diff options
| author | Fraser Tweedale <ftweedal@redhat.com> | 2016-11-10 23:22:52 +1000 |
|---|---|---|
| committer | Martin Babinsky <mbabinsk@redhat.com> | 2016-11-11 15:42:26 +0100 |
| commit | e1df2e0792a6a423563c4787215b284948f51582 (patch) | |
| tree | fa5d4e55f1352098cd6fea1d01c5277438ac6302 /ipaserver/plugins | |
| parent | f183f70e0183e51d569ada972bd3ec73cad76a30 (diff) | |
| download | freeipa-e1df2e0792a6a423563c4787215b284948f51582.tar.gz freeipa-e1df2e0792a6a423563c4787215b284948f51582.tar.xz freeipa-e1df2e0792a6a423563c4787215b284948f51582.zip | |
cert-request: accept CSRs with extraneous data
The cert-request command used to accept CSRs that had extra data
surrounding the PEM data, e.g. commentary about the contents of the
CSR. Recent commits that switch to using python-cryptography for
cert and CSR handling broke this. Our acceptance tests use such
CSRs, hence the tests are now failing.
To avoid the issue, freshly encode the python-cryptography
CertificateSigningRequest object as PEM. This avoids re-using the
user-supplied data, in case it has extraneous data.
Fixes: https://fedorahosted.org/freeipa/ticket/6472
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Diffstat (limited to 'ipaserver/plugins')
| -rw-r--r-- | ipaserver/plugins/cert.py | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py index 4362d8268..3571ef1fc 100644 --- a/ipaserver/plugins/cert.py +++ b/ipaserver/plugins/cert.py @@ -26,7 +26,7 @@ from operator import attrgetter import os import cryptography.x509 -from cryptography.hazmat.primitives import hashes +from cryptography.hazmat.primitives import hashes, serialization import six from ipalib import Command, Str, Int, Flag @@ -750,8 +750,11 @@ class cert_request(Create, BaseCertMethod, VirtualCommand): # Request the certificate try: + # re-serialise to PEM, in case the user-supplied data has + # extraneous material that will cause Dogtag to freak out + csr_pem = csr_obj.public_bytes(serialization.Encoding.PEM) result = self.Backend.ra.request_certificate( - csr, profile_id, ca_id, request_type=request_type) + csr_pem, profile_id, ca_id, request_type=request_type) except errors.HTTPRequestError as e: if e.status == 409: # pylint: disable=no-member raise errors.CertificateOperationError( |