#!/usr/bin/env python3 # # Copyright VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as # published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . from os import system from vyos.pki import create_private_key from vyos.pki import create_certificate_request from vyos.pki import create_certificate from vyos.pki import create_certificate_revocation_list from vyos.pki import create_dh_parameters from vyos.pki import encode_certificate from vyos.pki import encode_dh_parameters from vyos.pki import encode_private_key from vyos.utils.file import write_file subject = {'country': 'DE', 'state': 'BY', 'locality': 'Cloud', 'organization': 'VyOS', 'common_name': 'VyOS'} ca_subject = {'country': 'DE', 'state': 'BY', 'locality': 'Cloud', 'organization': 'VyOS', 'common_name': 'VyOS CA'} subca_subject = {'country': 'DE', 'state': 'BY', 'locality': 'Cloud', 'organization': 'VyOS', 'common_name': 'VyOS SubCA'} ca_cert = '/config/auth/ovpn_test_ca.pem' ca_key = '/config/auth/ovpn_test_ca.key' ca_cert_chain = '/config/auth/ovpn_test_chain.pem' ca_crl = '/config/auth/ovpn_test_ca.crl' subca_cert = '/config/auth/ovpn_test_subca.pem' subca_csr = '/tmp/subca.csr' subca_key = '/config/auth/ovpn_test_subca.key' ssl_cert = '/config/auth/ovpn_test_server.pem' ssl_key = '/config/auth/ovpn_test_server.key' dh_pem = '/config/auth/ovpn_test_dh.pem' s2s_key = '/config/auth/ovpn_test_site2site.key' auth_key = '/config/auth/ovpn_test_tls_auth.key' rpki_ssh_priv_key = """ -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn NhAAAAAwEAAQAAAQEAweDyflDFR4qyEwETbJkZ2ZZc+sJNiDTvYpwGsWIkju49lJSxHe1x Kf8FhwfyMu40Snt1yDlRmmmz4CsbLgbuZGMPvXG11e34+C0pSVUvpF6aqRTeLl1pDRK7Rn jgm3su+I8SRLQR4qbLG6VXWOFuVpwiqbExLaU0hFYTPNP+dArNpsWEEKsohk6pTXdhg3Vz Wp3vCMjl2JTshDa3lD7p2xISSAReEY0fnfEAmQzH4Z6DIwwGdFuMWoQIg+oFBM9ARrO2/F IjRsz6AecR/WeU72JEw4aJic1/cAJQA6PiQBHwkuo3Wll1tbpxeRZoB2NQG22ETyJLvhfT aooNLT9HpQAAA8joU5dM6FOXTAAAAAdzc2gtcnNhAAABAQDB4PJ+UMVHirITARNsmRnZll z6wk2INO9inAaxYiSO7j2UlLEd7XEp/wWHB/Iy7jRKe3XIOVGaabPgKxsuBu5kYw+9cbXV 7fj4LSlJVS+kXpqpFN4uXWkNErtGeOCbey74jxJEtBHipssbpVdY4W5WnCKpsTEtpTSEVh M80/50Cs2mxYQQqyiGTqlNd2GDdXNane8IyOXYlOyENreUPunbEhJIBF4RjR+d8QCZDMfh noMjDAZ0W4xahAiD6gUEz0BGs7b8UiNGzPoB5xH9Z5TvYkTDhomJzX9wAlADo+JAEfCS6j daWXW1unF5FmgHY1AbbYRPIku+F9Nqig0tP0elAAAAAwEAAQAAAQACkDlUjzfUhtJs6uY5 WNrdJB5NmHUS+HQzzxFNlhkapK6+wKqI1UNaRUtq6iF7J+gcFf7MK2nXS098BsXguWm8fQ zPuemoDvHsQhiaJhyvpSqRUrvPTB/f8t/0AhQiKiJIWgfpTaIw53inAGwjujNNxNm2eafH TThhCYxOkRT7rsT6bnSio6yeqPy5QHg7IKFztp5FXDUyiOS3aX3SvzQcDUkMXALdvzX50t 1XIk+X48Rgkq72dL4VpV2oMNDu3hM6FqBUplf9Mv3s51FNSma/cibCQoVufrIfoqYjkNTj IpYFUcq4zZ0/KvgXgzSsy9VN/4TtbalrOuu7X/SHJbvhAAAAgGPFsXgONYQvXxCnK1dIue ozgaZg1I/n522E2ZCOXBW4dYJVyNpppwRreDzuFzTDEe061MpNHfScjVBJCCulivFYWscL 6oaGsryDbFxO3QmB4I98UBqrds2yan9/JGc6EYe299yvaHy7Y64+NC0+fN8H2RAZ61T4w1 0JrCaJRyvzAAAAgQDvBfuV1U7o9k/fbU+U7W2UYnWblpOZAMfi1XQP6IJJeyWs90PdTdXh +l0eIQrCawIiRJytNfxMmbD4huwTf77fWiyCcPznmALQ7ex/yJ+W5Z0V4dPGF3h7o1uiS2 36JhQ7mfcliCkhp/1PIklBIMPcCp0zl+s9wMv2hX7w1Pah9QAAAIEAz6YgU9Xute+J+dBw