From 9c24a655511c911c8acc724a45f79b3ea4986b9f Mon Sep 17 00:00:00 2001

From: Dinesh Prasanth M K <dmoluguw@redhat.com>

Date: Thu, 1 Nov 2018 16:29:11 -0400

Subject: [PATCH 01/13] Add --force flag to pki-destroy

Resolves: Bug 1372056

Ticket: https://pagure.io/dogtagpki/issue/1172

List of changes with this commit:

- Adds new flag `--force` to pkidestroy to force remove a subsystem

- Use `os.path.join()` instead of appending '/' between path names

- Remove the `pki_database_path` dir instead of removing contents of the dir

    - This is moved to `security_database.py` instead of `configuration.py`

- pkidestroy and pkispawn logs are owned by `root` instead of configured pkiuser

Signed-off-by: Dinesh Prasanth M K<dmoluguw@redhat.com>

(cherry picked from commit 926c26e10db1b3fde8f24802d7a77419d0f2f28d)

---

 .../python/pki/server/deployment/pkihelper.py      |  6 +-

 .../server/deployment/scriptlets/configuration.py  |  7 +-

 .../server/deployment/scriptlets/finalization.py   |  5 +-

 .../server/deployment/scriptlets/initialization.py | 92 ++++++++++++----------

 .../deployment/scriptlets/security_databases.py    |  8 +-

 .../deployment/scriptlets/webapp_deployment.py     |  2 +-

 base/server/sbin/pkidestroy                        | 44 ++++++++---

 7 files changed, 96 insertions(+), 68 deletions(-)

diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py

index 79f1e57..e1b9a02 100644

--- a/base/server/python/pki/server/deployment/pkihelper.py

+++ b/base/server/python/pki/server/deployment/pkihelper.py

@@ -947,8 +947,10 @@ class Instance:

         rv = []

         try:

             for subsystem in config.PKI_TOMCAT_SUBSYSTEMS:

-                path = self.mdict['pki_instance_path'] + \

-                    "/" + subsystem.lower()

+                path = os.path.join(

+                    self.mdict['pki_instance_path'],

+                    subsystem.lower()

+                )

                 if os.path.exists(path) and os.path.isdir(path):

                     rv.append(subsystem)

         except OSError as exc:

diff --git a/base/server/python/pki/server/deployment/scriptlets/configuration.py b/base/server/python/pki/server/deployment/scriptlets/configuration.py

index 1b62445..7bc0023 100644

--- a/base/server/python/pki/server/deployment/scriptlets/configuration.py

+++ b/base/server/python/pki/server/deployment/scriptlets/configuration.py

@@ -1274,9 +1274,4 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

             raise RuntimeError("server failed to restart")

     def destroy(self, deployer):

-

-        config.pki_log.info(log.CONFIGURATION_DESTROY_1, __name__,

-                            extra=config.PKI_INDENTATION_LEVEL_1)

-        if len(deployer.instance.tomcat_instance_subsystems()) == 1:

-            if deployer.directory.exists(deployer.mdict['pki_client_dir']):

-                deployer.directory.delete(deployer.mdict['pki_client_dir'])

+        pass

diff --git a/base/server/python/pki/server/deployment/scriptlets/finalization.py b/base/server/python/pki/server/deployment/scriptlets/finalization.py

index e62051f..3c7e118 100644

--- a/base/server/python/pki/server/deployment/scriptlets/finalization.py

+++ b/base/server/python/pki/server/deployment/scriptlets/finalization.py

@@ -68,19 +68,18 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

                             deployer.mdict['pki_subsystem'],

                             deployer.mdict['pki_instance_name'],

                             extra=config.PKI_INDENTATION_LEVEL_0)

-        deployer.file.modify(deployer.mdict['pki_spawn_log'], silent=True)

     def destroy(self, deployer):

         config.pki_log.info(log.FINALIZATION_DESTROY_1, __name__,

                             extra=config.PKI_INDENTATION_LEVEL_1)

-        deployer.file.modify(deployer.mdict['pki_destroy_log'], silent=True)

