openwisp / django-x509 Goto Github PK

View Code? Open in Web Editor NEW

336.0 19.0 68.0 4.92 MB

Reusable django app implementing x509 PKI certificates management

Home Page: http://openwisp.org

License: BSD 3-Clause "New" or "Revised" License

Python 95.20% Shell 0.61% CSS 0.67% HTML 2.05% JavaScript 1.29% Dockerfile 0.18%

x509 pki django certificate-authority certificate-revocation-lists crypto hacktoberfest

django-x509's People

Contributors

Stargazers

Watchers

Forkers

repusight bankimr r9295 awapf amitkumarj441 dimrozakis gandhi23 nbelenkov ayzhu brainbuzzer daffytheduck ezaquarii canter-nawab monsieurcellophane oceanbei333 rmatam lotib atb00ker aashishkul fahad-qureshi lakshya0310 cking100 1871vinayak manumohan1234 kkreitmair noumbissivalere zeus911 zzzirk gmcert jscy579 vidsgr pandafy xiong616 franceshe shengyewang shiok-tech devkapilbansal hleil benjaminwinokur shtalinberg vissree nagesh4193 codesankalp niteshsinha17 rahulpalve manishshah120 src-r-r bellyfat kgrimsby yashikajotwani12 tb960 jamestutton aagmanbhatt proshee anhtudotinfo lipton2777 hmilkovi liliancamille1 szpsunkk davidjmemmett juantorchia cs947939 burlesquer theko2fi sternwarder smartcylinders praptisharma28

django-x509's Issues

Not conforming to RFC5280 - certificate use GENERALIZEDTIME for dates <2050

Generated certificate use GENERALIZEDTIME for dates <2050.

According to this RFC https://tools.ietf.org/html/rfc5280#section-4.1.2.5:

CAs conforming to this profile MUST always encode certificate
validity dates through the year 2049 as UTCTime; certificate validity
dates in 2050 or later MUST be encoded as GeneralizedTime.

Here is a test ca.crt generated with django-x509:

Here is a matching test cert.crt:

Verification using LibreSSL fails:

$ openssl verify -CAfile ca.crt cert.crt
cert.crt: emailAddress = [email protected], CN = server-ca
error 13 at 1 depth lookup:format error in certificate's notBefore field
emailAddress = [email protected], CN = server-ca
error 13 at 1 depth lookup:format error in certificate's notBefore field
emailAddress = [email protected], CN = server-ca
error 13 at 1 depth lookup:format error in certificate's notBefore field

That is because LibreSSL has intentionaly stricter parser and
CA uses GENERALIZEDTIME:

$ openssl asn1parse -in ca.crt | grep TIME
  106:d=3  hl=2 l=  15 prim: GENERALIZEDTIME   :20181212000000Z
  123:d=3  hl=2 l=  15 prim: GENERALIZEDTIME   :20191213000000Z

Segmentation fault

The last few days, my CI tests fail with a Segmentation fault (core dumped) error when trying to use django-x509. I noticed that the CI tests of django-x509 fail as well with the same error. I was able to track it down to the latest cryptography release.

Django-x509 requires pyopenssl, which requires cryptography. The latest release of cryptography 2.1.3 was published a few days ago. The changelog contains a single entry:

Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0g.

I was able to work around the segmentation fault by pinning cryptography to 2.1.2. Perhaps django-x509 should also be pinning cryptography, until a proper fix is implemented that allows upgrading cryptography without segfaults.

[CI] Move to Github actions

Move to Github actions.

OperationalError: no such column: django_x509_ca.organization

Hi ,

it was working well for long time. Suddenly "OperationalError: no such column: django_x509_ca.organization " error came. not able to use Ca and Cert tables. Even in django admin page also it shows same error. please help me in this.
Thanks.

[models] Improve error message when validating PEM format

Reserved for GCI

When importing a certificate or CA, a mistake in the PEM formatted fields will trigger a validation error, which will report internal pyopenssl messages which are not easy to understand.

[release] Version 0.7.0

Blocked by #86 and #90.

Serial number clash causes uncaught exception

Serial number may clash with an imported certificate.

We should add a way to catch this exception and generate a new serial number until an available serial number is found.

It's better to work on this issue after having solved #8.

Update pyopenssl requirement

Github is flagging the current pyopenssl version used as a potential security vulnerability.

