pki.git/base/native-tools, branch branch-10.2.7-dev1

sslget must set Host HTTP header

2015-12-15T22:59:40+00:00

The sslget tool sends a TLS SNI header. Apache doesn't like server name
indication without a matching HTTP header. Requests without a Host
header are refused with

HTTP/1.1 400 Bad Request
Hostname example.org provided via SNI, but no hostname provided in HTTP request

sslget now sets a Host HTTP header for all requests.

https://fedorahosted.org/pki/ticket/1704

Signed-off-by: Christian Heimes 
(cherry picked from commit 73f5e33c945d865a88b47491b73553ba8ecf2f53)

Minor fix to "setpin" fix.

2015-08-19T22:57:24+00:00

The routine that sets the password of the "pinmanager" user was
not working. A very simple one character fix takes care of it.

Ticket # 1546 - Setpin utility doesn't set the pin for users.

Checking in under the one line trivial change rule.

(cherry picked from commit 6260a6d20c113343dd04cdbed999865ebc1650c9)

setpin utility doesn't set the pin for users.

2015-08-14T18:00:53+00:00

There were some things wrong with the setpin utility.

1. There were some syntax violations that had to be dealt with or a DS with syntax checking
would not be pleased.

2. The back end is expecting a byte of hash data at the beginning of the pin.
In our case we are sending NO hash so we want this code at the beginning '-'

3. We also need to prepend the dn in front of the pin so the back end can verify the set pin.

Tested to work during both steps of the setpin process: 1) Creating the schema, 2) creating the pin.
Tested to work with actual PinBased Enrollment.

4. Fix also now supports the SHA256 hashing method only, with the sha256 being the default hash.
The no hash option is supported but puts the pin in the clear.

(cherry picked from commit f60846e025ff5492e8c05ccf525fe8df1b59bba6)

Fixing upstream trac ticket 1150.

2014-10-09T19:03:06+00:00

In both sslget.c and revoker.c there is an incorrect equality
check which compares the output of a comparision operator with
a constant(SECFailure) which has a value of -1. The fix will print
the correct SECFailure or SECSuccess value for the do_writes method.

fix typo succesfully -> successfully

2014-09-09T18:42:29+00:00

Replace '-Wformat-security' warning with '-Werror=format-security' error

2013-12-19T01:33:14+00:00

Bugzilla Bug #1037248 - pki-core FTBFS if "-Werror=format-security" flag is used
Bugzilla Bug #1037249 - pki-tps FTBFS if "-Werror=format-security" flag is used

Fix sslget to skip link local addresses

2013-04-26T10:09:20+00:00

* Bugzilla Bug #953464 - ipa-server-install crashes due to sslget error
* Bugzilla Bug #859043 - ipa-server-install results in error -5987

Resolved Trac Ticket 367 - pkidestroy does not remove connector

2013-01-15T14:28:38+00:00

* Added RESTful servlet to add/remove a KRA connector from the CA.
* Modified ACL to allow KRA subsystem user to remove connector.
* Modified connector code to allow the connector to be replaced without a server restart.
* Added functionality to pki CLI to add/remove connector
* Added code to pkidestroy to remove the connector (using both pki CLI and sslget)
  When the issues with pki connection are resolved, we will use that method instead.
* Modified sslget to accept HTTP return codes != 200.  In this case, we were returning
  204 - which is perfectly legitimate.

Removed unnecessary pki folder.

2012-03-26T16:43:54+00:00

Previously the source code was located inside a pki folder.
This folder was created during svn migration and is no longer
needed. This folder has now been removed and the contents have
been moved up one level.

Ticket #131