From 9037c4d84bcf9cde48beb83d69f05c3733106c2d Mon Sep 17 00:00:00 2001

From: Jan Cholasta <jcholast@redhat.com>

Date: Mon, 10 Nov 2014 16:24:22 +0000

Subject: [PATCH] Fix CA certificate backup and restore

Backup and restore /etc/pki/ca-trust/source/ipa.p11-kit.

Create /etc/ipa/nssdb after restore if necessary.

https://fedorahosted.org/freeipa/ticket/4711

Reviewed-By: Petr Viktorin <pviktori@redhat.com>

---

 ipaplatform/base/paths.py        |  2 +-

 ipaplatform/base/tasks.py        |  9 +++++++++

 ipaplatform/redhat/tasks.py      | 43 ++++++++++++++++++++--------------------

 ipaserver/install/ipa_backup.py  |  2 ++

 ipaserver/install/ipa_restore.py | 35 +++++++++++++++++++++++++++++++-

 5 files changed, 67 insertions(+), 24 deletions(-)

diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py

index af502628e493ad7b4d8d30ed1acb98bba8cb39e4..e28147ab4aa1faa3859c38665a83f57fb67e96b2 100644

--- a/ipaplatform/base/paths.py

+++ b/ipaplatform/base/paths.py

@@ -92,7 +92,7 @@ class BasePathNamespace(object):

     PAM_LDAP_CONF = "/etc/pam_ldap.conf"

     PASSWD = "/etc/passwd"

     ETC_PKI_CA_DIR = "/etc/pki-ca"

-    SYSTEMWIDE_CA_STORE = "/etc/pki/ca-trust/source/anchors/"

+    SYSTEMWIDE_IPA_CA_CRT = "/etc/pki/ca-trust/source/anchors/ipa-ca.crt"

     IPA_P11_KIT = "/etc/pki/ca-trust/source/ipa.p11-kit"

     NSS_DB_DIR = "/etc/pki/nssdb"

     PKI_TOMCAT = "/etc/pki/pki-tomcat"

diff --git a/ipaplatform/base/tasks.py b/ipaplatform/base/tasks.py

index 408447e43cd36d0cdf11a1877b3bc9880c4785de..a6684d7653d6de8202a489edb1f7a38f4b344bbc 100644

--- a/ipaplatform/base/tasks.py

+++ b/ipaplatform/base/tasks.py

@@ -49,6 +49,15 @@ class BaseTaskNamespace(object):

         return

+    def reload_systemwide_ca_store(self):

+        """

+        Reloads the systemwide CA store.

+

+        Returns True if the operation succeeded, False otherwise.

+        """

+

+        return True

+

     def insert_ca_certs_into_systemwide_ca_store(self, ca_certs):

         """

         Adds CA certificates from 'ca_certs' to the systemwide CA store

diff --git a/ipaplatform/redhat/tasks.py b/ipaplatform/redhat/tasks.py

index 555516d90a6d1a7d3d9aced5de82a5c1efe6b8c2..4977e1c7c496e36d56110bcdf040ab5c932d31a2 100644

--- a/ipaplatform/redhat/tasks.py

+++ b/ipaplatform/redhat/tasks.py

@@ -158,8 +158,19 @@ class RedHatTaskNamespace(BaseTaskNamespace):

         auth_config.add_option("nostart")

         auth_config.execute()

+    def reload_systemwide_ca_store(self):

+        try:

+            ipautil.run([paths.UPDATE_CA_TRUST])

+        except CalledProcessError, e:

+            root_logger.error(

+                "Could not update systemwide CA trust database: %s", e)

+            return False

+        else:

+            root_logger.info("Systemwide CA database updated.")

+            return True

+

     def insert_ca_certs_into_systemwide_ca_store(self, ca_certs):

-        new_cacert_path = os.path.join(paths.SYSTEMWIDE_CA_STORE, 'ipa-ca.crt')

+        new_cacert_path = paths.SYSTEMWIDE_IPA_CA_CRT

         if os.path.exists(new_cacert_path):

             try:

@@ -248,24 +259,18 @@ class RedHatTaskNamespace(BaseTaskNamespace):

         f.close()

         # Add the CA to the systemwide CA trust database

-        try:

-            ipautil.run([paths.UPDATE_CA_TRUST])

-        except CalledProcessError, e:

-            root_logger.info("Failed to add CA to the systemwide "

-                             "CA trust database: %s" % str(e))

-        else:

-            root_logger.info('Added the CA to the systemwide CA trust '

-                             'database.')

-            return True

+        if not self.reload_systemwide_ca_store():

+            return False

-        return False

+        return True

     def remove_ca_certs_from_systemwide_ca_store(self):

-        ipa_ca_crt = os.path.join(paths.SYSTEMWIDE_CA_STORE, 'ipa-ca.crt')

+        result = True

         update = False

         # Remove CA cert from systemwide store

-        for new_cacert_path in (paths.IPA_P11_KIT, ipa_ca_crt):

+        for new_cacert_path in (paths.IPA_P11_KIT,

+                                paths.SYSTEMWIDE_IPA_CA_CRT):

             if not os.path.exists(new_cacert_path):

                 continue

             try:

@@ -273,21 +278,15 @@ class RedHatTaskNamespace(BaseTaskNamespace):

             except OSError, e:

                 root_logger.error(

                     "Could not remove %s: %s", new_cacert_path, e)

+                result = False

             else:

                 update = True

         if update:

-            try:

-                ipautil.run([paths.UPDATE_CA_TRUST])

-            except CalledProcessError, e:

-                root_logger.error(

-                    "Could not update systemwide CA trust database: %s", e)

+            if not self.reload_systemwide_ca_store():

                 return False

-            else:

-                root_logger.info("Systemwide CA database updated.")

-                return True

-        return False

+        return result

     def backup_and_replace_hostname(self, fstore, statestore, hostname):

         old_hostname = socket.gethostname()

diff --git a/ipaserver/install/ipa_backup.py b/ipaserver/install/ipa_backup.py

index 75ee243d1c8deb6f8452744df4c040fd0794250c..5d583f7e9186f20ebe8187ba70db28de0c255ae7 100644

--- a/ipaserver/install/ipa_backup.py

+++ b/ipaserver/install/ipa_backup.py

@@ -138,6 +138,8 @@ class Backup(admintool.AdminTool):

         paths.SYSCONFIG_ODS,

         paths.ETC_SYSCONFIG_AUTHCONFIG,

         paths.IPA_NSSDB_PWDFILE_TXT,

+        paths.IPA_P11_KIT,

+        paths.SYSTEMWIDE_IPA_CA_CRT,

         paths.NSSWITCH_CONF,

         paths.KRB5_KEYTAB,

         paths.SSSD_CONF,

diff --git a/ipaserver/install/ipa_restore.py b/ipaserver/install/ipa_restore.py

index 352a1ca2bf283c0beb8c95925c6eb9c9984b3338..8b1e80f5ed5e140ccb17ea0b63d92b6049507b74 100644

--- a/ipaserver/install/ipa_restore.py

+++ b/ipaserver/install/ipa_restore.py

@@ -26,7 +26,7 @@ import pwd

 from ConfigParser import SafeConfigParser

 from ipalib import api, errors

-from ipapython import version

+from ipapython import version, ipautil, certdb

 from ipapython.ipautil import run, user_input

 from ipapython import admintool

 from ipapython.dn import DN

@@ -278,7 +278,9 @@ class Restore(admintool.AdminTool):

                     create_ca_user()

                 if options.online:

                     raise admintool.ScriptError('File restoration cannot be done online.')

+                self.cert_restore_prepare()

                 self.file_restore(options.no_logs)

+                self.cert_restore()

                 if 'CA' in self.backup_services:

                     self.__create_dogtag_log_dirs()

@@ -660,3 +662,34 @@ class Restore(admintool.AdminTool):

             tasks.set_selinux_booleans(bools)

         except ipapython.errors.SetseboolError as e:

             self.log.error('%s', e)

+

+    def cert_restore_prepare(self):

+        for basename in ('cert8.db', 'key3.db', 'secmod.db', 'pwdfile.txt'):

+            filename = os.path.join(paths.IPA_NSSDB_DIR, basename)

+            try:

+                ipautil.backup_file(filename)

+            except OSError as e:

+                self.log.error("Failed to backup %s: %s" % (filename, e))

+

+        tasks.remove_ca_certs_from_systemwide_ca_store()

+

+    def cert_restore(self):

+        if not os.path.exists(os.path.join(paths.IPA_NSSDB_DIR, 'cert8.db')):

+            certdb.create_ipa_nssdb()

+            ipa_db = certdb.NSSDatabase(paths.IPA_NSSDB_DIR)

+            sys_db = certdb.NSSDatabase(paths.NSS_DB_DIR)

+            for nickname, trust_flags in (('IPA CA', 'CT,C,C'),

+                                          ('External CA cert', 'C,,')):

+                try:

+                    cert = sys_db.get_cert(nickname)

+                except RuntimeError:

+                    pass

+                else:

+                    try:

+                        ipa_db.add_cert(cert, nickname, trust_flags)

+                    except ipautil.CalledProcessError as e:

+                        self.log.error(

+                            "Failed to add %s to %s: %s" %

+                            (nickname, paths.IPA_NSSDB_DIR, e))

+

+        tasks.reload_systemwide_ca_store()

-- 

2.1.0