summaryrefslogtreecommitdiffstats
path: root/base
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove unused class 'RAEnrollProfile'Fraser Tweedale2016-03-221-128/+0
|
* Remove unused variables from profile classesFraser Tweedale2016-03-222-13/+1
| | | | | Also drive-by refactor 'createProfileData' to use 'getProfile', reducing code size.
* Remove unused imports from OCSP authority classesFraser Tweedale2016-03-222-2/+0
| | | | | Commit 04214b3d3405750cbbda228554c0d9f087a59170 left some vestigal imports behind; remove them.
* Removed unnecessary URL encoding for admin cert request.Endi S. Dewata2016-03-212-2/+8
| | | | | | | | | Due to changes in aaacd71a2f125501645885d3da1de18459782572, when pki_import_admin_cert is set to False the installation code performs an unnecessary URL encoding for the admin certificate request. The extra URL encoding has now been removed. https://fedorahosted.org/pki/ticket/1803
* Added support for cloning 3rd-party CA certificates.Endi S. Dewata2016-03-189-128/+270
| | | | | | | | | | | | | | | | | | | | | | | The installation code has been modified such that it imports all CA certificates from the PKCS #12 file for cloning before the server is started using certutil. The user certificates will continue to be imported using the existing JSS code after the server is started. This is necessary since JSS is unable to preserve the CA certificate nicknames. The PKCS12Util has been modified to support multiple certificates with the same nicknames. The pki pkcs12-cert-find has been modified to show certificate ID and another field indicating whether the certificate has a key. The pki pkcs12-cert-export has been modified to accept either certificate nickname or ID. The pki pkcs12-import has been modified to provide options for importing only user certificates or CA certificates. https://fedorahosted.org/pki/ticket/1742
* Additional clean-ups for PKCS #12 utilities.Endi S. Dewata2016-03-188-27/+41
| | | | | | | | | | | | | | | | The pki_server_external_cert_path has been renamed to pki_server_external_certs_path to match the file name. A default pki_server_external_certs_path has been added to default.cfg. The pki pkcs12-export has been modified to export into existing PKCS #12 file by default. The pki-server instance-cert-export has been modified to accept a list of nicknames to export. https://fedorahosted.org/pki/ticket/1742
* Renamed PKCS #12 options for consistency.Endi S. Dewata2016-03-1816-72/+72
| | | | | | | The pki CLI's --pkcs12 options has been renamed to --pkcs12-file for consistency with pki-server CLI options. https://fedorahosted.org/pki/ticket/1742
* Added TPS token filter dialog.Endi S. Dewata2016-03-177-13/+200
| | | | | | | | | | | The TPS UI Tokens page and the pki tps-token-find CLI have been modified to provide an interface to filter tokens based on their attributes. The TokenService.findTokens() has been modified to accept additional search criteria based on token attributes. https://fedorahosted.org/pki/ticket/1482
* Fixed illegal token state transition via TEMP_LOST.Endi S. Dewata2016-03-175-28/+60
| | | | | | | | | | | | | | | | The TokenService.setTokenStatus() has been modified to restore the temporarily lost token back into either uninitialized or active state based on whether the token has certificates. The TPSTokendb.tdbGetCertRecordsByCUID() has been modified to use only tokenID attribute to search for token certificates more accurately. It also has been simplified to return the certificate records collection object directly. Some constructors were added to the TPSException to allow chaining the exception cause. https://fedorahosted.org/pki/ticket/1808
* Replaced confirmation dialog with HTML dialog.Endi S. Dewata2016-03-174-142/+79
| | | | | | | | | The TPS UI has been modified such that it will use an HTML-based dialog instead of the browser's built-in dialog such that the option to "prevent this page from creating additional dialogs" will no longer appear. https://fedorahosted.org/pki/ticket/1685
* Rebase to 10.3.xMatthew Harmsen2016-03-041-2/+13
| | | | - PKI TRAC Ticket #1724 - Rebase pki-core to 10.3.x
* Make PKIInstance and PKISubsystem hashableChristian Heimes2016-03-041-2/+4
| | | | The upgrade uses instance and subsystem as keys for dicts.
* Package pki client library for Python 3Christian Heimes2016-03-042-3/+14
| | | | | | | | | | Dogtag's Python code has been compatible with Python 3 for a while. A new package pki-base-python3 provides the pki package for clients. As of now pki.server is not packages for Python 3. The pki-base package also provides pki-base-python2. https://fedorahosted.org/pki/ticket/1739
* Correct installation path for pki.serverChristian Heimes2016-03-031-1/+1
| | | | | 0e35b64c1f751cc8a7a8a0fac25828a8eab24714 introduced an additional and unwanted directory.