oWxEQ+igR6KE55Um7O9AvSrqnCm9r7lSFsXC2ErYOxoDSJ3yIBEV0b4XAGn6tbbVIs3jS8 BnLHxclAHQecOx1PGn7PKbnPW0oJRq/X9QCIEelKYvlykpayn7uZooTXqcDaPZxfPpmPdy e8chVJvdygi7kPEAAAAMY3BvQExSMS53dWUzAQIDBAUGBw== -----END OPENSSH PRIVATE KEY----- """ rpki_ssh_pub_key = """ ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDB4PJ+UMVHirITARNsmRnZllz6wk2INO9inAaxYiSO7j2UlLEd7XEp/wWHB/Iy7jRKe3XIOVGaabPgKxsuBu5kYw+9cbXV7fj4LSlJVS+kXpqpFN4uXWkNErtGeOCbey74jxJEtBHipssbpVdY4W5WnCKpsTEtpTSEVhM80/50Cs2mxYQQqyiGTqlNd2GDdXNane8IyOXYlOyENreUPunbEhJIBF4RjR+d8QCZDMfhnoMjDAZ0W4xahAiD6gUEz0BGs7b8UiNGzPoB5xH9Z5TvYkTDhomJzX9wAlADo+JAEfCS6jdaWXW1unF5FmgHY1AbbYRPIku+F9Nqig0tP0el vyos@vyos """ ### All OpenVPN related pub/priv keys generated on VyOS 1.3.8 using easyrsa openvpn_ca_1 = """ -----BEGIN CERTIFICATE----- MIIFFDCCA/ygAwIBAgIULRXlIT+yqqWW/OCBGnOtDtxmeJowDQYJKoZIhvcNAQEL BQAwgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQH DAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBO ZXR3b3JrcyBUZXN0IENBIDExFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZI hvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwHhcNMjUxMjAxMDc0NDU4 WhcNMzUxMTI5MDc0NDU4WjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm b3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAw HgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1S U0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldjCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALQHJWBuKQrFvX6pOhpk3FlJ aCiwDxPWib0EfMZWeF+CsvHxYH1W/WZfhVW2PcL8Zti0ppoqRsIQpyUDygtwWLjw MCVnQtD9yaA6rUImisQfNsR/ePrFaFK+8fSrGGS4poUnKFueNKzq4V9K7xMFb6+T recvoclYDEeBMOpCt3dOSCwNlKa2CboUA0mbATXMiIm9lW/1K8bJ7UwRydiEIU9e wi3ZCFXNw7FWj1h3cR1JwxwMPcL9jzm+jlhBTLCy7yiOkdCw7vVFBRa+OaxQ+tTv S+IpPv5f4/9Hr19IqmsR5HBOHJrYvgD3LDGFZZ1uuKeG4CM8N8G7K9DxqXvEl7EC AwEAAaOCASwwggEoMB0GA1UdDgQWBBTh+x9ektMHGHxAY/+cZMng8fuGpTCB6wYD VR0jBIHjMIHggBTh+x9ektMHGHxAY/+cZMng8fuGpaGBsaSBrjCBqzELMAkGA1UE BhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYD VQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3Qg Q0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3Qt Y2Eubm9yZXBseUB2eW9zLmRldoIULRXlIT+yqqWW/OCBGnOtDtxmeJowDAYDVR0T BAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBACgqIP4xZo6i oKnlNLhix4WRp0tRkveAKJ144ylCzzzP5+pdPQKS5hlydDcNxrJB6EYlkmaWBsvY t7NO9oII4wwD7uvD7Tnad31ANc9lkD8qEksoVy5Sc9HpYQvo+a8ZH/Co8ciTse/e UAIWzp8GHTH40HeqGtJGvLF4pHXxHYBO8vuZAL0Bs8hl7ihyOrRE5fkwjmWH3Rcs avTF5jhAOsRsInUiqLUafFChvte3z739irjCaIK0lt0ZWfKvWVeV+JeNgwl0mqNq 78FZRQa7rC72x3UJJwV1xRcPp4Y+WW7Xb8gTZqkuMzBW3xgYuKlOmHOz1Ta2ktEt eDdS5PF/c+g= -----END CERTIFICATE----- """ openvpn_ca_2 = """ -----BEGIN CERTIFICATE----- MIIFFDCCA/ygAwIBAgIUCKOAES495hrgXHMl0IQb1nkcWsEwDQYJKoZIhvcNAQEL BQAwgasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQH DAVQb3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBO ZXR3b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZI hvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwHhcNMjUxMjAxMDc1MzE5 WhcNMzUxMTI5MDc1MzE5WjCBqzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlm b3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAw HgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEUMBIGA1UEAwwLRWFzeS1S U0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldjCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMxcxr7KKqKuUOWpyE/GZ2BY vMxXEdDavQS3Ok2n5hFAnCAqtjCx63z26P18xJdqkpWpsyTxN5aEGgXyFUIL6kic eL4D9vIO52swI8QaRi/4V7X86wJQqUaQYg7FMboeyBsLXFMl+TX1vkX/bgFiGSfq S0oTPZt68GO6jHxbE1tqqhS2qQSVt/4WJMyZ3BFjQpz0szwcVh2tHKqSSuhpS0MY 8MKpeITo6LhPPphfpdBn6fizydj1IEdXD22YJK+YUYv2AFY5V6GzYYQpO2oGe9CG W68a/Q+OtocZYvjpCIm21UFnfkxz4vdW7vNgBSXvfKOEZ+ZhKzaNL6Ftj0afJdsC AwEAAaOCASwwggEoMB0GA1UdDgQWBBTaP0CGONZGw8I/Bze7xjO1p3dKszCB6wYD VR0jBIHjMIHggBTaP0CGONZGw8I/Bze7xjO1p3dKs6GBsaSBrjCBqzELMAkGA1UE BhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYD VQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3Qg Q0EgMjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3Qt Y2Eubm9yZXBseUB2eW9zLmRldoIUCKOAES495hrgXHMl0IQb1nkcWsEwDAYDVR0T BAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADggEBADjhWXjaR5EZ oqHBD+H2F+YFg4oxf5vTr37JrsDINZG2cDprGQUl/8MrjziuVobtFzFLMlYwI+s8 ASV1eYa+8yGrZFspsaJ3FkvWLx1CRCbP+jH+rJu+PzkcNRf5RinNxRVt/TnZlWKG AACsoGyzQJ3bg0NQKb47W0vD6PZ4nKK3SWvLdLBPW0bYpe62S3fE188fq4gr4Ig4 J0Egi2aZhX/MHpT9bYGvQih+FgY33aQiGQphX1FX2n4kC7fwcJlzlp+mMhmnjWwu WSxRMFGAp6aJlPBvWbE3GyRx0b7skH7xmbRpV3DYbzxAxpzXw5o2xUx/tyQKW76X p8nKZtK7jQM= -----END CERTIFICATE----- """ openvpn_crl_1 = """ -----BEGIN X509 CRL----- MIIDDzCCAfcCAQEwDQYJKoZIhvcNAQELBQAwgasxCzAJBgNVBAYTAlVTMRMwEQYD VQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBO ZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDExFDASBgNV BAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlA dnlvcy5kZXYXDTI1MTIwMTA5MjYwOFoXDTI2MDUzMDA5MjYwOFowIzAhAhAQ70nB plg7b4g0yD0jTde6Fw0yNTEyMDEwOTI2MDBaoIHxMIHuMIHrBgNVHSMEgeMwgeCA FOH7H16S0wcYfEBj/5xkyeDx+4aloYGxpIGuMIGrMQswCQYDVQQGEwJVUzETMBEG A1UECAwKQ2FsaWZvcm5pYTEOMAwGA1UEBwwFUG93YXkxFjAUBgNVBAoMDVZ5T1Mg TmV0d29ya3MxIDAeBgNVBAsMF1Z5T1MgTmV0d29ya3MgVGVzdCBDQSAxMRQwEgYD VQQDDAtFYXN5LVJTQSBDQTEnMCUGCSqGSIb3DQEJARYYdGVzdC1jYS5ub3JlcGx5 QHZ5b3MuZGV2ghQtFeUhP7KqpZb84IEac60O3GZ4mjANBgkqhkiG9w0BAQsFAAOC AQEAFVgGK+EIWsTO1d3PGeh+Sxp9etu60opYYcvtlEqZsyLOp8oJYslo62BNcrxz LIoRTViEVqyFjxyl2+mTk9q/REZqcSSesBpdkzErdVLixCEeIfSgmBd3yoqih2gG R+fEibG6ETbYAc4fzZN761F5Z7Wurm65s5Xgl4X6Vl989kskiw8C0ESeSUKciINP mwWbwTRvJRStJve5NtkqpM6Rdq0SoTA0XWQqRcc7Aicv3/SI5aPpEGTLFKuRoCgG GhnTQywaNACU/BykbjGiiFcwNWpfHrYj3lCFm2Gyw9Sw70PT1RGBDq9yBSa0Px2r i1WjhnYF58PjrW3m1laoI+LkIg== -----END X509 CRL----- """ openvpn_crl_2 = """ -----BEGIN X509 CRL----- MIIDEDCCAfgCAQEwDQYJKoZIhvcNAQELBQAwgasxCzAJBgNVBAYTAlVTMRMwEQYD VQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQb3dheTEWMBQGA1UECgwNVnlPUyBO ZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3b3JrcyBUZXN0IENBIDIxFDASBgNV BAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlA dnlvcy5kZXYXDTI1MTIwMTA5MjYzMVoXDTI2MDUzMDA5MjYzMVowJDAiAhEAir2a GfQlPIE/ohldfFbqRRcNMjUxMjAxMDkyNjI1WqCB8TCB7jCB6wYDVR0jBIHjMIHg gBTaP0CGONZGw8I/Bze7xjO1p3dKs6GBsaSBrjCBqzELMAkGA1UEBhMCVVMxEzAR BgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9T IE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEUMBIG A1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0BCQEWGHRlc3QtY2Eubm9yZXBs eUB2eW9zLmRldoIUCKOAES495hrgXHMl0IQb1nkcWsEwDQYJKoZIhvcNAQELBQAD ggEBAGgW8FkCVtFsmvnQcUuKtYEVco+xbl+DT++TTNuKneAIkqpDCtGNYG4GgV5X isEa443ubxaIL7uAvKu4gAixT7wegLQV4x/+vFgzrCeTlktyGUH2P+53Dta0sBn0 A8X4onbe1dDciosMhh4cm4Rj6z8p3xom9aNq/R4hbPm0r2DZi5cfXAW3nuM/pmoi 9I8lU5UoA7oSw2/nvSt2NDbW5XusP7SwvLL3wtn8MBpa8Y91yjFGCGsruu9MkMwv 1KLb4v8RSDZqHmPeZP+hSPLl/CIzb1rQLEtjD9tbwigNLCVcnH1ZzveA5+B2o+q8 QwyETyzWdV4Y7JUsCGgTNVvpyJ4= -----END X509 CRL----- """ openvpn_crypt_file = """ # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 5f48386b6d3f5aa8c828d88fe5c6791f a7cd0a72b283e2c8c3d8d7171ce4dcd9 3c33e06b3b99cf1868ddc90e803d2eaa e3278e9f9bcb937482e1b01be85a2df5 ea1f1a83d07af10c9ae821655d332649 37d49eedcee1b2a4f742283ebeaa7524 5a3d0687c0122ed7d10bfeaff97885e8 9514573cc566de8d7effbe0fff50e01e 3d966ca8e5d5e7d756871aed46aafe4b 1d20c8ef6df39c07198dcf957661aefa 76e212078b7a4c2165b72929b15a1dd9 c540e71a50718d3e7d1a70e85b29481e 05636b9df49d2e018af79ec052dfdb99 f26da65bae32923a00eeb6a1e764630c 35b2a89da6092cff6cc438d4086f7679 2a1580af158f0b25ae41034933424d36 -----END OpenVPN Static key V1----- """ openvpn_dh_1 = """ -----BEGIN DH PARAMETERS----- MIIBCAKCAQEA86ThynzIp1h5XN5YcVNUg+1G4EYqF81lypzqfx6zlD9eVSm6Sa1E 8sOtiMg1eAnz/tJYMmStJDJRnD62oxs/dgK4Imoz5clnZd0tq/ligwG1Qt54TuQ+ tlRBvQLa9r49kBRQRCka+R0YbQSaQGkwfD3VZfFX2CKeklcOnEVF5yXkaev10cBL OEXYEbdGO+WPmdkY0VXr6dzRZjkATSG+BIaKJ78y6o5sIiyxjLzJFYUQm9Kx/s+n JZLywufeycIycieMwGDyW6jewfBmdDPNgSiaDhbDpDcd7t/Qmoj01Y+z35YTnKuf DCMzCfBxuV/+GM+XcbhRVFdRrgWOnnlQswIBAg== -----END DH PARAMETERS----- """ openvpn_dh_2 = """ -----BEGIN DH PARAMETERS----- MIIBCAKCAQEAle+JFVmEsawtaiX0AFEwAOhoVb6L7BY2Nh6tiVzFYiZEQoa6yMr5 vi7ZGIv9n0gbaMtW+L6e7E4gJXPDSL15VW16UfNg1mXm05jpuZPpXBZndk2CtFvV ZHKzH1jnpO/E4oBjgJ2H4tVjIhPhgjk/oTc8yoQuluDnkhIcBcFqkdjS/vpAzfmA xGtvcYseDS6/ZZI7z9qkYRKCm6v/i2xk+zEI9IqnmowCt+n51psMdfHSYPqXFJxf S3ok//GvcJ7f4EEYUIVFsr+FbljlNN37FDauEgNa/eOGh9DIjsoY+EWoyhbzvw2r M3Ij0zoYsc99E5+MPdXlfkSe0NesBHaK8wIBAg== -----END DH PARAMETERS----- """ openvpn_hub_1_pub = """ -----BEGIN CERTIFICATE----- MIIFPjCCBCagAwIBAgIQezkarqdV2mnNk8+FGw3WuTANBgkqhkiG9w0BAQsFADCB qzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBv d2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdv cmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0B CQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldjAeFw0yNTEyMDEwNzQ1NDJaFw0y ODExMTUwNzQ1NDJaMIGtMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p YTEOMAwGA1UEBwwFUG93YXkxFjAUBgNVBAoMDVZ5T1MgTmV0d29ya3MxIDAeBgNV BAsMF1Z5T1MgTmV0d29ya3MgVGVzdCBDQSAxMRYwFAYDVQQDDA1vcGVudnBuLWh1 Yi0xMScwJQYJKoZIhvcNAQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwggEi MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDiS7M12I5D2Y+3GSNx2oNVFBEx 557FUUaV9Rf/OyN65HZ47qhQE6Kd5aEHJTIAFIALbzZwiZxYtFUGDD60p/lwB6si B2/7YHQtHiu0dF0VHq+N2nTzMhQK+ORaMLbnpHnxEa4Amcof/IkopZF+FdL8D5y9 tNDwFQRFNg4XU5Lnumb5f5974KlWV2qvwLEmkyklpzf0oPS2rUzb1L3TZzsjwXzg TGzxWgaOd9W3APeuxBQDznQfTA6Byj+vZEEqTSJLFwROJ33+G46CLoAJAk+aXpZg Mzrzk/KG0F+W3hvtVDPmkFN/bxqM5R/NjRvJWhthILOh10bI+eC3mc7kT2RlAgMB AAGjggFYMIIBVDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQujCWJeWPGu1pXOZ7Y9vr6 lWSkcTCB6wYDVR0jBIHjMIHggBTh+x9ektMHGHxAY/+cZMng8fuGpaGBsaSBrjCB qzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExDjAMBgNVBAcMBVBv d2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYDVQQLDBdWeU9TIE5ldHdv cmtzIFRlc3QgQ0EgMTEUMBIGA1UEAwwLRWFzeS1SU0EgQ0ExJzAlBgkqhkiG9w0B CQEWGHRlc3QtY2Eubm9yZXBseUB2eW9zLmRldoIULRXlIT+yqqWW/OCBGnOtDtxm eJowEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWgMBgGA1UdEQQRMA+C DW9wZW52cG4taHViLTEwDQYJKoZIhvcNAQELBQADggEBAF/ndor0WZHcHgwSQTd9 f4heYHMmy2CNBuodaEhFfszgT5s3Cxu3rmiTkciffzlF9P25QupW73XqZ0brKYn7 NR/StUjzWafcJL+0HO3Mcc14sFY3S+CW2iHgDlhOlOIdkHvkCmG27oBRkp2wAOb8 Bxc2nnV4Bn6n2DF3HYS+8YwGB1nlrkeRVIT4zBIpCofWMO4PRXFceksGxxZ1Acna wlLaL0lmZZFKTrueVY5JePUPqO2awxiy9uh83szZ5j6ZQKEYkVl6tMc+/fS+ZrQe WU7WBESg7WQ+UNFy4GdubmMEIReolEWvuUcEQlhWcLCeP4H4yvXoM21M1i/q28M7 wZI= -----END CERTIFICATE----- """ openvpn_hub_1_priv = """ -----BEGIN PRIVATE KEY----- MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDiS7M12I5D2Y+3 GSNx2oNVFBEx557FUUaV9Rf/OyN65HZ47qhQE6Kd5aEHJTIAFIALbzZwiZxYtFUG DD60p/lwB6siB2/7YHQtHiu0dF0VHq+N2nTzMhQK+ORaMLbnpHnxEa4Amcof/Iko pZF+FdL8D5y9tNDwFQRFNg4XU5Lnumb5f5974KlWV2qvwLEmkyklpzf0oPS2rUzb 1L3TZzsjwXzgTGzxWgaOd9W3APeuxBQDznQfTA6Byj+vZEEqTSJLFwROJ33+G46C LoAJAk+aXpZgMzrzk/KG0F+W3hvtVDPmkFN/bxqM5R/NjRvJWhthILOh10bI+eC3 mc7kT2RlAgMBAAECggEBAM3J5YkcDBPrr2PkunT5L+GYxCJL7fimdrg8ELyMPTGu vYYwEmPv1zwb7Jog2x1zhxXe5vTkT4fjRkafsA59irq0Xo4tkUpaZov5GemawGNK an9noF7gtZVczdyu3EY/Lp1pZIErWcJI1zpdhrfQhPOwBuwFmNQbaKzAAYR4/ek3 xkl76aLFjgf4Zo/+1VeDdmuvCXxLIc/3XEssirDGnKDPn1CSAcKKDEPX23MMHCAK VnjmocrgfJd3g2ST0GsWtWjO2sn5twCN7EZNClF/jYbCOTUdgGbzQFkX3apkIrMG FkNvxNZzo2ZtqPDZIhCvIGyoVX/bF+yTwgU2KBj2yqkCgYEA9ENeYV9oDe2Uq4TN 63FvKkHcP1hjhj3vK0zuWmiPSUAcd+uCtpBcyfn+UP3sq5WN/TYCFOPIiFck9k2b m5OJzduUVJ7VvE56B/semvTkZOmHX3pVPQSNwZ5BuJ+osAqwVG1oD6nG9ewrf7eQ zERUbpbMT+wZdEdESvouktkhmO8CgYEA7StRPmRLYZPOzlrRwqXR0MKo/TfItOUj Nd1h/HD2l1XKbG7Dq+4UCI3TJnfpIa9CAKAf2MLnsAWIVObnLuStdIzoSuAw1zaz mxN3Ssrc5YAj1jXUALcXIqMxhg+6Wip5SnvEzpoye5w+pA19JySpXqGfa/KhlcDY W7ixcTmeD+sCgYEAvxmJ2HJ1DRiHzNzc4cvgZdYbAzAaxSblXCIXBIJzP6K54xRN MpmlDpvYXPMcW21pJeZAIKnI9OoAz/YNvNzj3jthRAb0PxvCm0XbPu5DVbPipk8m KtPKN+Whk1jN99SU+aiS1lZEg5gevBAYZ8c5qz+tXwXfMDqlcmdjUp4vi98CgYAM 0WiErLr+PRTSRkpL8NZUKBEmDlvEmxW6FYr0L87EAxj7n0joA+gFRlUBIT3yWhyB GCZgerg25TWnEQuxlx5gzDTJxzAckZJHcVfjLO+fX7uQGjypBTw03QkSK8twkBca FXJfkCnmUF16VFhNQ0f8G1QYa3acN136JxNAAVMvnQKBgQDodAp0BcUFcfeEHtK5 FzGJ57m4cXk4wMf0QcChCrxJwS5AIdAf4pjqKgjAd5OOqUJzcwPf8TEMWJRbUAOd mnvB3fsLQaJMdq9y/h+GremZIdkXnM0SjmJfBnF9OOhCii3tR/xXVDj71JChkoeM vQ1ROCMubFrRl2Kkt6i7sOq/UQ== -----END PRIVATE KEY----- """ openvpn_hub_2_pub = """ -----BEGIN CERTIFICATE----- MIIFPzCCBCegAwIBAgIRAN9Hxz6M0Vkcc+MHyj5ojKEwDQYJKoZIhvcNAQELBQAw gasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQ b3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3 b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcN AQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXYwHhcNMjUxMjAxMDc1MzQzWhcN MjgxMTE1MDc1MzQzWjCBrTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3Ju aWExDjAMBgNVBAcMBVBvd2F5MRYwFAYDVQQKDA1WeU9TIE5ldHdvcmtzMSAwHgYD VQQLDBdWeU9TIE5ldHdvcmtzIFRlc3QgQ0EgMjEWMBQGA1UEAwwNb3BlbnZwbi1o dWItMjEnMCUGCSqGSIb3DQEJARYYdGVzdC1jYS5ub3JlcGx5QHZ5b3MuZGV2MIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAphlrcl3zMmzYQfVnlRTg66rJ Uxx3bSwHkL66ZrUN8eScLSnW0Qz4s1PluZhvOKMf9v0sOEEXPouAf9UzAhQztYlU 6yc10F0CWKwjeNGVSDSLf6Uyc1Y2sYWXLQTIUg5t0wNaT9zBUH6Nzgocb5nrMYOV 6nvkdm/MrT+AxzJwow+l/if780anFgCXZNsmwt0Qxai1BAgQbIjSOyfXbhhzd7lP cbdlXB3loW6f1JQc9pNbR0ZPj2vEFv1lHzya54cbNWQ510yGBqSi1YK4o8sxCNca 8nltH8skkkqugtG8hmk3Lzc3IxCiyXVSvTszsS5hQtQT+xioEKmh05yo4mIFbQID AQABo4IBWDCCAVQwCQYDVR0TBAIwADAdBgNVHQ4EFgQUgp3Kp12Gk0cvFlUnzsRL tv5qdOswgesGA1UdIwSB4zCB4IAU2j9AhjjWRsPCPwc3u8Yztad3SrOhgbGkga4w gasxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ4wDAYDVQQHDAVQ b3dheTEWMBQGA1UECgwNVnlPUyBOZXR3b3JrczEgMB4GA1UECwwXVnlPUyBOZXR3 b3JrcyBUZXN0IENBIDIxFDASBgNVBAMMC0Vhc3ktUlNBIENBMScwJQYJKoZIhvcN AQkBFhh0ZXN0LWNhLm5vcmVwbHlAdnlvcy5kZXaCFAijgBEuPeYa4FxzJdCEG9Z5 HFrBMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIFoDAYBgNVHREEETAP gg1vcGVudnBuLWh1Yi0yMA0GCSqGSIb3DQEBCwUAA4IBAQC8flK1UfwCtj79Jv5/ z/vyIwsNObTxQHag2eZmlJyMeX40T51uuSIifxPKqmyNk+7lk3nuqJkrRxFc63WV wo2IIAVQmOz0D3zm2A/21Cree/wqyXpl4H05qfZ4J9NULFCNswQEUSSje9WpEp5v ti5Qa88hFMzGS6C23FDL9A0LBeY9lsEieyVkEB3CRXHlkX/Mttg9DjbGRxjQX+VF W3DLlHZjuONSs3nRKypHMRVNP0SqTtG4TQv5BqArDyJHon/N/mepwNR0zDT3ksUo 3WW3uGI9CGcZoVCAPo0+LrjaBUvJVPwG1kqr++bKndozLuy/68hit8cuEcc2Np43 Nqqd -----END CERTIFICATE----- """ openvpn_hub_2_priv = """ -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCmGWtyXfMybNhB 9WeVFODrqslTHHdtLAeQvrpmtQ3x5JwtKdbRDPizU+W5mG84ox/2/Sw4QRc+i4B/ 1TMCFDO1iVTrJzXQXQJYrCN40ZVINIt/pTJzVjaxhZctBMhSDm3TA1pP3MFQfo3O Chxvmesxg5Xqe+R2b8ytP4DHMnCjD6X+J/vzRqcWAJdk2ybC3RDFqLUECBBsiNI7 J9duGHN3uU9xt2VcHeWhbp/UlBz2k1tHRk+Pa8QW/WUfPJrnhxs1ZDnXTIYGpKLV grijyzEI1xryeW0fyySSSq6C0byGaTcvNzcjEKLJdVK9OzOxLmFC1BP7GKgQqaHT nKjiYgVtAgMBAAECggEAFmWVFG3Qrjr5CiPSHMsc7QoxbXCINgNa3cyqC9FcGQLv gDOFENlD68JjVpxUWvm8BKzsuoUkYj2jTRltcFlTA6aJ+c9mtTrlZxmHCvKPw5W6 PbMD04OLinJuCRb8//uMGYj5M42bz4PREThRz0ac7SdGHsEn9ERs/+txLOsDPylU ZL4NrpYYespz45/AzgYflxk476l0IJhtLTY5N3XuJ7aonVZttDNA9Ds9W329spOE hvQKVKtmzMEddTAPRuk15lq+qM8qdZb+h/cmx72zCegsuKNXrMhvemcZdOqjqZGC li0p2hQawtKFzLhQUEYglUb/4lIB0Aihu84OHDchDQKBgQDSKUjW827NRQ6mysOB a7SZBreSklkXArfLc/4nasQcdeoFGO6xHGo6MR78LHuuTC2O/MDeMZ0A5PAhB5Tr WxVa9FSbbLk8Ytkm9VTZjdtaVDID0RuV7fcSgvpG+msrcC238uMo2rAtE7mNWJK4 COxy6vlAygt3SwXNVjh9GEBFQwKBgQDKU9v5f4uhlydW1Oj21kbPQU7vfaLt4dkz znOTSOizqRyZdihNCuvdgyKphCRVR4x/bCNQ9VpScXe4p8LnOmPDr2K7FGW2It6D WdRkqlTrFROtG9xPh1eNwzl3B+QSt7OC8+muL2gcv3V5V55mm9EojzKnlXYrs4V6 Jsef3GeHjwKBgF9+eOWLGZbWQTESw0FEgnxiK/nC3A5zorYkz6BziAbyoVKNoLAD nFUyysSFJfHuFWl6edy8qH2miWJIwqcq7Qo2KVeyUH0a4VctdM+iAMELrupDEwjO Z00XDMhBs366a1vBVuzSaekhpFeQnqJXE7GoCXgiFpGvGkTSX7qf0VxnAoGBAIjk BiAfuKRi9X3dXaWsQop1gGevFG5ocSGJHE9ZdAAiejQmaov9yKm90NTqj/6XAysv ShG7fxnqpXrtHoR90AQVBPLYkRyTKQOr4nUdfYj0YLSt9fhk9Mr4fEfZseksGyuN xdxRPNq+e0fXDVgVMoWDpV0XVbWpp7SGymeRowZnAoGBAJXAgnKIVch/fXdoIjWF ShPkZLa+784TTtg8XdYyyC/IEdgvWgNAZ71YBlIpupcORQwKFHR8wrQYj69f8U9c pkFIqB20DQr2ZG7fxLA6kCwcCt33Qx5dC0pTvKROHUyO5riuL0UOTYDmHkwNBUC+ Gmcr5OJhN9KqJaAXkyekr3Xc -----END PRIVATE KEY----- """ openvpn_shared_secret_1 = """ # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 44a5889380ec775d952d94071f719bc1 282e4156c9e778895892302dcfafc233 e0d881e38393c033ab3067493dfbe234 4c58b3c22e1ae103b12a68c00df64ca7 2d30e49f2b19c0ac764120ede85af5a1 f9ade1752530ee7bafbf8512540d0379 75042d485a3661c0c70f292436bcdd9a f410ce0b487ee2d717317414b659fe9d 8ba892eec8c7e7816110461784a40b91 8d98254e7a84cd06925124887bbf6a07 cc4eba384063a4dfb890ce0b76a56f55 df0dc4162f653c60858c3810d01071c8 22cac29e77840f0dad62776202073350 3d7c2cb9818096ed7b16f43cafd3963f ac2b95a20540ed2f4e5d46298e107baa 0b3bdd0453edc82acbbb61eff4e43242 -----END OpenVPN Static key V1----- """ openvpn_shared_secret_2 = """ # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 25f54b2c5bfc25adcd54c2107ded69fc f79fdfb80dc95272a3591ac0cf298738 4beda01f91a4a6bbc8dd3123356f3d4a e53a68e6fced4542066c257f8a45e754 16edee612e81dc723042e248ed408245 d67d15434a98df50caa039476868f7d5 23088f11dcef832abb037999102abdeb d1454daa4dcc58f7fa6279ea1d8c7f2f 9c9fc1e155238b1a3fb011b2ef0c096a fa268b08dbaf88f8a887240568118047 25857423a5b634e7859596075fdbd809 657bcbc912535c55d6dcda4043336bed d6cb91560a0d15f38983a498e3085a9e fe4c82ebe9003161619a475f16355127 a14824a1e66b8327bd7e8d6e7882b3ec 89b5fd1f3008ff9f79569f0d368cfb3d -----END OpenVPN Static key V1----- """ openvpn_tls_auth_1 = """ # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 5c4fea2d9db3314af54aab7dfcf9b50c b540a015bf67aa1000e03fad65e78566 4fef8910c7c219a7568c77e1b51eebe3 8dd794e7d3718298ad1aceb02740949a 65a22283df2962e1c61abee62ee9107d 8572ee8e9bc15a43cda9647386c32f36 0002e1c3835fef4a1cb9439f8e56e93d 2808102d57d2709ba2302a2b9f1ab5fe 684edf584fb010e6cae580df30466355 3b662fb91dba47e8573870ab52511e99 e59c42bce8631dfb9200fb37652efd15 8e656b9ed4b9b4f3e73ce8e8f918e194 02b80f6b5a36239bb6a3ca6f8b09e0cb 9620126d171659161615790bbf441a54 4911724f1b08e7d6d327cd87eeb0edfa 5a2cbdd8a2e07bde2251d65b6f609439 -----END OpenVPN Static key V1----- """ openvpn_tls_auth_2 = """ # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 9d530ed1da7696eb75afa37520adeecb 510e3e7506ce5d73d30eaffd6b2abc52 7f1ccf20ae28e0834490d5fb4ef34b06 979707bc0dc1950d66e051a2c5232062 0465e879c3278af05ba892be9c5a320a 1bba19b46eff1fd13a61699d9ec5b677 5d3ce3f3ba141885ee0276f2a8d54550 4eddd028762c4343258fa5ba9722b0d8 0a06571d4f6a20527ddfb63d40e58821 2158ed154d0a244e238274426369b256 d6ac7c2161a2931f2e4afad77df7aa3f 84e3728c5794fa18bb592647db77d1eb 4d3a91127f3f91dcff527a5995b3f3c7 1cc745f27aa69659472ef337f6b4432b 01792a720b9722da5bf5d9d2a6e8601f 191750d6c331be9049240f1a292b370e -----END OpenVPN Static key V1----- """ def create_cert(subject, cert_path, key_path, sign_by=None, sign_by_key=None, ca=False, sub_ca=False): priv_key = create_private_key('rsa', 2048) cert_req = create_certificate_request(subject, priv_key) cert = create_certificate( cert_req, sign_by if sign_by else cert_req, sign_by_key if sign_by_key else priv_key, is_ca=ca, is_sub_ca=sub_ca) with open(cert_path, 'w') as f: f.write(encode_certificate(cert)) with open(key_path, 'w') as f: f.write(encode_private_key(priv_key)) return cert, priv_key def create_empty_crl(crl_path, sign_by, sign_by_key): crl = create_certificate_revocation_list(sign_by, sign_by_key, [1]) with open(crl_path, 'w') as f: f.write(encode_certificate(crl)) return crl if __name__ == '__main__': # Create Root CA ca_cert_obj, ca_key_obj = create_cert(ca_subject, ca_cert, ca_key, ca=True) # Create Empty CRL create_empty_crl(ca_crl, ca_cert_obj, ca_key_obj) # Create Intermediate CA subca_cert_obj, subca_key_obj = create_cert( subca_subject, subca_cert, subca_key, sign_by=ca_cert_obj, sign_by_key=ca_key_obj, ca=True, sub_ca=True) # Create Chain with open(ca_cert_chain, 'w') as f: f.write(encode_certificate(subca_cert_obj) + "\n") f.write(encode_certificate(ca_cert_obj) + "\n") # Create Server Cert create_cert(subject, ssl_cert, ssl_key, sign_by=subca_cert_obj, sign_by_key=subca_key_obj) # Create DH params dh_params = create_dh_parameters() with open(dh_pem, 'w') as f: f.write(encode_dh_parameters(dh_params)) # OpenVPN S2S Key system(f'openvpn --genkey secret {s2s_key}') # OpenVPN Auth Key system(f'openvpn --genkey secret {auth_key}') write_file('/config/id_rsa', rpki_ssh_priv_key.strip()) write_file('/config/id_rsa.pub', rpki_ssh_pub_key.strip()) write_file('/config/known-hosts-file', '') # Testcases for improved config migrator T7738 write_file('/config/auth/openvpn/ca-1.crt', openvpn_ca_1) write_file('/config/auth/openvpn/ca-2.crt', openvpn_ca_2) write_file('/config/auth/openvpn/crl-1.pem', openvpn_crl_1) write_file('/config/auth/openvpn/crl-2.pem', openvpn_crl_2) write_file('/config/auth/openvpn/crypt-file.key', openvpn_crypt_file) write_file('/config/auth/openvpn/dh-1.pem', openvpn_dh_1) write_file('/config/auth/openvpn/dh-2.pem', openvpn_dh_2) write_file('/config/auth/openvpn/openvpn-hub-1.crt', openvpn_hub_1_pub) write_file('/config/auth/openvpn/openvpn-hub-1.key', openvpn_hub_1_priv) write_file('/config/auth/openvpn/openvpn-hub-2.crt', openvpn_hub_2_pub) write_file('/config/auth/openvpn/openvpn-hub-2.key', openvpn_hub_2_priv) write_file('/config/auth/openvpn/shared-secret-1.key', openvpn_shared_secret_1) write_file('/config/auth/openvpn/shared-secret-2.key', openvpn_shared_secret_2) write_file('/config/auth/openvpn/tls-auth-1.key', openvpn_tls_auth_1) write_file('/config/auth/openvpn/tls-auth-2.key', openvpn_tls_auth_2)