pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone
Blob Blame History Raw
From b98b21aaa709ccd91369e89a836f64c06c4593e8 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Thu, 27 Apr 2017 09:33:25 +0200
Subject: [PATCH] certdb: add named trust flag constants

Add named constants for common trust flag combinations.

Use the named constants instead of trust flags strings in the code.

https://pagure.io/freeipa/issue/6831

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
---
 install/restart_scripts/restart_httpd      |  3 ++-
 install/tools/ipa-replica-conncheck        |  4 +++-
 ipaclient/install/client.py                |  9 ++++++---
 ipapython/certdb.py                        |  9 +++++++--
 ipaserver/install/ca.py                    |  2 +-
 ipaserver/install/certs.py                 |  5 +++--
 ipaserver/install/dsinstance.py            |  5 +++--
 ipaserver/install/httpinstance.py          |  5 +++--
 ipaserver/install/ipa_cacert_manage.py     | 16 +++++++++++-----
 ipaserver/install/plugins/upload_cacrt.py  |  2 +-
 ipaserver/install/server/replicainstall.py |  3 ++-
 ipaserver/install/server/upgrade.py        |  4 ++--
 12 files changed, 44 insertions(+), 23 deletions(-)

diff --git a/install/restart_scripts/restart_httpd b/install/restart_scripts/restart_httpd
index b661b82b896b109c3859ac82c2d84ab27b839f72..cd7f12024ea3cab16e9c664687cd854e666c9570 100644
--- a/install/restart_scripts/restart_httpd
+++ b/install/restart_scripts/restart_httpd
@@ -24,6 +24,7 @@ import traceback
 from ipalib import api
 from ipaplatform import services
 from ipaplatform.paths import paths
+from ipapython.certdb import TRUSTED_PEER_TRUST_FLAGS
 from ipaserver.install import certs, installutils
 
 
@@ -36,7 +37,7 @@ def _main():
     nickname = installutils.get_directive(paths.HTTPD_NSS_CONF, "NSSNickname")
 
     # Add trust flag which set certificate trusted for SSL connections.
-    db.trust_root_cert(nickname, "P,,")
+    db.trust_root_cert(nickname, TRUSTED_PEER_TRUST_FLAGS)
 
     syslog.syslog(syslog.LOG_NOTICE, 'certmonger restarted httpd')
 
diff --git a/install/tools/ipa-replica-conncheck b/install/tools/ipa-replica-conncheck
index fdbd4f32d9fa4a625cca3614e13e71d00f58e57e..528242268f9992e903781b76a379039d533853c0 100755
--- a/install/tools/ipa-replica-conncheck
+++ b/install/tools/ipa-replica-conncheck
@@ -549,7 +549,9 @@ def main():
                             data = ca_cert.public_bytes(
                                 serialization.Encoding.DER)
                             nss_db.add_cert(
-                                data, str(DN(ca_cert.subject)), 'C,,')
+                                data,
+                                str(DN(ca_cert.subject)),
+                                certdb.EXTERNAL_CA_TRUST_FLAGS)
 
                     api.bootstrap(context='client',
                                   confdir=paths.ETC_IPA,
diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py
index abca692fd61be4a9f35a1398fb2af4b1d9e8689b..e78be904dd6bad491d9f3c1bb1e1410bc1779d45 100644
--- a/ipaclient/install/client.py
+++ b/ipaclient/install/client.py
@@ -2318,8 +2318,9 @@ def update_ipa_nssdb():
     if not os.path.exists(os.path.join(ipa_db.secdir, 'cert8.db')):
         create_ipa_nssdb()
 
-    for nickname, trust_flags in (('IPA CA', 'CT,C,C'),
-                                  ('External CA cert', 'C,,')):
+    for nickname, trust_flags in (
+            ('IPA CA', certdb.IPA_CA_TRUST_FLAGS),
+            ('External CA cert', certdb.EXTERNAL_CA_TRUST_FLAGS)):
         try:
             cert = sys_db.get_cert(nickname)
         except RuntimeError:
@@ -2680,7 +2681,9 @@ def _install(options):
             tmp_db.create_db()
 
             for i, cert in enumerate(ca_certs):
-                tmp_db.add_cert(cert, 'CA certificate %d' % (i + 1), 'C,,')
+                tmp_db.add_cert(cert,
+                                'CA certificate %d' % (i + 1),
+                                certdb.EXTERNAL_CA_TRUST_FLAGS)
         except CalledProcessError:
             raise ScriptError(
                 "Failed to add CA to temporary NSS database.",
diff --git a/ipapython/certdb.py b/ipapython/certdb.py
index ea73ec139df9013b860df447fcffd9038cf7c8f2..44c7bf3197c198295035742e6db48527d76e85a6 100644
--- a/ipapython/certdb.py
+++ b/ipapython/certdb.py
@@ -52,6 +52,11 @@ CA_NICKNAME_FMT = "%s IPA CA"
 
