pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0155-cacert-manage-support-PKINIT.patch

ac7d03
From 7aca75a7142eba58d9cb3ab5d40f3224e53e2243 Mon Sep 17 00:00:00 2001
ac7d03
From: Jan Cholasta <jcholast@redhat.com>
ac7d03
Date: Wed, 3 May 2017 06:17:32 +0000
ac7d03
Subject: [PATCH] cacert manage: support PKINIT
ac7d03
ac7d03
Allow installing 3rd party CA certificates trusted to issue PKINIT KDC
ac7d03
and/or client certificates.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/6831
ac7d03
ac7d03
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
ac7d03
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
ac7d03
---
ac7d03
 install/tools/man/ipa-cacert-manage.1  |  2 +-
ac7d03
 ipaserver/install/ipa_cacert_manage.py | 21 +++++++++++++++++----
ac7d03
 2 files changed, 18 insertions(+), 5 deletions(-)
ac7d03
ac7d03
diff --git a/install/tools/man/ipa-cacert-manage.1 b/install/tools/man/ipa-cacert-manage.1
ac7d03
index e36258d0f96aa1050fe88b05f4fe9a1a8f9a7978..03172814ffb603b656952ce5e9ad6af9c8238ab3 100644
ac7d03
--- a/install/tools/man/ipa-cacert-manage.1
ac7d03
+++ b/install/tools/man/ipa-cacert-manage.1
ac7d03
@@ -90,7 +90,7 @@ File containing the IPA CA certificate and the external CA certificate chain. Th
ac7d03
 Nickname for the certificate.
ac7d03
 .TP
ac7d03
 \fB\-t\fR \fITRUST_FLAGS\fR, \fB\-\-trust\-flags\fR=\fITRUST_FLAGS\fR
ac7d03
-Trust flags for the certificate in certutil format. Trust flags are of the form "X,Y,Z" where X is for SSL, Y is for S/MIME, and Z is for code signing. Use ",," for no explicit trust.
ac7d03
+Trust flags for the certificate in certutil format. Trust flags are of the form "A,B,C" or "A,B,C,D" where A is for SSL, B is for S/MIME, C is for code signing, and D is for PKINIT. Use ",," for no explicit trust.
ac7d03
 .sp
ac7d03
 The supported trust flags are:
ac7d03
 .RS
ac7d03
diff --git a/ipaserver/install/ipa_cacert_manage.py b/ipaserver/install/ipa_cacert_manage.py
ac7d03
index d28a5966f054141819463cdb1dfef48ee1e46e92..e88e8b63ae94759ac835f3b3b31b0735d68a67b0 100644
ac7d03
--- a/ipaserver/install/ipa_cacert_manage.py
ac7d03
+++ b/ipaserver/install/ipa_cacert_manage.py
ac7d03
@@ -28,6 +28,7 @@ from ipalib.install import certmonger, certstore
ac7d03
 from ipapython import admintool, ipautil
ac7d03
 from ipapython.certdb import (EMPTY_TRUST_FLAGS,
ac7d03
                               EXTERNAL_CA_TRUST_FLAGS,
ac7d03
+                              TrustFlags,
ac7d03
                               parse_trust_flags)
ac7d03
 from ipapython.dn import DN
ac7d03
 from ipaplatform.paths import paths
ac7d03
@@ -363,12 +364,24 @@ class CACertManage(admintool.AdminTool):
ac7d03
                     "http://www.freeipa.org/page/Troubleshooting for "
ac7d03
                     "troubleshooting guide)" % e)
ac7d03
 
ac7d03
-        trust_flags = options.trust_flags
ac7d03
-        if ((set(trust_flags) - set(',CPTcgpuw')) or
ac7d03
-            len(trust_flags.split(',')) != 3):
ac7d03
+        trust_flags = options.trust_flags.split(',')
ac7d03
+        if (set(options.trust_flags) - set(',CPTcgpuw') or
ac7d03
+                len(trust_flags) not in [3, 4]):
ac7d03
             raise admintool.ScriptError("Invalid trust flags")
ac7d03
 
ac7d03
-        trust_flags = parse_trust_flags(trust_flags)
ac7d03
+        extra_flags = trust_flags[3:]
ac7d03
+        extra_usages = set()
ac7d03
+        if extra_flags:
ac7d03
+            if 'C' in extra_flags[0]:
ac7d03
+                extra_usages.add(x509.EKU_PKINIT_KDC)
ac7d03
+            if 'T' in extra_flags[0]:
ac7d03
+                extra_usages.add(x509.EKU_PKINIT_CLIENT_AUTH)
ac7d03
+
ac7d03
+        trust_flags = parse_trust_flags(','.join(trust_flags[:3]))
ac7d03
+        trust_flags = TrustFlags(trust_flags.has_key,
ac7d03
+                                 trust_flags.trusted,
ac7d03
+                                 trust_flags.ca,
ac7d03
+                                 trust_flags.usages | extra_usages)
ac7d03
 
ac7d03
         try:
ac7d03
             certstore.put_ca_cert_nss(
ac7d03
-- 
ac7d03
2.9.4
ac7d03