summaryrefslogtreecommitdiffstats
path: root/base
Commit message (Collapse)AuthorAgeFilesLines
...
| * Added python info clientAde Lee2017-04-032-11/+138
| | | | | | | | | | | | | | | | | | | | | | | | Add python client code to read from the InfoResource class and get the server version. As the PKIConnection in the python client currently requires a subsystem, it is difficult to add an infoclient to an existing KRAClient (or any other client). To get around this, I modified the PKIConnection to allow using the rootURI. Change-Id: Ided75f45f741e2ba3fc86acec715d24b829c8a97
* | Added PKIRESTProvider.Endi S. Dewata2017-04-047-24/+128
| | | | | | | | | | | | | | A new PKIRESTProvider has been added to send and receive StreamingOutput object through REST API. Change-Id: Iefc513aacb9fc26bc7c8c5cbfb4550a4a98da52e
* | Added audit service and CLI to all subsystems.Endi S. Dewata2017-04-0421-2/+105
|/ | | | | | | Previously the audit service and CLI were only available on TPS. Now they have been added to all subsystems. Change-Id: I3b472254641eb887289c5122df390c46ccd97d47
* Change default key size for KRA storage unit to 128Ade Lee2017-04-031-1/+1
| | | | | | | Most of the research out there seems to indicate that AES-128 is more than sufficient for security. Use this as default. Change-Id: Ie333282eacc5ce628c90296561e4cd6a76dcbd8e
* Fix generation of CRMF request for ECC keysAde Lee2017-04-032-16/+11
| | | | | | | | | | | Old CRMFPopClients add the OID for ECC public keys in the encryption algorithm OID for no obvious reason (considering the OID was never read on the server side to begin with). Now that we do read and use that field, we need to set it properly, and also special case on the server side to handle old clients. Change-Id: I0d753e572206e9062746c879ce683978e5e657bd
* Refactored AuditCLI.Endi S. Dewata2017-03-312-5/+7
| | | | | | | The AuditCLI has been modified to create the AuditClient with lazy initialization. Change-Id: I61b08e92a2f2de983fc77513dde89e1d5e1254b9
* Removed redundant Context attributes.Endi S. Dewata2017-03-3122-365/+0
| | | | | | | All subclasses of PKIService have been modified to remove the Context attribute since they have been declared in the base class. Change-Id: Icdbe97efa2b910a579264099f817930c2cc2ed1a
* Fix for pylint when using Python 3.6Christian Heimes2017-03-312-2/+10
| | | | | Added 'pylint: disable=no-member' whenever module 're' attempts to reference its 'MULTILINE' member.
* Misc pylint, flake8 and tox fixesChristian Heimes2017-03-3110-10/+14
|
* Fixed pylint error in pki.authority.Endi S. Dewata2017-03-311-1/+1
| | | | | | https://pagure.io/dogtagpki/issue/2627 Change-Id: I3111e78fc0afb63799e7bd707274ec7a9e8624ac
* Fixed pylint errors in pki.server.cli.subsystem.Endi S. Dewata2017-03-311-3/+2
| | | | | | https://pagure.io/dogtagpki/issue/2627 Change-Id: Icd47be636c78224328438a8091c7c3bdd07c06bd
* Fixed default subsystems for top-level CLI commands.Endi S. Dewata2017-03-315-10/+39
| | | | | | | | | | The top-level CLI commands have been modified to get the subsystem name from the parent subsystem CLI if available, otherwise they will use a hard-coded default value. https://pagure.io/dogtagpki/issue/2626 Change-Id: Ieef45abfdfb4a6fc63fd06a6ccda4e70366de4a0
* Removed duplicate PROP_EXPIRATION_TIME constant.Endi S. Dewata2017-03-302-7/+6
| | | | Change-Id: Ife9108019994b385fc452da0f29dee64d0ccc5d3
* Removed duplicate PROP_MAX_FILE_SIZE constant.Endi S. Dewata2017-03-301-5/+4
| | | | Change-Id: Ic2aa92985e8aee9b5405ad542c640ca67a0047c6
* Removed duplicate PROP_ROLLOVER_INTERVAL constant.Endi S. Dewata2017-03-302-10/+10
| | | | Change-Id: I66b369ec33f97dab96f6d832e2eb9ab0c6cdbe98
* Fix retrieval for symmetric keysAde Lee2017-03-2810-29/+258
| | | | | | | | | | | | | Up to now, we have only ever used the same algorithm (DES3_CBC) for key wrapping and encryption. With the change to use AES Keywrap and AES CBC, we need to know which mechanism was used to encrypt/wrap the secrets when returned to the client. This means passing back more information to the client with the key data, and also modifying the client to use this information to decode the data correctly. Change-Id: I7232085c1eedf38c63abad81db08acc912fa1da1
* Bug #2615 CMC: cleanup code for Encrypted Decrypted POP This patch adds more ↵Christina Fu2017-03-283-43/+240
| | | | error checking and debugging
* Bug 1419742: CMC RFE: provide Proof of Possession for encryption cert ↵Christina Fu2017-03-288-327/+1300
| | | | requests CMC encryptedPOP and decrypedPOP (Phase 1) also disable lraPOPwitness This patch implements the Proof of Possession for encryption only keys. This is a preliminary implementation with limitations. It does not support more than one request. ECC keys are untested. This version only uses default algorithms at some internal places. Not all limitations are listed here.
* Bug 1419734 CMC: id-cmc-identityProofV2 feature implementation This patch ↵Christina Fu2017-03-284-38/+388
| | | | adds both client and server support for two cmc controls: id-cmc-identityProofV2 - for supporting RFC5272, and id-cmc-identification - for assisting in shared secret search; Note: for client, only CMCRequest is updated in this patch
* Refactored TPS ConnectorCLI.Endi S. Dewata2017-03-286-9/+22
| | | | | The TPS ConnectorCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored TPS TokenCLI.Endi S. Dewata2017-03-286-9/+23
| | | | | The TPS TokenCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored TPS ProfileCLI.Endi S. Dewata2017-03-286-9/+22
| | | | | The TPS ProfileCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored TPS ConfigCLI.Endi S. Dewata2017-03-283-5/+12
| | | | | The TPS ConfigCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored TPSCertCLI.Endi S. Dewata2017-03-283-5/+12
| | | | | The TPSCertCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored AuthenticatorCLI.Endi S. Dewata2017-03-286-9/+22
| | | | | The AuthenticatorCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored AuditCLI.Endi S. Dewata2017-03-283-6/+13
| | | | | The AuditCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored ActivityCLI.Endi S. Dewata2017-03-283-5/+12
| | | | | The ActivityCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Added audit logs for SSL/TLS events.Endi S. Dewata2017-03-2811-11/+190
| | | | | | | | | | | | | | | The CMSStartServlet has been modified to register an SSL socket listener called PKIServerSocketListener to TomcatJSS. The PKIServerSocketListener will receive the alerts generated by SSL server sockets and generate ACCESS_SESSION_* audit logs. The CS.cfg for all subsystems have been modified to include ACCESS_SESSION_* audit events. https://pagure.io/dogtagpki/issue/2602 Change-Id: If7fb6c1b096ec8c68d1fd08f9132baf099816f11
* Refactored TPSConnectorCLI for TKS.Endi S. Dewata2017-03-276-8/+21
| | | | | The TPSConnectorCLI for TKS and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored SelfTestCLI.Endi S. Dewata2017-03-274-7/+16
| | | | | The SelfTestCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored CA ProfileMappingCLI.Endi S. Dewata2017-03-276-9/+22
| | | | | The CA ProfileMappingCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored CA ProfileCLI.Endi S. Dewata2017-03-279-18/+41
| | | | | The CA ProfileCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored KRAConnectorCLI for CA.Endi S. Dewata2017-03-274-9/+19
| | | | | The KRAConnectorCLI for CA and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored FeatureCLI.Endi S. Dewata2017-03-273-5/+14
| | | | | The FeatureCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Refactored AuthorityCLI.Endi S. Dewata2017-03-277-9/+26
| | | | | The AuthorityCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
* Modify storage unit to generate a new IVAde Lee2017-03-249-34/+68
| | | | | | | | | | | | | | | | | Currently, the storage unit reuses the same IV each time a record is stored. This works (probably) for DES3, but not for AES. The getWrappingParams() method is modified to check the config as follows (in order): -- if the iv is defined, use that iv -- if the length is defined, generate a byte array of that length -- return null To ensure that the same IV used to encrypt the secret is stored in the DB, the wrapping param is defined once in the archival process, and passed in to the wrapping functions in storageUnit. Change-Id: Ia6696adf56fc7a4e90f83948c7549b64a38ab854
* Change CRMFPopClient to use AES-KeyWrap with paddingAde Lee2017-03-243-37/+86
| | | | | | | | | | | | | | | | | | Also made a couple of small changes to WrappingParams. * Set the wrapIV to null when AES KeyWrap is used. Trying to unpack the PKIArchiveOptions package with this IV set to null fails. * removed superfluous this modifiers. Added a parameter KEY_WRAP_PARAMETER_SET which is set in /etc/pki/pki.conf. If this parameter is set to 0, we will use the old DES3 algorithms. This can be set by clients talking to old servers. CRMFPopClient has the ability to automatically submit requests to a CA. In this case, we shouldcontact the server and determine the version using InfoClient, and choose the algorithm accordingly. We will implement this in a separate patch. Change-Id: Ib4a99545cb59b62a96c272311595e96dda10979e
* Merge github.com:dogtagpki/pkiAde Lee2017-03-2466-229/+306
|\
| * Refactored UserCLI.Endi S. Dewata2017-03-2415-38/+57
| | | | | | | | | | The UserCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
| * Refactored SecurityDomainCLI.Endi S. Dewata2017-03-242-4/+9
| | | | | | | | | | The SecurityDomainCLI and its submodule have been modified to use lazy initialization to get the PKIClient object.
| * Refactored KRA KeyCLI.Endi S. Dewata2017-03-2411-31/+56
| | | | | | | | | | The KRA KeyCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
| * Refactored GroupCLI.Endi S. Dewata2017-03-2411-28/+43
| | | | | | | | | | The CertCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
| * Refactored CA CertCLI.Endi S. Dewata2017-03-2412-39/+61
| | | | | | | | | | The CA CertCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
| * Refactored SubsystemCLI.Endi S. Dewata2017-03-246-70/+52
| | | | | | | | | | | | The SubsystemCLI and its subclasses have been modified to use lazy initialization to get the PKIClient object. They also have been simplified by moving common methods to the base class.
| * Refactored ProxyCLI.Endi S. Dewata2017-03-241-2/+2
| | | | | | | | | | The ProxyCLI has been modified to use lazy initialization to get the PKIClient object.
| * Refactored ClientCLI.Endi S. Dewata2017-03-246-14/+12
| | | | | | | | | | The ClientCLI and its submodules have been modified to use lazy initialization to get the PKIClient object.
| * Refactored CLI.getClient().Endi S. Dewata2017-03-242-3/+4
| | | | | | | | | | The CLI.getClient() has been modified to return the parent CLI's PKIClient object if available.
| * Added CLI.getConfig().Endi S. Dewata2017-03-242-0/+10
| | | | | | | | | | A new CLI.getConfig() has been added to return the parent CLI's configuration if available.
* | Refactor code that creates PKIArchiveOptions objectsAde Lee2017-03-2321-929/+235
|/ | | | | | | | | | | | | | * Refactor code in CryptoUtil to parametrize the algorithms used. * Moved WrappingParams to utils jar to allow correct compilation. * Removed code that created a PKIArchiveOptions structure from CRMFPopClient and replaced with calls to CryptoUtil methods. Note that the algorithms have been left as DES3. They will be changed to AES in the next patch. * Converted code in AuthorityKeyExportCLI to use the new methods in CryptoUtil. * Removed DRMTest this code is no longer maintained or used. Change-Id: I8f625f0310877dca68f6a01285b6ff4e27e7f34a
* Added comparator function to versionAde Lee2017-03-222-20/+54
| | | | Change-Id: I862c86994e6268860380404113a9bea0d237d60e
generated by cgit (git 2.34.1) at 2025-09-26 22:36:01 +0000