follow naming convention, fix getting new X509Name object for createCertificate

caucase/ca.py

@@ -42,20 +42,15 @@ MIN_CA_RENEW_PERIOD = 2
 DEFAULT_DIGEST_LIST = ['sha256', 'sha384', 'sha512']
 SUBJECT_KEY_LIST = ['C', 'ST', 'L', 'OU', 'O', 'CN', 'emailAddress']
 
-def x509_name(**attrs):
+def getX509NameFromDict(**name_dict):
   """
   Return a new X509Name with the given attributes.
   """
   # XXX There's no other way to get a new X509Name.
   name = crypto.X509().get_subject()
-  attrs = list(attrs.items())
-
-  # Make the order stable - order matters!
-  def key(attr):
-    return attr[1]
-  attrs.sort(key=key)
-  for k, v in attrs:
-    setattr(name, k, v)
+
+  for key, value in name_dict.items():
+    setattr(name, key, value)
   return name
 
 class CertificateAuthority(object):
@@ -251,14 +246,16 @@ class CertificateAuthority(object):
     if ca_key_pair is None:
       ca_key_pair = self._ca_key_pairs_list[-1]
     if subject_dict:
-      for attr in subject_dict.keys():
-        if not attr in SUBJECT_KEY_LIST:
-          raise ValueError("Subject key %r is not allowed. Certificate subject " \
-                         "key should be one of %r" % (attr, SUBJECT_KEY_LIST))
       if subject_dict.has_key('C') and len(subject_dict['C']) != 2:
         # Country code size is 2
         raise ValueError("Country Code size in subject should be equal to 2.")
-      subject = x509_name(**subject_dict)
+      if not subject_dict.has_key('CN'):
+        raise AttributeError("Attribute 'CN' is required in subject.")
+      try:
+        subject = getX509NameFromDict(**subject_dict)
+      except AttributeError:
+        raise AttributeError("X509Name attribute not found. Subject " \
+                         "keys should be in %r" % SUBJECT_KEY_LIST)
     cert_pem = self._generateCertificateObjects(ca_key_pair,
                                                 csr_pem,
                                                 serial,

caucase/test/testca.py

@@ -268,10 +268,10 @@ m4DpuP4nL0ixQJWZuV+qrx6Tow==
 
     subject_dict = {'CN': 'some.site.com', 
                    'C': 'FR',
-                   'ST': 'State',
-                   'L': 'Localisation',
                    'O': 'My Organisation',
+                   'L': 'Localisation',
                    'OU': 'Organisation U',
+                   'ST': 'State',
                    'emailAddress': 'toto@example.com'}
     # sign certificate but change subject
     cert_id = ca.createCertificate(csr_id, subject_dict=subject_dict)
@@ -287,6 +287,17 @@ m4DpuP4nL0ixQJWZuV+qrx6Tow==
     with self.assertRaises(NotFound):
        ca.getPendingCertificateRequest(csr_id)
 
+  def test_createCertificate_custom_subject_no_cn(self):
+    ca = self.make_ca(190)
+    csr, key = self.generateCSR(cn="test certificate", email="some@test.com")
+    csr_id = ca.createCertificateSigningRequest(self.csr_tostring(csr))
+
+    subject_dict = dict(C="FR", emailAddress="caucase@email.com")
+
+    # CN is missing, will raise
+    with self.assertRaises(AttributeError):
+      ca.createCertificate(csr_id, subject_dict=subject_dict)
+
   def test_getCAKeypairForCertificate(self):
     csr, key = self.generateCSR()
     ca = self.make_ca(3)

caucase/web.py

@@ -508,6 +508,10 @@ def sign_cert():
       subject_dict = json.loads(subject)
     return signcert(key, subject_dict=subject_dict)
   except ValueError, e:
+    traceback.print_exc()
+    raise FlaskException(str(e),
+                payload={"name": "FileFormat", "code": 3})
+  except AttributeError, e:
     raise FlaskException(str(e),
                 payload={"name": "FileFormat", "code": 3})