give README a proper file extension so that it renders correctly
[stack/cam.git] / cam / ca.py
1 import errno
2 import fcntl
3 import logging
4 import re
5 import os
6 import getpass
7 import random
8 import shutil
9 import tempfile
10 import time
11 from cam import openssl_wrap
12 from cam import utils
13
14 log = logging.getLogger(__name__)
15
16
17 class _CAFiles(object):
18
19     def __init__(self, basedir, **attrs):
20         for key, value in attrs.items():
21             setattr(self, key, os.path.join(basedir, value))
22
23
24 class CA(object):
25
26     def __init__(self, basedir, config, password=None):
27         self._pw = password
28         self.basedir = basedir
29         self.config = {'basedir': basedir, 'default_days': '365', 'ou': 'CA',
30                        'days': '3650', 'country': 'XX', 'crl_url': '',
31                        'signature_algorithm': 'sha1', 'bits': '2048'}
32         self.config.update(config)
33         self.files = _CAFiles(basedir, 
34                               conf='conf/ca.conf',
35                               public_key='public/ca.pem',
36                               private_key='private/ca.key',
37                               crl='public/ca.crl',
38                               serial='serial',
39                               crlnumber='crlnumber',
40                               index='index')
41         self._lock()
42
43     def _getpw(self):
44         if self._pw is None:
45             self._pw = getpass.getpass(prompt='CA Password: ')
46         return self._pw
47
48     def _lock(self):
49         self._lockfd = open(os.path.join(self.basedir, '_lock'), 'w+')
50         n = 3
51         while True:
52             try:
53                 fcntl.lockf(self._lockfd, fcntl.LOCK_EX | fcntl.LOCK_NB)
54                 break
55             except IOError, e:
56                 if e.errno in (errno.EACCES, errno.EAGAIN):
57                     n -= 1
58                     if n == 0:
59                         log.error('another instance is running')
60                         raise
61                     time.sleep(1)
62                     continue
63                 raise
64
65     def _unlock(self):
66         fcntl.lockf(self._lockfd, fcntl.LOCK_UN)
67         self._lockfd.close()
68
69     def _update_config(self):
70         # Create the OpenSSL configuration file.
71         utils.render(self.files.conf, 'openssl_config', self.config)
72
73     def close(self):
74         self._unlock()
75
76     def create(self):
77         old_umask = os.umask(077)
78
79         for pathext in ('', 'conf', 'public', 'public/certs',
80                         'public/crl', 'private', 'newcerts'):
81             fullpath = os.path.join(self.basedir, pathext)
82             if not os.path.isdir(fullpath):
83                 os.mkdir(fullpath)
84
85         if not os.path.exists(self.files.index):
86             log.info('creating new index file')
87             open(self.files.index, 'w').close()
88
89         if not os.path.exists(self.files.serial):
90             serial = random.randint(1, 1000000000)
91             log.info('initializing serial number (%d)', serial)
92             with open(self.files.serial, 'w') as fd:
93                 fd.write('%08X\n' % serial)
94
95         if not os.path.exists(self.files.crlnumber):
96             with open(self.files.crlnumber, 'w') as fd:
97                 fd.write('01\n')
98
99         self._update_config()
100
101         # Generate keys if they do not exist.
102         if not os.path.exists(self.files.public_key):
103             tmpdir = tempfile.mkdtemp()
104             csr_file = os.path.join(tmpdir, 'ca.csr')
105             log.info('creating new RSA CA CSR')
106             openssl_wrap.run_with_config(
107                 self.basedir, self.files.conf,
108                 'req', '-new',
109                 '-passout', 'pass:%s' % self._getpw(),
110                 '-keyout', self.files.private_key, '-out', csr_file)
111             log.info('self-signing RSA CA certificate')
112             openssl_wrap.run_with_config(
113                 self.basedir, self.files.conf,
114                 'ca', '-keyfile', self.files.private_key,
115                 '-key', self._getpw(),
116                 '-md', self.config['signature_algorithm'],
117                 '-extensions', 'v3_ca', '-out', self.files.public_key,
118                 '-days', self.config.get('days', self.config['default_days']),
119                 '-selfsign', '-infiles', csr_file)
120             shutil.rmtree(tmpdir)
121
122         os.umask(old_umask)
123
124         # Make some files public.
125         for path in (os.path.join(self.basedir, 'public'),
126                      os.path.join(self.basedir, 'public/certs'),
127                      self.files.public_key):
128             if os.path.isdir(path):
129                 os.chmod(path, 0755)
130             else:
131                 os.chmod(path, 0644)
132
133     def gencrl(self):
134         log.info('generating CRL')
135
136         self._update_config()
137
138         # Write the CRL in PEM format to a temporary file.
139         tmpf = self.files.crl + '.tmp'
140         openssl_wrap.run_with_config(
141             self.basedir, self.files.conf,
142             'ca', '-gencrl', '-out', tmpf,
143             '-key', self._getpw())
144         # Convert to DER format for distribution.
145         openssl_wrap.run(
146             'crl', '-inform', 'PEM', '-outform', 'DER',
147             '-in', tmpf, '-out', self.files.crl)
148         os.remove(tmpf)
149         os.chmod(self.files.crl, 0644)
150
151     def revoke(self, cert):
152         log.info('revoking certificate %s', cert.name)
153         openssl_wrap.run_with_config(
154             self.basedir, self.files.conf,
155             'ca', '-revoke', cert.public_key_file,
156             '-key', self._getpw())
157         self.gencrl()
158
159     def generate(self, cert):
160         self._update_config()
161
162         expiry = cert.get_expiration_date()
163         if expiry and expiry > time.time():
164             log.warn('certificate is still valid')
165
166         if cert.exists():
167             log.warn('revoking previous version')
168             self.revoke(cert)
169
170         log.info('generating new certificate %s', cert.name)
171         tmpdir = tempfile.mkdtemp()
172         try:
173             csr_file = os.path.join(tmpdir, '%s.csr' % cert.name)
174             conf_file = os.path.join(tmpdir, '%s.conf' % cert.name)
175             ext_file = os.path.join(tmpdir, '%s-ext.conf' % cert.name)
176             conf = {'usage': 'client, server'}
177             conf.update(self.config)
178             conf['cn'] = cert.cn
179             conf['days'] = cert.days or self.config['default_days']
180             if cert.ou:
181                 conf['ou'] = cert.ou
182             conf['alt_names'] = ''.join(
183                 ['DNS.%d=%s\n' % (idx + 1, x) 
184                  for idx, x in enumerate(cert.alt_names)])
185             utils.render(conf_file, 'openssl_config', conf)
186             utils.render(ext_file, 'ext_config', conf)
187             openssl_wrap.run_with_config(
188                 self.basedir, conf_file,
189                 'req', '-new', '-keyout', cert.private_key_file,
190                 '-nodes', '-out', csr_file)
191             os.chmod(cert.private_key_file, 0600)
192             openssl_wrap.run_with_config(
193                 self.basedir, conf_file,
194                 'ca', '-days', conf['days'],
195                 '-key', self._getpw(),
196                 '-md', self.config['signature_algorithm'],
197                 '-policy', 'policy_anything', '-out', cert.public_key_file,
198                 '-extfile', ext_file, '-infiles', csr_file)
199         finally:
200             shutil.rmtree(tmpdir)
201