         # If this is the last remaining PKI instance, ALWAYS remove the

         # link to start configured PKI instances upon system reboot

         if deployer.mdict['pki_subsystem'] in config.PKI_SUBSYSTEMS and\

            deployer.instance.pki_instance_subsystems() == 0:

             deployer.systemd.disable()

-        # Start this Tomcat PKI Process

+

+        # Start this Tomcat PKI Process back if there are any subsystems still existing

         if len(deployer.instance.tomcat_instance_subsystems()) >= 1:

             deployer.systemd.start()

         config.pki_log.info(log.PKIDESTROY_END_MESSAGE_2,

diff --git a/base/server/python/pki/server/deployment/scriptlets/initialization.py b/base/server/python/pki/server/deployment/scriptlets/initialization.py

index 9528ec5..efd1536 100644

--- a/base/server/python/pki/server/deployment/scriptlets/initialization.py

+++ b/base/server/python/pki/server/deployment/scriptlets/initialization.py

@@ -86,45 +86,53 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

         deployer.configuration_file.verify_ds_secure_connection_data()

     def destroy(self, deployer):

-

-        # begin official logging

-        config.pki_log.info(log.PKIDESTROY_BEGIN_MESSAGE_2,

-                            deployer.mdict['pki_subsystem'],

-                            deployer.mdict['pki_instance_name'],

-                            extra=config.PKI_INDENTATION_LEVEL_0)

-        config.pki_log.info(log.INITIALIZATION_DESTROY_1, __name__,

-                            extra=config.PKI_INDENTATION_LEVEL_1)

-        # verify that this type of "subsystem" currently EXISTS

-        # for this "instance"

-        deployer.instance.verify_subsystem_exists()

-        # verify that the command-line parameters match the values

-        # that are present in the corresponding configuration file

-        deployer.configuration_file.verify_command_matches_configuration_file()

-        # establish 'uid' and 'gid'

-        deployer.identity.set_uid(deployer.mdict['pki_user'])

-        deployer.identity.set_gid(deployer.mdict['pki_group'])

-        # get ports to remove selinux context

-        deployer.configuration_file.populate_non_default_ports()

-

-        # remove kra connector from CA if this is a KRA

-        deployer.kra_connector.deregister()

-

-        # remove tps connector from TKS if this is a TPS

-        deployer.tps_connector.deregister()

-

-        # de-register instance from its Security Domain

-        #

-        #     NOTE:  Since the security domain of an instance must be up

-        #            and running in order to be de-registered, this step

-        #            must be done PRIOR to instance shutdown because this

-        #            instance's security domain may be a part of a

-        #            tightly-coupled shared instance.

-        #

-

-        # Previously we obtained the token through a command line interface

-        # no longer supported. Thus we assume no token and the deregister op will

-        # take place without the token using an alternate method.

-

-        deployer.security_domain.deregister(None)

-        # ALWAYS Stop this Tomcat PKI Process

-        deployer.systemd.stop()

+        try:

+            # begin official logging

+            config.pki_log.info(log.PKIDESTROY_BEGIN_MESSAGE_2,

+                                deployer.mdict['pki_subsystem'],

+                                deployer.mdict['pki_instance_name'],

+                                extra=config.PKI_INDENTATION_LEVEL_0)

+            config.pki_log.info(log.INITIALIZATION_DESTROY_1, __name__,

+                                extra=config.PKI_INDENTATION_LEVEL_1)

+            # verify that this type of "subsystem" currently EXISTS

+            # for this "instance"

+            deployer.instance.verify_subsystem_exists()

+            # verify that the command-line parameters match the values

+            # that are present in the corresponding configuration file

+            deployer.configuration_file.verify_command_matches_configuration_file()

+            # establish 'uid' and 'gid'

+            deployer.identity.set_uid(deployer.mdict['pki_user'])

+            deployer.identity.set_gid(deployer.mdict['pki_group'])

+            # get ports to remove selinux context

+            deployer.configuration_file.populate_non_default_ports()

+

+            # remove kra connector from CA if this is a KRA

+            deployer.kra_connector.deregister()

+

+            # remove tps connector from TKS if this is a TPS

+            deployer.tps_connector.deregister()

+

+            # de-register instance from its Security Domain

+            #

+            #     NOTE:  Since the security domain of an instance must be up

+            #            and running in order to be de-registered, this step

+            #            must be done PRIOR to instance shutdown because this

+            #            instance's security domain may be a part of a

+            #            tightly-coupled shared instance.

