-
Notifications
You must be signed in to change notification settings - Fork 42
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Use certificate authentication in the ssl test
This sets up nginx to accept client certificates and provides a matching client certificate with DN=admin.
- Loading branch information
Showing
9 changed files
with
280 additions
and
42 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| import argparse | ||
| import os | ||
| import sys | ||
| import typing as t | ||
|
|
||
| import trustme | ||
|
|
||
|
|
||
| def main(argv: t.Optional[t.List[str]] = None) -> None: | ||
| if argv is None: | ||
| argv = sys.argv[1:] | ||
|
|
||
| parser = argparse.ArgumentParser(prog="gen_certs") | ||
| parser.add_argument( | ||
| "-d", | ||
| "--dir", | ||
| default=os.getcwd(), | ||
| help="Directory where certificates and keys are written to. Defaults to cwd.", | ||
| ) | ||
|
|
||
| args = parser.parse_args(argv) | ||
| cert_dir = args.dir | ||
|
|
||
| if not os.path.isdir(cert_dir): | ||
| raise ValueError(f"--dir={cert_dir} is not a directory") | ||
|
|
||
| key_type = trustme.KeyType["ECDSA"] | ||
|
|
||
| # Generate the CA certificate | ||
| ca = trustme.CA(key_type=key_type) | ||
| # Write the certificate the client should trust | ||
| ca_cert_path = os.path.join(cert_dir, "ca.pem") | ||
| ca.cert_pem.write_to_path(path=ca_cert_path) | ||
|
|
||
| # Generate the server certificate | ||
| server_cert = ca.issue_cert("localhost", "127.0.0.1", "::1", key_type=key_type) | ||
| # Write the certificate and private key the server should use | ||
| server_key_path = os.path.join(cert_dir, "server.key") | ||
| server_cert_path = os.path.join(cert_dir, "server.pem") | ||
| server_cert.private_key_pem.write_to_path(path=server_key_path) | ||
| with open(server_cert_path, mode="w") as f: | ||
| f.truncate() | ||
| for blob in server_cert.cert_chain_pems: | ||
| blob.write_to_path(path=server_cert_path, append=True) | ||
|
|
||
| # Generate the client certificate | ||
| client_cert = ca.issue_cert("[email protected]", common_name="admin", key_type=key_type) | ||
| # Write the certificate and private key the client should use | ||
| client_key_path = os.path.join(cert_dir, "client.key") | ||
| client_cert_path = os.path.join(cert_dir, "client.pem") | ||
| client_cert.private_key_pem.write_to_path(path=client_key_path) | ||
| with open(client_cert_path, mode="w") as f: | ||
| f.truncate() | ||
| for blob in client_cert.cert_chain_pems: | ||
| blob.write_to_path(path=client_cert_path, append=True) | ||
|
|
||
|
|
||
| if __name__ == "__main__": | ||
| main() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,147 @@ | ||
| # Copy from pulp-oci-images. | ||
| # Ideally we can get it upstream again. | ||
| # | ||
| # TODO: Support IPv6. | ||
| # TODO: Maybe serve multiple `location`s, not just one. | ||
|
|
||
| # The "nginx" package on fedora creates this user and group. | ||
| user nginx nginx; | ||
| # Gunicorn docs suggest this value. | ||
| worker_processes 1; | ||
| daemon off; | ||
| events { | ||
| worker_connections 1024; # increase if you have lots of clients | ||
| accept_mutex off; # set to 'on' if nginx worker_processes > 1 | ||
| } | ||
|
|
||
| http { | ||
| include mime.types; | ||
| # fallback in case we can't determine a type | ||
| default_type application/octet-stream; | ||
| sendfile on; | ||
|
|
||
| # If left at the default of 1024, nginx emits a warning about being unable | ||
| # to build optimal hash types. | ||
| types_hash_max_size 4096; | ||
|
|
||
| map $ssl_client_s_dn $ssl_client_s_dn_cn { | ||
| default ""; | ||
| ~CN=(?<CN>[^,]+) $CN; | ||
| } | ||
|
|
||
| upstream pulp-content { | ||
| server 127.0.0.1:24816; | ||
| } | ||
|
|
||
| upstream pulp-api { | ||
| server 127.0.0.1:24817; | ||
| } | ||
|
|
||
| server { | ||
| # Gunicorn docs suggest the use of the "deferred" directive on Linux. | ||
| {% if https | default(false) -%} | ||
| listen 443 default_server deferred ssl; | ||
|
|
||
| ssl_certificate /etc/pulp/certs/pulp_webserver.crt; | ||
| ssl_certificate_key /etc/pulp/certs/pulp_webserver.key; | ||
| ssl_session_cache shared:SSL:50m; | ||
| ssl_session_timeout 1d; | ||
| ssl_session_tickets off; | ||
|
|
||
| # intermediate configuration | ||
| ssl_protocols TLSv1.2; | ||
| ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256'; | ||
| ssl_prefer_server_ciphers on; | ||
|
|
||
| # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months) | ||
| add_header Strict-Transport-Security max-age=15768000; | ||
|
|
||
| # Configure client cert authentication | ||
| ssl_client_certificate /etc/pulp/certs/ca.pem; | ||
| ssl_verify_client optional; | ||
| {%- else -%} | ||
| listen 80 default_server deferred; | ||
| {%- endif %} | ||
| server_name $hostname; | ||
|
|
||
| # The default client_max_body_size is 1m. Clients uploading | ||
| # files larger than this will need to chunk said files. | ||
| client_max_body_size 10m; | ||
|
|
||
| # Gunicorn docs suggest this value. | ||
| keepalive_timeout 5; | ||
|
|
||
| location {{ content_path }} { | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| proxy_set_header Host $http_host; | ||
| # we don't want nginx trying to do something clever with | ||
| # redirects, we set the Host: header above already. | ||
| proxy_redirect off; | ||
| proxy_pass http://pulp-content; | ||
| } | ||
|
|
||
| location {{ api_root }}api/v3/ { | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| proxy_set_header Host $http_host; | ||
| proxy_set_header Remoteuser $ssl_client_s_dn_cn; | ||
| # we don't want nginx trying to do something clever with | ||
| # redirects, we set the Host: header above already. | ||
| proxy_redirect off; | ||
| proxy_pass http://pulp-api; | ||
| client_max_body_size 0; | ||
| } | ||
|
|
||
| {%- if domain_enabled | default(false) %} | ||
| location ~ {{ api_root }}.+/api/v3/ { | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| proxy_set_header Host $http_host; | ||
| # we don't want nginx trying to do something clever with | ||
| # redirects, we set the Host: header above already. | ||
| proxy_redirect off; | ||
| proxy_pass http://pulp-api; | ||
| client_max_body_size 0; | ||
| } | ||
| {%- endif %} | ||
|
|
||
| location /auth/login/ { | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| proxy_set_header Host $http_host; | ||
| # we don't want nginx trying to do something clever with | ||
| # redirects, we set the Host: header above already. | ||
| proxy_redirect off; | ||
| proxy_pass http://pulp-api; | ||
| } | ||
|
|
||
| include pulp/*.conf; | ||
|
|
||
| location / { | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| proxy_set_header Host $http_host; | ||
| # we don't want nginx trying to do something clever with | ||
| # redirects, we set the Host: header above already. | ||
| proxy_redirect off; | ||
| proxy_pass http://pulp-api; | ||
| # most pulp static files are served through whitenoise | ||
| # http://whitenoise.evans.io/en/stable/ | ||
| } | ||
|
|
||
| {%- if https | default(false) %} | ||
| # ACME http-01 tokens, i.e, for Let's Encrypt | ||
| location /.well-known/ { | ||
| try_files $uri $uri/ =404; | ||
| } | ||
| {%- endif %} | ||
| } | ||
| {%- if https | default(false) %} | ||
| server { | ||
| listen 80 default_server; | ||
| server_name _; | ||
| return 301 https://$host$request_uri; | ||
| } | ||
| {%- endif %} | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.