From 2d40c57887f7801f2ab0a8065b3b471bb7eafe80 Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Tue, 19 Jun 2018 15:21:54 -0700

Subject: [PATCH 1/7] Ticket 3037 CMC SharedToken SubjectDN default

This patch adds proper subjectDN to CMC requests authenticated via ShardToken.

Specifically, the AuthTokenSubjectNameDefault profile default is added to

the default CMC profiles that authenticates via SharedToken.

Code were added to ensure that the proper subjectDN retrieved from the

mapped user entry is added to the AuthToken for such utilization.

Fixes https://pagure.io/dogtagpki/issue/3037

Change-Id: Id92d9496ab5b41ea7b5dcffb8d73d3ffe8b29fbc

---

 .../ca/shared/profiles/ca/caECFullCMCSelfSignedCert.cfg |  4 ++--

 base/ca/shared/profiles/ca/caFullCMCSelfSignedCert.cfg  |  4 ++--

 .../netscape/certsrv/authentication/ISharedToken.java   |  2 +-

 .../com/netscape/cms/authentication/SharedSecret.java   | 17 ++++++++++++++---

 .../com/netscape/cms/profile/common/EnrollProfile.java  | 12 ++++++++++--

 .../cms/servlet/profile/ProfileSubmitCMCServlet.java    |  1 +

 6 files changed, 30 insertions(+), 10 deletions(-)

diff --git a/base/ca/shared/profiles/ca/caECFullCMCSelfSignedCert.cfg b/base/ca/shared/profiles/ca/caECFullCMCSelfSignedCert.cfg

index d0a3c25..144c05c 100644

--- a/base/ca/shared/profiles/ca/caECFullCMCSelfSignedCert.cfg

+++ b/base/ca/shared/profiles/ca/caECFullCMCSelfSignedCert.cfg

@@ -13,8 +13,8 @@ policyset.cmcUserCertSet.list=1,2,3,4,5,6,7,8

 policyset.cmcUserCertSet.1.constraint.class_id=subjectNameConstraintImpl

 policyset.cmcUserCertSet.1.constraint.name=Subject Name Constraint

 policyset.cmcUserCertSet.1.constraint.params.accept=true

-policyset.cmcUserCertSet.1.constraint.params.pattern=.*

-policyset.cmcUserCertSet.1.default.class_id=userSubjectNameDefaultImpl

+policyset.cmcUserCertSet.1.constraint.params.pattern=(UID|CN)=.*

+policyset.cmcUserCertSet.1.default.class_id=authTokenSubjectNameDefaultImpl

 policyset.cmcUserCertSet.1.default.name=Subject Name Default

 policyset.cmcUserCertSet.1.default.params.name=

 policyset.cmcUserCertSet.2.constraint.class_id=validityConstraintImpl

diff --git a/base/ca/shared/profiles/ca/caFullCMCSelfSignedCert.cfg b/base/ca/shared/profiles/ca/caFullCMCSelfSignedCert.cfg

index 6b2da33..bdcdc24 100644

--- a/base/ca/shared/profiles/ca/caFullCMCSelfSignedCert.cfg

+++ b/base/ca/shared/profiles/ca/caFullCMCSelfSignedCert.cfg

@@ -12,9 +12,9 @@ policyset.list=cmcUserCertSet

 policyset.cmcUserCertSet.list=1,2,3,4,5,6,7,8

 policyset.cmcUserCertSet.1.constraint.class_id=subjectNameConstraintImpl

 policyset.cmcUserCertSet.1.constraint.name=Subject Name Constraint

+policyset.cmcUserCertSet.1.constraint.params.pattern=(UID|CN)=.*

 policyset.cmcUserCertSet.1.constraint.params.accept=true

-policyset.cmcUserCertSet.1.constraint.params.pattern=.*

-policyset.cmcUserCertSet.1.default.class_id=userSubjectNameDefaultImpl

+policyset.cmcUserCertSet.1.default.class_id=authTokenSubjectNameDefaultImpl

 policyset.cmcUserCertSet.1.default.name=Subject Name Default

 policyset.cmcUserCertSet.1.default.params.name=

 policyset.cmcUserCertSet.2.constraint.class_id=validityConstraintImpl

diff --git a/base/common/src/com/netscape/certsrv/authentication/ISharedToken.java b/base/common/src/com/netscape/certsrv/authentication/ISharedToken.java

