summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--ipalib/x509.py7
-rw-r--r--tests/test_xmlrpc/test_host_plugin.py6
-rw-r--r--tests/test_xmlrpc/test_service_plugin.py6
-rw-r--r--tests/test_xmlrpc/xmlrpc_test.py3
4 files changed, 14 insertions, 8 deletions
diff --git a/ipalib/x509.py b/ipalib/x509.py
index e757e1d1f..23f337edc 100644
--- a/ipalib/x509.py
+++ b/ipalib/x509.py
@@ -45,6 +45,10 @@ from ipalib import errors
PEM = 0
DER = 1
+def valid_issuer(issuer, realm):
+ return issuer in ('CN=%s Certificate Authority' % realm,
+ 'CN=Certificate Authority,O=%s' % realm,)
+
def strip_header(pem):
"""
Remove the header and footer from a certificate.
@@ -187,8 +191,7 @@ def verify_cert_subject(ldap, hostname, dercert):
issuer = str(nsscert.issuer)
# Handle both supported forms of issuer, from selfsign and dogtag.
- if ((issuer != 'CN=%s Certificate Authority' % api.env.realm) and
- (issuer != 'CN=Certificate Authority,O=%s' % api.env.realm)):
+ if (not valid_issuer(issuer, api.env.realm)):
raise errors.CertificateOperationError(error=_('Issuer "%(issuer)s" does not match the expected issuer') % \
{'issuer' : issuer})
diff --git a/tests/test_xmlrpc/test_host_plugin.py b/tests/test_xmlrpc/test_host_plugin.py
index 793729629..426b0d7ca 100644
--- a/tests/test_xmlrpc/test_host_plugin.py
+++ b/tests/test_xmlrpc/test_host_plugin.py
@@ -24,7 +24,7 @@ Test the `ipalib.plugins.host` module.
from ipalib import api, errors, x509
from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid, fuzzy_digits
-from tests.test_xmlrpc.xmlrpc_test import fuzzy_hash, fuzzy_date
+from tests.test_xmlrpc.xmlrpc_test import fuzzy_hash, fuzzy_date, fuzzy_issuer
from tests.test_xmlrpc import objectclasses
import base64
@@ -239,7 +239,7 @@ class test_host(Declarative):
serial_number=fuzzy_digits,
md5_fingerprint=fuzzy_hash,
sha1_fingerprint=fuzzy_hash,
- issuer=u'CN=%s Certificate Authority' % api.env.realm,
+ issuer=fuzzy_issuer,
),
),
),
@@ -266,7 +266,7 @@ class test_host(Declarative):
serial_number=fuzzy_digits,
md5_fingerprint=fuzzy_hash,
sha1_fingerprint=fuzzy_hash,
- issuer=u'CN=%s Certificate Authority' % api.env.realm,
+ issuer=fuzzy_issuer,
),
),
),
diff --git a/tests/test_xmlrpc/test_service_plugin.py b/tests/test_xmlrpc/test_service_plugin.py
index be58b3511..4f08f235e 100644
--- a/tests/test_xmlrpc/test_service_plugin.py
+++ b/tests/test_xmlrpc/test_service_plugin.py
@@ -23,7 +23,7 @@ Test the `ipalib/plugins/service.py` module.
from ipalib import api, errors, x509
from tests.test_xmlrpc.xmlrpc_test import Declarative, fuzzy_uuid, fuzzy_hash
-from tests.test_xmlrpc.xmlrpc_test import fuzzy_digits, fuzzy_date
+from tests.test_xmlrpc.xmlrpc_test import fuzzy_digits, fuzzy_date, fuzzy_issuer
from tests.test_xmlrpc import objectclasses
import base64
@@ -375,7 +375,7 @@ class test_host(Declarative):
serial_number=fuzzy_digits,
md5_fingerprint=fuzzy_hash,
sha1_fingerprint=fuzzy_hash,
- issuer=u'CN=%s Certificate Authority' % api.env.realm,
+ issuer=fuzzy_issuer,
),
),
),
@@ -401,7 +401,7 @@ class test_host(Declarative):
serial_number=fuzzy_digits,
md5_fingerprint=fuzzy_hash,
sha1_fingerprint=fuzzy_hash,
- issuer=u'CN=%s Certificate Authority' % api.env.realm,
+ issuer=fuzzy_issuer,
),
),
),
diff --git a/tests/test_xmlrpc/xmlrpc_test.py b/tests/test_xmlrpc/xmlrpc_test.py
index 7b6a74177..4f29fb7ce 100644
--- a/tests/test_xmlrpc/xmlrpc_test.py
+++ b/tests/test_xmlrpc/xmlrpc_test.py
@@ -27,6 +27,7 @@ import nose
from tests.util import assert_deepequal, Fuzzy
from ipalib import api, request
from ipalib import errors
+from ipalib.x509 import valid_issuer
# Matches a gidnumber like '1391016742'
@@ -50,6 +51,8 @@ fuzzy_hash = Fuzzy('^([a-f0-9][a-f0-9]:)+[a-f0-9][a-f0-9]$', type=basestring)
# Matches a date, like Tue Apr 26 17:45:35 2016 UTC
fuzzy_date = Fuzzy('^[a-zA-Z]{3} [a-zA-Z]{3} \d{2} \d{2}:\d{2}:\d{2} \d{4} UTC$')
+fuzzy_issuer = Fuzzy(type=basestring, test=lambda issuer: valid_issuer(issuer, api.env.realm))
+
try:
if not api.Backend.xmlclient.isconnected():
api.Backend.xmlclient.connect(fallback=False)