 NSS_FILES = ("cert8.db", "key3.db", "secmod.db", "pwdfile.txt")
 
+EMPTY_TRUST_FLAGS = ',,'
+IPA_CA_TRUST_FLAGS = 'CT,C,C'
+EXTERNAL_CA_TRUST_FLAGS = 'C,,'
+TRUSTED_PEER_TRUST_FLAGS = 'P,,'
+
 
 def get_ca_nickname(realm, format=CA_NICKNAME_FMT):
     return format % realm
@@ -441,7 +446,7 @@ class NSSDatabase(object):
             cert = x509.load_certificate(cert_pem)
             nickname = str(DN(cert.subject))
             data = cert.public_bytes(serialization.Encoding.DER)
-            self.add_cert(data, nickname, ',,')
+            self.add_cert(data, nickname, EMPTY_TRUST_FLAGS)
 
         if extracted_key:
             in_file = ipautil.write_tmp_file(
@@ -473,7 +478,7 @@ class NSSDatabase(object):
                 root_nickname)
         else:
             if trust_flags is None:
-                trust_flags = 'C,,'
+                trust_flags = EXTERNAL_CA_TRUST_FLAGS
             try:
                 self.run_certutil(["-M", "-n", root_nickname,
                                    "-t", trust_flags])
diff --git a/ipaserver/install/ca.py b/ipaserver/install/ca.py
index 8ee0fda23411563c70b7db5f39f43c2869c108b5..52cb20f1cb3612394544a6a41f10e9e939bc0657 100644
--- a/ipaserver/install/ca.py
+++ b/ipaserver/install/ca.py
@@ -320,7 +320,7 @@ def install_step_1(standalone, replica_config, options):
             realm_name, nssdir=dirname, subject_base=subject_base)
         cacert = cadb.get_cert_from_db('caSigningCert cert-pki-ca', pem=False)
         nickname = certdb.get_ca_nickname(realm_name)
-        trust_flags = 'CT,C,C'
+        trust_flags = certdb.IPA_CA_TRUST_FLAGS
         dsdb.add_cert(cacert, nickname, trust_flags)
         certstore.put_ca_cert_nss(api.Backend.ldap2, api.env.basedn,
                                   cacert, nickname, trust_flags,
diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
index 89e57134f24c505d669057eefffb7862b3b8179a..f87e00eb5e9c14ed30d39ef9f6e86b6f24bb1c61 100644
--- a/ipaserver/install/certs.py
+++ b/ipaserver/install/certs.py
@@ -37,6 +37,7 @@ from ipalib.install import certmonger, sysrestore
 from ipapython.ipa_log_manager import root_logger
 from ipapython import dogtag
 from ipapython import ipautil
+from ipapython.certdb import EMPTY_TRUST_FLAGS, IPA_CA_TRUST_FLAGS
 from ipapython.certdb import get_ca_nickname, find_cert_from_txt, NSSDatabase
 from ipapython.dn import DN
 from ipalib import pkcs10, x509, api
@@ -597,7 +598,7 @@ class CertDB(object):
         # a new certificate database.
         self.create_passwd_file()
         self.create_certdbs()
-        self.load_cacert(cacert_fname, 'CT,C,C')
+        self.load_cacert(cacert_fname, IPA_CA_TRUST_FLAGS)
 
     def create_from_pkcs12(self, pkcs12_fname, pkcs12_passwd, passwd=None,
                            ca_file=None, trust_flags=None):
@@ -643,7 +644,7 @@ class CertDB(object):
                     cert, st = find_cert_from_txt(certs, st)
                 except RuntimeError:
                     break
-                self.add_cert(cert, 'CA %s' % num, ',,', pem=True)
+                self.add_cert(cert, 'CA %s' % num, EMPTY_TRUST_FLAGS, pem=True)
                 num += 1
 
         # We only handle one server cert
diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
index 403fe8489fdd9e0dbf40dd4df3794b51185d45b9..0db0368fa4b48495718afd779291ce164d1687c8 100644
--- a/ipaserver/install/dsinstance.py
+++ b/ipaserver/install/dsinstance.py
@@ -32,6 +32,7 @@ import fnmatch
 import ldap
 
 from ipalib.install import certmonger, certstore
+from ipapython.certdb import IPA_CA_TRUST_FLAGS, EXTERNAL_CA_TRUST_FLAGS
 from ipapython.ipa_log_manager import root_logger
 from ipapython import ipautil, ipaldap
 from ipapython import dogtag
@@ -766,7 +767,7 @@ class DsInstance(service.Service):
         )
         if self.pkcs12_info:
             if self.ca_is_configured:
-                trust_flags = 'CT,C,C'
+                trust_flags = IPA_CA_TRUST_FLAGS
             else:
                 trust_flags = None
             dsdb.create_from_pkcs12(self.pkcs12_info[0], self.pkcs12_info[1],
@@ -1065,7 +1066,7 @@ class DsInstance(service.Service):
         certdb.cacert_name = cacert_name
         status = True
         try:
-            certdb.load_cacert(cacert_fname, 'C,,')
+            certdb.load_cacert(cacert_fname, EXTERNAL_CA_TRUST_FLAGS)
         except ipautil.CalledProcessError as e:
             root_logger.critical("Error importing CA cert file named [%s]: %s" %
                                          (cacert_fname, str(e)))
diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py
index ab688a85f157b1886842a91bb7d22f9ea99e3615..a6aeb21edc73783ff9a3f9b526409ea525aa66dd 100644
--- a/ipaserver/install/httpinstance.py
+++ b/ipaserver/install/httpinstance.py
@@ -32,6 +32,7 @@ import six
 from augeas import Augeas
 
 from ipalib.install import certmonger
+from ipapython.certdb import IPA_CA_TRUST_FLAGS, TRUSTED_PEER_TRUST_FLAGS
 from ipaserver.install import service
 from ipaserver.install import certs
 from ipaserver.install import installutils
@@ -381,7 +382,7 @@ class HTTPInstance(service.Service):
 
         if self.pkcs12_info:
             if self.ca_is_configured:
-                trust_flags = 'CT,C,C'
+                trust_flags = IPA_CA_TRUST_FLAGS
             else:
                 trust_flags = None
             db.init_from_pkcs12(self.pkcs12_info[0], self.pkcs12_info[1],
@@ -403,7 +404,7 @@ class HTTPInstance(service.Service):
             self.__set_mod_nss_nickname(nickname)
             self.add_cert_to_service()
 
-            db.trust_root_cert(nickname, "P,,")
+            db.trust_root_cert(nickname, TRUSTED_PEER_TRUST_FLAGS)
 
         else:
             if not self.promote:
diff --git a/ipaserver/install/ipa_cacert_manage.py b/ipaserver/install/ipa_cacert_manage.py
index 3b732e4dcbb5c9b4dfbb9e3608bc7d7afd3e10c2..88b40d45e10281d272882d21e06f5d53cf5a701d 100644
--- a/ipaserver/install/ipa_cacert_manage.py
+++ b/ipaserver/install/ipa_cacert_manage.py
@@ -26,6 +26,7 @@ import gssapi
 
 from ipalib.install import certmonger, certstore
 from ipapython import admintool, ipautil
+from ipapython.certdb import EMPTY_TRUST_FLAGS, EXTERNAL_CA_TRUST_FLAGS
 from ipapython.dn import DN
 from ipaplatform.paths import paths
 from ipalib import api, errors, x509
@@ -242,10 +243,10 @@ class CACertManage(admintool.AdminTool):
 
         with certs.NSSDatabase() as tmpdb:
             tmpdb.create_db()
-            tmpdb.add_cert(old_cert_der, 'IPA CA', 'C,,')
+            tmpdb.add_cert(old_cert_der, 'IPA CA', EXTERNAL_CA_TRUST_FLAGS)
 
             try:
-                tmpdb.add_cert(new_cert_der, 'IPA CA', 'C,,')
+                tmpdb.add_cert(new_cert_der, 'IPA CA', EXTERNAL_CA_TRUST_FLAGS)
             except ipautil.CalledProcessError as e:
                 raise admintool.ScriptError(
                     "Not compatible with the current CA certificate: %s" % e)
@@ -253,7 +254,8 @@ class CACertManage(admintool.AdminTool):
             ca_certs = x509.load_certificate_list_from_file(ca_file.name)
             for ca_cert in ca_certs:
                 data = ca_cert.public_bytes(serialization.Encoding.DER)
-                tmpdb.add_cert(data, str(DN(ca_cert.subject)), 'C,,')
+                tmpdb.add_cert(
+                    data, str(DN(ca_cert.subject)), EXTERNAL_CA_TRUST_FLAGS)
 
