Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feat(eos_cli_config_gen): Add CRL support for management security #3420

Merged
merged 9 commits into from
Dec 14, 2023
Merged

Feat(eos_cli_config_gen): Add CRL support for management security #3420

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
d30135f
Feat(eos_cli_config_gen): Add CRL support for management security
Dec 12, 2023
32be984
Regenerate schema json correctly
Dec 13, 2023
ce327e6
Fix documentation template
Dec 13, 2023
b894edb
Fix expected documentation
Dec 13, 2023
c2466a8
Address review comments
Dec 13, 2023
0d25c01
Fix test
Dec 13, 2023
b14a26c
Merge branch 'devel' into feat/managementcrl
gmuloc Dec 14, 2023
caaa5d0
Refactor: Add back some logic to detect empty CRL in doc
gmuloc Dec 14, 2023
3e9b3b0
Test: Missed one host
gmuloc Dec 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ...olecule/eos_cli_config_gen/documentation/devices/mac-security-eth-po-entropy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,9 +54,9 @@ interface Management1

### Management Security SSL Profiles

| SSL Profile Name | TLS protocol accepted | Certificate filename | Key filename | Cipher List |
| ---------------- | --------------------- | -------------------- | ------------ | ----------- |
| SSL_PROFILE | 1.1 1.2 | SSL_CERT | SSL_KEY | - |
| SSL Profile Name | TLS protocol accepted | Certificate filename | Key filename | Cipher List | CRLs |
| ---------------- | --------------------- | -------------------- | ------------ | ----------- | ---- |
| SSL_PROFILE | 1.1 1.2 | SSL_CERT | SSL_KEY | - | - |

### Management Security Device Configuration

Expand Down
24 changes: 13 additions & 11 deletions ...ta/avd/molecule/eos_cli_config_gen/documentation/devices/management-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,17 +55,17 @@ interface Management1

### Management Security SSL Profiles

| SSL Profile Name | TLS protocol accepted | Certificate filename | Key filename | Cipher List |
| ---------------- | --------------------- | -------------------- | ------------ | ----------- |
| certificate-profile | - | eAPI.crt | eAPI.key | - |
| cipher-list-profile | - | - | - | ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384 |
| test1-chain-cert | - | - | - | - |
| test1-trust-cert | - | - | - | - |
| test2-chain-cert | - | - | - | - |
| test2-trust-cert | - | - | - | - |
| tls-single-version-profile-as-float | 1.0 | - | - | - |
| tls-single-version-profile-as-string | 1.1 | - | - | - |
| tls-versions-profile | 1.0 1.1 | - | - | - |
| SSL Profile Name | TLS protocol accepted | Certificate filename | Key filename | Cipher List | CRLs |
| ---------------- | --------------------- | -------------------- | ------------ | ----------- | ---- |
| certificate-profile | - | eAPI.crt | eAPI.key | - | ca.crl<br>intermediate.crl |
| cipher-list-profile | - | - | - | ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384 | - |
| test1-chain-cert | - | - | - | - | - |
| test1-trust-cert | - | - | - | - | - |
| test2-chain-cert | - | - | - | - | - |
| test2-trust-cert | - | - | - | - | - |
| tls-single-version-profile-as-float | 1.0 | - | - | - | - |
| tls-single-version-profile-as-string | 1.1 | - | - | - | - |
| tls-versions-profile | 1.0 1.1 | - | - | - | - |

### SSL profile test1-chain-cert Certificates Summary

Expand Down Expand Up @@ -116,6 +116,8 @@ management security
maximum sequential 7
ssl profile certificate-profile
certificate eAPI.crt key eAPI.key
crl ca.crl
crl intermediate.crl
ssl profile cipher-list-profile
cipher-list ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384
ssl profile test1-chain-cert
Expand Down
2 changes: 2 additions & 0 deletions ...llections/arista/avd/molecule/eos_cli_config_gen/intended/configs/management-security.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ management security
maximum sequential 7
ssl profile certificate-profile
certificate eAPI.crt key eAPI.key
crl ca.crl
crl intermediate.crl
ssl profile cipher-list-profile
cipher-list ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384
ssl profile test1-chain-cert
Expand Down
3 changes: 3 additions & 0 deletions ...ctions/arista/avd/molecule/eos_cli_config_gen/inventory/host_vars/management-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,9 @@ management_security:
certificate:
file: eAPI.crt
key: eAPI.key
certificate_revocation_lists:
- intermediate.crl
- ca.crl
- name: tls-single-version-profile-as-string
tls_versions: "1.1"
- name: tls-single-version-profile-as-float
Expand Down
7 changes: 7 additions & 0 deletions ...lections/arista/avd/roles/eos_cli_config_gen/docs/tables/management-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@
| [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;certificate</samp>](## "management_security.ssl_profiles.[].certificate") | Dictionary | | | | |
| [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;file</samp>](## "management_security.ssl_profiles.[].certificate.file") | String | | | | |
| [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;key</samp>](## "management_security.ssl_profiles.[].certificate.key") | String | | | | |
| [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;certificate_revocation_lists</samp>](## "management_security.ssl_profiles.[].certificate_revocation_lists") | List, items: String | | | | List of CRLs (Certificate Revocation List).<br>If specified, one CRL needs to be provided for every certificate in the chain, even if the revocation list in the CRL is empty.<br> |
| [<samp>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;&lt;str&gt;</samp>](## "management_security.ssl_profiles.[].certificate_revocation_lists.[]") | String | | | | |