[qa] Reformat with black

As we did in the other repos, to be done after #87 is merged.

Error: [('PEM routines', 'PEM_read_bio', 'no start line')]

How to reproduce:

add certificate or ca
import an existing certificate, but omit the first line

Expected result:

validation error in the web interface

Actual result:

uncaught exception and resulting 500 internal server error

[bug] Render Issue in popup page

It's related to the Issue mentioned here openwisp/openwisp-controller#375.
It should be solved from here.

How to reproduce

Go to change page of ca.
add ?_to_field=id&_popup=1 in the url and refresh the page.

[pki] Add possibility of renewing certificates

We should add a way to renew expired certificates, a model method and an admin action.

It should also be possible to renew a CA, which in turn should renew all the certificates related to it.

Renewing would mean generate a new x509 certificate and private key which replaces the old ones.

[pki] CA can't be created when `Key length` set to `None` or `Digest algorithm` set to `None`

Steps to reproduce :-

First Error

Start creating a new CA.
Set the name.
Set the Key length choice to None.
Hit the save button.

Error[Screenshot]:-

Second Error
3. Set the Digest algorithm to None
4. Hit the save button.

Error[Screenshot]:-

[docs] Mention how to upgrade to swappable

When we will release the new version with swappable models, dependencies using this library will get an error and will come here to look what has been changed.

We should mention this and how to upgrade in the change log.

[release] Release django-x509 0.9.1

Let's release openwisp-utils 0.7.0 first and update the requirement files to support both 0.6 and 0.7 (to avoid conflict with other modules having older versions).

Then we can release django-x509 0.9.1.

[travis] Add pending migration check

Add a Dockerfile to build from source

What to do

Create a Dockerfile so that users can create a virtual environment on Mac, Linux or Windows with ease and build it in a repeatable way.

How to do

Follow the django-x509 installation instructions from README.rst and compiled those instructions into Dockerfile.

How to verify it

Clone the PR and do a docker build -t django_x509 .

[qa] Cleanup isort and flake8 settings

Move the command line options in runflake8 or runisort script to the setup.cfg which standardize qa check of python modules of OpenWISP Network Management System and makes it cleaner and easier to review.

Static files are not loaded

What can be the reason of not loaded js in Admin panel? I was following the guide to extend model

I got a workaround to solve the problem with staticfiles

import os
import importlib
def pkg_static(pkg, static='static'):
    return os.path.join(os.path.dirname(importlib.util.find_spec(pkg).origin), static)

...


STATICFILES_DIRS = [pkg_static('django_x509')]

Is there any smarter way to do that?

[dependencies] Update cryptography to 3.1.1

Update the cryptography library to allow the latest version, ensure tests pass and the main features work correctly.

Importing new CA with passphrase causes server to hang while passphrase is asked in console

I was playing with django-x509 before deciding to build a project on top of it. I've tried to import my existing CA in the admin panel (running on docker image) but got no response. After a closer look I've found PEM passphrase request for CA. That was really surprising because I had to type it in CLI (where logs were printed). Afterwards, problem was solved. It's probably better to have password field in the form and automatically pass it to verify CA

In short, I'm planning to import all my VPN clients into the app

Importing invalid country code fails

Importing a certificate or ca with invalid country code fails the validation error.

Have to find a solution in order to keep compatibility with legacy systems.

[bug] Fix JavaScript error on django 2.2

I see an error on javascript in the latest release with django 2.2.

Go to the CA or Certs form to see the error.

Note: Ensure django 2.2 is installed in your virtualenv, clear the cache (actually in google chrome or chromium you can go to the network tab in the developer console and check "disable cache" and repeat the process.

You should see a JS error.

[refactor] Convert download `crl_view` to mixin

We need to move the download crl_view to a mixin to allow reusability for REST API of PKI app in openwisp-controller module.

django-x509/django_x509/base/admin.py

Lines 135 to 143 in 43d810f

    
           def crl_view(self, request, pk): 
        
               authenticated = request.user.is_authenticated 
        
               authenticated = authenticated() if callable(authenticated) else authenticated 
        
               if app_settings.CRL_PROTECTED and not authenticated: 
        
                   return HttpResponse(_('Forbidden'), status=403, content_type='text/plain') 
        
               instance = get_object_or_404(self.model, pk=pk) 
        
               return HttpResponse( 
        
                   instance.crl, status=200, content_type='application/x-pem-file' 
        
               )

Update cryptography dependency

While installing other openwisp projects I've got

ERROR: django-x509 0.6.2 has requirement cryptography<2.9.0,>=2.4.0, but you'll have cryptography 2.9 which is incompatible.

Serial number mismatch?

Hi,

I'm testing django-x509 for my application. Upon creating client certificate I noticed something strange regarding serial_number.

From database:
Serial number: 169979165402110668045607377783554886462
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
88:77:73:03:c1:e5:4a:5c:81:4f:58:20:6d:cf:bf:01

88:77:73:03:c1:e5:4a:5c:81:4f:58:20:6d:cf:bf:01 = 181395223527710912757353954506106191617 (which is also the result i get from crypto (get_serial_number()).

So why isn't the serial number on the db entry and the certificate itself the same?

/Kristian

[models] common_name max_length should be 64

The common_name field max_length should be 64, not 63. The common_name represents a hostname, and hostnames by various internet standard definitions have a maximum length of 64 characters.

[bug] CA/Cert creation generates 2 SQL write queries instead of 1

This code:

django-x509/django_x509/base/models.py

Lines 206 to 217 in c5a5acd

    
           def save(self, *args, **kwargs): 
        
               generate = False 
        
               if not self.pk and not self.certificate and not self.private_key: 
        
                   generate = True 
        
               super().save(*args, **kwargs) 
        
               if generate: 
        
                   # automatically determine serial number 
        
                   if not self.serial_number: 
        
                       self.serial_number = self._generate_serial_number() 
        
                   self._generate() 
        
                   kwargs['force_insert'] = False 
        
                   super().save(*args, **kwargs)

Generates two queries for creating a certificate and a CA.

I figured this out while working on openwisp/openwisp-controller#455.

I think this part could be optimized.

default_validity_start and default_ca_validity_end documentation is confusing

Creating Ca/Cert with timzone enabled results in Django warnings: "RuntimeWarning: DateTimeField Ca.validity_start received a naive datetime (2018-01-02 00:00:00) while time zone support is active.
RuntimeWarning)" warning


This looked like a bug, so I checked the implementation and I find the comment quite unhelpful.
def default_validity_start():
    """
    sets validity_start field to 1 day before the current date
    (avoids "certificate not valid yet" edge case)
    intentionally returns naive datetime (not timezone aware)
    """
   ...

Well, I see that we return naive date, that's what this 2-line function does. Re-using this code I'm wondering WHY we do this. My first reaction was "i'll fix it", but now I'm not sure what can of worms is hiding behind such change.

The hipster punctuation doesn't help understanding the intent too.

Please, please, please clarify the function documentation providing hints for end-users regarding this behavior.

[requirements] Update dependencies

We need to update all the dependencies including update to django 3.0

Serial number should be an alphanumeric code

The serial number implementation would be more robust as an alphanumeric string rather than a number.

A possible solution would be to use a uuid (universal unique identifier).

unique_together check design on Cert model is flawed

In some cases it may happen that by using the app normally the unique_together check will fail.

We should avoid this, will try to collect more information on how to reproduce the issue.

[models] Implement swappable models

Add swappable models like we did in openwisp/openwisp-firmware-upgrader#9.

Testing taiga

testing

[ux] Add jsonschema widget which allows to manage x509 extensions

We should add a jsonschema widget like the one added to the credentials admin of openwisp-controller to make easier to define the x509 extensions to be used.

[admin] Add confirmation step for renew CA action

Once #84 is merged, we should add a confirmation step to the admin action that renews the CA.

The page should say something like the following.

Are you sure you want to renew the CA {name} and {count} certificates related to it?

[UX] New vs import javascript switcher (hide/show different fields)

We need to improve the UX in the Ca and Cert admin, so that the difference between creating and importing CAs and Certs is clear without needing further explaination.

A CharField named operation_type (suggestions for better names are welcome) at the ModelForm level should be added, this field should use a select widget having 2 options:

(empty string, default)
new
import

Case 1: empty

With the default option, all the fields except the name should be hidden.

Case 2: new

When "new" is selected, all the hidden fields except certificate and private_key will be shown.

Case 3: import

When "import" is selected, of all the hidden fields only the fields certificate and private_key will be shown.

[feature] Importing existing CA: KeyError: 'ecdsa-with-SHA384'

I'm trying to importing an existing CA certificate which generates an error:

  File "/home/max/git/django-x509/django_x509/base/models.py", line 362, in _import
    self.digest = SIGNATURE_MAPPING[algorithm]
KeyError: 'ecdsa-with-SHA384'
[13/Jun/2021 00:03:38] "POST /admin/django_x509/ca/add/ HTTP/1.1" 500 142363

Looking into django_x509/base/models.py dict SIGNATURE_MAPPING: are EC signatures and certificates/keys supported?

[qa] Upgrade to Django 2.0

django-x509 should be upgraded to Django 2.0 because when i upgrade django-netjsonconfig to Django 2.0, need django-x509 in django 2.0 version

Add optional UUID based base models

All the OpenWISP 2 models have uuid based IDs except django-x509.

We need to have uuid based fields for django-x509 too, but since this app is also used by projects that are not related to openwisp, we could keep this feature optional.

Tasks:

create an abstract BaseUUID model which inherits BaseX509 which has a uuid field exactly as https://github.com/openwisp/openwisp-utils/blob/master/openwisp_utils/base.py#L13
create two additional abstract models: AbstractUUIDCa and AbstractUUIDCert, which inherit BaseUUID
create tests to ensure AbstractUUIDCa and AbstractUUIDCert work as expected, (concrete models will have to be added as well)
document how to use these models in the section Extending django-x509

x509 module with Rest Framework: UNIQUE constraint failed

I have discovered a really strange problem with django-x509. I have created a small demo application to trigger that problem:

https://github.com/hggh/certrest

If you want to create a certificate via the REST API the cert itself is created at the database but the REST Framework throws a IntegrityError.

Steps:

git clone https://github.com/hggh/certrest
pip install -r requirements.txt
./manage migrate
./mange createsuperuser
create a new CA inside the admin: http://127.0.0.1:8000/admin/certs/ca/add/
http://127.0.0.1:8000/certs/certs/
create a new certificate with the default CreateView in Django: http://127.0.0.1:8000/certs/certs/create/
7.1 this works great the certificate is created and will be shown inside the Listview
Goto the REST Framework: http://127.0.0.1:8000/certs/api/cert/
create a new certificate within the REST Framework View
click on "POST"
Django throws: "UNIQUE constraint failed: certs_cert.id"

[feature] Include in docker registry?

This might be a dumb request, if so, feel free to just say so and close out this ticket.

Would it be possible for you to include pre-built images of django-x509 project within the openwisp hub.docker.com registry along with the other projects?

I ask because I'm using unraid, which doesn't support building within the UI, only pulling down existing images.

Automatically select certificate and private_key on click event

GCI task:
https://codein.withgoogle.com/dashboard/task-instances/6534612266254336/

I'll be doing this.

Curious about subject alternative name support

Google Chrome is apparently enforcing this extension; phasing it by version 65.

Use jsonfield instead of jsonfield2

According to https://github.com/rpkilby/jsonfield2/ jsonfield2 has been merged back with jsonfield. The merge happened with the 3.0.0 release.

Outdated cryptography 2.3.1

Hi,

Cryptography package has been bumped to 2.6.x, but pypi release of x509 still depends on <2.4.0. Is there any intention to update it?

I see that on master it is upgraded to >=2.4, <2.5, but that version is not in pypi.

Maximum length of x509 serial number is incorrect

The current maximum length of serial number in x509 model is 39. The maximum value of x509 serial number is 2^159 which is equal to 730750818665451459101842416358141509827966271488 and has a length of 48.
So while importing existing ca, I got this validation error- Ensure this value has at most 39 characters (it has 48).

	def crl_view(self, request, pk):
	authenticated = request.user.is_authenticated
	authenticated = authenticated() if callable(authenticated) else authenticated
	if app_settings.CRL_PROTECTED and not authenticated:
	return HttpResponse(_('Forbidden'), status=403, content_type='text/plain')
	instance = get_object_or_404(self.model, pk=pk)
	return HttpResponse(
	instance.crl, status=200, content_type='application/x-pem-file'
	)

	def save(self, args, *kwargs):
	generate = False
	if not self.pk and not self.certificate and not self.private_key:
	generate = True
	super().save(args, *kwargs)
	if generate:
	# automatically determine serial number
	if not self.serial_number:
	self.serial_number = self._generate_serial_number()
	self._generate()
	kwargs['force_insert'] = False
	super().save(args, *kwargs)