pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone
ac7d03
From ea2fc433d3f72364340919345805c667ce0d7524 Mon Sep 17 00:00:00 2001
ac7d03
From: Pavel Vomacka <pvomacka@redhat.com>
ac7d03
Date: Thu, 1 Jun 2017 09:56:16 +0200
ac7d03
Subject: [PATCH] Turn off OCSP check
ac7d03
ac7d03
The OCSP check was previously turned on but it introduced several
ac7d03
issues. Therefore the check will be turned off by default.
ac7d03
ac7d03
For turning on should be used ipa advise command with correct recipe.
ac7d03
The solution is tracked here: https://pagure.io/freeipa/issue/6982
ac7d03
ac7d03
Fixes: https://pagure.io/freeipa/issue/6981
ac7d03
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
ac7d03
---
ac7d03
 install/restart_scripts/restart_httpd | 15 +-----------
ac7d03
 ipaserver/install/httpinstance.py     | 43 +++++++++++++++++++----------------
ac7d03
 ipaserver/install/server/upgrade.py   | 25 +++-----------------
ac7d03
 3 files changed, 28 insertions(+), 55 deletions(-)
ac7d03
ac7d03
diff --git a/install/restart_scripts/restart_httpd b/install/restart_scripts/restart_httpd
ac7d03
index cd7f12024ea3cab16e9c664687cd854e666c9570..d1684812904a9d32842a0ca548ec6b9df5a5a0b7 100644
ac7d03
--- a/install/restart_scripts/restart_httpd
ac7d03
+++ b/install/restart_scripts/restart_httpd
ac7d03
@@ -21,24 +21,11 @@
ac7d03
 
ac7d03
 import syslog
ac7d03
 import traceback
ac7d03
-from ipalib import api
ac7d03
 from ipaplatform import services
ac7d03
-from ipaplatform.paths import paths
ac7d03
-from ipapython.certdb import TRUSTED_PEER_TRUST_FLAGS
ac7d03
-from ipaserver.install import certs, installutils
ac7d03
+from ipaserver.install import certs
ac7d03
 
ac7d03
 
ac7d03
 def _main():
ac7d03
-
ac7d03
-    api.bootstrap(in_server=True, context='restart', confdir=paths.ETC_IPA)
ac7d03
-    api.finalize()
ac7d03
-
ac7d03
-    db = certs.CertDB(api.env.realm, nssdir=paths.HTTPD_ALIAS_DIR)
ac7d03
-    nickname = installutils.get_directive(paths.HTTPD_NSS_CONF, "NSSNickname")
ac7d03
-
ac7d03
-    # Add trust flag which set certificate trusted for SSL connections.
ac7d03
-    db.trust_root_cert(nickname, TRUSTED_PEER_TRUST_FLAGS)
ac7d03
-
ac7d03
     syslog.syslog(syslog.LOG_NOTICE, 'certmonger restarted httpd')
ac7d03
 
ac7d03
     try:
ac7d03
diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py
ac7d03
index 12fdddccc26b0c1132bcdca7fe2249a85997892e..f637b97db8f21ddbc00c4f70e18e836d300b2f33 100644
ac7d03
--- a/ipaserver/install/httpinstance.py
ac7d03
+++ b/ipaserver/install/httpinstance.py
ac7d03
@@ -34,8 +34,7 @@ from augeas import Augeas
ac7d03
 from ipalib.install import certmonger
ac7d03
 from ipapython import ipaldap
ac7d03
 from ipapython.certdb import (IPA_CA_TRUST_FLAGS,
ac7d03
-                              EXTERNAL_CA_TRUST_FLAGS,
ac7d03
-                              TRUSTED_PEER_TRUST_FLAGS)
ac7d03
+                              EXTERNAL_CA_TRUST_FLAGS)
ac7d03
 from ipaserver.install import replication
ac7d03
 from ipaserver.install import service
ac7d03
 from ipaserver.install import certs
ac7d03
@@ -74,6 +73,10 @@ NSS_CIPHER_SUITE = [
ac7d03
 ]
ac7d03
 NSS_CIPHER_REVISION = '20160129'
ac7d03
 
