commit 7ed1e32c574a2ee93a62297d16e07a7071e696d7

Author: Endi S. Dewata <edewata@redhat.com>

Date:   Wed Sep 2 04:50:24 2015 +0200

    Added CLI to update cert data and request in CS.cfg.

    A set of new pki-server commands have been added to simplify

    updating the cert data and cert request stored in the CS.cfg with

    the cert data and cert request stored in the NSS and LDAP database,

    respectively.

    https://fedorahosted.org/pki/ticket/1551

diff --git a/base/server/python/pki/server/__init__.py b/base/server/python/pki/server/__init__.py

index 9777d22..d004465 100644

--- a/base/server/python/pki/server/__init__.py

+++ b/base/server/python/pki/server/__init__.py

@@ -20,7 +20,11 @@

 #

 from lxml import etree

+import getpass

 import grp

+import io

+import ldap

+import operator

 import os

 import pwd

 import re

@@ -31,7 +35,7 @@ import pki

 INSTANCE_BASE_DIR = '/var/lib/pki'

 REGISTRY_DIR = '/etc/sysconfig/pki'

 SUBSYSTEM_TYPES = ['ca', 'kra', 'ocsp', 'tks', 'tps']

-

+SUBSYSTEM_CLASSES = {}

 class PKIServer(object):

@@ -65,6 +69,7 @@ class PKISubsystem(object):

             self.base_dir = instance.base_dir

         self.conf_dir = os.path.join(self.base_dir, 'conf')

+        self.cs_conf = os.path.join(self.conf_dir, 'CS.cfg')

         self.context_xml_template = os.path.join(

             pki.SHARE_DIR, self.name, 'conf', 'Catalina', 'localhost', self.name + '.xml')

@@ -72,9 +77,62 @@ class PKISubsystem(object):

         self.context_xml = os.path.join(

             instance.conf_dir, 'Catalina', 'localhost', self.name + '.xml')

+        self.config = {}

+        self.type = None

+        self.prefix = None

+

         # custom subsystem location

         self.doc_base = os.path.join(self.base_dir, 'webapps', self.name)

+    def load(self):

+        self.config.clear()

+

+        lines = open(self.cs_conf).read().splitlines()

+

+        for line in lines:

+            parts = line.split('=', 1)

+            name = parts[0]

+            value = parts[1]

+            self.config[name] = value

+

+        self.type = self.config['cs.type']

+        self.prefix = self.type.lower()

+

+    def find_subsystem_certs(self):

+        certs = []

+

+        cert_ids = self.config['%s.cert.list' % self.name].split(',')

+        for cert_id in cert_ids:

+            cert = self.create_subsystem_cert_object(cert_id)

+            certs.append(cert)

+

+        return certs

+

+    def get_subsystem_cert(self, cert_id):

+        return self.create_subsystem_cert_object(cert_id)

+

+    def create_subsystem_cert_object(self, cert_id):

+        cert = {}

+        cert['id'] = cert_id

+        cert['nickname'] = self.config.get('%s.%s.nickname' % (self.name, cert_id), None)

+        cert['token'] = self.config.get('%s.%s.tokenname' % (self.name, cert_id), None)

+        cert['data'] = self.config.get('%s.%s.cert' % (self.name, cert_id), None)

+        cert['request'] = self.config.get('%s.%s.certreq' % (self.name, cert_id), None)

+        return cert

+

+    def update_subsystem_cert(self, cert):

+        cert_id = cert['id']

+        self.config['%s.%s.nickname' % (self.name, cert_id)] = cert.get('nickname', None)

+        self.config['%s.%s.tokenname' % (self.name, cert_id)] = cert.get('token', None)

+        self.config['%s.%s.cert' % (self.name, cert_id)] = cert.get('data', None)

+        self.config['%s.%s.certreq' % (self.name, cert_id)] = cert.get('request', None)

+

+    def save(self):

+        sorted_config = sorted(self.config.items(), key=operator.itemgetter(0))

+        with io.open(self.cs_conf, 'wb') as f:

+            for (key, value) in sorted_config:

+                f.write('%s=%s\n' % (key, value))

+

     def is_valid(self):

         return os.path.exists(self.conf_dir)

@@ -102,6 +160,21 @@ class PKISubsystem(object):

     def disable(self):

         self.instance.undeploy(self.name)

+    def open_database(self, name='internaldb'):

+

+        hostname = self.config['%s.ldapconn.host' % name]

+        port = self.config['%s.ldapconn.port' % name]

+        bind_dn = self.config['%s.ldapauth.bindDN' % name]

+

+        # TODO: add support for other authentication

+        # mechanisms (e.g. client cert authentication, LDAPI)

+        bind_password = self.instance.get_password(name)

+

+        con = ldap.initialize('ldap://%s:%s' % (hostname, port))

+        con.simple_bind_s(bind_dn, bind_password)

+

+        return con

+

     def __repr__(self):

         return str(self.instance) + '/' + self.name

@@ -119,6 +192,9 @@ class PKIInstance(object):

             self.base_dir = os.path.join(pki.BASE_DIR, name)

         self.conf_dir = os.path.join(self.base_dir, 'conf')

+        self.password_conf = os.path.join(self.conf_dir, 'password.conf')

+

+        self.nssdb_dir = os.path.join(self.base_dir, 'alias')

         self.lib_dir = os.path.join(self.base_dir, 'lib')

         self.registry_dir = os.path.join(pki.server.REGISTRY_DIR, 'tomcat', self.name)

@@ -132,6 +208,8 @@ class PKIInstance(object):

         self.uid = None

         self.gid = None

+        self.passwords = {}

+

         self.subsystems = []

     def is_valid(self):

@@ -153,6 +231,7 @@ class PKIInstance(object):

         return rc == 0

     def load(self):

+        # load UID and GID

         with open(self.registry_file, 'r') as registry:

             lines = registry.readlines()

@@ -168,11 +247,41 @@ class PKIInstance(object):

                 self.group = m.group(1)

                 self.gid = grp.getgrnam(self.group).gr_gid

+        # load passwords

+        self.passwords.clear()

+        lines = open(self.password_conf).read().splitlines()

+

+        for line in lines:

+            parts = line.split('=', 1)

+            name = parts[0]

+            value = parts[1]

+            self.passwords[name] = value

+

+        # load subsystems

         for subsystem_name in os.listdir(self.registry_dir):

-            if subsystem_name in pki.server.SUBSYSTEM_TYPES:

-                subsystem = PKISubsystem(self, subsystem_name)

+            if subsystem_name in SUBSYSTEM_TYPES:

+                if subsystem_name in SUBSYSTEM_CLASSES:

+                    subsystem = SUBSYSTEM_CLASSES[subsystem_name](self)

+                else:

+                    subsystem = PKISubsystem(self, subsystem_name)

+                subsystem.load()

                 self.subsystems.append(subsystem)

+    def get_password(self, name):

+        if name in self.passwords:

+            return self.passwords[name]

+

+        password = getpass.getpass(prompt='Enter password for %s: ' % name)

+        self.passwords[name] = password

+

+        return password

+

+    def get_subsystem(self, name):

+        for subsystem in self.subsystems:

+            if name == subsystem.name:

+                return subsystem

+        return None

+

     def is_deployed(self, webapp_name):

         context_xml = os.path.join(

             self.conf_dir, 'Catalina', 'localhost', webapp_name + '.xml')

diff --git a/base/server/python/pki/server/ca.py b/base/server/python/pki/server/ca.py

new file mode 100644

index 0000000..70ebf4d

--- /dev/null

+++ b/base/server/python/pki/server/ca.py

@@ -0,0 +1,92 @@

+#!/usr/bin/python

+# Authors:

+#     Endi S. Dewata <edewata@redhat.com>

+#

+# This program is free software; you can redistribute it and/or modify

+# it under the terms of the GNU General Public License as published by

+# the Free Software Foundation; version 2 of the License.

+#

+# This program is distributed in the hope that it will be useful,

+# but WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License along

+# with this program; if not, write to the Free Software Foundation, Inc.,

+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

+#

+# Copyright (C) 2015 Red Hat, Inc.

+# All rights reserved.

+#

+

+from __future__ import absolute_import

+import ldap

+import ldap.filter

+

+import pki

+import pki.server

+

+

+class CASubsystem(pki.server.PKISubsystem):

+

+    def __init__(self, instance):

+        super(CASubsystem, self).__init__(instance, 'ca')

+

+    def find_cert_requests(self, cert=None):

+

+        base_dn = self.config['internaldb.basedn']

+

+        if cert:

+            escaped_value = ldap.filter.escape_filter_chars(cert)

+            search_filter = '(extdata-req--005fissued--005fcert=%s)' % escaped_value

+

+        else:

+            search_filter = '(objectClass=*)'

+

+        con = self.open_database()

+

+        entries = con.search_s(

+            'ou=ca,ou=requests,%s' % base_dn,

+            ldap.SCOPE_ONELEVEL,

+            search_filter,

+            None)

+

+        con.unbind_s()

+

+        requests = []

+        for entry in entries:

+            requests.append(self.create_request_object(entry))

+

+        return requests

+

+    def get_cert_requests(self, request_id):

+

+        base_dn = self.config['internaldb.basedn']

+

+        con = self.open_database()

+

+        entries = con.search_s(

+            'cn=%s,ou=ca,ou=requests,%s' % (request_id, base_dn),

+            ldap.SCOPE_BASE,

+            '(objectClass=*)',

+            None)

+

+        con.unbind_s()

+

+        entry = entries[0]

+        return self.create_request_object(entry)

+

+    def create_request_object(self, entry):

+

+        attrs = entry[1]

+

+        request = {}

+        request['id'] = attrs['cn'][0]

+        request['type'] = attrs['requestType'][0]

+        request['status'] = attrs['requestState'][0]

+        request['request'] = attrs['extdata-cert--005frequest'][0]

+

+        return request

+

+

+pki.server.SUBSYSTEM_CLASSES['ca'] = CASubsystem

diff --git a/base/server/python/pki/server/cli/ca.py b/base/server/python/pki/server/cli/ca.py

new file mode 100644

index 0000000..2ad8652

--- /dev/null

+++ b/base/server/python/pki/server/cli/ca.py

@@ -0,0 +1,206 @@

+#!/usr/bin/python

+# Authors:

+#     Endi S. Dewata <edewata@redhat.com>

+#

+# This program is free software; you can redistribute it and/or modify

+# it under the terms of the GNU General Public License as published by

+# the Free Software Foundation; version 2 of the License.

+#

+# This program is distributed in the hope that it will be useful,

+# but WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License along

+# with this program; if not, write to the Free Software Foundation, Inc.,

+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

+#

+# Copyright (C) 2015 Red Hat, Inc.

+# All rights reserved.

+#

+

+from __future__ import absolute_import

+from __future__ import print_function

+import getopt

+import io

+import sys

+

+import pki.cli

+import pki.server.ca

+

+

+class CACLI(pki.cli.CLI):

+

+    def __init__(self):

+        super(CACLI, self).__init__(

+            'ca', 'CA management commands')

+

+        self.add_module(CACertCLI())

+

+

+class CACertCLI(pki.cli.CLI):

+

+    def __init__(self):

+        super(CACertCLI, self).__init__(

+            'cert', 'CA certificates management commands')

+

+        self.add_module(CACertRequestCLI())

+

+

+class CACertRequestCLI(pki.cli.CLI):

+

+    def __init__(self):

+        super(CACertRequestCLI, self).__init__(

+            'request', 'CA certificate requests management commands')

+

+        self.add_module(CACertRequestFindCLI())

+        self.add_module(CACertRequestShowCLI())

+

+    @staticmethod

+    def print_request(request, details=False):

+        print('  Request ID: %s' % request['id'])

+        print('  Type: %s' % request['type'])

+        print('  Status: %s' % request['status'])

+

+        if details:

+            print('  Request: %s' % request['request'])

+

+

+class CACertRequestFindCLI(pki.cli.CLI):

+

+    def __init__(self):

+        super(CACertRequestFindCLI, self).__init__(

+            'find', 'Find CA certificate requests')

+

+    def usage(self):

+        print('Usage: pki-server ca-cert-request-find [OPTIONS]')

+        print()

+        print('  -i, --instance <instance ID>    Instance ID (default: pki-tomcat).')

+        print('      --cert                      Issued certificate.')

+        print('      --cert-file                 File containing issued certificate.')

+        print('  -v, --verbose                   Run in verbose mode.')

+        print('      --help                      Show help message.')

+        print()

+

+    def execute(self, args):

+

+        try:

+            opts, _ = getopt.gnu_getopt(args, 'i:v', [

+                'instance=', 'cert=', 'cert-file=',

+                'verbose', 'help'])

+

+        except getopt.GetoptError as e:

+            print('ERROR: ' + str(e))

+            self.usage()

+            sys.exit(1)

+

+        instance_name = 'pki-tomcat'

+        cert = None

+

+        for o, a in opts:

+            if o in ('-i', '--instance'):

+                instance_name = a

+

+            elif o == '--cert':

+                cert = a

+

+            elif o == '--cert-file':

+                with io.open(a, 'rb') as f:

+                    cert = f.read()

+

+            elif o in ('-v', '--verbose'):

+                self.set_verbose(True)

+

+            elif o == '--help':

+                self.print_help()

+                sys.exit()

+

+            else:

+                print('ERROR: unknown option ' + o)

+                self.usage()

+                sys.exit(1)

+

+        instance = pki.server.PKIInstance(instance_name)

+        instance.load()

+

+        subsystem = instance.get_subsystem('ca')

+        results = subsystem.find_cert_requests(cert=cert)

+

+        self.print_message('%s entries matched' % len(results))

+

+        first = True

+        for request in results:

+            if first:

+                first = False

+            else:

+                print()

+

+            CACertRequestCLI.print_request(request)

+

+

+class CACertRequestShowCLI(pki.cli.CLI):

+

+    def __init__(self):

+        super(CACertRequestShowCLI, self).__init__(

+            'show', 'Show CA certificate request')

+

+    def usage(self):

+        print('Usage: pki-server ca-cert-request-show <request ID> [OPTIONS]')

+        print()

+        print('  -i, --instance <instance ID>    Instance ID (default: pki-tomcat).')

