Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] x509.create_csr creates invalid CSR by default #63103

Closed
5 tasks done
lkubb opened this issue Nov 23, 2022 · 0 comments · Fixed by #63099
Closed
5 tasks done

[BUG] x509.create_csr creates invalid CSR by default #63103

lkubb opened this issue Nov 23, 2022 · 0 comments · Fixed by #63099
Labels
Bug broken, incorrect, or confusing behavior needs-triage

Comments

@lkubb
Copy link
Contributor

lkubb commented Nov 23, 2022

Description
x509.create_csr by default sets the version to 3, which is invalid for CSR (only 1 exists). Trying to import such a CSR with more strict libraries fails (latest versions of cryptography, whatever Go library Vault uses).

Setup

  • on-prem machine
  • VM (Virtualbox, KVM, etc. please specify)
  • classic packaging
  • onedir packaging
  • used bootstrap to install

Steps to Reproduce the behavior

salt-call x509.create_private_key /tmp/pk
salt-call x509.create_csr /tmp/csr private_key=/tmp/pk
>>> import cryptography
>>> cryptography.__version__
'38.0.3'
>>> a = """-----BEGIN CERTIFICATE REQUEST-----
... MIICVjCCAT4CAQIwADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM5+
... 0OS8+xIy2I475qlgxEqqSP28BncqlRG1d1VjB4Xc22K+QHS2ipeFM6NRlO2OytYy
... qMMgqU1lKU7sJXxw/uXfNMP40G3t5hrI8O/KtVbIYwujVkswgEMg4bZvmOSjyqte
... BbOH4baQK+7P8LN8Ceaja6d5QAWKBvKSD8f8X1khZP8Lw0rUJjOFWi+XIrEsyd8d
... gern7Qw6ATdFvLs7aY5p2AliUhp1zlqkBJqNcqpLQZubVlg8w1ABfzwFRvTslGio
... SCoCA0MJ0QyThgHjJIqpvZGVdrD4ZQP4rXZHMv8Qzquolpou0n984oCk8t3qyaR+
... WmJIdcPtmMYr8Y6YGKcCAwEAAaARMA8GCSqGSIb3DQEJDjECMAAwDQYJKoZIhvcN
... AQELBQADggEBAEwUc47pXGCNLmZSKAhDu4FbrVyW+PrdWGYKBI+onycy7wCqDP9c
... vQ4lGeuG3t074drgKvm9fIDUdTZLqDDXD2kOAW+7AYbRYxUvTxMiDyrsqyH+N590
... S+SucVJzEZTVNqrWLMn4JwOuXf4onuAxtFLOY+dSGbpU6CiFbaXk6qDDsankqn0Y
... TsAWx3PqeU2w9CT3a68rW214Avn1aMP+aCMHZ7QQpnTnRKXVZscOjiY6MT9Yb8Nv
... BldjvVnQN7bCjM2TQTMSbd00lD+071hLm6ceDQdoewbipNKyhBnQd4hFYJgDPQR7
... 1OVnGCilmno3MkKW4yztBX2gI2ifXSaunmY=
... -----END CERTIFICATE REQUEST-----"""
>>> from cryptography import x509
>>> x509.load_pem_x509_csr(a.encode())
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/jeanluc/.local/share/asdf/installs/python/3.10.4/lib/python3.10/site-packages/cryptography/x509/base.py", line 535, in load_pem_x509_csr
    return rust_x509.load_pem_x509_csr(data)
cryptography.x509.base.InvalidVersion: 2 is not a valid CSR version

Expected behavior
Default to the correct version 1

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
          Salt: 3005.1

Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 3.0.3
       libgit2: Not Installed
      M2Crypto: 0.37.1
          Mako: Not Installed
       msgpack: 1.0.0
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: Not Installed
      pycrypto: Not Installed
  pycryptodome: 3.9.7
        pygit2: Not Installed
        Python: 3.9.2 (default, Feb 28 2021, 17:03:44)
  python-gnupg: Not Installed
        PyYAML: 5.3.1
         PyZMQ: 20.0.0
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.4

System Versions:
          dist: debian 11 bullseye
        locale: utf-8
       machine: x86_64
       release: 5.10.0-18-amd64
        system: Linux
       version: Debian GNU/Linux 11 bullseye
@lkubb lkubb added Bug broken, incorrect, or confusing behavior needs-triage labels Nov 23, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug broken, incorrect, or confusing behavior needs-triage
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant