483b06
From c9fb09190ac243bcf45622693944d7e6785141b4 Mon Sep 17 00:00:00 2001
483b06
From: Florence Blanc-Renaud <flo@redhat.com>
483b06
Date: Mon, 28 Aug 2017 10:50:58 +0200
483b06
Subject: [PATCH] Backport PR 1008 to ipa-4-5 Fix ipa-server-upgrade: This
483b06
 entry already exists
483b06
483b06
ipa-server-upgrade fails when running the ipaload_cacrt plugin. The plugin
483b06
finds all CA certificates in /etc/httpd/alias and uploads them in LDAP
483b06
below cn=certificates,cn=ipa,cn=etc,$BASEDN.
483b06
The issue happens because there is already an entry in LDAP for IPA CA, but
483b06
with a different DN. The nickname in /etc/httpd/alias can differ from
483b06
$DOMAIN IPA CA.
483b06
483b06
To avoid the issue:
483b06
1/ during upgrade, run a new plugin that removes duplicates and restarts ldap
483b06
(to make sure that uniqueness attr plugin is working after the new plugin)
483b06
2/ modify upload_cacert plugin so that it is using $DOMAIN IPA CA instead of
483b06
cn=$nickname,cn=ipa,cn=etc,$BASEDN when uploading IPA CA.
483b06
483b06
https://pagure.io/freeipa/issue/7125
483b06
483b06
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
483b06
---
483b06
 install/updates/90-post_upgrade_plugins.update     |  1 +
483b06
 ipalib/install/certstore.py                        | 19 +++++
483b06
 .../plugins/update_fix_duplicate_cacrt_in_ldap.py  | 84 ++++++++++++++++++++++
483b06
 ipaserver/install/plugins/upload_cacrt.py          | 19 ++++-
483b06
 4 files changed, 120 insertions(+), 3 deletions(-)
483b06
 create mode 100644 ipaserver/install/plugins/update_fix_duplicate_cacrt_in_ldap.py
483b06
483b06
diff --git a/install/updates/90-post_upgrade_plugins.update b/install/updates/90-post_upgrade_plugins.update
483b06
index 8477199e07d6729d5847e58bfa67d061bd1410c2..bbc3e29422fc0f139c2ca68a7033863e4c25f8cf 100644
483b06
--- a/install/updates/90-post_upgrade_plugins.update
483b06
+++ b/install/updates/90-post_upgrade_plugins.update
483b06
@@ -15,6 +15,7 @@ plugin: update_ca_renewal_master
483b06
 plugin: update_idrange_type
483b06
 plugin: update_pacs
483b06
 plugin: update_service_principalalias
483b06
+plugin: update_fix_duplicate_cacrt_in_ldap
483b06
 plugin: update_upload_cacrt
483b06
 # update_ra_cert_store has to be executed after update_ca_renewal_master
483b06
 plugin: update_ra_cert_store
483b06
diff --git a/ipalib/install/certstore.py b/ipalib/install/certstore.py
483b06
index bc2079fb12873444cbe6796eebfdfcfebd0e284d..76181fe47de585974f3fb33ec586f5c576adebb5 100644
483b06
--- a/ipalib/install/certstore.py
483b06
+++ b/ipalib/install/certstore.py
483b06
@@ -27,6 +27,7 @@ from pyasn1.error import PyAsn1Error
483b06
 from ipapython.dn import DN
483b06
 from ipapython.certdb import get_ca_nickname, TrustFlags
483b06
 from ipalib import errors, x509
483b06
+from ipalib.constants import IPA_CA_CN
483b06
 
483b06
 def _parse_cert(dercert):
483b06
     try:
483b06
@@ -381,3 +382,21 @@ def get_ca_certs_nss(ldap, base_dn, compat_realm, compat_ipa_ca,
483b06
         nss_certs.append((cert, nickname, trust_flags))
483b06
 
483b06
     return nss_certs
483b06
+
483b06
+
483b06
+def get_ca_subject(ldap, container_ca, base_dn):
483b06
+    """
483b06
+    Look for the IPA CA certificate subject.
483b06
+    """
483b06
+    dn = DN(('cn', IPA_CA_CN), container_ca, base_dn)
483b06
+    try:
483b06
+        cacert_subject = ldap.get_entry(dn)['ipacasubjectdn'][0]
483b06
+    except errors.NotFound:
483b06
+        # if the entry doesn't exist, we are dealing with a pre-v4.4
483b06
+        # installation, where the default CA subject was always based
483b06
+        # on the subject_base.
483b06
+        attrs = ldap.get_ipa_config()
483b06
+        subject_base = attrs.get('ipacertificatesubjectbase')[0]
483b06
+        cacert_subject = DN(('CN', 'Certificate Authority'), subject_base)
483b06
+
483b06
+    return cacert_subject
483b06
diff --git a/ipaserver/install/plugins/update_fix_duplicate_cacrt_in_ldap.py b/ipaserver/install/plugins/update_fix_duplicate_cacrt_in_ldap.py
483b06
new file mode 100644
483b06
index 0000000000000000000000000000000000000000..cd4f13a8eb6b5bc9e04fcdd407907497528f8be1
483b06
--- /dev/null
483b06
+++ b/ipaserver/install/plugins/update_fix_duplicate_cacrt_in_ldap.py
483b06
@@ -0,0 +1,84 @@
483b06
+# Authors:
483b06
+#   Florence Blanc-Renaud <flo@redhat.com>
483b06
+#
483b06
+# Copyright (C) 2017  Red Hat
483b06
+# see file 'COPYING' for use and warranty information
483b06
+#
483b06
+# This program is free software; you can redistribute it and/or modify
483b06
+# it under the terms of the GNU General Public License as published by
483b06
+# the Free Software Foundation, either version 3 of the License, or
483b06
+# (at your option) any later version.
483b06
+#
483b06
+# This program is distributed in the hope that it will be useful,
483b06
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
483b06
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
483b06
+# GNU General Public License for more details.
483b06
+#
483b06
+# You should have received a copy of the GNU General Public License
483b06
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
483b06
+
483b06
+import logging
483b06
+
483b06
+from ipalib import Registry, errors
483b06
+from ipalib import Updater
483b06
+from ipalib.install import certstore
483b06
+from ipapython.dn import DN
483b06
+from ipapython.certdb import get_ca_nickname
483b06
+
483b06
+logger = logging.getLogger(__name__)
483b06
+
483b06
+register = Registry()
483b06
+
483b06
+
483b06
+@register()
483b06
+class update_fix_duplicate_cacrt_in_ldap(Updater):
483b06
+    """
483b06
+    When multiple entries exist for IPA CA cert in ldap, remove the duplicate
483b06
+
483b06
+    After this plugin, ds needs to be restarted. This ensures that
483b06
+    the attribute uniqueness plugin is working and prevents
483b06
+    other plugins from adding duplicates.
483b06
+    """
483b06
+
483b06
+    def execute(self, **options):
483b06
+        # If CA is disabled, no need to check for duplicates of IPA CA
483b06
+        ca_enabled = self.api.Command.ca_is_enabled()['result']
483b06
+        if not ca_enabled:
483b06
+            return True, []
483b06
+
483b06
+        # Look for the IPA CA cert subject
483b06
+        ldap = self.api.Backend.ldap2
483b06
+        cacert_subject = certstore.get_ca_subject(
483b06
+            ldap,
483b06
+            self.api.env.container_ca,
483b06
+            self.api.env.basedn)
483b06
+
483b06
+        # Find if there are other certificates with the same subject
483b06
+        # They are duplicates resulting of BZ 1480102
483b06
+        base_dn = DN(('cn', 'certificates'), ('cn', 'ipa'), ('cn', 'etc'),
483b06
+                     self.api.env.basedn)
483b06
+        try:
483b06
+            filter = ldap.make_filter({'ipaCertSubject': cacert_subject})
483b06
+            result, _truncated = ldap.find_entries(
483b06
+                base_dn=base_dn,
483b06
+                filter=filter,
483b06
+                attrs_list=[])
483b06
+        except errors.NotFound:
483b06
+            # No duplicate, we're good
483b06
+            logger.debug("No duplicates for IPA CA in LDAP")
483b06
+            return True, []
483b06
+
483b06
+        logger.debug("Found %d entrie(s) for IPA CA in LDAP", len(result))
483b06
+        cacert_dn = DN(('cn', get_ca_nickname(self.api.env.realm)), base_dn)
483b06
+        for entry in result:
483b06
+            if entry.dn == cacert_dn:
483b06
+                continue
483b06
+            # Remove the duplicate
483b06
+            try:
483b06
+                ldap.delete_entry(entry)
483b06
+                logger.debug("Removed the duplicate %s", entry.dn)
483b06
+            except Exception as e:
483b06
+                logger.warning("Failed to remove the duplicate %s: %s",
483b06
+                               entry.dn, e)
483b06
+
483b06
+        return True, []
483b06
diff --git a/ipaserver/install/plugins/upload_cacrt.py b/ipaserver/install/plugins/upload_cacrt.py
483b06
index a1957ca5b675b86f0df36dc820ee31305f54f863..985b74c06e80a3620eb6454c0bd9c7590b04184d 100644
483b06
--- a/ipaserver/install/plugins/upload_cacrt.py
483b06
+++ b/ipaserver/install/plugins/upload_cacrt.py
483b06
@@ -20,7 +20,7 @@
483b06
 from ipalib.install import certstore
483b06
 from ipaplatform.paths import paths
483b06
 from ipaserver.install import certs
483b06
-from ipalib import Registry, errors
483b06
+from ipalib import Registry, errors, x509
483b06
 from ipalib import Updater
483b06
 from ipapython import certdb
483b06
 from ipapython.dn import DN
483b06
@@ -41,6 +41,10 @@ class update_upload_cacrt(Updater):
483b06
         ca_enabled = self.api.Command.ca_is_enabled()['result']
483b06
         if ca_enabled:
483b06
             ca_nickname = certdb.get_ca_nickname(self.api.env.realm)
483b06
+            ca_subject = certstore.get_ca_subject(
483b06
+                self.api.Backend.ldap2,
483b06
+                self.api.env.container_ca,
483b06
+                self.api.env.basedn)
483b06
         else:
483b06
             ca_nickname = None
483b06
             server_certs = db.find_server_certs()
483b06
@@ -54,9 +58,18 @@ class update_upload_cacrt(Updater):
483b06
         for nickname, trust_flags in db.list_certs():
483b06
             if trust_flags.has_key:
483b06
                 continue
483b06
-            if nickname == ca_nickname and ca_enabled:
483b06
-                trust_flags = certdb.IPA_CA_TRUST_FLAGS
483b06
             cert = db.get_cert_from_db(nickname, pem=False)
483b06
+            subject = DN(
483b06
+                x509.load_certificate(cert, datatype=x509.DER).subject)
483b06
+            if ca_enabled and subject == ca_subject:
483b06
+                # When ca is enabled, we can have the IPA CA cert stored
483b06
+                # in the nss db with a different nickname (for instance
483b06
+                # when the server was installed with --subject to
483b06
+                # customize the CA cert subject), but it must always be
483b06
+                # stored in LDAP with the DN cn=$DOMAIN IPA CA
483b06
+                # This is why we check the subject instead of the nickname here
483b06
+                nickname = ca_nickname
483b06
+                trust_flags = certdb.IPA_CA_TRUST_FLAGS
483b06
             trust, _ca, eku = certstore.trust_flags_to_key_policy(trust_flags)
483b06
 
483b06
             dn = DN(('cn', nickname), ('cn', 'certificates'), ('cn', 'ipa'),
483b06
--
483b06
2.13.5