index 761c344..13f2286 100644

--- a/base/common/src/com/netscape/certsrv/authentication/ISharedToken.java

+++ b/base/common/src/com/netscape/certsrv/authentication/ISharedToken.java

@@ -28,7 +28,7 @@ import com.netscape.certsrv.base.EBaseException;

 public interface ISharedToken {

     // support for id_cmc_identification

-    public char[] getSharedToken(String identification)

+    public char[] getSharedToken(String identification, IAuthToken authToken)

             throws EBaseException;

     public char[] getSharedToken(PKIData cmcData)

diff --git a/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java b/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java

index 1a3d877..e304b74 100644

--- a/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java

+++ b/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java

@@ -33,6 +33,7 @@ import com.netscape.certsrv.apps.CMS;

 import com.netscape.certsrv.authentication.AuthToken;

 import com.netscape.certsrv.authentication.EInvalidCredentials;

 import com.netscape.certsrv.authentication.IAuthCredentials;

+import com.netscape.certsrv.authentication.IAuthToken;

 import com.netscape.certsrv.authentication.ISharedToken;

 import com.netscape.certsrv.base.EBaseException;

 import com.netscape.certsrv.base.IConfigStore;

@@ -233,18 +234,25 @@ public class SharedSecret extends DirBasedAuthentication

     }

     /**

-     * getSharedToken(String identification) provides

+     * getSharedToken(String identification, IAuthToken authToken) provides

      *  support for id_cmc_identification shared secret based enrollment

      *

+     * @param identification maps to the uid in user's ldap record

+     * @param authToken the IAuthToken that will be filled with the DN

+     *        in user's ldap record

+     *

      * Note: caller should clear the memory for the returned token

      *       after each use

      */

-    public char[] getSharedToken(String identification)

+    public char[] getSharedToken(String identification, IAuthToken authToken)

             throws EBaseException {

-        String method = "SharedSecret.getSharedToken(String identification): ";

+        String method = "SharedSecret.getSharedToken(String identification, IAuthToken authToken): ";

         String msg = "";

         CMS.debug(method + "begins.");

+        if ((identification == null) || (authToken == null)) {

+            throw new EBaseException(method + "paramsters identification or authToken cannot be null");

+        }

         LDAPConnection shrTokLdapConnection = null;

         LDAPSearchResults res = null;

         LDAPEntry entry = null;

@@ -287,6 +295,9 @@ public class SharedSecret extends DirBasedAuthentication

                 throw new EBaseException(msg);

             }

+            CMS.debug(method + "found user ldap entry: userdn = " + userdn);

+            authToken.set(AuthToken.TOKEN_CERT_SUBJECT, userdn);

+

             res = shrTokLdapConnection.search(userdn, LDAPv2.SCOPE_BASE,

                     "(objectclass=*)", new String[] { mShrTokAttr }, false);

             if (res != null && res.hasMoreElements()) {

diff --git a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java

index caa466c..929e629 100644

--- a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java

+++ b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java

@@ -1412,10 +1412,14 @@ public abstract class EnrollProfile extends BasicProfile

                     CMS.debug(method + " Failed to retrieve shared secret authentication plugin class");

                     sharedSecretFound = false;

                 }

+

+                IAuthToken authToken = (IAuthToken)

+                    context.get(SessionContext.AUTH_TOKEN);

+

                 ISharedToken tokenClass = (ISharedToken) sharedTokenAuth;

                 if (ident_string != null) {

-                    sharedSecret = tokenClass.getSharedToken(ident_string);

+                    sharedSecret = tokenClass.getSharedToken(ident_string, authToken);

                 } else {

                     sharedSecret = tokenClass.getSharedToken(mCMCData);

                 }

@@ -1709,12 +1713,16 @@ public abstract class EnrollProfile extends BasicProfile

                 signedAuditLogger.log(auditMessage);

                 return false;

             }

+

+            IAuthToken authToken = (IAuthToken)

+                sessionContext.get(SessionContext.AUTH_TOKEN);

+

             ISharedToken tokenClass = (ISharedToken) sharedTokenAuth;

             char[] token = null;

             if (ident_string != null) {

                 auditAttemptedCred = ident_string;

-                token = tokenClass.getSharedToken(ident_string);

+                token = tokenClass.getSharedToken(ident_string, authToken);

             } else

                 token = tokenClass.getSharedToken(mCMCData);

diff --git a/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java b/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java

index 7d75e31..f469a66 100644

--- a/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java

+++ b/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java

@@ -446,6 +446,7 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

                 // authentication success

                 if (authToken != null) {

                     auditSubjectID = authToken.getInString(IAuthToken.USER_ID);

+                    context.put(SessionContext.AUTH_TOKEN, authToken);

                 }

             } catch (EBaseException e) {

                 CMCOutputTemplate template = new CMCOutputTemplate();

-- 

1.8.3.1

From 2a228b4a8e1af920e577d007be87291831c635d5 Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Wed, 20 Jun 2018 18:59:28 -0700

Subject: [PATCH 2/7] Ticket 2920 Part2 of SharedToken Audit

This patch addresses the issue that the original audit message for failure

got overwritten for SharedToken.

fixes https://pagure.io/dogtagpki/issue/2920

Change-Id: I0c09fbcc39135dc9aeee8a49a40772565af996c4

---

 .../netscape/cms/authentication/SharedSecret.java  |  5 ++

 .../def/CMCUserSignedSubjectNameDefault.java       |  7 ++-

 .../cms/servlet/common/CMCOutputTemplate.java      |  9 ++--

 .../servlet/profile/ProfileSubmitCMCServlet.java   | 63 ++++++++++++++--------

 4 files changed, 57 insertions(+), 27 deletions(-)

diff --git a/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java b/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java

index e304b74..5ebc213 100644

--- a/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java

+++ b/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java

@@ -406,6 +406,11 @@ public class SharedSecret extends DirBasedAuthentication

         String method = "SharedSecret.getSharedToken(BigInteger serial): ";

         String msg = "";

+        if (serial == null) {

+            throw new EBaseException(method + "paramster serial cannot be null");

+        }

+        CMS.debug(method + serial.toString());

+

         ICertRecord record = null;

         try {

             record = certRepository.readCertificateRecord(serial);

diff --git a/base/server/cms/src/com/netscape/cms/profile/def/CMCUserSignedSubjectNameDefault.java b/base/server/cms/src/com/netscape/cms/profile/def/CMCUserSignedSubjectNameDefault.java

index a0816ea..f1810b0 100644

--- a/base/server/cms/src/com/netscape/cms/profile/def/CMCUserSignedSubjectNameDefault.java

+++ b/base/server/cms/src/com/netscape/cms/profile/def/CMCUserSignedSubjectNameDefault.java

@@ -137,12 +137,17 @@ public class CMCUserSignedSubjectNameDefault extends EnrollDefault {

         String msg = "";

         CMS.debug(method + "begins");

-        String signingUserSerial = request.getExtDataInString(IAuthManager.CRED_CMC_SIGNING_CERT);

         if (info == null) {

             msg = method + "info null";

             CMS.debug(msg);

             throw new EProfileException(msg);

         }

+        String signingUserSerial = request.getExtDataInString(IAuthManager.CRED_CMC_SIGNING_CERT);

+        if (signingUserSerial == null) {

+            msg = method + "signing user serial not found; request was unsigned?";

+            CMS.debug(msg);

+            throw new EProfileException(msg);

+        }

         CertificateSubjectName certSN = null;

         try {

diff --git a/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java b/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java

index a0a946d..154cd33 100644

--- a/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java

+++ b/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java

@@ -1103,14 +1103,15 @@ public class CMCOutputTemplate {

                     char[] sharedSecret = null;

                     try {

-                       sharedSecret = tokenClass.getSharedToken(revokeSerial);

+                        sharedSecret = tokenClass.getSharedToken(revokeSerial);

                     } catch (Exception eShrTok) {

-                        CMS.debug("CMCOutputTemplate: " + eShrTok.toString());

+                        msg = "CMCOutputTemplate: " + eShrTok.toString();

                     }

                     if (sharedSecret == null) {

-                        msg = " shared secret not found";

-                        CMS.debug(method + msg);

+                        if (msg.equals("")) // don't overwrite the msg

+                            msg = " shared secret not found";

+                        CMS.debug(msg);

                         audit(new CertStatusChangeRequestProcessedEvent(

                                 auditSubjectID,

                                 ILogger.FAILURE,

diff --git a/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java b/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java

index f469a66..12fd294 100644

--- a/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java

+++ b/base/server/cms/src/com/netscape/cms/servlet/profile/ProfileSubmitCMCServlet.java

@@ -533,10 +533,16 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

             CMS.debug("ProfileSubmitCMCServlet: setting CRED_CMC_SIGNING_CERT in ctx for CMCUserSignedAuth");

             ctx.set(IAuthManager.CRED_CMC_SIGNING_CERT, signingCertSerialS);

         }

+

+        String errorCode = null;

+        String errorReason = null;

+        String auditRequesterID = ILogger.UNIDENTIFIED;

+

         try {

             reqs = profile.createRequests(ctx, locale);

         } catch (ECMCBadMessageCheckException e) {

-            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + e.toString());

+            errorReason = e.toString();

+            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + errorReason);

             CMCOutputTemplate template = new CMCOutputTemplate();

             SEQUENCE seq = new SEQUENCE();

             seq.addElement(new INTEGER(0));

@@ -547,9 +553,9 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

             }

             template.createFullResponseWithFailedStatus(response, seq,

                     OtherInfo.BAD_MESSAGE_CHECK, s);

-            return;

         } catch (ECMCBadIdentityException e) {

-            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + e.toString());

+            errorReason = e.toString();

+            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + errorReason);

             CMCOutputTemplate template = new CMCOutputTemplate();

             SEQUENCE seq = new SEQUENCE();

             seq.addElement(new INTEGER(0));

@@ -560,9 +566,9 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

             }

             template.createFullResponseWithFailedStatus(response, seq,

                     OtherInfo.BAD_IDENTITY, s);

-            return;

         } catch (ECMCPopFailedException e) {

-            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + e.toString());

+            errorReason = e.toString();

+            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + errorReason);

             CMCOutputTemplate template = new CMCOutputTemplate();

             SEQUENCE seq = new SEQUENCE();

             seq.addElement(new INTEGER(0));

@@ -573,9 +579,9 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

             }

             template.createFullResponseWithFailedStatus(response, seq,

                     OtherInfo.POP_FAILED, s);

-            return;

         } catch (ECMCBadRequestException e) {

-            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + e.toString());

+            errorReason = e.toString();

+            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + errorReason);

             CMCOutputTemplate template = new CMCOutputTemplate();

             SEQUENCE seq = new SEQUENCE();

             seq.addElement(new INTEGER(0));

@@ -586,9 +592,9 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

             }

             template.createFullResponseWithFailedStatus(response, seq,

                     OtherInfo.BAD_REQUEST, s);

-            return;

         } catch (EProfileException e) {

-            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + e.toString());

+            errorReason = e.toString();

+            CMS.debug("ProfileSubmitCMCServlet: after createRequests - " + errorReason);

             CMCOutputTemplate template = new CMCOutputTemplate();

             SEQUENCE seq = new SEQUENCE();

             seq.addElement(new INTEGER(0));

@@ -599,9 +605,9 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

             }

             template.createFullResponseWithFailedStatus(response, seq,

                     OtherInfo.INTERNAL_CA_ERROR, s);

-            return;

         } catch (Throwable e) {

-            CMS.debug("ProfileSubmitCMCServlet: createRequests - " + e.toString());

+            errorReason = e.toString();

+            CMS.debug("ProfileSubmitCMCServlet: createRequests - " + errorReason);

             CMCOutputTemplate template = new CMCOutputTemplate();

             SEQUENCE seq = new SEQUENCE();

             seq.addElement(new INTEGER(0));

