name, port, proto, cert))
certhex = TLSA.hashCert(reftype, dercert) certhex = TLSA.hashCert(reftype, str(dercert))
if compat: if compat:
super(TLSA, self).__init__( super(TLSA, self).__init__(
'TYPE52', 'TYPE52',
@ -271,6 +275,16 @@ class Zone(ZoneBase):
except (KeyError, TypeError): except (KeyError, TypeError):
pass pass
def add_tlsa_record(self, cert):
if 'TLSACert' in cert['objectClass']:
for host in cert['hostCert']:
nom=self.get_name(host)
if nom is None: continue
for port in cert['portTCPin']:
self.add(TLSA(nom, port, 'tcp', cert['certificat'][0], cert['certificatUsage'][0], cert['matchingType'][0], cert['selector'][0], format='der'))
for port in cert['portUDPin']:
self.add(TLSA(nom, port, 'udp', cert['certificat'][0], cert['certificatUsage'][0], cert['matchingType'][0], cert['selector'][0], format='der'))
def add_machine(self, machine): def add_machine(self, machine):
for host in machine['host']: for host in machine['host']:
nom=self.get_name(host) nom=self.get_name(host)
@ -279,6 +293,8 @@ class Zone(ZoneBase):
self.add_a_record(nom, machine) self.add_a_record(nom, machine)
self.add_aaaa_record(nom, machine) self.add_aaaa_record(nom, machine)
self.add_sshfp_record(nom, machine) self.add_sshfp_record(nom, machine)
for cert in machine.certificats():
self.add_tlsa_record(cert)
if machine['host']: if machine['host']: