pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0155-cacert-manage-support-PKINIT.patch

483b06
From 7aca75a7142eba58d9cb3ab5d40f3224e53e2243 Mon Sep 17 00:00:00 2001
483b06
From: Jan Cholasta <jcholast@redhat.com>
483b06
Date: Wed, 3 May 2017 06:17:32 +0000
483b06
Subject: [PATCH] cacert manage: support PKINIT
483b06
483b06
Allow installing 3rd party CA certificates trusted to issue PKINIT KDC
483b06
and/or client certificates.
483b06
483b06
https://pagure.io/freeipa/issue/6831
483b06
483b06
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
483b06
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
483b06
---
483b06
 install/tools/man/ipa-cacert-manage.1  |  2 +-
483b06
 ipaserver/install/ipa_cacert_manage.py | 21 +++++++++++++++++----
483b06
 2 files changed, 18 insertions(+), 5 deletions(-)
483b06
483b06
diff --git a/install/tools/man/ipa-cacert-manage.1 b/install/tools/man/ipa-cacert-manage.1
483b06
index e36258d0f96aa1050fe88b05f4fe9a1a8f9a7978..03172814ffb603b656952ce5e9ad6af9c8238ab3 100644
483b06
--- a/install/tools/man/ipa-cacert-manage.1
483b06
+++ b/install/tools/man/ipa-cacert-manage.1
483b06
@@ -90,7 +90,7 @@ File containing the IPA CA certificate and the external CA certificate chain. Th
483b06
 Nickname for the certificate.
483b06
 .TP
483b06
 \fB\-t\fR \fITRUST_FLAGS\fR, \fB\-\-trust\-flags\fR=\fITRUST_FLAGS\fR
483b06
-Trust flags for the certificate in certutil format. Trust flags are of the form "X,Y,Z" where X is for SSL, Y is for S/MIME, and Z is for code signing. Use ",," for no explicit trust.
483b06
+Trust flags for the certificate in certutil format. Trust flags are of the form "A,B,C" or "A,B,C,D" where A is for SSL, B is for S/MIME, C is for code signing, and D is for PKINIT. Use ",," for no explicit trust.
483b06
 .sp
483b06
 The supported trust flags are:
483b06
 .RS
483b06
diff --git a/ipaserver/install/ipa_cacert_manage.py b/ipaserver/install/ipa_cacert_manage.py
483b06
index d28a5966f054141819463cdb1dfef48ee1e46e92..e88e8b63ae94759ac835f3b3b31b0735d68a67b0 100644
483b06
--- a/ipaserver/install/ipa_cacert_manage.py
483b06
+++ b/ipaserver/install/ipa_cacert_manage.py
483b06
@@ -28,6 +28,7 @@ from ipalib.install import certmonger, certstore
483b06
 from ipapython import admintool, ipautil
483b06
 from ipapython.certdb import (EMPTY_TRUST_FLAGS,
483b06
                               EXTERNAL_CA_TRUST_FLAGS,
483b06
+                              TrustFlags,
483b06
                               parse_trust_flags)
483b06
 from ipapython.dn import DN
483b06
 from ipaplatform.paths import paths
483b06
@@ -363,12 +364,24 @@ class CACertManage(admintool.AdminTool):
483b06
                     "http://www.freeipa.org/page/Troubleshooting for "
483b06
                     "troubleshooting guide)" % e)
483b06
 
483b06
-        trust_flags = options.trust_flags
483b06
-        if ((set(trust_flags) - set(',CPTcgpuw')) or
483b06
-            len(trust_flags.split(',')) != 3):
483b06
+        trust_flags = options.trust_flags.split(',')
483b06
+        if (set(options.trust_flags) - set(',CPTcgpuw') or
483b06
+                len(trust_flags) not in [3, 4]):
483b06
             raise admintool.ScriptError("Invalid trust flags")
483b06
 
483b06
-        trust_flags = parse_trust_flags(trust_flags)
483b06
+        extra_flags = trust_flags[3:]
483b06
+        extra_usages = set()
483b06
+        if extra_flags:
483b06
+            if 'C' in extra_flags[0]:
483b06
+                extra_usages.add(x509.EKU_PKINIT_KDC)
483b06
+            if 'T' in extra_flags[0]:
483b06
+                extra_usages.add(x509.EKU_PKINIT_CLIENT_AUTH)
483b06
+
483b06
+        trust_flags = parse_trust_flags(','.join(trust_flags[:3]))
483b06
+        trust_flags = TrustFlags(trust_flags.has_key,
483b06
+                                 trust_flags.trusted,
483b06
+                                 trust_flags.ca,
483b06
+                                 trust_flags.usages | extra_usages)
483b06
 
483b06
         try:
483b06
             certstore.put_ca_cert_nss(
483b06
-- 
483b06
2.9.4
483b06