@@ -612,7 +618,15 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

             }

             template.createFullResponseWithFailedStatus(response, seq,

                     OtherInfo.INTERNAL_CA_ERROR, s);

-            return;

+        }

+

+        if (errorReason != null) {

+            audit(CertRequestProcessedEvent.createFailureEvent(

+                        auditSubjectID,

+                        auditRequesterID,

+                        ILogger.SIGNED_AUDIT_REJECTION,

+                        errorReason));

+                return;

         }

         TaggedAttribute attr =

@@ -684,13 +698,11 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

             }

         }

-        String errorCode = null;

-        String errorReason = null;

-

         ///////////////////////////////////////////////

         // populate request

         ///////////////////////////////////////////////

         for (int k = 0; (!isRevoke) && (provedReq == null) &&(k < reqs.length); k++) {

+            auditRequesterID = auditRequesterID(reqs[k]);

             // adding parameters to request

             setInputsIntoRequest(request, profile, reqs[k]);

@@ -769,7 +781,8 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

                 profile.populateInput(ctx, reqs[k]);

                 profile.populate(reqs[k]);

             } catch (ECMCPopFailedException e) {

-                CMS.debug("ProfileSubmitCMCServlet: after populate - " + e.toString());

+                errorReason = e.toString();

+                CMS.debug("ProfileSubmitCMCServlet: after populate - " + errorReason);

                 CMCOutputTemplate template = new CMCOutputTemplate();

                 SEQUENCE seq = new SEQUENCE();

                 seq.addElement(new INTEGER(0));

@@ -780,9 +793,9 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

                 }

                 template.createFullResponseWithFailedStatus(response, seq,

                         OtherInfo.POP_FAILED, s);

-                return;

             } catch (EProfileException e) {

-                CMS.debug("ProfileSubmitCMCServlet: after populate - " + e.toString());

+                errorReason = e.toString();

+                CMS.debug("ProfileSubmitCMCServlet: after populate - " + errorReason);

                 CMCOutputTemplate template = new CMCOutputTemplate();

                 SEQUENCE seq = new SEQUENCE();

                 seq.addElement(new INTEGER(0));

@@ -793,9 +806,9 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

                 }

                 template.createFullResponseWithFailedStatus(response, seq,

                         OtherInfo.BAD_REQUEST, s);

-                return;

             } catch (Throwable e) {

-                CMS.debug("ProfileSubmitCMCServlet: after populate - " + e.toString());

+                errorReason = e.toString();

+                CMS.debug("ProfileSubmitCMCServlet: after populate - " + errorReason);

                 //  throw new IOException("Profile " + profileId +

                 //          " cannot populate");

                 CMCOutputTemplate template = new CMCOutputTemplate();

@@ -808,12 +821,18 @@ public class ProfileSubmitCMCServlet extends ProfileServlet {

                 }

                 template.createFullResponseWithFailedStatus(response, seq,

                         OtherInfo.INTERNAL_CA_ERROR, s);

+            }

+

+            if (errorReason != null) {

+                audit(CertRequestProcessedEvent.createFailureEvent(

+                        auditSubjectID,

+                        auditRequesterID,

+                        ILogger.SIGNED_AUDIT_REJECTION,

+                        errorReason));

                 return;

             }

         } //for

-        String auditRequesterID = ILogger.UNIDENTIFIED;

-

         try {

             ///////////////////////////////////////////////

             // submit request

-- 

1.8.3.1

From a85486cfc7644b6a1caac6f5a2b34c4516ea1288 Mon Sep 17 00:00:00 2001

From: Fraser Tweedale <ftweedal@redhat.com>

Date: Fri, 15 Jun 2018 00:28:43 +1000

Subject: [PATCH 3/7] IPAddressName: fix construction from String

The IPAddressName(String) constructor (the non-netmask case) was

broken by commit 628ace0c90073a8a1d90e96fae0aab9e43903fd6.  Fix it,

and rename one of the helper methods to clarify its behaviour.

