Changeset 1125

Timestamp:

11/21/06 10:00:32 (7 years ago)

Author:

mglb1

Message:

Add a facility to retrieve the latest CRL from the configuration system

• Move CRL generation into a separate routine
• Add XMLRPC API to retrieve CRL and generate a new one if required
• Add script to connect to the server over XMLRPC and output the CRL

Location:

ccsd/trunk

Files:

• crcnetd/_utils/ccsd_ca.py (modified) (4 diffs)
• scripts/retrieve-ccsd-crl (added)

ccsd/trunk/crcnetd/_utils/ccsd_ca.py

@@ -124 +124 @@
 
     return (csr, key)
+    
+@exportViaXMLRPC(SESSION_RO, AUTH_AUTHENTICATED)
+def fetchCRL(self):
+
+    ca = ccs_ca(ADMIN_SESSION_ID)
+
+    # Check when the next CRL is due
+    os.environ["CCS_CA_DIR"] = ca.rDir
+    (fdi, fdo) = os.popen2("openssl crl -text -in %s/crl.pem 2>&1" % ca.rDir)
+    fdi.close()
+    lines = fdo.readlines()
+    fdo.close()
+    del os.environ["CCS_CA_DIR"]
+    
+    try:
+        for line in lines:
+            if line.strip().startswith("Next Update"):
+                parts = line.strip().split(":")
+                tmp = ":".join(parts[1:]).strip()
+                next = time.mktime(time.strptime(tmp, \
+                        "%b %d %H:%M:%S %Y %Z"))
+                now = time.time()
+                if (next - now) < (60*60*24*2):
+                    # Update the CRL if it expires in less than 2 days
+                    ca.updateCRL()
+                    ca.checkin("Updated CRL to satisfy user request")
+                break
+    except:
+        log_error("Could not parse CRL output. " \
+                "Returned CRL may be old.\n%s" % "".join(lines), \
+                sys.exc_info())
+
+    # Read and return the CRL
+    crl = open("%s/crl.pem" % ca.rDir, "r").read()
+    return crl
 
 #####################################################################
@@ -560 +595 @@
         cert = open(certfile, "r").read()
         return cert
-    
+
+    def updateCRL(self):
+        """Regenerates the Certificate Revocation List"""
+
+        os.environ["CCS_CA_DIR"] = self.rDir
+        (fdi, fdo) = os.popen2("openssl ca -config %s/ca.cnf -gencrl -out " \
+                "%s/crl.pem -batch 2>&1" % (self.rDir, self.rDir))
+        fdi.close()
+        rlines = fdo.readlines()
+        fdo.close()
+        del os.environ["CCS_CA_DIR"]
+
+        return True
+
     def revoke(self, serial, reasonCode=REVOKE_UNSPECIFIED, reasonText=""):
         """Revokes the specified certificate optionally giving a reason
@@ -578 +626 @@
         lines = fdo.readlines()
         fdo.close()
-        (fdi, fdo) = os.popen2("openssl ca -config %s/ca.cnf -gencrl -out " \
-                "%s/crl.pem -batch 2>&1" % (self.rDir, self.rDir))
-        fdi.close()
-        rlines = fdo.readlines()
-        fdo.close()
         del os.environ["CCS_CA_DIR"]
         
@@ -607 +650 @@
             log_error("Could not move revoked certificate to new name!", \
                     sys.exc_info())
+
+        # Generate a new CRL
+        self.updateCRL()
 
         # Commit the changes