From dcf1135e8d55ba8bcfc6df07883aa3704b20a81f Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Thu, 1 Jul 2021 14:58:31 -0700

Subject: [PATCH 1/5] Bug1958277 PKCS10Client Attribute Encoding

PKCS10Client has an option "-k" which allows for individual DN

attributes to be encoded differently and separately.

For example:

    PKCS10Client -p <passwd> -d . -k true -o req.txt -n 'cn=UTF8String:aa,ou=BMPString:bb,o=cc'

This option might have been accidentally disabled.  In this patch, the

attribute encoding code is moved to CryptoUtil.java with some

refactoring, and calls to getJssName() is re-enabled for subjectName

in PKCS10Client;

fixes https://bugzilla.redhat.com/show_bug.cgi?id=1958277

(cherry picked from commit 22008c96bf943e575c254cbd0e8414a478481263)

---

 .../src/com/netscape/cmstools/PKCS10Client.java    | 151 +---------------

 .../com/netscape/cmsutil/crypto/CryptoUtil.java    | 196 ++++++++++++++++++++-

 2 files changed, 196 insertions(+), 151 deletions(-)

diff --git a/base/java-tools/src/com/netscape/cmstools/PKCS10Client.java b/base/java-tools/src/com/netscape/cmstools/PKCS10Client.java

index 137049e..4c002c2 100644

--- a/base/java-tools/src/com/netscape/cmstools/PKCS10Client.java

+++ b/base/java-tools/src/com/netscape/cmstools/PKCS10Client.java

@@ -24,18 +24,11 @@ import java.io.PrintStream;

 import java.security.KeyPair;

 import org.mozilla.jss.CryptoManager;

-import org.mozilla.jss.asn1.BMPString;

 import org.mozilla.jss.asn1.OBJECT_IDENTIFIER;

-import org.mozilla.jss.asn1.PrintableString;

-import org.mozilla.jss.asn1.TeletexString;

-import org.mozilla.jss.asn1.UTF8String;

-import org.mozilla.jss.asn1.UniversalString;

 import org.mozilla.jss.crypto.CryptoToken;

 import org.mozilla.jss.crypto.KeyPairAlgorithm;

 import org.mozilla.jss.crypto.KeyPairGenerator;

 import org.mozilla.jss.crypto.PrivateKey;

-import org.mozilla.jss.pkix.primitive.AVA;

-import org.mozilla.jss.pkix.primitive.Name;

 import org.mozilla.jss.util.Password;

 import com.netscape.cmsutil.crypto.CryptoUtil;

@@ -138,6 +131,7 @@ public class PKCS10Client {

                     enable_encoding = true;

                 else

                     enable_encoding = false;

+                System.out.println("PKCS10Client: enable_encoding =" + enable_encoding);

             } else if (name.equals("-s")) {

                 String ec_sensitive_s = args[i+1];

                 ec_sensitive = Integer.parseInt(ec_sensitive_s);

@@ -289,7 +283,7 @@ public class PKCS10Client {

             PKCS10 certReq = CryptoUtil.createCertificationRequest(

-                    subjectName, pair, extns);

+                    subjectName, enable_encoding, pair, extns);

             if (certReq == null) {

                 System.out.println("PKCS10Client: cert request null");

@@ -333,145 +327,4 @@ public class PKCS10Client {

         }

     }

-    static boolean isEncoded (String elementValue) {

-        boolean encoded = false;

-

-        if (elementValue != null && ((elementValue.startsWith("UTF8String:")) ||

-                                     (elementValue.startsWith("PrintableString:")) ||

-                                     (elementValue.startsWith("BMPString:")) ||

-                                     (elementValue.startsWith("TeletexString:")) ||

-                                     (elementValue.startsWith("UniversalString:")))) {

-            encoded = true;

-        }

-        return encoded;

-    }

-

-    static Name addNameElement (Name name, OBJECT_IDENTIFIER oid, int n, String elementValue) {

-        try {

-            String encodingType = (n > 0)? elementValue.substring(0, n): null;

-            String nameValue = (n > 0)? elementValue.substring(n+1): null;

-            if (encodingType != null && encodingType.length() > 0 &&

-                nameValue != null && nameValue.length() > 0) {

-                if (encodingType.equals("UTF8String")) {

-                    name.addElement( new AVA(oid, new UTF8String(nameValue)));

-                } else if (encodingType.equals("PrintableString")) {

-                    name.addElement( new AVA(oid, new PrintableString(nameValue)));

-                } else if (encodingType.equals("BMPString")) {

-                    name.addElement( new AVA(oid, new BMPString(nameValue)));

-                } else if (encodingType.equals("TeletexString")) {

-                    name.addElement( new AVA(oid, new TeletexString(nameValue)));

-                } else if (encodingType.equals("UniversalString")) {

-                    name.addElement( new AVA(oid, new UniversalString(nameValue)));

-                }

-            }

-        }  catch (Exception e)  {

-            System.out.println("PKCS10Client: Error adding name element: " + elementValue + " Error: "  + e.toString());

-        }

-        return name;

-    }

-

-    static Name getJssName(boolean enable_encoding, String dn) {

-

-        X500Name x5Name = null;

-

-        try {

-            x5Name = new X500Name(dn);

-        } catch (IOException e) {

-

-            System.out.println("PKCS10Client: Illegal Subject Name:  " + dn + " Error: " + e.toString());

-            System.out.println("PKCS10Client: Filling in default Subject Name......");

-            return null;

-        }

-

-        Name ret = new Name();

-        netscape.security.x509.RDN[] names = null;

-        names = x5Name.getNames();

-        int nameLen = x5Name.getNamesLength();

-

-        netscape.security.x509.RDN cur = null;

-

-        for (int i = 0; i < nameLen; i++) {

-            cur = names[i];

-            String rdnStr = cur.toString();

-            String[] split = rdnStr.split("=");

-

-            if (split.length != 2)

-                continue;

-            int n = split[1].indexOf(':');

-

-            try {

-                if (split[0].equals("UID")) {

-                    if (enable_encoding && isEncoded(split[1])) {

-                        ret = addNameElement(ret, new OBJECT_IDENTIFIER("0.9.2342.19200300.100.1.1"),

-                                             n, split[1]);

-                    } else {

-                        ret.addElement(new AVA(new OBJECT_IDENTIFIER("0.9.2342.19200300.100.1.1"),

-                                               new PrintableString(split[1])));

-                    }

-                    //                 System.out.println("UID found : " + split[1]);

-                }

-

-                if (split[0].equals("C")) {

-                    ret.addCountryName(split[1]);

-                    //                   System.out.println("C found : " + split[1]);

-                    continue;

-                }

-

-                if (split[0].equals("CN")) {

-                    if (enable_encoding && isEncoded(split[1])) {

-                        ret = addNameElement (ret, Name.commonName, n, split[1]);

-                    } else {

-                        ret.addCommonName(split[1]);

-                    }

-                    //                  System.out.println("CN found : " + split[1]);

-                    continue;

-                }

-

-                if (split[0].equals("L")) {

-                    if (enable_encoding && isEncoded(split[1])) {

-                        ret = addNameElement (ret, Name.localityName, n, split[1]);

-                    } else {

-                        ret.addLocalityName(split[1]);

-                    }

-                    //                 System.out.println("L found : " + split[1]);

-                    continue;

-                }

-

-                if (split[0].equals("O")) {

-                    if (enable_encoding && isEncoded(split[1])) {

-                        ret = addNameElement (ret, Name.organizationName, n, split[1]);

-                    } else {

-                        ret.addOrganizationName(split[1]);

-                    }

-                    //                System.out.println("O found : " + split[1]);

-                    continue;

-                }

-

-                if (split[0].equals("ST")) {

-                    if (enable_encoding && isEncoded(split[1])) {

-                        ret = addNameElement (ret, Name.stateOrProvinceName, n, split[1]);

-                    } else {

-                        ret.addStateOrProvinceName(split[1]);

-                    }

-                    //               System.out.println("ST found : " + split[1]);

-                    continue;

-                }

-

-                if (split[0].equals("OU")) {

-                    if (enable_encoding && isEncoded(split[1])) {

-                        ret = addNameElement (ret, Name.organizationalUnitName, n, split[1]);