+            #

+

+            # Previously we obtained the token through a command line interface

+            # no longer supported. Thus we assume no token and the deregister op will

+            # take place without the token using an alternate method.

+

+            deployer.security_domain.deregister(None)

+

+        except Exception as e:  # pylint: disable=broad-except

+            config.pki_log.error(str(e))

+            # If it is a normal destroy, pass any exception

+            if not deployer.mdict['pki_force_destroy']:

+                raise

+

+        finally:

+            # ALWAYS Stop this Tomcat PKI Process

+            deployer.systemd.stop()

diff --git a/base/server/python/pki/server/deployment/scriptlets/security_databases.py b/base/server/python/pki/server/deployment/scriptlets/security_databases.py

index b8550ad..02f4713 100644

--- a/base/server/python/pki/server/deployment/scriptlets/security_databases.py

+++ b/base/server/python/pki/server/deployment/scriptlets/security_databases.py

@@ -259,7 +259,9 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

         config.pki_log.info(log.SECURITY_DATABASES_DESTROY_1, __name__,

                             extra=config.PKI_INDENTATION_LEVEL_1)

         if len(deployer.instance.tomcat_instance_subsystems()) == 0:

-            deployer.file.delete(deployer.mdict['pki_cert_database'])

-            deployer.file.delete(deployer.mdict['pki_key_database'])

-            deployer.file.delete(deployer.mdict['pki_secmod_database'])

+

+            if deployer.directory.exists(deployer.mdict['pki_client_dir']):

+                deployer.directory.delete(deployer.mdict['pki_client_dir'])

+

+            deployer.directory.delete(deployer.mdict['pki_database_path'])

             deployer.file.delete(deployer.mdict['pki_shared_password_conf'])

diff --git a/base/server/python/pki/server/deployment/scriptlets/webapp_deployment.py b/base/server/python/pki/server/deployment/scriptlets/webapp_deployment.py

index bfa3c32..8957d9d 100644

--- a/base/server/python/pki/server/deployment/scriptlets/webapp_deployment.py

+++ b/base/server/python/pki/server/deployment/scriptlets/webapp_deployment.py

@@ -70,7 +70,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

         config.pki_log.info(log.WEBAPP_DEPLOYMENT_DESTROY_1, __name__,

                             extra=config.PKI_INDENTATION_LEVEL_1)

-        # Delete <instance>/conf/Catalina/localhost/<subsystem>.xml

+        # Delete <instance>/Catalina/localhost/<subsystem>.xml

         deployer.file.delete(

             os.path.join(

                 deployer.mdict['pki_instance_configuration_path'],

diff --git a/base/server/sbin/pkidestroy b/base/server/sbin/pkidestroy

index 58f0541..4692e36 100755

--- a/base/server/sbin/pkidestroy

+++ b/base/server/sbin/pkidestroy

@@ -95,6 +95,13 @@ def main(argv):

         nargs=1, metavar='<security domain password file>',

         help='security domain password file path')

+    parser.optional.add_argument(

+        '--force',

+        dest='pki_force_destroy',

+        action='store_true',

+        help='force removal of subsystem'

+    )

+

     args = parser.process_command_line_arguments()

     interactive = False

@@ -155,20 +162,26 @@ def main(argv):

                 pwd_file:

             config.pki_secdomain_pass = pwd_file.readline().strip('\n')

+    #   '--force'

+    force_destroy = args.pki_force_destroy

+

     # verify that previously deployed instance exists

-    deployed_pki_instance_path = \

-        config.pki_root_prefix + config.PKI_DEPLOYMENT_BASE_ROOT + "/" + \

-        config.pki_deployed_instance_name

-    if not os.path.exists(deployed_pki_instance_path):