=== "YAML"

Expand Down Expand Up @@ -109,4 +111,9 @@
certificate:
file: <str>
key: <str>

# List of CRLs (Certificate Revocation List).
# If specified, one CRL needs to be provided for every certificate in the chain, even if the revocation list in the CRL is empty.
certificate_revocation_lists:
- <str>
```
8 changes: 8 additions & 0 deletions ...ollections/arista/avd/roles/eos_cli_config_gen/schemas/eos_cli_config_gen.jsonschema.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 10 additions & 0 deletions ...ble_collections/arista/avd/roles/eos_cli_config_gen/schemas/eos_cli_config_gen.schema.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 7 additions & 0 deletions ...ista/avd/roles/eos_cli_config_gen/schemas/schema_fragments/management_security.schema.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,3 +154,10 @@ keys:
type: str
key:
type: str
certificate_revocation_lists:
type: list
description: |
List of CRLs (Certificate Revocation List).
If specified, one CRL needs to be provided for every certificate in the chain, even if the revocation list in the CRL is empty.
items:
type: str
10 changes: 7 additions & 3 deletions ...ctions/arista/avd/roles/eos_cli_config_gen/templates/documentation/management-security.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,11 +28,15 @@

### Management Security SSL Profiles

| SSL Profile Name | TLS protocol accepted | Certificate filename | Key filename | Cipher List |
| ---------------- | --------------------- | -------------------- | ------------ | ----------- |
| SSL Profile Name | TLS protocol accepted | Certificate filename | Key filename | Cipher List | CRLs |
| ---------------- | --------------------- | -------------------- | ------------ | ----------- | ---- |
{% set ssl_profiles_certs = [] %}
{% for ssl_profile in management_security.ssl_profiles | arista.avd.natural_sort %}
| {{ ssl_profile.name | arista.avd.default('-') }} | {{ ssl_profile.tls_versions | arista.avd.default('-') }} | {{ ssl_profile.certificate.file | arista.avd.default('-') }} | {{ ssl_profile.certificate.key | arista.avd.default('-') }} | {{ ssl_profile.cipher_list | arista.avd.default('-') }} |
{% set crls = "-" %}
{% if ssl_profile.certificate_revocation_lists is arista.avd.defined %}
{% set crls = ssl_profile.certificate_revocation_lists | arista.avd.natural_sort | join("<br>") %}
{% endif %}
| {{ ssl_profile.name | arista.avd.default('-') }} | {{ ssl_profile.tls_versions | arista.avd.default('-') }} | {{ ssl_profile.certificate.file | arista.avd.default('-') }} | {{ ssl_profile.certificate.key | arista.avd.default('-') }} | {{ ssl_profile.cipher_list | arista.avd.default('-') }} | {{ crls }} |
{% set tmp_cert = {} %}
{% if ssl_profile.trust_certificate is arista.avd.defined %}
{% set tmp_cert = {'trust_certificate': ssl_profile.trust_certificate} %}
Expand Down
3 changes: 3 additions & 0 deletions ansible_collections/arista/avd/roles/eos_cli_config_gen/templates/eos/management-security.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,5 +92,8 @@ management security
{% if ssl_profile.certificate is arista.avd.defined %}
certificate {{ ssl_profile.certificate.file }} key {{ ssl_profile.certificate.key }}
{% endif %}
{% for crl in ssl_profile.certificate_revocation_lists | arista.avd.natural_sort %}
crl {{ crl }}
{% endfor %}
{% endfor %}
{% endif %}