[ADD] clouder_certificate_authority: Implement CA using CFSSL

clouder_cert_authority/README.rst

@@ -0,0 +1,52 @@
+.. image:: https://img.shields.io/badge/licence-LGPL--3-blue.svg
+   :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html
+   :alt: License: LGPL-3
+
+=============================
+Clouder Cert Authority
+=============================
+
+This module provides a Cert Authority using Clouder and CFSSL,
+
+
+Configuration
+=============
+
+Clouder configuration instructions are available at https://clouder.readthedocs.io/
+
+Usage
+=====
+
+To use this module, you need to:
+
+#. Create a CFSSL Service in the Clouder Control Panel
+
+Known issues / Roadmap
+======================
+
+* Add more Signature Profile options - https://github.com/cloudflare/cfssl/blob/86ecfbe5750ebf05565e4c80104d0a7919792fee/doc/cmd/cfssl.txt#L113
+* Need to add a hook so that services dependent on revoked certs are refreshed
+* Don't run as root
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues
+<https://github.com/clouder-community/clouder/issues>`_. In case of trouble, please
+check there if your issue has already been reported. If you spotted it first,
+help us smashing it by providing a detailed and welcomed feedback.
+
+Credits
+=======
+
+Contributors
+------------
+
+* Dave Lasley <dave@laslabs.com>
+
+Maintainer
+----------
+
+This module is maintained by Clouder Community.
+
+To contribute to this module, please visit https://github.com/clouder-community/clouder

clouder_cert_authority/__init__.py

@@ -0,0 +1,6 @@
+# -*- coding: utf-8 -*-
+# Copyright 2016 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+from . import models
+from . import wizards

clouder_cert_authority/__manifest__.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+# Copyright 2016 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+{
+    'name': 'Clouder Cert Authority',
+    'version': '10.0.10.0.0',
+    'category': 'Clouder',
+    'depends': [
+        'clouder',
+        'clouder_template_proxy',
+    ],
+    'author': 'LasLabs Inc.',
+    'license': 'LGPL-3',
+    'website': 'https://github.com/clouder-community/clouder',
+    'data': [
+        'data/image_template.xml',
+        'data/image.xml',
+        'data/image_port.xml',
+        'data/image_volume.xml',
+        'data/application_tag.xml',
+        'data/application_type.xml',
+        'data/application_template.xml',
+        'data/application.xml',
+        'data/cert_policy_use.xml',
+        'views/cert_authority.xml',
+        'views/menu.xml',
+        'wizards/cert_authority_scan.xml',
+        'wizards/cert_authority_sign.xml',
+        'wizards/cert_authority_revoke.xml',
+    ],
+    'installable': True,
+    'application': False,
+}

clouder_cert_authority/api.py

@@ -0,0 +1,43 @@
+# -*- coding: utf-8 -*-
+# Copyright 2016 LasLabs Inc.
+# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html).
+
+import logging
+
+from contextlib import contextmanager
+
+from odoo import api
+
+_logger = logging.getLogger(__name__)
+
+try:
+    import cfssl
+except ImportError:
+    _logger.info('CFSSL Python library is not installed.')
+
+
+class API(object):
+    """ It provides a base for all Models requiring API functionality """
+
+    cfssl = cfssl
+
+    @contextmanager
+    @api.model_cr_context
+    def get_api(self, cert_authority=None):
+        """ It returns a :obj:`cfssl.CFSSL` for the cert authority.
+
+        Args:
+            cert_authority (:type:`clouder.CertAuthority`):
+                The cert authority record singleton representing the
+                remote API. The CA does not have to be initialized yet. Use
+                :type:`None` if ``self`` is the CA that should be connected
+                to.
+        """
+        try:
+            # @TODO: Figure out how the hell to get this host from the base
+            host = '000.000.000.000'
+            port = cert_authority.port_id.local_port
+            api = cfssl.CFSSL(host, port, ssl=True)
+            yield api
+        finally:
+            pass

clouder_cert_authority/data/application.xml

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="application_openssl_exec" model="clouder.application">
+        <field name="name">OpenSSL</field>
+        <field name="code">exec</field>
+        <field name="type_id" ref="application_type_openssl" />
+        <field name="tag_ids" eval="[(4, ref('clouder.tag_exec'))]" />
+        <field name="default_image_id" ref="image_openssl_exec" />
+        <field name="sequence">1</field>
+        <field name="required" eval="True"/>
+        <field name="update_strategy">auto</field>
+    </record>
+
+    <record id="application_cfssl_data" model="clouder.application">
+        <field name="name">CFSSL Data</field>
+        <field name="code">data</field>
+        <field name="type_id" ref="application_type_cfssl" />
+        <field name="tag_ids" eval="[(4, ref('clouder.tag_data'))]" />
+        <field name="default_image_id" ref="image_cfssl_data" />
+        <field name="sequence">1</field>
+        <field name="required" eval="True" />
+    </record>
+
+    <record id="application_cfssl_exec" model="clouder.application">
+        <field name="name">CFSSL Exec</field>
+        <field name="code">exec</field>
+        <field name="type_id" ref="application_type_cfssl" />
+        <field name="tag_ids" eval="[(4, ref('clouder.tag_exec'))]" />
+        <field name="default_image_id" ref="image_cfssl_exec" />
+        <field name="sequence">2</field>
+        <field name="required" eval="True" />
+        <field name="update_strategy">auto</field>
+        <field name="child_ids"
+               eval="[(4, ref('application_openssl_exec'))]"
+               />
+    </record>
+
+    <record id="application_cfssl" model="clouder.application">
+        <field name="name">CFSSL</field>
+        <field name="code">cfssl</field>
+        <field name="base" eval="True" />
+        <field name="sequence">1</field>
+        <field name="required" eval="True" />
+        <field name="type_id" ref="application_type_cfssl" />
+        <field name="tag_ids" eval="[(4, ref('tag_cert_authority'))]" />
+        <field name="child_ids"
+               eval="[(4, ref('application_cfssl_data')),
+                      (4, ref('application_cfssl_exec')),
+                     ]"
+               />
+        <field name="template_ids"
+               eval="[(4, ref('clouder.application_template_base_www'))]"
+               />
+    </record>
+
+</odoo>

clouder_cert_authority/data/application_tag.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="tag_cert_authority" model="clouder.application.tag">
+        <field name="name">cert_authority</field>
+    </record>
+
+</odoo>

clouder_cert_authority/data/application_template.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="application_template_cfssl"
+            model="clouder.application.template"
+            >
+        <field name="name">CFSSL</field>
+    </record>
+
+    <record id="application_template_openssl"
+            model="clouder.application.template"
+            >
+        <field name="name">OpenSSL</field>
+    </record>
+
+</odoo>

clouder_cert_authority/data/application_type.xml

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 LasLabs Inc.
+     License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). -->
+
+<odoo>
+
+    <record id="application_type_cfssl"
+            model="clouder.application.type"
+            >
+        <field name="name">cfssl</field>
+        <field name="system_user">root</field>
+        <field name="tag_ids"
+               eval="[(6, 0, [ref('tag_cert_authority')])]"
+               />
+    </record>
+
+    <record id="application_type_openssl"
+            model="clouder.application.type"
+            >
+        <field name="name">openssl</field>
+        <field name="system_user">root</field>
+    </record>
+
+</odoo>