Fixes: https://pagure.io/dogtagpki/issue/2922

Change-Id: I711cf6845496f54c86b10d2d01368912084f96ea

---

 base/util/src/netscape/security/x509/IPAddressName.java | 8 ++++----

 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/base/util/src/netscape/security/x509/IPAddressName.java b/base/util/src/netscape/security/x509/IPAddressName.java

index a343a5f..b227af0 100644

--- a/base/util/src/netscape/security/x509/IPAddressName.java

+++ b/base/util/src/netscape/security/x509/IPAddressName.java

@@ -76,7 +76,7 @@ public class IPAddressName implements GeneralNameInterface {

      * @param netmask the netmask address in the format: n.n.n.n or x:x:x:x:x:x:x:x (RFC 1884)

      */

     public IPAddressName(String s, String netmask) {

-        address = initAddress(true, s);

+        address = parseAddress(true, s);

         if (address.length == IPv4_LEN * 2)

             fillIPv4Address(netmask, address, address.length / 2);

         else

@@ -90,7 +90,7 @@ public class IPAddressName implements GeneralNameInterface {

      * @param mask a CIDR netmask

      */

     public IPAddressName(String s, CIDRNetmask mask) {

-        address = initAddress(true, s);

+        address = parseAddress(true, s);

         mask.write(ByteBuffer.wrap(

                     address, address.length / 2, address.length / 2));

     }

@@ -102,7 +102,7 @@ public class IPAddressName implements GeneralNameInterface {

      * @param s the ip address in the format: n.n.n.n or x:x:x:x:x:x:x:x

      */

     public IPAddressName(String s) {

-        initAddress(false, s);

+        address = parseAddress(false, s);

     }

     /**

@@ -113,7 +113,7 @@ public class IPAddressName implements GeneralNameInterface {

      * @return byte[] of length 4 or 16 if withNetmask == false,

      *         or length 8 or 32 if withNetmask == true.

      */

-    private static byte[] initAddress(boolean withNetmask, String s) {

+    private static byte[] parseAddress(boolean withNetmask, String s) {

         if (s.indexOf(':') != -1) {

             byte[] address = new byte[IPv6_LEN * (withNetmask ? 2 : 1)];

             fillIPv6Address(s, address, 0);

-- 

1.8.3.1

From 1f5e857759cb822093cdc20125fa4d0990432356 Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Mon, 25 Jun 2018 16:46:36 -0700

Subject: [PATCH 4/7] Ticket 3003 AuditVerify failure due to line breaks

This patch normalizes the CONFIG_ROLE audit event params to eliminate line breaks

in audit entry from running pki ca-user-cert-add which would cause AuditVerify

to fail. (note: adding user cert via the java console does not have such issue)

fixes https://pagure.io/dogtagpki/issue/3003

Change-Id: I52814714acebd29774abf0eb66aef3655ef2adb9

---

 .../com/netscape/certsrv/logging/event/ConfigRoleEvent.java  |  3 ++-

 base/util/src/com/netscape/cmsutil/util/Utils.java           | 12 +++++++++++-

 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/base/common/src/com/netscape/certsrv/logging/event/ConfigRoleEvent.java b/base/common/src/com/netscape/certsrv/logging/event/ConfigRoleEvent.java

index cc5f0b7..0ac71a8 100644

--- a/base/common/src/com/netscape/certsrv/logging/event/ConfigRoleEvent.java

+++ b/base/common/src/com/netscape/certsrv/logging/event/ConfigRoleEvent.java

@@ -18,6 +18,7 @@

 package com.netscape.certsrv.logging.event;

 import com.netscape.certsrv.logging.SignedAuditEvent;

+import com.netscape.cmsutil.util.Utils;

 public class ConfigRoleEvent extends SignedAuditEvent {

@@ -35,6 +36,6 @@ public class ConfigRoleEvent extends SignedAuditEvent {

         setAttribute("SubjectID", subjectID);

         setAttribute("Outcome", outcome);

-        setAttribute("ParamNameValPairs", params);

+        setAttribute("ParamNameValPairs", Utils.normalizeString(params, true /*keep space*/));

