miguelfdez99
commented
2 years ago Update
The function that we are using to parse config.yml to bash is not ideal, this function does not distinguish if a server IP comes from one node or another, it just passes everything into the same array. Moreover, right now we can't pass more than one IP to one node, it is a one-to-one relationship. So, the function needs to be changed, this also means that the variables would probably change the way we are getting them.
I have found a function that allows us to do more things with the YAML files, it is more accurate that the previous one. The function is based on the previous one: Function , Credits
I have only added this line gsub(\"name: \", \"\"); due to the names were not parse correctly.
Example of both functions output:
config.yml
```` nodes: indexer: - name: indexer ip: 127.0.0.1 - name: indexer2 ip: 127.0.0.20 server: - name: server ip: 127.0.0.1 ip: 127.0.0.2 ip: 127.0.0.4 node_type: master - name: server2 ip: 127.0.0.3 node_type: worker - name: server3 ip: 127.0.0.10 node_type: worker dashboard: - name: dashboard ip: 127.0.0.1 - name: dashboard2 ip: 127.0.0.12 ````Current parse YAML function output
```` nodes_indexer__name=indexer nodes_indexer__ip=127.0.0.1 nodes_indexer__name=indexer2 nodes_indexer__ip=127.0.0.20 nodes_server__name=server nodes_server__ip=127.0.0.1 nodes_server__ip=127.0.0.2 nodes_server__ip=127.0.0.4 nodes_server__node_type=master nodes_server__name=server2 nodes_server__ip=127.0.0.3 nodes_server__node_type=worker nodes_server__name=server3 nodes_server__ip=127.0.0.10 nodes_server__node_type=worker nodes_dashboard__name=dashboard nodes_dashboard__ip=127.0.0.1 nodes_dashboard__name=dashboard2 nodes_dashboard__ip=127.0.0.12 ````New parse YAML function output
```` nodes_indexer_1="indexer" nodes_indexer_1_ip="127.0.0.1" nodes_indexer_2="indexer2" nodes_indexer_2_ip="127.0.0.20" nodes_server_1="server" nodes_server_1_ip="127.0.0.1" nodes_server_1_ip="127.0.0.2" nodes_server_1_ip="127.0.0.4" nodes_server_1_node_type="master" nodes_server_2="server2" nodes_server_2_ip="127.0.0.3" nodes_server_2_node_type="worker" nodes_server_3="server3" nodes_server_3_ip="127.0.0.10" nodes_server_3_node_type="worker" nodes_dashboard_1="dashboard" nodes_dashboard_1_ip="127.0.0.1" nodes_dashboard_2="dashboard2" nodes_dashboard_2_ip="127.0.0.12" nodes_dashboard_=" nodes_dashboard_1 nodes_dashboard_2" nodes_indexer_1_=" nodes_indexer_1_ip" nodes_indexer_2_=" nodes_indexer_2_ip" nodes_=" nodes_indexer nodes_server nodes_dashboard" nodes_dashboard_1_=" nodes_dashboard_1_ip" nodes_server_1_=" nodes_server_1_ip nodes_server_1_node_type" nodes_dashboard_2_=" nodes_dashboard_2_ip" nodes_server_2_=" nodes_server_2_ip nodes_server_2_node_type" nodes_server_3_=" nodes_server_3_ip nodes_server_3_node_type" nodes_indexer_=" nodes_indexer_1 nodes_indexer_2" __=" nodes" nodes_server_=" nodes_server_1 nodes_server_2 nodes_server_3" ````Now, we can separate the nodes IP's.
By changing this we also need to change the variables.
New variables
```` eval "indexer_node_names=( $(cert_parseYaml "${config_file}" | grep "nodes_indexer_[0-9]=" | cut -d = -f 2 ) )" eval "server_node_names=( $(cert_parseYaml "${config_file}" | grep "nodes_server_[0-9]=" | cut -d = -f 2 ) )" eval "dashboard_node_names=( $(cert_parseYaml "${config_file}" | grep "nodes_dashboard_[0-9]=" | cut -d = -f 2) )" eval "indexer_node_ips=( $(cert_parseYaml "${config_file}" | grep "nodes_indexer_[0-9]_ip=" | cut -d = -f 2) )" eval "server_node_ips=( $(cert_parseYaml "${config_file}" | grep "nodes_server_[0-9]_ip=" | cut -d = -f 2) )" eval "dashboard_node_ips=( $(cert_parseYaml "${config_file}" | grep "nodes_dashboard_[0-9]_ip=" | cut -d = -f 2 ) )" eval "server_node_types=( $(cert_parseYaml "${config_file}" | grep "nodes_server_[0-9]_node_type=" | cut -d = -f 2 ) )" eval "number_server_ips=( $(cert_parseYaml "${config_file}" | grep -o -E 'nodes_server_[0-9]_ip' | sort -u | wc -l) )" for i in $(seq 1 ${number_server_ips}); do string='nodes__server__' nodes_server="${string}""${i}" eval "server_node_ip_$i=( $( cert_parseYaml config.yml | grep "${nodes_server}" | sed '/\./!d' | cut -d = -f 2 | sed -r 's/\s+//g') )" done ````Output
```` Indexer node names: indexer indexer2 Server node names: server server2 server3 Dashboard node names: dashboard dashboard2 Indexer node ips: 127.0.0.1 127.0.0.20 Server node ips: 127.0.0.1 127.0.0.2 127.0.0.4 127.0.0.3 127.0.0.10 Dashboard node ips: 127.0.0.1 127.0.0.12 Server node types: master worker worker Number of servers: 3 Server 1: 127.0.0.1 127.0.0.2 127.0.0.4 Server 2: 127.0.0.3 Server 3: 127.0.0.10 ````Now that all of this is done, we need to make some changes in the cert_generateCertificateconfiguration function.
Right now our certificates file looks like this.
[ req ]
prompt = no
default_bits = 2048
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
[req_distinguished_name]
C = US
L = California
O = Wazuh
OU = Wazuh
CN = cname
[ v3_req ]
authorityKeyIdentifier=keyid,issuer
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
IP.1 = cipIt has to be changed to include more IPs in the alt_names section.
Goals
- [x] Change the function that parses .yml files.
- [x] Adapt the variables to the new function.
- [x] Make the cert-tool capable of using multiple IPs.
- [x] Make sure that certificates are created correctly.
- [x] Improve what has been done(remove unnecessary calls, see if some things can be done better).
Hello Team, When configuring cluster nodes that contain more than one IP address (such as CCS, CCR) we need to create the certificates with multiple IP addresses (Subject Alternative Names)
My request is to add this feature to the wazuh-cert-tool.
Thank you in advance!