From 961eab48de35d1574e5efbbc43b3b57bfa09c93e Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Thu, 21 Nov 2024 21:54:40 +0100
Subject: pki: T3642: Minimize `node_changed` code
---
src/conf_mode/pki.py | 32 ++++++--------------------------
1 file changed, 6 insertions(+), 26 deletions(-)
diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index 45e0129a3..4ff15d56e 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -149,35 +149,15 @@ def get_config(config=None):
if len(argv) > 1 and argv[1] == 'certbot_renew':
pki['certbot_renew'] = {}
- tmp = node_changed(conf, base + ['ca'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
- if tmp:
- if 'changed' not in pki: pki.update({'changed':{}})
- pki['changed'].update({'ca' : tmp})
-
- tmp = node_changed(conf, base + ['certificate'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
- if tmp:
- if 'changed' not in pki: pki.update({'changed':{}})
- pki['changed'].update({'certificate' : tmp})
-
- tmp = node_changed(conf, base + ['dh'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
- if tmp:
- if 'changed' not in pki: pki.update({'changed':{}})
- pki['changed'].update({'dh' : tmp})
+ changed_keys = ['ca', 'certificate', 'dh', 'key-pair', 'openssh', 'openvpn']
- tmp = node_changed(conf, base + ['key-pair'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
- if tmp:
- if 'changed' not in pki: pki.update({'changed':{}})
- pki['changed'].update({'key_pair' : tmp})
+ for key in changed_keys:
+ tmp = node_changed(conf, base + [key], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
- tmp = node_changed(conf, base + ['openssh'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
- if tmp:
- if 'changed' not in pki: pki.update({'changed':{}})
- pki['changed'].update({'openssh' : tmp})
+ if 'changed' not in pki:
+ pki.update({'changed':{}})
- tmp = node_changed(conf, base + ['openvpn', 'shared-secret'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
- if tmp:
- if 'changed' not in pki: pki.update({'changed':{}})
- pki['changed'].update({'openvpn' : tmp})
+ pki['changed'].update({key.replace('-', '_') : tmp})
# We only merge on the defaults of there is a configuration at all
if conf.exists(base):
--
cgit v1.2.3
From 0358f6c660e6130b94ca8c53ec7b34d796605dd8 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Thu, 21 Nov 2024 22:05:49 +0100
Subject: pki: T6809: Support system install of CA certificates
---
interface-definitions/pki.xml.in | 6 ++++++
python/vyos/defaults.py | 3 ++-
src/conf_mode/pki.py | 29 +++++++++++++++++++++++++++++
src/init/vyos-router | 6 ++++++
4 files changed, 43 insertions(+), 1 deletion(-)
diff --git a/interface-definitions/pki.xml.in b/interface-definitions/pki.xml.in
index b922771c1..c69886a4b 100644
--- a/interface-definitions/pki.xml.in
+++ b/interface-definitions/pki.xml.in
@@ -35,6 +35,12 @@
+
+
+ Install into CA certificate store on router
+
+
+
#include
diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py
index dec619d3e..425990967 100644
--- a/python/vyos/defaults.py
+++ b/python/vyos/defaults.py
@@ -36,7 +36,8 @@ directories = {
'isc_dhclient_dir' : '/run/dhclient',
'dhcp6_client_dir' : '/run/dhcp6c',
'vyos_configdir' : '/opt/vyatta/config',
- 'completion_dir' : f'{base_dir}/completion'
+ 'completion_dir' : f'{base_dir}/completion',
+ 'ca_certificates' : '/usr/local/share/ca-certificates/vyos'
}
config_status = '/tmp/vyos-config-status'
diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index 4ff15d56e..acea2c9be 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -50,6 +50,7 @@ from vyos import airbag
airbag.enable()
vyos_certbot_dir = directories['certbot']
+vyos_ca_certificates_dir = directories['ca_certificates']
# keys to recursively search for under specified path
sync_search = [
@@ -397,10 +398,33 @@ def verify(pki):
return None
+def cleanup_system_ca():
+ if not os.path.exists(vyos_ca_certificates_dir):
+ os.mkdir(vyos_ca_certificates_dir)
+ else:
+ for filename in os.listdir(vyos_ca_certificates_dir):
+ full_path = os.path.join(vyos_ca_certificates_dir, filename)
+ if os.path.isfile(full_path):
+ os.unlink(full_path)
+
def generate(pki):
if not pki:
+ cleanup_system_ca()
return None
+ # Create or cleanup CA install directory
+ if 'changed' in pki and 'ca' in pki['changed']:
+ cleanup_system_ca()
+
+ if 'ca' in pki:
+ for ca, ca_conf in pki['ca'].items():
+ if 'system_install' in ca_conf:
+ ca_obj = load_certificate(ca_conf['certificate'])
+ ca_path = os.path.join(vyos_ca_certificates_dir, f'{ca}.crt')
+
+ with open(ca_path, 'w') as f:
+ f.write(encode_certificate(ca_obj))
+
# Certbot renewal only needs to re-trigger the services to load up the
# new PEM file
if 'certbot_renew' in pki:
@@ -467,6 +491,7 @@ def apply(pki):
systemd_certbot_name = 'certbot.timer'
if not pki:
call(f'systemctl stop {systemd_certbot_name}')
+ call('update-ca-certificates')
return None
has_certbot = False
@@ -484,6 +509,10 @@ def apply(pki):
if 'changed' in pki:
call_dependents()
+ # Rebuild ca-certificates bundle
+ if 'ca' in pki['changed']:
+ call('update-ca-certificates')
+
return None
if __name__ == '__main__':
diff --git a/src/init/vyos-router b/src/init/vyos-router
index 8825cc16a..f8cc87507 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -471,6 +471,12 @@ start ()
touch /tmp/vyos.smoketest.debug
fi
+ # Cleanup PKI CAs
+ if [ -d /usr/local/share/ca-certificates/vyos ]; then
+ rm -f /usr/local/share/ca-certificates/vyos/*.crt
+ update-ca-certificates >/dev/null 2>&1
+ fi
+
log_action_begin_msg "Mounting VyOS Config"
# ensure the vyatta_configdir supports a large number of inodes since
# the config hierarchy is often inode-bound (instead of size).
--
cgit v1.2.3