     }

 }

diff --git a/base/util/src/com/netscape/cmsutil/util/Utils.java b/base/util/src/com/netscape/cmsutil/util/Utils.java

index 5ff78ad..9d0f9eb 100644

--- a/base/util/src/com/netscape/cmsutil/util/Utils.java

+++ b/base/util/src/com/netscape/cmsutil/util/Utils.java

@@ -336,15 +336,24 @@ public class Utils {

      * Normalize B64 input String

      *

      * @pram string base-64 string

+     * @param keepspace a boolean variable to control whether to keep spaces or not

      * @return normalized string

      */

     public static String normalizeString(String string) {

+        return normalizeString(string, false /*keepSpace*/);

+    }

+

+    public static String normalizeString(String string, Boolean keepSpace) {

         if (string == null) {

             return string;

         }

         StringBuffer sb = new StringBuffer();

-        StringTokenizer st = new StringTokenizer(string, "\r\n ");

+        StringTokenizer st = null;

+        if (keepSpace)

+            st = new StringTokenizer(string, "\r\n");

+        else

+            st = new StringTokenizer(string, "\r\n ");

         while (st.hasMoreTokens()) {

             String nextLine = st.nextToken();

@@ -353,4 +362,5 @@ public class Utils {

         }

         return sb.toString();

     }

+

 }

-- 

1.8.3.1

From cf1b83ed6e7be07636c3deac770d586433d80f9e Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Tue, 26 Jun 2018 15:16:53 -0700

Subject: [PATCH 5/7] Ticket 2992 CMC Simple request profiles and CMCResponse

 to support simple response

This patch fixes the broken profiles resulted from https://pagure.io/dogtagpki/issue/3018.

In addition, CMCResponse has been improved to handle CMC simple response.

fixes https://pagure.io/dogtagpki/issue/2992

Change-Id: If72aa08f044c96e4e5bd5ed98512d2936fe0d50a

---

 .../shared/profiles/ca/caECSimpleCMCUserCert.cfg   |  6 +--

 base/ca/shared/profiles/ca/caSimpleCMCUserCert.cfg |  6 +--

 .../src/com/netscape/cmstools/CMCResponse.java     | 46 +++++++++++++---------

 3 files changed, 34 insertions(+), 24 deletions(-)

diff --git a/base/ca/shared/profiles/ca/caECSimpleCMCUserCert.cfg b/base/ca/shared/profiles/ca/caECSimpleCMCUserCert.cfg

index 64a6ad9..8df3576 100644

--- a/base/ca/shared/profiles/ca/caECSimpleCMCUserCert.cfg

+++ b/base/ca/shared/profiles/ca/caECSimpleCMCUserCert.cfg

@@ -1,11 +1,11 @@

-desc=This certificate profile is for enrolling user certificates by using the CMC certificate request with CMC Signature authentication.

+desc=This certificate profile is for enrolling user certificates by using the CMC simple certificate request with agent authentication.

 enable=true

 enableBy=admin

 name=Simple CMC Enrollment Request for User Certificate

 visible=false

-auth.instance_id=

+auth.instance_id=AgentCertAuth

 input.list=i1

-input.i1.class_id=cmcCertReqInputImpl

+input.i1.class_id=certReqInputImpl

 output.list=o1

 output.o1.class_id=certOutputImpl

 policyset.list=cmcUserCertSet

diff --git a/base/ca/shared/profiles/ca/caSimpleCMCUserCert.cfg b/base/ca/shared/profiles/ca/caSimpleCMCUserCert.cfg

index 0628a36..a55873f 100644

--- a/base/ca/shared/profiles/ca/caSimpleCMCUserCert.cfg

+++ b/base/ca/shared/profiles/ca/caSimpleCMCUserCert.cfg

@@ -1,11 +1,11 @@

-desc=This certificate profile is for enrolling user certificates by using the CMC certificate request with CMC Signature authentication.