+    deployed_pki_instance_path = os.path.join(

+        config.PKI_DEPLOYMENT_BASE_ROOT, config.pki_deployed_instance_name

+    )

+

+    if not os.path.exists(deployed_pki_instance_path) and not force_destroy:

         print("ERROR:  " + log.PKI_INSTANCE_DOES_NOT_EXIST_1 %

               deployed_pki_instance_path)

         print()

         parser.arg_parser.exit(-1)

     # verify that previously deployed subsystem for this instance exists

-    deployed_pki_subsystem_path = \

-        deployed_pki_instance_path + "/" + deployer.subsystem_name.lower()

-    if not os.path.exists(deployed_pki_subsystem_path):

+    deployed_pki_subsystem_path = os.path.join(

+        deployed_pki_instance_path, deployer.subsystem_name.lower()

+    )

+

+    if not os.path.exists(deployed_pki_subsystem_path) and not force_destroy:

         print("ERROR:  " + log.PKI_SUBSYSTEM_DOES_NOT_EXIST_2 %

               (deployer.subsystem_name, deployed_pki_instance_path))

         print()

@@ -178,11 +191,16 @@ def main(argv):

         config.PKI_DEPLOYMENT_DEFAULT_CONFIGURATION_FILE

     # establish complete path to previously deployed configuration file

-    config.user_deployment_cfg =\

-        deployed_pki_subsystem_path + "/" +\

-        "registry" + "/" +\

-        deployer.subsystem_name.lower() + "/" +\

+    config.user_deployment_cfg = os.path.join(

+        deployed_pki_subsystem_path,

+        "registry",

+        deployer.subsystem_name.lower(),

         config.USER_DEPLOYMENT_CONFIGURATION

+    )

+

+    if force_destroy and not os.path.exists(config.user_deployment_cfg):

+        # During force destroy, try to load the file. If file doesn't exist, we ignore it

+        config.user_deployment_cfg = None

     parser.validate()

     parser.init_config()

@@ -213,6 +231,10 @@ def main(argv):

     parser.compose_pki_master_dictionary()

     parser.mdict['pki_destroy_log'] = \

         config.pki_log_dir + "/" + config.pki_log_name

+

+    # Add force_destroy to master dictionary

+    parser.mdict['pki_force_destroy'] = force_destroy

+

     config.pki_log.debug(log.PKI_DICTIONARY_MASTER,

                          extra=config.PKI_INDENTATION_LEVEL_0)

     config.pki_log.debug(pkilogging.log_format(parser.mdict),

-- 

1.8.3.1

From 7f0af3958605c9826c5bb71fcb43cfccb3056d90 Mon Sep 17 00:00:00 2001

From: Dinesh Prasanth M K <dmoluguw@redhat.com>

Date: Thu, 1 Nov 2018 16:43:36 -0400

Subject: [PATCH 02/13] Add --remove-logs flag to pki-destroy

Partially resolves: Bug 1372056

List of changes by this commit:

- Logs are preserved by default (comment #1 in BZ)

- Add `--remove-flags` flag to pkidestroy to remove logs

Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>

(cherry picked from commit 9e2cdb0b2f5df552ef50ba7883b4c686adec41b3)

---

 .../server/deployment/scriptlets/instance_layout.py   |  7 +++++--

 .../server/deployment/scriptlets/subsystem_layout.py  | 19 +++++++++++--------

 base/server/sbin/pkidestroy                           | 13 +++++++++++++

 3 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py b/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

index 2095212..568c0a0 100644

--- a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

+++ b/base/server/python/pki/server/deployment/scriptlets/instance_layout.py

@@ -199,8 +199,11 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

         # remove Tomcat instance base

         deployer.directory.delete(deployer.mdict['pki_instance_path'])

-        # remove Tomcat instance logs

-        deployer.directory.delete(deployer.mdict['pki_instance_log_path'])