ac7d03
+OCSP_DIRECTIVE = 'NSSOCSP'
ac7d03
+
ac7d03
+NSS_OCSP_ENABLED = 'nss_ocsp_enabled'
ac7d03
+
ac7d03
 
ac7d03
 def httpd_443_configured():
ac7d03
     """
ac7d03
@@ -163,7 +166,7 @@ class HTTPInstance(service.Service):
ac7d03
                   self.set_mod_nss_protocol)
ac7d03
         self.step("setting mod_nss password file", self.__set_mod_nss_passwordfile)
ac7d03
         self.step("enabling mod_nss renegotiate", self.enable_mod_nss_renegotiate)
ac7d03
-        self.step("enabling mod_nss OCSP", self.enable_mod_nss_ocsp)
ac7d03
+        self.step("disabling mod_nss OCSP", self.disable_mod_nss_ocsp)
ac7d03
         self.step("adding URL rewriting rules", self.__add_include)
ac7d03
         self.step("configuring httpd", self.__configure_http)
ac7d03
         self.step("setting up httpd keytab", self.request_service_keytab)
ac7d03
@@ -270,7 +273,12 @@ class HTTPInstance(service.Service):
ac7d03
         installutils.set_directive(paths.HTTPD_NSS_CONF, 'NSSRenegotiation', 'on', False)
ac7d03
         installutils.set_directive(paths.HTTPD_NSS_CONF, 'NSSRequireSafeNegotiation', 'on', False)
ac7d03
 
ac7d03
-    def enable_mod_nss_ocsp(self):
ac7d03
+    def disable_mod_nss_ocsp(self):
ac7d03
+        if sysupgrade.get_upgrade_state('http', NSS_OCSP_ENABLED) is None:
ac7d03
+            self.__disable_mod_nss_ocsp()
ac7d03
+            sysupgrade.set_upgrade_state('http', NSS_OCSP_ENABLED, False)
ac7d03
+
ac7d03
+    def __disable_mod_nss_ocsp(self):
ac7d03
         aug = Augeas(flags=Augeas.NO_LOAD | Augeas.NO_MODL_AUTOLOAD)
ac7d03
 
ac7d03
         aug.set('/augeas/load/Httpd/lens', 'Httpd.lns')
ac7d03
@@ -278,22 +286,21 @@ class HTTPInstance(service.Service):
ac7d03
         aug.load()
ac7d03
 
ac7d03
         path = '/files{}/VirtualHost'.format(paths.HTTPD_NSS_CONF)
ac7d03
+        ocsp_path = '{}/directive[.="{}"]'.format(path, OCSP_DIRECTIVE)
ac7d03
+        ocsp_arg = '{}/arg'.format(ocsp_path)
ac7d03
+        ocsp_comment = '{}/#comment[.="{}"]'.format(path, OCSP_DIRECTIVE)
ac7d03
 
ac7d03
-        ocsp_comment = aug.get(
ac7d03
-                        '{}/#comment[.=~regexp("NSSOCSP .*")]'.format(path))
ac7d03
-        ocsp_dir = aug.get('{}/directive[.="NSSOCSP"]'.format(path))
ac7d03
+        ocsp_dir = aug.get(ocsp_path)
ac7d03
 
ac7d03
-        if ocsp_dir is None and ocsp_comment is not None:
ac7d03
-            # Directive is missing, comment is present
ac7d03
-            aug.set('{}/#comment[.=~regexp("NSSOCSP .*")]'.format(path),
ac7d03
-                    'NSSOCSP')
ac7d03
-            aug.rename('{}/#comment[.="NSSOCSP"]'.format(path), 'directive')
ac7d03
-        elif ocsp_dir is None:
ac7d03
-            # Directive is missing and comment is missing
ac7d03
-            aug.set('{}/directive[last()+1]'.format(path), "NSSOCSP")
ac7d03
+        # there is NSSOCSP directive in nss.conf file, comment it
ac7d03
+        # otherwise just do nothing
ac7d03
+        if ocsp_dir is not None:
ac7d03
+            ocsp_state = aug.get(ocsp_arg)
ac7d03
+            aug.remove(ocsp_arg)
ac7d03
+            aug.rename(ocsp_path, '#comment')
ac7d03
+            aug.set(ocsp_comment, '{} {}'.format(OCSP_DIRECTIVE, ocsp_state))
ac7d03
+            aug.save()
ac7d03
 
ac7d03
-        aug.set('{}/directive[. = "NSSOCSP"]/arg'.format(path), 'on')
ac7d03
-        aug.save()
ac7d03
 
ac7d03
     def set_mod_nss_cipher_suite(self):
ac7d03
         ciphers = ','.join(NSS_CIPHER_SUITE)
ac7d03
@@ -412,8 +419,6 @@ class HTTPInstance(service.Service):
ac7d03
             self.__set_mod_nss_nickname(nickname)
ac7d03
             self.add_cert_to_service()
ac7d03
 
ac7d03
-            db.trust_root_cert(nickname, TRUSTED_PEER_TRUST_FLAGS)
ac7d03
-
ac7d03
         else:
ac7d03
             if not self.promote:
ac7d03
                 ca_args = [
ac7d03
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
ac7d03
index b1f59d3e29d69bffc11935ec22d4b5f510293355..732776f2cf513a4bb11d8f3f0dfaac78217e460f 100644
ac7d03
--- a/ipaserver/install/server/upgrade.py
ac7d03
+++ b/ipaserver/install/server/upgrade.py
ac7d03
@@ -1395,24 +1395,6 @@ def fix_trust_flags():
ac7d03
     sysupgrade.set_upgrade_state('http', 'fix_trust_flags', True)
ac7d03
 
ac7d03
 
ac7d03
-def fix_server_cert_trust_flags():
ac7d03
-    root_logger.info(
ac7d03
-        '[Fixing server certificate trust flags in %s]' %
ac7d03
-        paths.HTTPD_ALIAS_DIR)
ac7d03
-
ac7d03
-    if sysupgrade.get_upgrade_state('http', 'fix_serv_cert_trust_flags'):
ac7d03
-        root_logger.info("Trust flags already processed")
ac7d03
-        return
ac7d03
-
ac7d03
-    db = certs.CertDB(api.env.realm, nssdir=paths.HTTPD_ALIAS_DIR)
ac7d03
-    sc_nickname = installutils.get_directive(paths.HTTPD_NSS_CONF,
ac7d03
-                                             "NSSNickname")
ac7d03
-    # Add trust flag which set certificate trusted for SSL connections.
ac7d03
-    db.trust_root_cert(sc_nickname, certdb.TRUSTED_PEER_TRUST_FLAGS)
ac7d03
-
ac7d03
-    sysupgrade.set_upgrade_state('http', 'fix_serv_cert_trust_flags', True)
ac7d03
-
ac7d03
-
ac7d03
 def update_mod_nss_protocol(http):
ac7d03
     root_logger.info('[Updating mod_nss protocol versions]')
ac7d03
 
ac7d03
@@ -1425,9 +1407,9 @@ def update_mod_nss_protocol(http):
ac7d03
     sysupgrade.set_upgrade_state('nss.conf', 'protocol_updated_tls12', True)
ac7d03
 
ac7d03
 
ac7d03
-def enable_mod_nss_ocsp(http):
ac7d03
+def disable_mod_nss_ocsp(http):
ac7d03
     root_logger.info('[Updating mod_nss enabling OCSP]')
ac7d03
-    http.enable_mod_nss_ocsp()
ac7d03
+    http.disable_mod_nss_ocsp()
ac7d03
 
ac7d03
 
ac7d03
 def update_mod_nss_cipher_suite(http):
ac7d03
@@ -1721,9 +1703,8 @@ def upgrade_configuration():
ac7d03
     update_ipa_httpd_service_conf(http)
ac7d03
     update_mod_nss_protocol(http)
ac7d03
     update_mod_nss_cipher_suite(http)
ac7d03
-    enable_mod_nss_ocsp(http)
ac7d03
+    disable_mod_nss_ocsp(http)
ac7d03
     fix_trust_flags()
ac7d03
-    fix_server_cert_trust_flags()
ac7d03
     update_http_keytab(http)
ac7d03
     http.configure_gssproxy()
ac7d03
     http.start()
ac7d03
-- 
ac7d03
2.9.4
ac7d03