+        print('  -v, --verbose                   Run in verbose mode.')

+        print('      --help                      Show help message.')

+        print()

+

+    def execute(self, args):

+

+        try:

+            opts, args = getopt.gnu_getopt(args, 'i:v', [

+                'instance=', 'output-file=',

+                'verbose', 'help'])

+

+        except getopt.GetoptError as e:

+            print('ERROR: ' + str(e))

+            self.usage()

+            sys.exit(1)

+

+        if len(args) != 1:

+            print('ERROR: missing request ID')

+            self.usage()

+            sys.exit(1)

+

+        request_id = args[0]

+        instance_name = 'pki-tomcat'

+        output_file = None

+

+        for o, a in opts:

+            if o in ('-i', '--instance'):

+                instance_name = a

+

+            elif o == '--output-file':

+                output_file = a

+

+            elif o in ('-v', '--verbose'):

+                self.set_verbose(True)

+

+            elif o == '--help':

+                self.print_help()

+                sys.exit()

+

+            else:

+                print('ERROR: unknown option ' + o)

+                self.usage()

+                sys.exit(1)

+

+        instance = pki.server.PKIInstance(instance_name)

+        instance.load()

+

+        subsystem = instance.get_subsystem('ca')

+        request = subsystem.get_cert_requests(request_id)

+

+        if output_file:

+            with io.open(output_file, 'wb') as f:

+                f.write(request['request'])

+

+        else:

+            CACertRequestCLI.print_request(request, details=True)

diff --git a/base/server/python/pki/server/cli/subsystem.py b/base/server/python/pki/server/cli/subsystem.py

index 43eb564..fc89c27 100644

--- a/base/server/python/pki/server/cli/subsystem.py

+++ b/base/server/python/pki/server/cli/subsystem.py

@@ -19,8 +19,12 @@

 # All rights reserved.

 #

+from __future__ import absolute_import

+from __future__ import print_function

+import base64

 import getopt

-import os

+import nss.nss as nss

+import string

 import sys

 import pki.cli

@@ -38,11 +42,13 @@ class SubsystemCLI(pki.cli.CLI):

         self.add_module(SubsystemFindCLI())

         self.add_module(SubsystemShowCLI())

+        self.add_module(SubsystemCertCLI())

+

     @staticmethod

     def print_subsystem(subsystem):

-        print '  Subsystem ID: %s' % subsystem.name

-        print '  Instance ID: %s' % subsystem.instance.name

-        print '  Enabled: %s' % subsystem.is_enabled()

+        print('  Subsystem ID: %s' % subsystem.name)

+        print('  Instance ID: %s' % subsystem.instance.name)

+        print('  Enabled: %s' % subsystem.is_enabled())

 class SubsystemFindCLI(pki.cli.CLI):

@@ -51,12 +57,12 @@ class SubsystemFindCLI(pki.cli.CLI):

         super(SubsystemFindCLI, self).__init__('find', 'Find subsystems')

     def usage(self):

-        print 'Usage: pki-server subsystem-find [OPTIONS]'

-        print

-        print '  -i, --instance <instance ID>    Instance ID.'

-        print '  -v, --verbose                   Run in verbose mode.'

-        print '      --help                      Show help message.'

-        print

+        print('Usage: pki-server subsystem-find [OPTIONS]')

+        print()

+        print('  -i, --instance <instance ID>    Instance ID (default: pki-tomcat).')

+        print('  -v, --verbose                   Run in verbose mode.')

+        print('      --help                      Show help message.')