+

+        # remove Tomcat instance logs only if --remove-logs is specified

+        if deployer.mdict['pki_remove_logs']:

+            deployer.directory.delete(deployer.mdict['pki_instance_log_path'])

+

         # remove shared NSS security database path for this instance

         deployer.directory.delete(deployer.mdict['pki_database_path'])

         # remove Tomcat instance configuration

diff --git a/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py b/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py

index a0e4658..fb9f754 100644

--- a/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py

+++ b/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py

@@ -124,15 +124,18 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

             deployer.directory.delete(

                 deployer.mdict['pki_subsystem_profiles_path'])

         deployer.directory.delete(deployer.mdict['pki_subsystem_path'])

-        # remove instance-based subsystem logs

-        if deployer.mdict['pki_subsystem'] in \

-                config.PKI_SIGNED_AUDIT_SUBSYSTEMS:

+

+        # remove instance-based subsystem logs only if --remove-logs flag is specified

+        if deployer.mdict['pki_remove_logs']:

+            if deployer.mdict['pki_subsystem'] in \

+                    config.PKI_SIGNED_AUDIT_SUBSYSTEMS:

+                deployer.directory.delete(

+                    deployer.mdict['pki_subsystem_signed_audit_log_path'])

             deployer.directory.delete(

-                deployer.mdict['pki_subsystem_signed_audit_log_path'])

-        deployer.directory.delete(

-            deployer.mdict['pki_subsystem_archive_log_path'])

-        deployer.directory.delete(

-            deployer.mdict['pki_subsystem_log_path'])

+                deployer.mdict['pki_subsystem_archive_log_path'])

+            deployer.directory.delete(

+                deployer.mdict['pki_subsystem_log_path'])

+

         # remove instance-based subsystem configuration

         deployer.directory.delete(

             deployer.mdict['pki_subsystem_configuration_path'])

diff --git a/base/server/sbin/pkidestroy b/base/server/sbin/pkidestroy

index 4692e36..4095d13 100755

--- a/base/server/sbin/pkidestroy

+++ b/base/server/sbin/pkidestroy

@@ -102,6 +102,13 @@ def main(argv):

         help='force removal of subsystem'

     )

+    parser.optional.add_argument(

+        '--remove-logs',

+        dest='pki_remove_logs',

+        action='store_true',

+        help='remove subsystem logs'

+    )

+

     args = parser.process_command_line_arguments()

     interactive = False

@@ -165,6 +172,9 @@ def main(argv):

     #   '--force'

     force_destroy = args.pki_force_destroy

+    #   '--remove-logs'

+    remove_logs = args.pki_remove_logs

+

     # verify that previously deployed instance exists

     deployed_pki_instance_path = os.path.join(

         config.PKI_DEPLOYMENT_BASE_ROOT, config.pki_deployed_instance_name

@@ -235,6 +245,9 @@ def main(argv):

     # Add force_destroy to master dictionary

     parser.mdict['pki_force_destroy'] = force_destroy

+    # Add remove logs to master dictionary

+    parser.mdict['pki_remove_logs'] = remove_logs

+

     config.pki_log.debug(log.PKI_DICTIONARY_MASTER,

                          extra=config.PKI_INDENTATION_LEVEL_0)

     config.pki_log.debug(pkilogging.log_format(parser.mdict),

-- 

1.8.3.1

From 24405fac463e59250ccf42507bba7fb811e3a2fb Mon Sep 17 00:00:00 2001

From: Dinesh Prasanth M K <dmoluguw@redhat.com>

Date: Thu, 1 Nov 2018 17:02:03 -0400

Subject: [PATCH 03/13] Reuse same instance log dirs (if exists)

Resolves: Bug 1644769

Ticket: https://pagure.io/dogtagpki/issue/3077

- `pkidestroy` behaviour was chagned to preserve the logs by default.

  When `pkispawn` is run, it throws a name space collision error.

- This patch reuses the log dir and appends logs to the same log dir

  structure (if exists) and logs it accordingly.

`Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>`

(cherry picked from commit c6c6757b4c566d10d25fe220fa9f59539c7a55ee)

---

 base/server/python/pki/server/deployment/pkihelper.py   | 12 +++++-------

 base/server/python/pki/server/deployment/pkimessages.py |  2 ++

 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py

index e1b9a02..3b55f78 100644

--- a/base/server/python/pki/server/deployment/pkihelper.py

+++ b/base/server/python/pki/server/deployment/pkihelper.py

@@ -345,18 +345,16 @@ class Namespace:

                     log.PKIHELPER_NAMESPACE_COLLISION_2 % (

                         self.mdict['pki_instance_name'],

                         self.mdict['pki_cgroup_cpu_systemd_service_path']))

+

         if os.path.exists(self.mdict['pki_instance_log_path']) and\

            os.path.exists(self.mdict['pki_subsystem_log_path']):

-            # Top-Level PKI log path collision

-            config.pki_log.error(

-                log.PKIHELPER_NAMESPACE_COLLISION_2,

+            # Check if logs already exist. If so, append to it. Log it as info

+            config.pki_log.info(

+                log.PKIHELPER_LOG_REUSE,

                 self.mdict['pki_instance_name'],

                 self.mdict['pki_instance_log_path'],

                 extra=config.PKI_INDENTATION_LEVEL_2)

-            raise Exception(

-                log.PKIHELPER_NAMESPACE_COLLISION_2 % (

-                    self.mdict['pki_instance_name'],

-                    self.mdict['pki_instance_log_path']))

+

         if os.path.exists(self.mdict['pki_instance_configuration_path']) and\

            os.path.exists(self.mdict['pki_subsystem_configuration_path']):

             # Top-Level PKI configuration path collision

diff --git a/base/server/python/pki/server/deployment/pkimessages.py b/base/server/python/pki/server/deployment/pkimessages.py

index 7bb79ca..6539295 100644

--- a/base/server/python/pki/server/deployment/pkimessages.py

+++ b/base/server/python/pki/server/deployment/pkimessages.py

@@ -277,6 +277,8 @@ PKIHELPER_NAMESPACE_COLLISION_2 = \

     "PKI instance '%s' would produce a namespace collision with '%s'!"

 PKIHELPER_NAMESPACE_RESERVED_NAME_2 = \

     "PKI instance '%s' is already a reserved name under '%s'!"

+PKIHELPER_LOG_REUSE = \

+    "previous logs of PKI instance '%s' already exist. Appending logs to '%s'"

 PKIHELPER_NCIPHER_RESTART_1 = "executing '%s'"

 PKIHELPER_NOISE_FILE_2 = \

     "generating noise file called '%s' and filling it with '%d' random bytes"

-- 

1.8.3.1

From 2a0d9c8c8ee7333198a8f5cb09c988eeeb3d528f Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Wed, 22 Aug 2018 00:02:03 +0200

Subject: [PATCH 04/13] Updated pki.nssdb to support multiple CSR delimiters

 types

The pki.nssdb module has been modified to support both standard

and legacy CSR delimiters as defined in RFC 7468.

https://pagure.io/dogtagpki/issue/3053

Change-Id: I609d640a66357f5293ff3a565027c1a395a47db7

(cherry picked from commit 8bf25507886c446594fa1bd82e3040ab79b271b3)

---

 base/common/python/pki/nssdb.py | 46 ++++++++++++++++++++++++++++++++++-------

 1 file changed, 39 insertions(+), 7 deletions(-)

diff --git a/base/common/python/pki/nssdb.py b/base/common/python/pki/nssdb.py

index f350255..d4ae804 100644

--- a/base/common/python/pki/nssdb.py

+++ b/base/common/python/pki/nssdb.py

@@ -34,8 +34,11 @@ from cryptography.hazmat.backends import default_backend

 import pki

-CSR_HEADER = '-----BEGIN NEW CERTIFICATE REQUEST-----'

-CSR_FOOTER = '-----END NEW CERTIFICATE REQUEST-----'

+CSR_HEADER = '-----BEGIN CERTIFICATE REQUEST-----'

+CSR_FOOTER = '-----END CERTIFICATE REQUEST-----'

+

+LEGACY_CSR_HEADER = '-----BEGIN NEW CERTIFICATE REQUEST-----'

+LEGACY_CSR_FOOTER = '-----END NEW CERTIFICATE REQUEST-----'

 CERT_HEADER = '-----BEGIN CERTIFICATE-----'

 CERT_FOOTER = '-----END CERTIFICATE-----'

@@ -51,10 +54,18 @@ logger = logging.LoggerAdapter(

     extra={'indent': ''})

-def convert_data(data, input_format, output_format, header=None, footer=None):

+def convert_data(data, input_format, output_format,

+                 header=None, footer=None,

+                 headers=None, footers=None):

+    '''

+    This method converts a PEM file to base-64 and vice versa.

+    It supports CSR, certificate, and PKCS #7 certificate chain.

+    '''

+

     if input_format == output_format:

         return data

+    # converting from base-64 to PEM

     if input_format == 'base64' and output_format == 'pem':

         # join base-64 data into a single line

@@ -66,16 +77,30 @@ def convert_data(data, input_format, output_format, header=None, footer=None):

         # add header and footer

         return '%s\n%s\n%s\n' % (header, '\n'.join(lines), footer)

+    # converting from PEM to base-64

     if input_format == 'pem' and output_format == 'base64':

+        # initialize list of headers if not provided

+        if not headers:

+            headers = [header]

+

+        # initialize list of footers if not provided

+        if not footers:

+            footers = [footer]

+

         # join multiple lines into a single line

         lines = []

         for line in data.splitlines():

             line = line.rstrip('\r\n')

-            if line == header:

+

+            # if the line is a header, skip

+            if line in headers:

                 continue

-            if line == footer:

+

+            # if the line is a footer, skip

+            if line in footers:

                 continue

+

             lines.append(line)

         return ''.join(lines)

@@ -86,7 +111,9 @@ def convert_data(data, input_format, output_format, header=None, footer=None):

 def convert_csr(csr_data, input_format, output_format):

     return convert_data(csr_data, input_format, output_format,

-                        CSR_HEADER, CSR_FOOTER)

+                        CSR_HEADER, CSR_FOOTER,

+                        headers=[CSR_HEADER, LEGACY_CSR_HEADER],

+                        footers=[CSR_FOOTER, LEGACY_CSR_FOOTER])

 def convert_cert(cert_data, input_format, output_format):

@@ -100,10 +127,15 @@ def convert_pkcs7(pkcs7_data, input_format, output_format):

 def get_file_type(filename):

+    '''

+    This method detects the content of a PEM file. It supports

+    CSR, certificate, PKCS #7 certificate chain.

+    '''

+

     with open(filename, 'r') as f:

         data = f.read()

-    if data.startswith(CSR_HEADER):

+    if data.startswith(CSR_HEADER) or data.startswith(LEGACY_CSR_HEADER):

         return 'csr'

     if data.startswith(CERT_HEADER):

-- 

1.8.3.1

From b9867142f4971a98b6c79ba16788db8829dfd79d Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Mon, 20 Aug 2018 23:14:25 +0200

Subject: [PATCH 05/13] Removed default CSR paths

The default.cfg has been modified to remove default CSR paths.

The verify_predefined_configuration_file_data() has been modified

to no longer require CSR path parameters in the first step of

external CA scenario.

https://pagure.io/dogtagpki/issue/3053

Change-Id: Idef6849b8bd7ee00d13151e0de10357a1f1d9ef2

(cherry picked from commit f3dc6c79370d8b57362272c40bd9f67aaf791710)