-                    } else {

-                        ret.addOrganizationalUnitName(split[1]);

-                    }

-                    //              System.out.println("OU found : " + split[1]);

-                    continue;

-                }

-            } catch (Exception e) {

-                System.out.println("PKCS10Client: Error constructing RDN: " + rdnStr + " Error: " + e.toString());

-                continue;

-            }

-        }

-

-        return ret;

-    }

 }

diff --git a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java

index 2fe4757..befceed 100644

--- a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java

+++ b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java

@@ -65,6 +65,11 @@ import org.mozilla.jss.asn1.ANY;

 import org.mozilla.jss.asn1.ASN1Value;

 import org.mozilla.jss.asn1.BIT_STRING;

 import org.mozilla.jss.asn1.INTEGER;

+import org.mozilla.jss.asn1.BMPString;

+import org.mozilla.jss.asn1.PrintableString;

+import org.mozilla.jss.asn1.TeletexString;

+import org.mozilla.jss.asn1.UTF8String;

+import org.mozilla.jss.asn1.UniversalString;

 import org.mozilla.jss.asn1.InvalidBERException;

 import org.mozilla.jss.asn1.NULL;

 import org.mozilla.jss.asn1.OBJECT_IDENTIFIER;

@@ -114,6 +119,7 @@ import org.mozilla.jss.pkix.crmf.EncryptedKey;

 import org.mozilla.jss.pkix.crmf.EncryptedValue;

 import org.mozilla.jss.pkix.crmf.PKIArchiveOptions;

 import org.mozilla.jss.pkix.primitive.AlgorithmIdentifier;

+import org.mozilla.jss.pkix.primitive.AVA;

 import org.mozilla.jss.pkix.primitive.Name;

 import org.mozilla.jss.pkix.primitive.SubjectPublicKeyInfo;

 import org.mozilla.jss.ssl.SSLSocket;

@@ -1691,6 +1697,14 @@ public class CryptoUtil {

             throws NoSuchAlgorithmException, NoSuchProviderException,

             InvalidKeyException, IOException, CertificateException,

             SignatureException {

+        return createCertificationRequest(subjectName, false, keyPair, exts);

+    }

+    // encodeSubj works with PKCS10Client "-k" option

+    public static PKCS10 createCertificationRequest(String subjectName,

+            boolean encodeSubj, KeyPair keyPair, Extensions exts)

+            throws NoSuchAlgorithmException, NoSuchProviderException,

+            InvalidKeyException, IOException, CertificateException,

+            SignatureException {

         String method = "CryptoUtil: createCertificationRequest: ";

         String alg = "SHA256withRSA";

@@ -1705,7 +1719,7 @@ public class CryptoUtil {

         }

         return createCertificationRequest(

-                subjectName, key, (org.mozilla.jss.crypto.PrivateKey) keyPair.getPrivate(),

+                subjectName, encodeSubj, key, (org.mozilla.jss.crypto.PrivateKey) keyPair.getPrivate(),

                 alg, exts);

     }

@@ -1714,6 +1728,14 @@ public class CryptoUtil {

             throws NoSuchAlgorithmException, NoSuchProviderException,

             InvalidKeyException, IOException, CertificateException,

             SignatureException {

+        return createCertificationRequest(subjectName, false, pubk, prik, alg, null);

+    }

+    public static PKCS10 createCertificationRequest(String subjectName,

+            boolean encodeSubj,

+            X509Key pubk, PrivateKey prik, String alg, Extensions exts)

+            throws NoSuchAlgorithmException, NoSuchProviderException,

+            InvalidKeyException, IOException, CertificateException,

+            SignatureException {

         X509Key key = pubk;

         java.security.Signature sig = java.security.Signature.getInstance(alg,

                 "Mozilla-JSS");

@@ -1734,13 +1756,182 @@ public class CryptoUtil {

         } else {

             pkcs10 = new PKCS10(key);

         }

-        X500Name name = new X500Name(subjectName);

+

+        Name n = getJssName(encodeSubj, subjectName);

