juju-core

Merge lp:~axwalk/juju-core/cert-server-auth into lp:~go-bot/juju-core/trunk

  1. cert-server-auth
  2. Merge into trunk
Proposed by Andrew Wilkins
Status: Merged
Approved by: Andrew Wilkins
Approved revision: no longer in the source branch.
Merged at revision: 2349
Proposed branch: lp:~axwalk/juju-core/cert-server-auth
Merge into: lp:~go-bot/juju-core/trunk
Diff against target: 33 lines (+3/-2)
2 files modified
cert/cert.go (+2/-2)
cert/cert_test.go (+1/-0)
To merge this branch: bzr merge lp:~axwalk/juju-core/cert-server-auth
Reviewer Review Type Date Requested Status
Juju Engineering Pending
Review via email: mp+207613@code.launchpad.net

Commit message

cert: add serverAuth extKeyUsage to server certs

GnuTLS is particular about the key usage, which
prevents rsyslog from serving TLS unless the
correct ones are set.

This enables a fix for lp:1281071

https://codereview.appspot.com/66930043/

Description of the change

cert: add serverAuth extKeyUsage to server certs

GnuTLS is particular about the key usage, which
prevents rsyslog from serving TLS unless the
correct ones are set.

This enables a fix for lp:1281071

https://codereview.appspot.com/66930043/

To post a comment you must log in.
Revision history for this message
Andrew Wilkins (axwalk) wrote :

Reviewers: mp+207613_code.launchpad.net,

Message:
Please take a look.

Description:
cert: add serverAuth extKeyUsage to server certs

GnuTLS is particular about the key usage, which
prevents rsyslog from serving TLS unless the
correct ones are set.

This enables a fix for lp:1281071

https://code.launchpad.net/~axwalk/juju-core/cert-server-auth/+merge/207613

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/66930043/

Affected files (+5, -2 lines):
   A [revision details]
   M cert/cert.go
   M cert/cert_test.go

Index: [revision details]
=== added file '[revision details]'
--- [revision details] 2012-01-01 00:00:00 +0000
+++ [revision details] 2012-01-01 00:00:00 +0000
@@ -0,0 +1,2 @@
+Old revision: tarmac-20140220160904-67ajnt8y3n3jd73c
+New revision: <email address hidden>

Index: cert/cert.go
=== modified file 'cert/cert.go'
--- cert/cert.go 2014-02-03 14:31:54 +0000
+++ cert/cert.go 2014-02-21 10:13:05 +0000
@@ -119,7 +119,7 @@

  // NewServer generates a certificate/key pair suitable for use by a server.
  func NewServer(caCertPEM, caKeyPEM []byte, expiry time.Time, hostnames
[]string) (certPEM, keyPEM []byte, err error) {
- return newLeaf(caCertPEM, caKeyPEM, expiry, hostnames, nil)
+ return newLeaf(caCertPEM, caKeyPEM, expiry, hostnames,
[]x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})
  }

  // NewClient generates a certificate/key pair suitable for client
authentication.
@@ -164,7 +164,7 @@
    NotAfter: expiry.UTC(),

    SubjectKeyId: bigIntHash(key.N),
- KeyUsage: x509.KeyUsageDataEncipherment,
+ KeyUsage: x509.KeyUsageKeyEncipherment |
x509.KeyUsageDigitalSignature | x509.KeyUsageKeyAgreement,
    ExtKeyUsage: extKeyUsage,
   }
   for _, hostname := range hostnames {

Index: cert/cert_test.go
=== modified file 'cert/cert_test.go'
--- cert/cert_test.go 2013-09-24 05:42:43 +0000
+++ cert/cert_test.go 2014-02-21 10:13:05 +0000
@@ -86,6 +86,7 @@
   c.Assert(srvCert.NotAfter.Equal(expiry), gc.Equals, true)
   c.Assert(srvCert.BasicConstraintsValid, gc.Equals, false)
   c.Assert(srvCert.IsCA, gc.Equals, false)
+ c.Assert(srvCert.ExtKeyUsage, gc.DeepEquals,
[]x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})

   checkTLSConnection(c, caCert, srvCert, srvKey)
  }

Revision history for this message
Ian Booth (wallyworld) wrote :

LGTM

https://codereview.appspot.com/66930043/

Revision history for this message
Go Bot (go-bot) wrote :
Download full text (15.1 KiB)

The attempt to merge lp:~axwalk/juju-core/cert-server-auth into lp:juju-core failed. Below is the output from the failed tests.

