From 5c241b2bef8a1b2883874e3ab4ecd5f70b361ab0 Mon Sep 17 00:00:00 2001 From: Russell Teague Date: Thu, 25 Jan 2018 14:26:49 -0500 Subject: [1502838] Correct certificate alt name parsing Certificates may have alternate names specified, which may contain different name types. Only 'DNS' alternate types should be parsed. X509v3 Subject Alternative Name: email:hostmaster@example.com, DNS:host.example.com Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1502838 --- roles/lib_utils/filter_plugins/oo_filters.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/roles/lib_utils/filter_plugins/oo_filters.py b/roles/lib_utils/filter_plugins/oo_filters.py index ef996fefe..a5c8c2aba 100644 --- a/roles/lib_utils/filter_plugins/oo_filters.py +++ b/roles/lib_utils/filter_plugins/oo_filters.py @@ -272,7 +272,7 @@ def haproxy_backend_masters(hosts, port): return servers -# pylint: disable=too-many-branches +# pylint: disable=too-many-branches, too-many-nested-blocks def lib_utils_oo_parse_named_certificates(certificates, named_certs_dir, internal_hostnames): """ Parses names from list of certificate hashes. @@ -318,8 +318,9 @@ def lib_utils_oo_parse_named_certificates(certificates, named_certs_dir, interna certificate['names'].append(str(cert.get_subject().commonName.decode())) for i in range(cert.get_extension_count()): if cert.get_extension(i).get_short_name() == 'subjectAltName': - for name in str(cert.get_extension(i)).replace('DNS:', '').split(', '): - certificate['names'].append(name) + for name in str(cert.get_extension(i)).split(', '): + if 'DNS:' in name: + certificate['names'].append(name.replace('DNS:', '')) except Exception: raise errors.AnsibleFilterError(("|failed to parse certificate '%s', " % certificate['certfile'] + "please specify certificate names in host inventory")) -- cgit v1.2.3