From 997ebc0f56963769bdcbeda60a2dca222c884b1e Mon Sep 17 00:00:00 2001

From: Jan Cholasta <jcholast@redhat.com>

Date: Thu, 27 Apr 2017 09:57:45 +0200

Subject: [PATCH] certdb, certs: make trust flags argument mandatory

Make the trust flags argument mandatory in all functions in `certdb` and

`certs`.

https://pagure.io/freeipa/issue/6831

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>

---

 ipapython/certdb.py                        |  4 +---

 ipaserver/install/certs.py                 | 11 +++++------

 ipaserver/install/dsinstance.py            |  2 +-

 ipaserver/install/httpinstance.py          |  6 ++++--

 ipaserver/install/installutils.py          |  5 +++--

 ipaserver/install/server/replicainstall.py |  4 ++--

 6 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/ipapython/certdb.py b/ipapython/certdb.py

index 44c7bf3197c198295035742e6db48527d76e85a6..88dcae750de5881ae7b4921ca1ae23daa9c5d4b0 100644

--- a/ipapython/certdb.py

+++ b/ipapython/certdb.py

@@ -471,14 +471,12 @@ class NSSDatabase(object):

             self.import_pkcs12(out_file.name, out_password)

-    def trust_root_cert(self, root_nickname, trust_flags=None):

+    def trust_root_cert(self, root_nickname, trust_flags):

         if root_nickname[:7] == "Builtin":

             root_logger.debug(

                 "No need to add trust for built-in root CAs, skipping %s" %

                 root_nickname)

         else:

-            if trust_flags is None:

-                trust_flags = EXTERNAL_CA_TRUST_FLAGS

             try:

                 self.run_certutil(["-M", "-n", root_nickname,

                                    "-t", trust_flags])

diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py

index f87e00eb5e9c14ed30d39ef9f6e86b6f24bb1c61..17b9ebad4a128e292e453af44ca9d63cfb1e6ea2 100644

--- a/ipaserver/install/certs.py

+++ b/ipaserver/install/certs.py

@@ -550,7 +550,7 @@ class CertDB(object):

         return root_nicknames

-    def trust_root_cert(self, root_nickname, trust_flags=None):

+    def trust_root_cert(self, root_nickname, trust_flags):

         if root_nickname is None:

             root_logger.debug("Unable to identify root certificate to trust. Continuing but things are likely to fail.")

             return

@@ -600,14 +600,13 @@ class CertDB(object):

         self.create_certdbs()

         self.load_cacert(cacert_fname, IPA_CA_TRUST_FLAGS)

-    def create_from_pkcs12(self, pkcs12_fname, pkcs12_passwd, passwd=None,

-                           ca_file=None, trust_flags=None):

+    def create_from_pkcs12(self, pkcs12_fname, pkcs12_passwd,

+                           ca_file, trust_flags):

         """Create a new NSS database using the certificates in a PKCS#12 file.

            pkcs12_fname: the filename of the PKCS#12 file

            pkcs12_pwd_fname: the file containing the pin for the PKCS#12 file

            nickname: the nickname/friendly-name of the cert we are loading

-           passwd: The password to use for the new NSS database we are creating

            The global CA may be added as well in case it wasn't included in the

            PKCS#12 file. Extra certs won't hurt in any case.

@@ -615,7 +614,7 @@ class CertDB(object):

            The global CA may be specified in ca_file, as a PEM filename.

         """

         self.create_noise_file()

-        self.create_passwd_file(passwd)

+        self.create_passwd_file()

         self.create_certdbs()

         self.init_from_pkcs12(

             pkcs12_fname,

@@ -624,7 +623,7 @@ class CertDB(object):

             trust_flags=trust_flags)

     def init_from_pkcs12(self, pkcs12_fname, pkcs12_passwd,

-                         ca_file=None, trust_flags=None):

+                         ca_file, trust_flags):

         self.import_pkcs12(pkcs12_fname, pkcs12_passwd)

         server_certs = self.find_server_certs()

         if len(server_certs) == 0:

diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py

index 0db0368fa4b48495718afd779291ce164d1687c8..0e4ae4bfe6f1445de167df8fe5328d6a421e416f 100644

--- a/ipaserver/install/dsinstance.py

+++ b/ipaserver/install/dsinstance.py

@@ -769,7 +769,7 @@ class DsInstance(service.Service):

             if self.ca_is_configured:

                 trust_flags = IPA_CA_TRUST_FLAGS

             else:

-                trust_flags = None

+                trust_flags = EXTERNAL_CA_TRUST_FLAGS

             dsdb.create_from_pkcs12(self.pkcs12_info[0], self.pkcs12_info[1],

                                     ca_file=self.ca_file,

                                     trust_flags=trust_flags)

diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py

index a6aeb21edc73783ff9a3f9b526409ea525aa66dd..c76a1a4e484c5777ced92761916c1c586e8b2d5d 100644

--- a/ipaserver/install/httpinstance.py

+++ b/ipaserver/install/httpinstance.py

@@ -32,7 +32,9 @@ import six

 from augeas import Augeas

 from ipalib.install import certmonger

-from ipapython.certdb import IPA_CA_TRUST_FLAGS, TRUSTED_PEER_TRUST_FLAGS

+from ipapython.certdb import (IPA_CA_TRUST_FLAGS,

+                              EXTERNAL_CA_TRUST_FLAGS,

+                              TRUSTED_PEER_TRUST_FLAGS)

 from ipaserver.install import service

 from ipaserver.install import certs

 from ipaserver.install import installutils

@@ -384,7 +386,7 @@ class HTTPInstance(service.Service):

             if self.ca_is_configured:

                 trust_flags = IPA_CA_TRUST_FLAGS

             else:

-                trust_flags = None

+                trust_flags = EXTERNAL_CA_TRUST_FLAGS

             db.init_from_pkcs12(self.pkcs12_info[0], self.pkcs12_info[1],

                                 ca_file=self.ca_file,

                                 trust_flags=trust_flags)

diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py

index b6f01489ccc65dcbc360929e0a7b315b074df8ce..0445a1d3c403fab690e5afb7c8801ed85773b1e0 100644

--- a/ipaserver/install/installutils.py

+++ b/ipaserver/install/installutils.py

@@ -49,6 +49,7 @@ from ipalib.install.kinit import kinit_password

 import ipaplatform

 from ipapython import ipautil, admintool, version

 from ipapython.admintool import ScriptError

+from ipapython.certdb import EXTERNAL_CA_TRUST_FLAGS

 from ipapython.ipa_log_manager import root_logger

 from ipapython.ipaldap import DIRMAN_DN, LDAPClient

 from ipalib.util import validate_hostname

@@ -1036,7 +1037,7 @@ def load_pkcs12(cert_files, key_password, key_nickname, ca_cert_files,

             if 'u' in trust_flags:

                 key_nickname = nickname

                 continue

-            nssdb.trust_root_cert(nickname)

+            nssdb.trust_root_cert(nickname, EXTERNAL_CA_TRUST_FLAGS)

         # Check we have the whole cert chain & the CA is in it

         trust_chain = list(reversed(nssdb.get_trust_chain(key_nickname)))

@@ -1176,7 +1177,7 @@ def load_external_cert(files, ca_subject):

             cache[nickname] = (cert, subject, issuer)

             if subject == ca_subject:

                 ca_nickname = nickname

-            nssdb.trust_root_cert(nickname)

+            nssdb.trust_root_cert(nickname, EXTERNAL_CA_TRUST_FLAGS)

         if ca_nickname is None:

             raise ScriptError(

diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py

index 5e78e6faf51ded2fe7634f230c66aa15ae84bad4..fb738cb9f590f3f9595de92ef025c6032e9343f8 100644

--- a/ipaserver/install/server/replicainstall.py

+++ b/ipaserver/install/server/replicainstall.py

@@ -23,7 +23,7 @@ import ipaclient.install.ntpconf

 from ipalib.install import certstore, sysrestore

 from ipalib.install.kinit import kinit_keytab

 from ipapython import ipaldap, ipautil

-from ipapython.certdb import IPA_CA_TRUST_FLAGS

+from ipapython.certdb import IPA_CA_TRUST_FLAGS, EXTERNAL_CA_TRUST_FLAGS

 from ipapython.dn import DN

 from ipapython.ipa_log_manager import root_logger

 from ipapython.admintool import ScriptError

@@ -740,7 +740,7 @@ def install_check(installer):

             if ca_enabled:

                 trust_flags = IPA_CA_TRUST_FLAGS

             else:

-                trust_flags = None

+                trust_flags = EXTERNAL_CA_TRUST_FLAGS

             tmp_db.create_from_pkcs12(pkcs12_info[0], pkcs12_info[1],

                                       ca_file=cafile,

                                       trust_flags=trust_flags)

-- 

2.9.4