ok launchpad.net/juju-core 0.017s
ok launchpad.net/juju-core/agent 1.162s
ok launchpad.net/juju-core/agent/tools 0.271s
ok launchpad.net/juju-core/bzr 6.930s
ok launchpad.net/juju-core/cert 3.604s
ok launchpad.net/juju-core/charm 0.556s
? launchpad.net/juju-core/charm/hooks [no test files]
? launchpad.net/juju-core/charm/testing [no test files]
ok launchpad.net/juju-core/cloudinit 0.036s
ok launchpad.net/juju-core/cloudinit/sshinit 1.191s
ok launchpad.net/juju-core/cmd 0.228s
ok launchpad.net/juju-core/cmd/charm-admin 0.870s
? launchpad.net/juju-core/cmd/charmd [no test files]
? launchpad.net/juju-core/cmd/charmload [no test files]
ok launchpad.net/juju-core/cmd/juju 247.856s
ok launchpad.net/juju-core/cmd/jujud 60.983s
ok launchpad.net/juju-core/cmd/plugins/juju-metadata 13.183s
? launchpad.net/juju-core/cmd/plugins/juju-restore [no test files]
ok launchpad.net/juju-core/constraints 0.027s
ok launchpad.net/juju-core/container 0.037s
ok launchpad.net/juju-core/container/factory 0.051s
ok launchpad.net/juju-core/container/kvm 0.250s
ok launchpad.net/juju-core/container/kvm/mock 0.038s
? launchpad.net/juju-core/container/kvm/testing [no test files]
ok launchpad.net/juju-core/container/lxc 0.279s
? launchpad.net/juju-core/container/lxc/mock [no test files]
? launchpad.net/juju-core/container/lxc/testing [no test files]
? launchpad.net/juju-core/container/testing [no test files]
ok launchpad.net/juju-core/downloader 5.307s
ok launchpad.net/juju-core/environs 3.049s
ok launchpad.net/juju-core/environs/bootstrap 4.546s
ok launchpad.net/juju-core/environs/cloudinit 0.698s
ok launchpad.net/juju-core/environs/config 3.131s
ok launchpad.net/juju-core/environs/configstore 0.040s
ok launchpad.net/juju-core/environs/filestorage 0.031s
ok launchpad.net/juju-core/environs/httpstorage 0.959s
ok launchpad.net/juju-core/environs/imagemetadata 0.633s
? launchpad.net/juju-core/environs/imagemetadata/testing [no test files]
ok launchpad.net/juju-core/environs/instances 0.059s
ok launchpad.net/juju-core/environs/jujutest 0.235s
ok launchpad.net/juju-core/environs/manual 15.352s
ok launchpad.net/juju-core/environs/simplestreams 0.337s
? launchpad.net/juju-core/environs/simplestreams/testing [no test files]
ok launchpad.net/juju-core/environs/sshstorage 1.167s
ok launchpad.net/juju-core/environs/storage 1.250s
ok launchpad.net/juju-core/environs/sync 33.605s
ok launchpad.net/juju-core/environs/testing 0.216s
ok launchpad.net/juju-core/environs/tools 6.783s
? launchpad.net/juju-core/environs/tools/testing [no test files]
ok launchpad.net/juju-core/errors 0.016s
ok launchpad.net/juju-core/instance 0.024s
? launchpad.net/juju-core/instance/testing [no test files]
ok launchpad.net/juju-core/juju 22.628s
ok launchpad.net/juju-core/juju/osenv 0.020s
? launchpad.net/juju-core/juju/testing [no test files]
ok launchpad.net/juju-core/log 0.015s
ok launchpad.net/juju-core/log/syslog 0.027s
? launchpad.net/juju-core/log/sy...

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1=== modified file 'cert/cert.go'
2--- cert/cert.go 2014-02-03 14:31:54 +0000
3+++ cert/cert.go 2014-02-21 10:21:35 +0000
4@@ -119,7 +119,7 @@
5
6 // NewServer generates a certificate/key pair suitable for use by a server.
7 func NewServer(caCertPEM, caKeyPEM []byte, expiry time.Time, hostnames []string) (certPEM, keyPEM []byte, err error) {
8- return newLeaf(caCertPEM, caKeyPEM, expiry, hostnames, nil)
9+ return newLeaf(caCertPEM, caKeyPEM, expiry, hostnames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})
10 }
11
12 // NewClient generates a certificate/key pair suitable for client authentication.
13@@ -164,7 +164,7 @@
14 NotAfter: expiry.UTC(),
15
16 SubjectKeyId: bigIntHash(key.N),
17- KeyUsage: x509.KeyUsageDataEncipherment,
18+ KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyAgreement,
19 ExtKeyUsage: extKeyUsage,
20 }
21 for _, hostname := range hostnames {
22
23=== modified file 'cert/cert_test.go'
24--- cert/cert_test.go 2013-09-24 05:42:43 +0000
25+++ cert/cert_test.go 2014-02-21 10:21:35 +0000
26@@ -86,6 +86,7 @@
27 c.Assert(srvCert.NotAfter.Equal(expiry), gc.Equals, true)
28 c.Assert(srvCert.BasicConstraintsValid, gc.Equals, false)
29 c.Assert(srvCert.IsCA, gc.Equals, false)
30+ c.Assert(srvCert.ExtKeyUsage, gc.DeepEquals, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})
31
32 checkTLSConnection(c, caCert, srvCert, srvKey)
33 }

Subscribers

People subscribed via source and target branches

to status/vote changes: