summaryrefslogtreecommitdiffstats
path: root/ipapython/certdb.py
Commit message (Collapse)AuthorAgeFilesLines
* LGTM: Remove redundant assignmentChristian Heimes2018-01-091-2/+0
| | | | | | | https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Use pylint 1.7.5 with fix for bad python3 importChristian Heimes2017-12-191-1/+1
| | | | | | Closes: https://pagure.io/freeipa/issue/7315 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com>
* NSSDB: use preferred convert commandChristian Heimes2017-12-071-8/+12
| | | | | | | | | | | | After further testing, Kai Engert proposed to use -N with -f -@ to convert a NSSDB from DBM to SQL format. https://fedoraproject.org/wiki/Changes/NSSDefaultFileFormatSql#Upgrade.2Fcompatibility_impact https://pagure.io/freeipa/issue/7049 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix ca less IPA install on fips modeFlorence Blanc-Renaud2017-11-271-0/+4
| | | | | | | | | | | | | | | | | When ipa-server-install is run in fips mode and ca-less, the installer fails when the keys are provided with --{http|dirsrv|pkinit}-cert-file in a separate key file. The installer transforms the key into PKCS#8 format using openssl pkcs8 -topk8 but this command fails on a fips-enabled server, unless the options -v2 aes256 -v2prf hmacWithSHA256 are also provided. Fixes: https://pagure.io/freeipa/issue/7280 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Run tox tests for PyPI packages on TravisChristian Heimes2017-11-201-1/+1
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Support sqlite NSSDBChristian Heimes2017-11-161-21/+136
| | | | | | | | | | | Prepare CertDB and NSSDatabase to support sqlite DB format. NSSDatabase will automatically detect and use either old DBM or new SQL format. Old databases are not migrated yet. https://pagure.io/freeipa/issue/7049 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use namespace-aware meta importer for ipaplatformChristian Heimes2017-11-151-19/+9
| | | | | | | | | | | | | | | | Instead of symlinks and build-time configuration the ipaplatform module is now able to auto-detect platforms on import time. The meta importer uses the platform 'ID' from /etc/os-releases. It falls back to 'ID_LIKE' on platforms like CentOS, which has ID=centos and ID_LIKE="rhel fedora". The meta importer is able to handle namespace packages and the ipaplatform package has been turned into a namespace package in order to support external platform specifications. https://fedorahosted.org/freeipa/ticket/6474 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix cert file creation during CA-less installationStanislav Laznicka2017-08-251-1/+2
| | | | | | | | | | | | When writing extracted certs and keys to the file, we opened the same file at a different spot but the original file position indicator would not be moved when the certificate is written there. The result is that the certificate gets rewritten by the private key. This commit fixes it. Fixes: https://pagure.io/freeipa/issue/7118 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Fix incorrect 'with' statement in CA-less installationFraser Tweedale2017-08-251-2/+2
| | | | | | | Part of: https://pagure.io/freeipa/issue/7118 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* x509,certdb: handle certificates as bytesStanislav Laznicka2017-07-271-12/+22
| | | | | | | | | | | Certificates, both in PEM and DER format, should be handled as bytes in Python 3. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* x509: Make certificates represented as objectsStanislav Laznicka2017-07-271-61/+45
| | | | | | | | https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Split x509.load_certificate() into PEM/DER functionsStanislav Laznicka2017-07-271-6/+6
| | | | | | | | | | | | | Splitting the load_certificate() function into two separate helps us word the requirements for the input explicitly. It also makes our backend similar to the one of python-cryptography so eventually we can swap python-cryptography for IPA x509 module. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-141-10/+14
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* More verbose error message on kdc cert validationStanislav Laznicka2017-06-161-3/+7
| | | | | | | | | | KDC cert validation was added but provides rather non-descriptive error should there be something wrong with a certificate. Pass the error message from the `openssl` tool in such cases. https://pagure.io/freeipa/issue/6945 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* cert-validate: keep all messages in cert validationStanislav Laznicka2017-06-161-10/+2
| | | | | | | | | | Previous attempt to improve error messages during certificate validation would only work in English locale so we're keeping the whole NSS messages for all cases. https://pagure.io/freeipa/issue/6945 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add Subject Key Identifier to CA cert validity checkFraser Tweedale2017-05-301-0/+6
| | | | | | | | | | | | | | | CA certificates MUST have the Subject Key Identifier extension to facilitiate certification path construction. Not having this extension on the IPA CA certificate will cause failures in Dogtag during signing; it tries to copy the CA's Subject Key Identifier to the new certificate's Authority Key Identifier extension, which fails. When installing an externally-signed CA, check that the Subject Key Identifier extension is present in the CA certificate. Fixes: https://pagure.io/freeipa/issue/6976 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server install: fix KDC certificate validation in CA-lessJan Cholasta2017-05-191-0/+41
| | | | | | | | | | | Verify that the provided certificate has the extended key usage and subject alternative name required for KDC. https://pagure.io/freeipa/issue/6831 https://pagure.io/freeipa/issue/6869 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* install: trust IPA CA for PKINITJan Cholasta2017-05-191-0/+2
| | | | | | | | | | Trust IPA CA to issue PKINIT KDC and client authentication certificates in the IPA certificate store. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb: use custom object for trust flagsJan Cholasta2017-05-191-6/+103
| | | | | | | | | | | Replace trust flag strings with `TrustFlags` objects. The `TrustFlags` class encapsulates `certstore` key policy and has an additional flag indicating the presence of a private key. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb, certs: make trust flags argument mandatoryJan Cholasta2017-05-191-3/+1
| | | | | | | | | | Make the trust flags argument mandatory in all functions in `certdb` and `certs`. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb: add named trust flag constantsJan Cholasta2017-05-191-2/+7
| | | | | | | | | | | Add named constants for common trust flag combinations. Use the named constants instead of trust flags strings in the code. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Provide useful messages during cert validationStanislav Laznicka2017-05-181-6/+20
| | | | | | | | | When the certificate validation was replaced, some error messages were omitted (like "Peer's certificate expired."). Bring these back. https://pagure.io/freeipa/issue/6945 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Remove publish_ca_cert() method from NSSDatabaseStanislav Laznicka2017-04-031-9/+0
| | | | | | | | NSSDatabase.publish_ca_cert() is not used anymore, remove it. https://pagure.io/freeipa/issue/6806 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* certdb: fix `AttributeError` in `verify_ca_cert_validity`Jan Cholasta2017-04-031-1/+1
| | | | | | | | | `NSSDatabase.verify_ca_cert_validity` tries to access a property of basic constraints extension on the extension object itself rather than its value. Access the attribute on the correct object to fix the issue. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certdb: use certutil and match_hostname for cert verificationJan Cholasta2017-03-311-50/+30
| | | | | | | Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* httpinstance: clean up /etc/httpd/alias on uninstallJan Cholasta2017-03-221-0/+13
| | | | | | | | | | | Restore cert8.db, key3.db, pwdfile.txt and secmod.db in /etc/httpd/alias from backup on uninstall. Files modified by IPA are kept with .ipasave suffix. https://pagure.io/freeipa/issue/4639 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* pylint_plugins: add forbidden import checkerJan Cholasta2017-03-101-2/+4
| | | | | | | | | | Add new pylint AST checker plugin which implements a check for imports forbidden in IPA. Which imports are forbidden is configurable in pylintrc. Provide default forbidden import configuration and disable the check for existing forbidden imports in our code base. Reviewed-By: Martin Basti <mbasti@redhat.com>
* certdb: Don't restore_context() of new NSSDBChristian Heimes2017-03-011-5/+1
| | | | | | | | | | | It's not necesary to restore the context of newly created files. SELinux ensures that new files have the correct permission. An explicit restore_context() is only required when either policies have changed or the context was changed manually. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client install: create /etc/ipa/nssdb with correct modeJan Cholasta2017-02-201-2/+8
| | | | | | | | | | | | The NSS database directory is created with mode 640, which causes the IPA client to fail to connect to any IPA server, because it is unable to read trusted CA certificates from the NSS database. Create the directory with mode 644 to fix the issue. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add password to certutil calls in NSSDatabaseStanislav Laznicka2017-02-171-13/+7
| | | | | | | | | | NSSDatabases should call certutil with a password. Also, removed `password_filename` argument from `.create_db()`. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Simplify NSSDatabase password file handlingSimo Sorce2017-02-151-17/+12
| | | | | | | https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Separate RA cert store from the HTTP cert storeSimo Sorce2017-02-151-1/+92
| | | | | | | | | | | | | | | This is in preparation for separating out the user under which the ipa api framework runs as. This commit also removes certs.NSS_DIR to avoid confusion and replaces it where appropriate with the correct NSS DB directory, either the old HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is removed altogether as it was simply not necessary. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* certdb: accumulate extracted certs as list of PEMsFraser Tweedale2016-12-121-7/+8
| | | | | | | | | | | | certdb.NSSDatabase.import_files currently accumulates certificates extracted from input files as a string, which is ugly. Accumulate a list of PEMs instead, and join() them just in time for PKCS #12 creation. Part of: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add function for extracting PEM certs from PKCS #7Fraser Tweedale2016-12-121-7/+2
| | | | | | | | | | | Add a single function for extracting X.509 certs in PEM format from a PKCS #7 object. Refactor sites that execute ``openssl pkcs7`` to use the new function. Part of: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* certdb: fix PKCS#12 import with empty passwordJan Cholasta2016-12-121-1/+1
