summaryrefslogtreecommitdiffstats
path: root/base/common
Commit message (Collapse)AuthorAgeFilesLines
...
* Replaced legacy HttpClient.Endi S. Dewata2015-10-221-3/+17
| | | | | | | | | | | | | The ConfigurationUtils and CertUtil have been modified to use PKIConnection which uses Apache HttpClient instead of the legacy custom HttpClient. The POST request content is now created using MultivaluedMap. The PKIConnection has been modified to provide a get() method to send an HTTP GET request. The post() method was modified to accept a path parameter. https://fedorahosted.org/pki/ticket/342
* Removed unused WizardServlet.Endi S. Dewata2015-10-221-22/+8
| | | | | | | | | | The unused configuration wizard servlet has been removed to simplify refactoring other codes. The remaining references in CertUtil and ConfigurationUtils have been removed as well. https://fedorahosted.org/pki/ticket/1120
* Store issuer DN in certificate recordsFraser Tweedale2015-10-211-2/+5
| | | | | | | | Lightweight CAs mean that we may wish to filter certificates based on the issuer. Update X509CertImplMapper to store the issuer DN in each certificate record, using exiting schema. Also add indices for the 'issuerName' LDAP attribute.
* Ticket #1648 [RFE] provide separate cipher lists for CS instances acting as ↵Christina Fu2015-10-202-1/+3
| | | | client and server This patch provides subsystem->subsystem cipher configuration when acting as a client
* Add delete_ca functionality to the Python APIAde Lee2015-10-061-1/+60
|
* Lightweight CAs: implement deletion API and CLIFraser Tweedale2015-10-066-0/+54
| | | | | | | Implement lightweight authority deletion including CLI command. To be deleted an authority must be disabled and have no sub-CAs. Fixes: https://fedorahosted.org/pki/ticket/1324
* Added Java client and CLI support for Feature resource.Ade Lee2015-10-023-5/+58
|
* Ticket #1593 auto-shutdown - for HSM failover supportChristina Fu2015-10-013-1/+17
| | | | | | | | | | | | | | | This is an interim solution for supporting HSM failover by automatically shutting down the server when signing key becomes inaccessible. At auto-shutdown, a crumb fiile will be left in the instance directory for an external daemon to detect and restart, if necessary. Due to limitation of the watch dog (nuxwdog) at present time, the restart option currently only works if started with watch dog (nuxwdog), and it will prompt for passwords on the terminals. The restart counter is to prevent the server from going into an infinite restart loop. Administrator will have to reset autoShutdown.restart.count to 0 when max is reached. (cherry picked from commit 5a9ecad9172f76ca1b94b40aedcdd49d009aceb1)
* Python packaging of PKI client libraryChristian Heimes2015-10-012-0/+105
| | | | | | | | | | | | | | | | | | | | | | A new setup.py in base/common/python makes it possible to bundle the pki client library and upload it on PyPI. The setup.py in the root directory is only used for tox and testing. It's a cleaner and less fragile approach than to support two different build flavors with one setup.py The 'release' alias from setup.cfg creates and uploads a source distribution and an universal wheel: $ sudo yum install python-wheel python-setuptools $ cd base/common/python $ python setup.py release The 'packages' alias just creates the source distribution and wheel: $ python setup.py packages The version number is taken from the Version and Release fields of pki-core.spec.
* Replace legacy Python base64 invocations with Py3-safe codeChristian Heimes2015-10-013-11/+42
| | | | | | | | | Replace deprecated decodestring() and encodestring() with b64decode() and b64encode(). Provice specialized encode_cert() / decode_cert() functions to handle base64 encoding and decoding for X.509 certs in JSON strings. In Python 3 the base64 function don't suppor ASCII text, just ASCII bytes.
* Fixup for subcasAde Lee2015-09-301-3/+3
| | | | | | The attribute used in requests to specify the authority has changed from authority to issuer_id. This updates the python client accordingly.
* Refactored certificate processors.Endi S. Dewata2015-09-301-5/+7
| | | | | | | | | | | | | The CertProcessor.setCredentialsIntoContext() and CAProcessor. authenticate() methods have been modified such that they can accept credentials provided via the AuthCredentials (for REST services) or via the HttpServletRequest (for legacy servlets). The CertEnrollmentRequest has been modified to inherit from ResourceMessage such that REST clients can provide the credentials via request attributes. https://fedorahosted.org/pki/ticket/1463
* Fixup for python client for subcasAde Lee2015-09-271-7/+7
|
* Python client for subcasAde Lee2015-09-272-14/+486
| | | | | | Includes python code (and unit tests!) to list, get and create subCAs. Also fixed a couple of PEP 8 violations that crept in.
* Added Features REST API resourceAde Lee2015-09-273-0/+365
| | | | | | | | | This will help us track whether or not a server has a feature either offered or enabled. Ultimately, it could be used by an admin to enable or disable features. The Java client is not included in this commit. Will add in a subsequent commit.
* Lightweight CAs: REST cert request param to specify authorityFraser Tweedale2015-09-262-3/+18
| | | | | | | | Add the optional "ca" query parameter for REST cert request submission. Also update the ca-cert-request-submit CLI command with an option to provide an AuthorityID. Part of: https://fedorahosted.org/pki/ticket/1213
* Lightweight CAs: add ca-authority CLIFraser Tweedale2015-09-262-1/+64
| | | | | | Add CLI commands for creating, listing and showing lightweight CAs. Part of: https://fedorahosted.org/pki/ticket/1213
* Lightweight CAs: initial supportFraser Tweedale2015-09-2611-4/+403
| | | | | | | | | | | | | This commit adds initial support for "lightweight CAs" - CAs that inhabit an existing CA instance and share the request queue and certificate database of the "top-level CA". We initially support only sub-CAs under the top-level CA - either direct sub-CAs or nested. The general design will support hosting unrelated CAs but creation or import of unrelated CAs is not yet implemented. Part of: https://fedorahosted.org/pki/ticket/1213
* API: add support for generic entitiesFraser Tweedale2015-09-142-3/+21
|
* Silence no-name-in-module errorChristian Heimes2015-08-191-1/+1
| | | | | | | | Some versions of pylint complain about six's moves magic: No name 'urllib' in module '_MovedItems' (no-name-in-module) Disable error E0611.
* Py3 compatibility: __eq__ blocks inheritance of __hash__Christian Heimes2015-08-171-0/+6
| | | | | | | | Some types implement __eq__ but don't provide a __hash__ function. Mark these types as non-hashable with __hash__ = None. This fixes: DeprecationWarning: Overriding __eq__ blocks inheritance of __hash__ in 3.x
* Py3 modernization: misc manual fixesChristian Heimes2015-08-173-5/+6
| | | | | | | | | | | | | | | | | | | | | | Python 3's exception class has no message attribute. e.message can either be replaced with string representation of e or e.args[0]. Use print(line, end='') instead of sys.stdout.write(). With end='' no new line is appended. Use six.reraise() to reraise an exception. Remove sys.exc_clear() as it is no longer available in Python 3. Conditionally import shutil.WindowsError. Use six.move to import correct modules / function like quote, urlparse and configparser. Silence some pylint warnings. pylint doesn't understand six.moves magic and emits a import-error warning. Add additional tox envs to check for Python 3 compatibility.
* Py3 modernization: libmodernize.fixes.fix_dict_sixChristian Heimes2015-08-175-22/+30
| | | | | | | | | In Python 3 dict methods like values(), items() and keys() return views rather than lists. The iter equivalents are gone. Use six to use iterators on Python 2 and 3. In some places like setup.py a list is required. Use list(somedict.values()) to get a list on all Python versions.
* Py3 modernization: libmodernize.fixes.fix_metaclassChristian Heimes2015-08-171-2/+2
| | | | | | Python 3 has a different syntax for meta classes. The old __metaclass__ attribute is no longer supported. six.with_metaclass() constructs a suitable metaclass for us.
* Py3 modernization: lib2to3.fixes.fix_execfileChristian Heimes2015-08-171-1/+4
| | | | | execfile has been removed from Python 3. The upgrade importer now reads, compiles and executed the upgrade scripts manually.
* Py3 modernization: libmodernize.fixes.fix_input_sixChristian Heimes2015-08-171-1/+4
| | | | | | | In Python 3 raw_input() has been renamed to input() and the old, insecure input() builtin is gone. six.moves simplifies the transition. It provides the former raw_input() function under the same import name on Python 2 and 3.