---

 base/server/etc/default.cfg                        | 24 ++++++++--------

 .../python/pki/server/deployment/pkihelper.py      | 32 +---------------------

 2 files changed, 13 insertions(+), 43 deletions(-)

diff --git a/base/server/etc/default.cfg b/base/server/etc/default.cfg

index b92cca7..2c0430a 100644

--- a/base/server/etc/default.cfg

+++ b/base/server/etc/default.cfg

@@ -330,7 +330,7 @@ pki_ca_signing_subject_dn=cn=CA Signing Certificate,ou=%(pki_instance_name)s,o=%

 pki_ca_signing_token=

 # DEPRECATED: Use 'pki_ca_signing_csr_path' instead.

-pki_external_csr_path=%(pki_instance_configuration_path)s/external_ca.csr

+pki_external_csr_path=

 pki_ca_signing_csr_path=%(pki_external_csr_path)s

 pki_ocsp_signing_csr_path=

@@ -442,12 +442,12 @@ pki_kra_ephemeral_requests=False

 # DEPRECATED

 # Use 'pki_*_csr_path' instead.

-pki_external_admin_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.csr

-pki_external_audit_signing_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.csr

-pki_external_sslserver_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.csr

-pki_external_storage_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_storage.csr

-pki_external_subsystem_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.csr

-pki_external_transport_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_transport.csr

+pki_external_admin_csr_path=

+pki_external_audit_signing_csr_path=

+pki_external_sslserver_csr_path=

+pki_external_storage_csr_path=

+pki_external_subsystem_csr_path=

+pki_external_transport_csr_path=

 pki_admin_csr_path=%(pki_external_admin_csr_path)s

 pki_audit_signing_csr_path=%(pki_external_audit_signing_csr_path)s

@@ -527,11 +527,11 @@ pki_standalone=False

 # DEPRECATED

 # Use 'pki_*_csr_path' instead.

-pki_external_admin_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.csr

-pki_external_audit_signing_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.csr

-pki_external_signing_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_signing.csr

-pki_external_sslserver_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.csr

-pki_external_subsystem_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.csr

+pki_external_admin_csr_path=

+pki_external_audit_signing_csr_path=

+pki_external_signing_csr_path=

+pki_external_sslserver_csr_path=

+pki_external_subsystem_csr_path=

 pki_admin_csr_path=%(pki_external_admin_csr_path)s

 pki_audit_signing_csr_path=%(pki_external_audit_signing_csr_path)s

diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py

index 3b55f78..b3c3ccb 100644

--- a/base/server/python/pki/server/deployment/pkihelper.py

+++ b/base/server/python/pki/server/deployment/pkihelper.py

@@ -712,39 +712,9 @@ class ConfigurationFile:

                 # pki_ca_signing_cert_path are optional.

                 pass

         elif not self.skip_configuration and self.standalone:

-            if not self.external_step_two:

-

-                # Stand-alone PKI Admin CSR (Step 1)

-                self.confirm_data_exists("pki_admin_csr_path")

-

-                # Stand-alone PKI Audit Signing CSR (Step 1)

-                self.confirm_data_exists(

-                    "pki_audit_signing_csr_path")

-                # Stand-alone PKI SSL Server CSR (Step 1)

-                self.confirm_data_exists("pki_sslserver_csr_path")

+            if self.external_step_two:

-                # Stand-alone PKI Subsystem CSR (Step 1)

-                self.confirm_data_exists("pki_subsystem_csr_path")

-

-                # Stand-alone PKI KRA CSRs

-                if self.subsystem == "KRA":

-

-                    # Stand-alone PKI KRA Storage CSR (Step 1)

-                    self.confirm_data_exists(

-                        "pki_storage_csr_path")

-

-                    # Stand-alone PKI KRA Transport CSR (Step 1)

-                    self.confirm_data_exists(

-                        "pki_transport_csr_path")

-

-                # Stand-alone PKI OCSP CSRs

-                if self.subsystem == "OCSP":

-                    # Stand-alone PKI OCSP OCSP Signing CSR (Step 1)

-                    self.confirm_data_exists(

-                        "pki_ocsp_signing_csr_path")

-

-            else:

                 # Stand-alone PKI External CA Certificate (Step 2)

                 # The pki_ca_signing_cert_path is optional.

-- 

1.8.3.1

From e2563b186203e5e89d281ff5c39ca182f62cfefa Mon Sep 17 00:00:00 2001