* Do not leak status of certs issued by other CAsFraser Tweedale2016-03-031-1/+18
| | | | | | If an OCSP request includes CertIDs for certificates issued by multiple CAs, return 'unknown' CertStatus for all certificates not issued by the "signing" CA.
* Move OCSP digest name lookup to CertID classFraser Tweedale2016-03-035-34/+21
| | | | | | | | | The OCSP digest name lookup is currently defined in IOCSPAuthority and implemented by OCSPAuthority, but /any/ code that deals with CertID might need to know the digest, so move the lookup there. Also refactor the lookup to use a HashMap, and add mappings for SHA2 algorithms.
* Lightweight CAs: lookup correct issuer for OCSP responsesFraser Tweedale2016-03-031-1/+38
|
* Simplify Python package installationChristian Heimes2016-03-032-2/+6
| | | | | | | | | | | * The cmake files now copy just *.py into the installation directory. This ensures that no stale pyc files or __pycache__ directories are copied. rpmbuilder takes care of pyc/pyo compilation on Fedora and RHEL. * The pki-core.spec file uses python2 macros. In case of RHEL missing macros are defined on the top of the file. * A bug in the python_sitelib macros has been fixed. rpmbuilder doesn't like lines breaks.
* Backwards compatibility with sphinx 1.1Christian Heimes2016-03-031-1/+3
| | | | | | sphinx 1.1 doesn't have sphinx.version_info. All supported version have sphinx.__version__ string. conf.py now parses the string for version tests.
* Fix pkcs12 exportAde Lee2016-03-032-7/+11
| | | | | | | | | | | | | | | | | | | | The utility for exporting certs and keys to a PKCS12 file did not handle the signing certificate correctly. This is because the signing certificate was imported multiple times during the export process - either with its key (and key id set) or as part of the cert chain for the other system certs (with no key set). Each import would override the previous import - so whether or not the key_id was set would depend on the order in which the certificates were imported. This becomes an issue for import into a clone certdb, because in the new mechanism, we rely on the cert attributes (ie. key_id) to determine if a key is to be imported or not. We fix this by specifying whether the entry in the export should be overwritten or not.
* Avoid XML parse fail with double-hyphen in hostnameFraser Tweedale2016-03-032-20/+20
| | | | | | | | | | | | server.xml contains metadata read by pkidaemon which includes URLs, in XML comments. If the hostname contains `--', the parse fails. Instead of XML comments, put this information in XML Processing instructions[1], which allows double-hyphens to be used. [1] https://www.w3.org/TR/REC-xml/#NT-PI Fixes: https://fedorahosted.org/pki/ticket/1260
* Ticket #1963 CRL generation enters loop when CA loses connection to netHSM.Christina Fu2016-03-022-0/+80
| | | | | | | | | | | | | | | | | | | | | | | | | This patch makes a low risk attempt to slow down the loop that could be caused by an unexpected exception caused by the unavailability of a dependant component (e.g. HSM, LDAP) in the middle of CRL generation/update. New configuration parameters are: ca.crl.MasterCRL.unexpectedExceptionWaitTime - the wait time in minutes; default is 30 - normally you want it to be less than ca.crl.MasterCRL.autoUpdateInterval and ca.crl.MasterCRL.cacheUpdateInterval ca.crl.MasterCRL.unexpectedExceptionLoopMax - the max number of tries allowed before the slow down mechanism kicks in; default is 10 When such unexpected failure happens, a loop counter is kept and checked against the unexpectedExceptionLoopMax. If the loop counter exceeds the unexpectedExceptionLoopMax, then the current time is checked against the time of the failure, where the time lapse must exceed the unexpectedExceptionWaitTime to trigger a delay. This delay is the counter measure to mitigate the amount of log messages that could flood the log(s). The delay is calcuated like this: waitTime = mUnexpectedExceptionWaitTime - (now - timeOfUnexpectedFailure);
* Handle import and export of external certsAde Lee2016-03-0110-24/+362
| | | | | | | | | | | | | | | | | | | | | | Ticket 1742 has a case where a third party CA certificate has been added by IPA to the dogtag certdb for the proxy cert. There is no way to ensure that this certificate is imported when the system is cloned. This patch will allow the user to import third party certificates into a dogtag instance through CLI commands (pki-server). The certs are tracked by a new instance level configuration file external_certs.conf. Then, when cloning: 1. When the pk12 file is created by the pki-server ca-clone-prepare command, the external certs are automatically included. 2. When creating the clone, the new pki_server_pk12_path and password must be provided. Also, a copy of the external_certs.conf file must be provided. 3. This copy will be read and merged with the existing external_certs.conf if one exists.
* Lightweight CAs: add audit eventsFraser Tweedale2016-03-014-23/+64
| | | | | | Add audit events for lightweight CA administration. Fixes: https://fedorahosted.org/pki/ticket/1590
* Man page updates for new cloning optionsAde Lee2016-03-012-1/+88
|
* Man updates for pre-check modeAde Lee2016-03-012-1/+48
|
* Use CMAKE_CURRENT_SOURCE_DIR for sphinx-buildChristian Heimes2016-03-012-3/+8
| | | | | | sphinx-build used wrong search path for pki Python package. This caused builds to fail on some machines. On systems with pki-base installed, sphinx-build picked up the wrong files.
* Sphinx 1.3 has renamed the default schemeChristian Heimes2016-02-291-1/+5
| | | | | | | | Use html_theme = 'classic' on sphinx 1.3 to silence this warning: WARNING: 'default' html theme has been renamed to 'classic'. Please change your html_theme setting either to the new 'alabaster' default theme, or to 'classic' to keep using the old default.
* Fix pylint 1.5 violation in new pki.cli.pkcs12 moduleChristian Heimes2016-02-291-4/+2
| | | | | | ************* Module pki.cli.pkcs12 E:160,43: Value 'cert_info' doesn't support membership test (unsupported-membership-test)
* Fail builds when sphinx-builder failsChristian Heimes2016-02-292-1/+3
| | | | | | | | | sphinx-builder just reports errors to stderr but doesn't signal build failures in its return code. The -W option turns any warning into a non-null exit code. Comment out html_static_path. It doesn't exist, is not used but emits a warning which is then turned into an error.
* Implement total ordering for PKISubsystem and PKIInstanceChristian Heimes2016-02-261-0/+45
| | | | | | | | In Python 3 subclasses no longer implement automatic ordering. To provide ordering for sort() and custom comparison, __eq__ and __lt__ are required. https://fedorahosted.org/pki/ticket/2216
* Added workaround for JSS limitation in pki pkcs12-import.Endi S. Dewata2016-02-266-58/+402
| | | | | | | | | | | | | | | | Currently JSS is unable to import CA certificates while preserving their nicknames. As a workaround, the pki pkcs12-import has been modified such that it exports individual CA certificates from PKCS The remaining user certificates will continue to be imported using JSS. A new pki pkcs12-cert-export command has been added to export individual certificates from PKCS #12 file into PEM files. The pki pkcs12-import has been modified to take a list of nicknames of the certificates to be imported into NSS database. https://fedorahosted.org/pki/ticket/1742
* Added Python wrapper for pki pkcs12-import.Endi S. Dewata2016-02-264-98/+348
| | | | | | | | | | | | | | | | | | A Python wrapper module has been added for the pki pkcs12-import command to provide a mechanism to implement a workaround for JSS import limitation. Additional fixes by cheimes have been merged into this patch: setup.py: We must track all sub-packages manually. pylint-build-scan.py: pylint confuses the 'pki' package with the 'pki' command. The workaround symlinks the command and analysis the command under its alternative name. https://fedorahosted.org/pki/ticket/1742
* Added mechanism to import system certs via PKCS #12 file.Endi S. Dewata2016-02-268-86/+158
| | | | | | | | | | | | | | | | | | | | | | The installation tool has been modified to provide an optional pki_server_pkcs12_path property to specify a PKCS #12 file containing certificate chain, system certificates, and third-party certificates needed by the subsystem being installed. If the pki_server_pkcs12_path is specified the installation tool will no longer download the certificate chain from the security domain directly, and it will no longer import the PKCS #12 containing the entire master NSS database specified in pki_clone_pkcs12_path. For backward compatibility, if the pki_server_pkcs12_path is not specified the installation tool will use the old mechanism to import the system certificates. The ConfigurationUtils.verifySystemCertificates() has been modified not to catch the exception to help troubleshooting. https://fedorahosted.org/pki/ticket/1742
* Silence pylint 1.5 false positivesChristian Heimes2016-02-262-6/+5
| | | | | | | Pylint 1.5 complains about additional issues. All issues are false positives. https://fedorahosted.org/pki/attachment/ticket/2223
* pki-tomcat8 needs tomcat-api.jar to compileChristian Heimes2016-02-261-1/+8
| | | | | | | | Tomcat 8.0.32 has moved org.apache.tomcat.ContextBind into tomcat-api.jar. Add tomcat-api.jar to javac classpath to compile pki with latest Tomcat. https://fedorahosted.org/pki/attachment/ticket/2222
* Fix compile issue in RA_Token.cppChristian Heimes2016-02-261-1/+1
| | | | | | | | | | | GCC 6 is more strict than GCC 5 and earlier. It refuses to initialize a char[] with 'int' initializers because char is signed while the its are values from 0 to 255. RA_Token.cpp:989:7: error: narrowing conversion of ‘194’ from ‘int’ to ‘char’ inside { } https://fedorahosted.org/pki/attachment/ticket/2221
* Add precheck option for pkispawn.Ade Lee2016-02-262-76/+103
| | | | | | | | | --precheck can be used to run specific tests prior to ensure that the installation parameters are sane, without actually doing the installation. There are also optional parameters to disable specific tests. Trac Ticket #2042
* Added pki-server commands to export system certificates.Endi S. Dewata2016-02-2510-39/+1036
| | | | | | | | | | | | | | | | Some pki-server commands have been added to simplify exporting the required certificates for subsystem installations. These commands will invoke the pki pkcs12 utility to export the certificates from the instance NSS database. The pki-server ca-cert-chain-export command will export the the certificate chain needed for installing additional subsystems running on a separate instance. The pki-server <subsystem>-clone-prepare commands will export the certificates required for cloning a subsystem. https://fedorahosted.org/pki/ticket/1742
* Updated PKCS12Util.Endi S. Dewata2016-02-244-46/+59
| | | | | | | | | | | | | | | | | | | | | | | The PKCSUtil has been updated to match the functionality provided by JSS. In order to import a certificate properly, the certificate needs to be exported with its private key and certificate chain, so the option to export without key or without the certificate chain has been removed. The option to export only the certificate chain has also been removed since it can be done by exporting the complete certificate chain, then remove the leaf certificate while keeping the chain. The pki pkcs12-cert-add has been modified to provide an option to create a new PKCS #12 file to store the certificate. The pki pkcs12-export has been modified to always overwrite existing file to match the behavior of PKCS12Export. It also has been modified to accept a list of nicknames of certificates to export. https://fedorahosted.org/pki/ticket/1742
* Python 3 fix for Tomcat.get_major_version()Christian Heimes2016-02-231-0/+1
| | | | | I forgot to decode the output of subprocess.check_call(). All other places decode bytes to text properly.
* Lightweight CAs: enrol cert via profile subsystemFraser Tweedale2016-02-225-16/+88
| | | | | | | | | | | | Enrol new CA certs via the profile subsystem to ensure that the usual audit events are logged and to avoid the nasty ConfigStore hack used to generate the cert via CertUtil. This commit also fixes an issue where the new CA certificate does not have the correct Authority Key Identifier extension. Fixes: https://fedorahosted.org/pki/ticket/1624 Fixes: https://fedorahosted.org/pki/ticket/1632
* Lightweight CAs: ensure disabled CA cannot create sub-CAsFraser Tweedale2016-02-222-1/+5
| | | | Fixes: https://fedorahosted.org/pki/ticket/1628
* Fix to determine supported javadoc optionsMatthew Harmsen2016-02-191-2/+59
| | | | - PKI TRAC Ticket #2040 - Determine supported javadoc options
* Added CLI to manage keys in PKCS #12 file.Endi S. Dewata2016-02-192-0/+151
| | | | | | | A new CLI has been added to remove a key from a PKCS #12 file based on the key ID. https://fedorahosted.org/pki/ticket/1742
* Added CLI to manage certs in PKCS #12 file.Endi S. Dewata2016-02-196-10/+368
| | | | | | | New CLIs have been added to add a certificate from NSS database and to remove a certificate from the PKCS #12 file. https://fedorahosted.org/pki/ticket/1742
* Refactored PKCS12Util to use PKCS12 object.Endi S. Dewata2016-02-1911-214/+308
| | | | | | | | | | | | The PKCS12Util has been modified such that it stores the certs and keys in PKCS12 object instead of PFX object. The PKCS12 object can be loaded either from NSS database or PKCS #12 file. The PKCS12 object can later be stored into NSS database or PKCS #12 file. The pki pkcs12-cert-find and pkcs12-key-find commands were modified to require PKCS #12 password. https://fedorahosted.org/pki/ticket/1742
* Refactored PKCS12CertInfo and PKCS12KeyInfo classes.Endi S. Dewata2016-02-197-35/+133
| | | | | | | | | | The PKCS12CertInfo and PKCS12KeyInfo classes have been moved out of PKCS12Util into separate classes. The createLocalKeyID() has been modified to return BigInteger instead of byte array. https://fedorahosted.org/pki/ticket/1742
* Modify dnsdomainname test in pkispawnAde Lee2016-02-173-3/+3
| | | | | | We do a check for the dnsdomainname, which fails in Openstack CI because this is not set. Instead of exiting, default to the hostname.
* Added PKCS #12 attribute to store certificate trust flags.Endi S. Dewata2016-02-176-52/+291
| | | | | | | | | A new PKCS #12 attribute has been defined to store NSS certificate trust flags in PKCS #12 file. The PKCS12Util has been modified to store the trust flags during export and reset the trust flags in NSS database during import. https://fedorahosted.org/pki/ticket/1742
generated by cgit (git 2.34.1) at 2024-06-08 07:00:52 +0000