+desc=This certificate profile is for enrolling user certificates by using the CMC Simple certificate request with agent authentication.

 enable=true

 enableBy=admin

 name=Simple CMC Enrollment Request for User Certificate

 visible=false

-auth.instance_id=

+auth.instance_id=AgentCertAuth

 input.list=i1

-input.i1.class_id=cmcCertReqInputImpl

+input.i1.class_id=certReqInputImpl

 output.list=o1

 output.o1.class_id=certOutputImpl

 policyset.list=cmcUserCertSet

diff --git a/base/java-tools/src/com/netscape/cmstools/CMCResponse.java b/base/java-tools/src/com/netscape/cmstools/CMCResponse.java

index 945f09f..5d4f6c6 100644

--- a/base/java-tools/src/com/netscape/cmstools/CMCResponse.java

+++ b/base/java-tools/src/com/netscape/cmstools/CMCResponse.java

@@ -82,14 +82,20 @@ public class CMCResponse {

     public Collection<CMCStatusInfoV2> getStatusInfos() throws IOException, InvalidBERException {

-        Collection<CMCStatusInfoV2> list = new ArrayList<>();

-

-        // assume full CMC response

-

         SignedData signedData = (SignedData) contentInfo.getInterpretedContent();

         EncapsulatedContentInfo eci = signedData.getContentInfo();

+        Collection<CMCStatusInfoV2> list = new ArrayList<>();

+

         OCTET_STRING content = eci.getContent();

+        if (content == null) {

+            System.out.println("CMC Simple Response.");

+            // No EncapsulatedContentInfo content; Assume simple response;

+            return null;

+        }

+        // assume full CMC response

+        System.out.println("CMC Full Response.");

+

         ByteArrayInputStream is = new ByteArrayInputStream(content.toByteArray());

         ResponseBody responseBody = (ResponseBody) (new ResponseBody.Template()).decode(is);

@@ -166,8 +172,10 @@ public class CMCResponse {

                 System.out.println("Invalid CMC Response Format");

             }

-            if (!ci.hasContent())

+            if (!ci.hasContent()) {

+                // No EncapsulatedContentInfo content; Assume simple response

                 return;

+            }

             OCTET_STRING content1 = ci.getContent();

             ByteArrayInputStream bbis = new ByteArrayInputStream(content1.toByteArray());

@@ -371,23 +379,25 @@ public class CMCResponse {

         // terminate if any of the statuses is not a SUCCESS

         Collection<CMCStatusInfoV2> statusInfos = response.getStatusInfos();

-        for (CMCStatusInfoV2 statusInfo : statusInfos) {

+        if (statusInfos != null) { // full response

+            for (CMCStatusInfoV2 statusInfo : statusInfos) {

-            int status = statusInfo.getStatus();

-            if (status == CMCStatusInfoV2.SUCCESS) {

-                continue;

-            }

+                int status = statusInfo.getStatus();

+                if (status == CMCStatusInfoV2.SUCCESS) {

+                    continue;

+                }

-            SEQUENCE bodyList = statusInfo.getBodyList();

+                SEQUENCE bodyList = statusInfo.getBodyList();

-            Collection<INTEGER> list = new ArrayList<>();

-            for (int i = 0; i < bodyList.size(); i++) {

-                INTEGER n = (INTEGER) bodyList.elementAt(i);

-                list.add(n);

-            }

+                Collection<INTEGER> list = new ArrayList<>();

+                for (int i = 0; i < bodyList.size(); i++) {

+                    INTEGER n = (INTEGER) bodyList.elementAt(i);

+                    list.add(n);

+                }

-            System.err.println("ERROR: CMC status for " + list + ": " + CMCStatusInfoV2.STATUS[status]);

-            System.exit(1);

+                System.err.println("ERROR: CMC status for " + list + ": " + CMCStatusInfoV2.STATUS[status]);

+                System.exit(1);

+            }

         }

         // export PKCS #7 if requested

-- 

1.8.3.1

From 3ad054342a08719cd80c618c2aa260210b418113 Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Wed, 27 Jun 2018 15:04:57 -0700

Subject: [PATCH 6/7] Ticket #2959 Address pkispawn ECC profile overrides

This patch enables proper ECC profiles to be automatically applied during

pkispawn.

This patch would eliminate the need for the workaround documented here:

http://www.dogtagpki.org/wiki/PKI_10.5_Pkispawn_ECC_Profile_Workaround

The idea is to use the % replacement strings as part of the profile names

in the default.cfg file for pkispawn,

and change the profile names to mach the format. So for example:

%(pki_admin_key_type)AdminCert.profile