From 997ebc0f56963769bdcbeda60a2dca222c884b1e Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Thu, 27 Apr 2017 09:57:45 +0200
Subject: [PATCH] certdb, certs: make trust flags argument mandatory
Make the trust flags argument mandatory in all functions in `certdb` and
`certs`.
https://pagure.io/freeipa/issue/6831
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
---
ipapython/certdb.py | 4 +---
ipaserver/install/certs.py | 11 +++++------
ipaserver/install/dsinstance.py | 2 +-
ipaserver/install/httpinstance.py | 6 ++++--
ipaserver/install/installutils.py | 5 +++--
ipaserver/install/server/replicainstall.py | 4 ++--
6 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/ipapython/certdb.py b/ipapython/certdb.py
index 44c7bf3197c198295035742e6db48527d76e85a6..88dcae750de5881ae7b4921ca1ae23daa9c5d4b0 100644
--- a/ipapython/certdb.py
+++ b/ipapython/certdb.py
@@ -471,14 +471,12 @@ class NSSDatabase(object):
self.import_pkcs12(out_file.name, out_password)
- def trust_root_cert(self, root_nickname, trust_flags=None):
+ def trust_root_cert(self, root_nickname, trust_flags):
if root_nickname[:7] == "Builtin":
root_logger.debug(
"No need to add trust for built-in root CAs, skipping %s" %
root_nickname)
else:
- if trust_flags is None:
- trust_flags = EXTERNAL_CA_TRUST_FLAGS
try:
self.run_certutil(["-M", "-n", root_nickname,
"-t", trust_flags])
diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
index f87e00eb5e9c14ed30d39ef9f6e86b6f24bb1c61..17b9ebad4a128e292e453af44ca9d63cfb1e6ea2 100644
--- a/ipaserver/install/certs.py
+++ b/ipaserver/install/certs.py
@@ -550,7 +550,7 @@ class CertDB(object):
return root_nicknames
- def trust_root_cert(self, root_nickname, trust_flags=None):
+ def trust_root_cert(self, root_nickname, trust_flags):
if root_nickname is None:
root_logger.debug("Unable to identify root certificate to trust. Continuing but things are likely to fail.")
return
@@ -600,14 +600,13 @@ class CertDB(object):
self.create_certdbs()
self.load_cacert(cacert_fname, IPA_CA_TRUST_FLAGS)
- def create_from_pkcs12(self, pkcs12_fname, pkcs12_passwd, passwd=None,
- ca_file=None, trust_flags=None):
+ def create_from_pkcs12(self, pkcs12_fname, pkcs12_passwd,
+ ca_file, trust_flags):
"""Create a new NSS database using the certificates in a PKCS#12 file.
pkcs12_fname: the filename of the PKCS#12 file
pkcs12_pwd_fname: the file containing the pin for the PKCS#12 file
nickname: the nickname/friendly-name of the cert we are loading
- passwd: The password to use for the new NSS database we are creating
The global CA may be added as well in case it wasn't included in the
PKCS#12 file. Extra certs won't hurt in any case.
@@ -615,7 +614,7 @@ class CertDB(object):
The global CA may be specified in ca_file, as a PEM filename.
"""
self.create_noise_file()
- self.create_passwd_file(passwd)
+ self.create_passwd_file()
self.create_certdbs()
self.init_from_pkcs12(
pkcs12_fname,
@@ -624,7 +623,7 @@ class CertDB(object):
trust_flags=trust_flags)
def init_from_pkcs12(self, pkcs12_fname, pkcs12_passwd,
- ca_file=None, trust_flags=None):
+ ca_file, trust_flags):
self.import_pkcs12(pkcs12_fname, pkcs12_passwd)
server_certs = self.find_server_certs()
if len(server_certs) == 0:
diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
index 0db0368fa4b48495718afd779291ce164d1687c8..0e4ae4bfe6f1445de167df8fe5328d6a421e416f 100644
--- a/ipaserver/install/dsinstance.py
+++ b/ipaserver/install/dsinstance.py
@@ -769,7 +769,7 @@ class DsInstance(service.Service):
if self.ca_is_configured:
trust_flags = IPA_CA_TRUST_FLAGS
else:
- trust_flags = None
+ trust_flags = EXTERNAL_CA_TRUST_FLAGS
dsdb.create_from_pkcs12(self.pkcs12_info[0], self.pkcs12_info[1],
ca_file=self.ca_file,
trust_flags=trust_flags)
diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py
index a6aeb21edc73783ff9a3f9b526409ea525aa66dd..c76a1a4e484c5777ced92761916c1c586e8b2d5d 100644
--- a/ipaserver/install/httpinstance.py
+++ b/ipaserver/install/httpinstance.py
@@ -32,7 +32,9 @@ import six
from augeas import Augeas
from ipalib.install import certmonger
-from ipapython.certdb import IPA_CA_TRUST_FLAGS, TRUSTED_PEER_TRUST_FLAGS
+from ipapython.certdb import (IPA_CA_TRUST_FLAGS,
+ EXTERNAL_CA_TRUST_FLAGS,
+ TRUSTED_PEER_TRUST_FLAGS)
from ipaserver.install import service
from ipaserver.install import certs
from ipaserver.install import installutils
@@ -384,7 +386,7 @@ class HTTPInstance(service.Service):
if self.ca_is_configured:
trust_flags = IPA_CA_TRUST_FLAGS
else:
- trust_flags = None
+ trust_flags = EXTERNAL_CA_TRUST_FLAGS
db.init_from_pkcs12(self.pkcs12_info[0], self.pkcs12_info[1],
ca_file=self.ca_file,
trust_flags=trust_flags)
diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py
index b6f01489ccc65dcbc360929e0a7b315b074df8ce..0445a1d3c403fab690e5afb7c8801ed85773b1e0 100644
--- a/ipaserver/install/installutils.py
+++ b/ipaserver/install/installutils.py
@@ -49,6 +49,7 @@ from ipalib.install.kinit import kinit_password
import ipaplatform
from ipapython import ipautil, admintool, version
from ipapython.admintool import ScriptError
+from ipapython.certdb import EXTERNAL_CA_TRUST_FLAGS
from ipapython.ipa_log_manager import root_logger
from ipapython.ipaldap import DIRMAN_DN, LDAPClient
from ipalib.util import validate_hostname
@@ -1036,7 +1037,7 @@ def load_pkcs12(cert_files, key_password, key_nickname, ca_cert_files,
if 'u' in trust_flags:
key_nickname = nickname
continue
- nssdb.trust_root_cert(nickname)
+ nssdb.trust_root_cert(nickname, EXTERNAL_CA_TRUST_FLAGS)
# Check we have the whole cert chain & the CA is in it
trust_chain = list(reversed(nssdb.get_trust_chain(key_nickname)))
@@ -1176,7 +1177,7 @@ def load_external_cert(files, ca_subject):
cache[nickname] = (cert, subject, issuer)
if subject == ca_subject:
ca_nickname = nickname
- nssdb.trust_root_cert(nickname)
+ nssdb.trust_root_cert(nickname, EXTERNAL_CA_TRUST_FLAGS)
if ca_nickname is None:
raise ScriptError(
diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
index 5e78e6faf51ded2fe7634f230c66aa15ae84bad4..fb738cb9f590f3f9595de92ef025c6032e9343f8 100644
--- a/ipaserver/install/server/replicainstall.py
+++ b/ipaserver/install/server/replicainstall.py
@@ -23,7 +23,7 @@ import ipaclient.install.ntpconf
from ipalib.install import certstore, sysrestore
from ipalib.install.kinit import kinit_keytab
from ipapython import ipaldap, ipautil
-from ipapython.certdb import IPA_CA_TRUST_FLAGS
+from ipapython.certdb import IPA_CA_TRUST_FLAGS, EXTERNAL_CA_TRUST_FLAGS
from ipapython.dn import DN
from ipapython.ipa_log_manager import root_logger
from ipapython.admintool import ScriptError
@@ -740,7 +740,7 @@ def install_check(installer):
if ca_enabled:
trust_flags = IPA_CA_TRUST_FLAGS
else:
- trust_flags = None
+ trust_flags = EXTERNAL_CA_TRUST_FLAGS
tmp_db.create_from_pkcs12(pkcs12_info[0], pkcs12_info[1],
ca_file=cafile,
trust_flags=trust_flags)
--
2.9.4