* Py3 modernization: libmodernize.fixes.fix_printChristian Heimes2015-08-178-196/+204
| | | | | | | | | Replace print statement with Python 3's print() function. For Python 2 'from __future__ import print_function' turns the print statement into Python 3 compatible print function. See https://www.python.org/dev/peps/pep-3105/
* Py3 modernization: libmodernize.fixes.fix_importChristian Heimes2015-08-1718-0/+18
| | | | | | | | | | | | | | Enforce absolute imports or explicit relative imports. Python 3 no longer supports implicit relative imports, that is unqualified imports from a module's directory. In order to load a module from the same directory inside a package, use from . import module The future feature 'from __future__ import absolute_import' ensures that pki uses absolute imports on Python 2, too. See https://www.python.org/dev/peps/pep-0328/
* Make pki PEP 8 compatibleChristian Heimes2015-08-1412-96/+126
| | | | | | | | | | | | | | | | | | | Large portions of the patch was automatically created with autopep8: find base/ -name '*.py' | xargs autopep8 --in-place --ignore E309 \ --aggressive find base/common/upgrade base/server/upgrade -type f -and \ -not -name .gitignore | autopep8 --in-place --ignore E309 --aggressive autopep8 --in-place --ignore E309 --aggressive \ base/common/sbin/pki-upgrade \ base/server/sbin/pkispawn \ base/server/sbin/pkidestroy \ base/server/sbin/pki-server \ base/server/sbin/pki-server-upgrade About two dozent violations were fixed manually. https://fedorahosted.org/pki/ticket/708
* Replace Exception.message with str(exc)Christian Heimes2015-08-101-5/+5
| | | | | | | | | | | | | | | Python 3 has deprecated and remove Exception.message. Instead we should simply use string formatting to print the message of an Exception. >>> import pki >>> pki.PKIException('msg') PKIException('msg',) >>> pki.PKIException('msg').message 'msg' >>> str(pki.PKIException('msg')) 'msg' >>> '%s' % pki.PKIException('msg') 'msg'
* Remove import of exceptions moduleChristian Heimes2015-08-101-2/+1
| | | | | The exceptions module is obsolete. All builtin exception classes are globals.
* Don't use the types module for builtin typesChristian Heimes2015-08-103-25/+22
| | | | | Since Python 2.2 most types in the types module refer to builtin type objects, e.g. types.ListType is list.
* Use dict.iteritems() instead of dict.items()Christian Heimes2015-08-104-34/+32
| | | | | | iteritems() is the preferred way to iterate over key, value pairs. Python-modernize can convert iteritems() to efficient code on Python 2 and 3.
* Temporary silence InsecureRequestWarningChristian Heimes2015-08-081-0/+24
| | | | https://fedorahosted.org/pki/ticket/1253
* Fixed missing cert request hostname and address.Endi S. Dewata2015-08-052-10/+8
| | | | | | | | | | | | The CA services have been modified to inject request hostname and address into the certificate request object such that they will be stored in the database. This fixes the problem with requests submitted either via the UI or the CLI. An unused method in CertRequestResource has been removed. Some debug messages have been cleaned as well. https://fedorahosted.org/pki/ticket/1535
* Add code to reindex data during cloning without replicationAde Lee2015-07-311-2/+17
| | | | | | | | | | | | | When setting up a clone, indexes are added before the replication agreements are set up and the consumer is initialized. Thus, as data is replicated and added to the clone db, the data is indexed. When cloning is done with the replication agreements already set up and the data replicated, the existing data is not indexed and cannot be accessed in searches. The data needs to be reindexed. Related to ticket 1414
* Removed audit CLI from non-TPS subsystems.Endi S. Dewata2015-07-174-8/+0
| | | | | | | | | | Due to database upgrade issue the pki <subsystem>-audit CLI has been removed from all subsystems except TPS. The AuditModifyCLI has been modified to clarify that the --action and the --input parameters are mutually exclusive. https://fedorahosted.org/pki/ticket/1437
* Handle JSON decode error in handle_exceptions()Christian Heimes2015-07-151-11/+24
| | | | | | | | | | | | | pki.handle_exceptions() raises a JSON decode exception when the body of the HTTPException is not a valid JSON string. The JSON exception hides the true error message. The patch also fixes a bug in PKIException.from_json(). The code and ClassName attribute are now correctly set. Finally we have our first unit test. https://fedorahosted.org/pki/ticket/1488 https://fedorahosted.org/freeipa/ticket/5129
* Ticket 1459 Dogtag clients cannot connect when CS is configured with ECCChristina Fu2015-07-131-0/+4
| | | | clients are: cli, HttpClient, and java console
* remove inaccessible URLs from server.xmlMatthew Harmsen2015-07-131-0/+4
| | | | | - PKI TRAC Ticket #1443 - pkidaemon status tomcat list URLs under PKI subsystems which are not accessible
* In-tree tests and linting with toxChristian Heimes2015-07-102-20/+23
| | | | | | | | | | | | | | | | | | | | | | | | | Before the patch it wasn't possible to run pylint outside a RPM build. The Python sources were split into common and server files in two separate trees. With setup.py and tox the pki package can now be installed and tested in a virtual env. Tox enables developers to automate installation and testing in Python virtual environment. The new tox.ini performs several tasks with one command: * It creates and installs a source distribution of pki packages and its command line scripts * It verifies that all CLI scripts can be execute (using its --help argument). * It runs pylint on all Python files and CLI scripts. * It can run flake8 on all Python and CLI files (disabled for now). * Finally it builds Sphinx autodocs. I had to delay the root check in pkispawn and pkidestroy and modify two files to get rid of Sphinx warnings. https://fedorahosted.org/pki/ticket/696 http://tox.readthedocs.org
* Fixed user-cert-add --serial with remote CA.Endi S. Dewata2015-07-095-217/+344
| | | | | | | | | | | | | | | | | The user-cert-add command has been modified to ask the user for the CA server URI if the CA is not available locally. A new SubsystemClient.exists() method has been added to check whether a subsystem is deployed on the target instance. The SubsystemCLI has been modified to call logout() only if the operation is executed successfully. The certificate approval callback class has been refactored out of PKIConnection into a separate class to clean up circular dependency with PKIClient. https://fedorahosted.org/pki/ticket/1448
* Cleaned up SystemConfigService.validateRequest().Endi S. Dewata2015-07-013-3/+3
| | | | | | | | | | The configure() in SystemConfigService method has been modified to log only the error message in normal responses but log the full stack trace when unexpected issues occur. The validateData() in SystemConfigService has been renamed to validateRequest() for clarity. The log messages have been modified to include the invalid values entered in the request.
* Fixed selftests log message.Endi S. Dewata2015-06-232-6/+4
| | | | | | | | | | | | | The SelfTestSubsystem has been modified to display a 'successful' message only if all tests have passed. If a test fails, it will log a failure, subsequent tests will not be executed, and the subsystem will shutdown immediately. The runSelfTest() in various tests have been cleaned up to throw the original exception to help troubleshooting. The unused RAPresence test has been removed. https://fedorahosted.org/pki/ticket/1249
* Fixed thread leaks during shutdown.Endi S. Dewata2015-06-183-9/+11
| | | | | | | | Various codes have been modified to properly stop threads during shutdown. A new ID attribute has been added to the LDAP connection factory classes to help identify leaking threads. https://fedorahosted.org/pki/ticket/1327
* Startup log message improvementes.Endi S. Dewata2015-06-161-1/+0
| | | | | | | | The PKIListener has been modified to verify that all subsystems are running and to show the command to enable the subsystem if it was disabled due to errors. https://fedorahosted.org/pki/ticket/1406
* Run pylint on upgrade scriptsChristian Heimes2015-06-162-8/+8
| | | | | | | pylint-build-scan.sh doesn't checked the upgrader's Python files yet. This patch adds the common and server upgrade scripts to pylint-build-scan.sh. It also fixes a couple of pylint violations, mostly missing calls to __init__().
* Add new KRA audit events to KRA's CS.cfgChristian Heimes2015-06-161-0/+4
| | | | | | | The patch implements an updater, that adds the new KRA signed audit events (#1160) to KRA's CS.cfg. https://fedorahosted.org/pki/ticket/1382
* Cleaned up python docs generation.Endi S. Dewata2015-05-286-65/+65
| | | | | | | The script to generate Python docs has been cleaned up and simplified. The python-sphinx configuration files have been moved into base/common/python. The build artifacts are now created in the build/base/common/python.
* PKI TRAC Ticket #1388 - pylint unidiomatic-typecheck warnings cause koji ↵Matthew Harmsen2015-05-262-4/+5
| | | | | | builds to fail (cherry picked from commit d2c24aff4e9dc6aa27b337479cfee1fac4940994)
generated by cgit (git 2.34.1) at 2025-09-26 20:50:14 +0000