             try:
                 tmpdb.verify_ca_cert_validity('IPA CA')
@@ -270,7 +272,11 @@ class CACertManage(admintool.AdminTool):
                 except RuntimeError:
                     break
                 certstore.put_ca_cert_nss(
-                    conn, api.env.basedn, ca_cert, nickname, ',,')
+                    conn,
+                    api.env.basedn,
+                    ca_cert,
+                    nickname,
+                    EMPTY_TRUST_FLAGS)
 
         dn = DN(('cn', self.cert_nickname), ('cn', 'ca_renewal'),
                 ('cn', 'ipa'), ('cn', 'etc'), api.env.basedn)
@@ -343,7 +349,7 @@ class CACertManage(admintool.AdminTool):
 
         with certs.NSSDatabase() as tmpdb:
             tmpdb.create_db()
-            tmpdb.add_cert(cert, nickname, 'C,,')
+            tmpdb.add_cert(cert, nickname, EXTERNAL_CA_TRUST_FLAGS)
             for ca_cert, ca_nickname, ca_trust_flags in ca_certs:
                 tmpdb.add_cert(ca_cert, ca_nickname, ca_trust_flags)
 
diff --git a/ipaserver/install/plugins/upload_cacrt.py b/ipaserver/install/plugins/upload_cacrt.py
index 425ea63976ec92a6d69492d90a1e970e528c4a26..7d294ff971bd109e5fbb3570bfff0198f24b68d3 100644
--- a/ipaserver/install/plugins/upload_cacrt.py
+++ b/ipaserver/install/plugins/upload_cacrt.py
@@ -55,7 +55,7 @@ class update_upload_cacrt(Updater):
             if 'u' in trust_flags:
                 continue
             if nickname == ca_nickname and ca_enabled:
-                trust_flags = 'CT,C,C'
+                trust_flags = certdb.IPA_CA_TRUST_FLAGS
             cert = db.get_cert_from_db(nickname, pem=False)
             trust, _ca, eku = certstore.trust_flags_to_key_policy(trust_flags)
 
diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
index aa8e67f60b8abe591d55a907c409b584c74d4541..5e78e6faf51ded2fe7634f230c66aa15ae84bad4 100644
--- a/ipaserver/install/server/replicainstall.py
+++ b/ipaserver/install/server/replicainstall.py
@@ -23,6 +23,7 @@ import ipaclient.install.ntpconf
 from ipalib.install import certstore, sysrestore
 from ipalib.install.kinit import kinit_keytab
 from ipapython import ipaldap, ipautil
+from ipapython.certdb import IPA_CA_TRUST_FLAGS
 from ipapython.dn import DN
 from ipapython.ipa_log_manager import root_logger
 from ipapython.admintool import ScriptError
@@ -737,7 +738,7 @@ def install_check(installer):
                                   nssdir=tmp_db_dir,
                                   subject_base=config.subject_base)
             if ca_enabled:
-                trust_flags = 'CT,C,C'
+                trust_flags = IPA_CA_TRUST_FLAGS
             else:
                 trust_flags = None
             tmp_db.create_from_pkcs12(pkcs12_info[0], pkcs12_info[1],
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
index 5e5c83731d3d3415deb61271baa7865c62f60336..73a4f1108a56a766cdbbcb93d7050482a8264a75 100644
--- a/ipaserver/install/server/upgrade.py
+++ b/ipaserver/install/server/upgrade.py
@@ -1389,7 +1389,7 @@ def fix_trust_flags():
     nickname = certdb.get_ca_nickname(api.env.realm)
     cert = db.get_cert_from_db(nickname)
     if cert:
-        db.trust_root_cert(nickname, 'CT,C,C')
+        db.trust_root_cert(nickname, certdb.IPA_CA_TRUST_FLAGS)
 
     sysupgrade.set_upgrade_state('http', 'fix_trust_flags', True)
 
@@ -1407,7 +1407,7 @@ def fix_server_cert_trust_flags():
     sc_nickname = installutils.get_directive(paths.HTTPD_NSS_CONF,
                                              "NSSNickname")
     # Add trust flag which set certificate trusted for SSL connections.
-    db.trust_root_cert(sc_nickname, "P,,")
+    db.trust_root_cert(sc_nickname, certdb.TRUSTED_PEER_TRUST_FLAGS)
 
     sysupgrade.set_upgrade_state('http', 'fix_serv_cert_trust_flags', True)
 
-- 
2.9.4