From 964a4d858e7f30e62691e6e0a1abdcd55cc68405 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Fri, 25 Jan 2019 16:18:59 +0100 Subject: [PATCH] Optimize cert remove case The cert_remove and mod subcommands for service and host now pass in the name to cert_find() to benefit from special cases. See: https://pagure.io/freeipa/issue/7835 Signed-off-by: Christian Heimes Reviewed-By: Alexander Bokovoy --- ipaserver/plugins/host.py | 8 ++++++-- ipaserver/plugins/service.py | 7 +++++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/ipaserver/plugins/host.py b/ipaserver/plugins/host.py index 306105d67a58fd4343933349db70a1d786eaa4b2..c74a3e58f8af6b33e284ba54b5763a684d91bac3 100644 --- a/ipaserver/plugins/host.py +++ b/ipaserver/plugins/host.py @@ -899,7 +899,9 @@ class host_mod(LDAPUpdate): old_certs = entry_attrs_old.get('usercertificate', []) removed_certs = set(old_certs) - set(certs) for cert in removed_certs: - rm_certs = api.Command.cert_find(certificate=cert)['result'] + rm_certs = api.Command.cert_find( + certificate=cert, + host=keys)['result'] revoke_certs(rm_certs) if certs: @@ -1335,7 +1337,9 @@ class host_remove_cert(LDAPRemoveAttributeViaOption): assert isinstance(dn, DN) for cert in options.get('usercertificate', []): - revoke_certs(api.Command.cert_find(certificate=cert)['result']) + revoke_certs(api.Command.cert_find( + certificate=cert, + host=keys)['result']) return dn diff --git a/ipaserver/plugins/service.py b/ipaserver/plugins/service.py index be31f810275214eb28a3f6b7ed9e6dc8ec808ae0..d176adddff8d2590d64ba4059018606ff1eb8d48 100644 --- a/ipaserver/plugins/service.py +++ b/ipaserver/plugins/service.py @@ -703,7 +703,8 @@ class service_mod(LDAPUpdate): removed_certs = set(old_certs) - set(certs) for cert in removed_certs: rm_certs = api.Command.cert_find( - certificate=cert.public_bytes(x509.Encoding.DER))['result'] + certificate=cert.public_bytes(x509.Encoding.DER), + service=keys)['result'] revoke_certs(rm_certs) if certs: @@ -983,7 +984,9 @@ class service_remove_cert(LDAPRemoveAttributeViaOption): assert isinstance(dn, DN) for cert in options.get('usercertificate', []): - revoke_certs(api.Command.cert_find(certificate=cert)['result']) + revoke_certs(api.Command.cert_find( + certificate=cert, + service=keys)['result']) return dn -- 2.20.1