+        print()

     def execute(self, args):

@@ -66,11 +72,11 @@ class SubsystemFindCLI(pki.cli.CLI):

                 'verbose', 'help'])

         except getopt.GetoptError as e:

-            print 'ERROR: ' + str(e)

+            print('ERROR: ' + str(e))

             self.usage()

             sys.exit(1)

-        instance_name = None

+        instance_name = 'pki-tomcat'

         for o, a in opts:

             if o in ('-i', '--instance'):

@@ -84,32 +90,17 @@ class SubsystemFindCLI(pki.cli.CLI):

                 sys.exit()

             else:

-                print 'ERROR: unknown option ' + o

+                print('ERROR: unknown option ' + o)

                 self.usage()

                 sys.exit(1)

-        if not instance_name:

-            print 'ERROR: missing instance ID'

-            self.usage()

-            sys.exit(1)

-

         instance = pki.server.PKIInstance(instance_name)

         instance.load()

-        results = []

-

-        for name in os.listdir(instance.base_dir):

-

-            subsystem = pki.server.PKISubsystem(instance, name)

-            if not subsystem.is_valid():

-                continue

-

-            results.append(subsystem)

-

-        self.print_message('%s entries matched' % len(results))

+        self.print_message('%s entries matched' % len(instance.subsystems))

         first = True

-        for subsystem in results:

+        for subsystem in instance.subsystems:

             if first:

                 first = False

             else:

@@ -124,12 +115,12 @@ class SubsystemShowCLI(pki.cli.CLI):

         super(SubsystemShowCLI, self).__init__('show', 'Show subsystem')

     def usage(self):

-        print 'Usage: pki-server subsystem-show [OPTIONS] <subsystem ID>'

-        print

-        print '  -i, --instance <instance ID>    Instance ID.'

-        print '  -v, --verbose                   Run in verbose mode.'

-        print '      --help                      Show help message.'

-        print

+        print('Usage: pki-server subsystem-show [OPTIONS] <subsystem ID>')

+        print()

+        print('  -i, --instance <instance ID>    Instance ID (default: pki-tomcat).')

+        print('  -v, --verbose                   Run in verbose mode.')

+        print('      --help                      Show help message.')

+        print()

     def execute(self, argv):

@@ -139,17 +130,17 @@ class SubsystemShowCLI(pki.cli.CLI):

                 'verbose', 'help'])

         except getopt.GetoptError as e:

-            print 'ERROR: ' + str(e)

+            print('ERROR: ' + str(e))

             self.usage()

             sys.exit(1)

         if len(args) != 1:

-            print 'ERROR: missing subsystem ID'

+            print('ERROR: missing subsystem ID')

             self.usage()

             sys.exit(1)

         subsystem_name = args[0]

-        instance_name = None

+        instance_name = 'pki-tomcat'

         for o, a in opts:

             if o in ('-i', '--instance'):

@@ -163,19 +154,14 @@ class SubsystemShowCLI(pki.cli.CLI):

                 sys.exit()

             else:

-                print 'ERROR: unknown option ' + o

+                print('ERROR: unknown option ' + o)

                 self.usage()

                 sys.exit(1)

-        if not instance_name:

-            print 'ERROR: missing instance ID'

-            self.usage()

-            sys.exit(1)

-

         instance = pki.server.PKIInstance(instance_name)

         instance.load()

-        subsystem = pki.server.PKISubsystem(instance, subsystem_name)

+        subsystem = instance.get_subsystem(subsystem_name)

         SubsystemCLI.print_subsystem(subsystem)

@@ -186,12 +172,12 @@ class SubsystemEnableCLI(pki.cli.CLI):

         super(SubsystemEnableCLI, self).__init__('enable', 'Enable subsystem')

     def usage(self):

-        print 'Usage: pki-server subsystem-enable [OPTIONS] <subsystem ID>'

-        print

-        print '  -i, --instance <instance ID>    Instance ID.'

-        print '  -v, --verbose                   Run in verbose mode.'

-        print '      --help                      Show help message.'

-        print

+        print('Usage: pki-server subsystem-enable [OPTIONS] <subsystem ID>')

+        print()

+        print('  -i, --instance <instance ID>    Instance ID (default: pki-tomcat).')

+        print('  -v, --verbose                   Run in verbose mode.')

+        print('      --help                      Show help message.')

+        print()

     def execute(self, argv):

@@ -201,17 +187,17 @@ class SubsystemEnableCLI(pki.cli.CLI):

                 'verbose', 'help'])

         except getopt.GetoptError as e:

-            print 'ERROR: ' + str(e)

+            print('ERROR: ' + str(e))

             self.usage()

             sys.exit(1)

         if len(args) != 1:

-            print 'ERROR: missing subsystem ID'

+            print('ERROR: missing subsystem ID')

             self.usage()

             sys.exit(1)

         subsystem_name = args[0]

-        instance_name = None

+        instance_name = 'pki-tomcat'

         for o, a in opts:

             if o in ('-i', '--instance'):

@@ -225,19 +211,14 @@ class SubsystemEnableCLI(pki.cli.CLI):