| | | | | | | | | | | | Since commit f919ab4ee0ec26d77ee6978e75de5daba4073402, a temporary file is used to give passwords to pk12util. When a password is empty, the temporary will be empty as well, which pk12util does not like. Add new line after the password in the temporary file to please pk12util. https://fedorahosted.org/freeipa/ticket/6541 Reviewed-By: David Kupka <dkupka@redhat.com>
* Add pylint guard to import of ipaplatform in ipapython.certdbChristian Heimes2016-12-021-4/+6
| | | | | | | | | | ipaplatform is not available in PyPI wheel packages. The guard silences a pylint error in wheel pylint tests. https://fedorahosted.org/freeipa/ticket/6474 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: remove hard dependency on ipaplatformJan Cholasta2016-11-291-6/+15
| | | | | | | | | | | | | | Use hard-coded paths to certutil, pk12util and openssl in certdb if ipaplatform is not available. Hard-coded the path to setpasswd in ipautil.run() doc string. Remove ipaplatform dependency from ipapython's setup.py and add ipapython dependency to ipaplatform's setup.py. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certdb: use a temporary file to pass password to pk12utilJan Cholasta2016-11-291-3/+7
| | | | | | | | | | | Currently the PKCS#12 file password is passed via stdin and pk12util reads it from /dev/stdin, which is platform-specific. Use a temporary file instead. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certdb: move IPA NSS DB install functions to ipaclient.installJan Cholasta2016-11-291-48/+0
| | | | | | | | | | | The create_ipa_nssdb() and update_ipa_nssdb() depend on ipaplatform. Move them to ipaclient.install.client as they are used only from the client installer and ipa-restore. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-101-8/+9
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Pylint: fix the rest of unused local variablesMartin Basti2016-10-111-5/+3
| | | | Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Pylint: enable check for unused-variablesMartin Basti2016-09-271-0/+2
| | | | | | | | | | | | | | | Unused variables may: * make code less readable * create dead code * potentialy hide issues/errors Enabled check should prevent to leave unused variable in code Check is locally disabled for modules that fix is not clear or easy or have too many occurences of unused variables Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certdb: never use the -r option of certutilJan Cholasta2016-03-161-10/+8
| | | | | | | | | | | | | | | The -r option makes certutil output certificates in DER. If there are multiple certificates sharing the same nickname, certutil will output them concatenated into a single blob. The blob is not a valid DER anymore and causes failures further in the code. Use the -a option instead to output the certificates in PEM and convert them to DER on demand. https://fedorahosted.org/freeipa/ticket/5117 https://fedorahosted.org/freeipa/ticket/5720 Reviewed-By: David Kupka <dkupka@redhat.com>
* client: stop using /etc/pki/nssdbJan Cholasta2016-02-241-0/+29
| | | | | | | | | | Don't put any IPA certificates to /etc/pki/nssdb - IPA itself uses /etc/ipa/nssdb and IPA CA certificates are provided to the system using p11-kit. Remove leftovers on upgrade. https://fedorahosted.org/freeipa/ticket/5592 Reviewed-By: David Kupka <dkupka@redhat.com>
* Refactor ipautil.runPetr Viktorin2015-12-141-13/+17
| | | | | | | | | | | | | | | | | | | | | The ipautil.run function now returns an object with returncode and output are accessible as attributes. The stdout and stderr of all commands are logged (unless skip_output is given). The stdout/stderr contents must be explicitly requested with a keyword argument, otherwise they are None. This is because in Python 3, the output needs to be decoded, and that can fail if it's not decodable (human-readable) text. The raw (bytes) output is always available from the result object, as is "leniently" decoded output suitable for logging. All calls are changed to reflect this. A use of Popen in cainstance is changed to ipautil.run. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* enable pem=True in export_pem_cert functionNiranjan MR2015-11-111-1/+1
| | | | | | | | | | export_pem_cert should export the certificate in pem format but instead exports the cert in der format as it doesn't enable pem=True. This patch specifies pem=True for export_pem_cert function Signed-off-by: Niranjan MR <mrniranjan@fedoraproject.org> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Modernize 'except' clausesPetr Viktorin2015-08-121-4/+4
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 will drop the "comma" syntax. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Modernize number literalsPetr Viktorin2015-07-311-5/+5
| | | | | | | | | | | | | | Use Python-3 compatible syntax, without breaking compatibility with py 2.7 - Octals literals start with 0o to prevent confusion - The "L" at the end of large int literals is not required as they use long on Python 2 automatically. - Using 'int' instead of 'long' for small numbers is OK in all cases except strict type checking checking, e.g. type(0). https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix CA cert validity check for CA-less and external CA installer optionsJan Cholasta2014-10-161-1/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4612 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add missing imports to ipapython.certdbJan Cholasta2014-09-301-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4416 Reviewed-By: Martin Kosek <mkosek@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-28 20:50:30 +0000