+        ByteArrayOutputStream subjectEncStream = new ByteArrayOutputStream();

+        n.encode(subjectEncStream);

+        byte[] b = subjectEncStream.toByteArray();

+        X500Name name = new X500Name(b);

         X500Signer signer = new X500Signer(sig, name);

         pkcs10.encodeAndSign(signer);

         return pkcs10;

     }

+    static boolean isEncoded (String elementValue) {

+        boolean encoded = false;

+

+        //System.out.println("CryptoUtil: isEncoded: elementValue =" +

+        //    elementValue);

+        if (elementValue != null && ((elementValue.startsWith("UTF8String:")) ||

+                                     (elementValue.startsWith("PrintableString:")) ||

+                                     (elementValue.startsWith("BMPString:")) ||

+                                     (elementValue.startsWith("TeletexString:")) ||

+                                     (elementValue.startsWith("UniversalString:")))) {

+            encoded = true;

+        }

+        return encoded;

+    }

+

+    static Name addNameElement (Name name, OBJECT_IDENTIFIER oid, int n, String elementValue) {

+        // System.out.println("CryptoUtil: addNameElement: elementValue =" +

+        //     elementValue);

+        try {

+            String encodingType = (n > 0)? elementValue.substring(0, n): null;

+            // System.out.println("CryptoUtil: addNameElement: encodingType =" +

+            //     encodingType);

+            String nameValue = (n > 0)? elementValue.substring(n+1): null;

+            // System.out.println("CryptoUtil: addNameElement: nameValue =" +

+            //     nameValue);

+            if (encodingType != null && encodingType.length() > 0 &&

+                nameValue != null && nameValue.length() > 0) {

+                if (encodingType.equals("UTF8String")) {

+                // System.out.println("CryptoUtil: addNameElement: UTF8String");

+                    name.addElement( new AVA(oid, new UTF8String(nameValue)));

+                } else if (encodingType.equals("PrintableString")) {

+                // System.out.println("CryptoUtil: addNameElement: PrintableString");

+                    name.addElement( new AVA(oid, new PrintableString(nameValue)));

+                } else if (encodingType.equals("BMPString")) {

+                // System.out.println("CryptoUtil: addNameElement: BMPString");

+                    name.addElement( new AVA(oid, new BMPString(nameValue)));

+                } else if (encodingType.equals("TeletexString")) {

+                // System.out.println("CryptoUtil: addNameElement: TeletexString");

+                    name.addElement( new AVA(oid, new TeletexString(nameValue)));

+                } else if (encodingType.equals("UniversalString")) {

+                // System.out.println("CryptoUtil: addNameElement: UniversalString");

+                    name.addElement( new AVA(oid, new UniversalString(nameValue)));

+                }

+            }

+        }  catch (Exception e)  {

+            System.out.println("CryptoUtil: Error adding name element: " + elementValue + " Error: "  + e.toString());

+        }

+        return name;

+    }

+

+    static Name getJssName(boolean enable_encoding, String dn) {

+

+        X500Name x5Name = null;

+

+        //System.out.println("CryptoUtil: getJssName: dn= " + dn);

+        try {

+            x5Name = new X500Name(dn);

+        } catch (IOException e) {

+

+            System.out.println("CryptoUtil: Illegal Subject Name:  " + dn + " Error: " + e.toString());

+            System.out.println("CryptoUtil: Filling in default Subject Name......");

+            return null;

+        }

+

+        Name ret = new Name();

+        netscape.security.x509.RDN[] names = x5Name.getNames();

+        int nameLen = x5Name.getNamesLength();

+

+        netscape.security.x509.RDN cur = null;

+

+        for (int i = 0; i < nameLen; i++) {

+            cur = names[i];

+            String rdnStr = cur.toString();

+            String[] split = rdnStr.split("=");

+

+            if (split.length != 2)

+                continue;

+            // System.out.println("  getJssName: split[0] =" + split[0]);

+            // System.out.println("  getJssName: split[1] =" + split[1]);

+            int n = split[1].indexOf(':');

+

+            try {

+                if (split[0].equals("UID")) {

+                    if (enable_encoding && isEncoded(split[1])) {

+                        // System.out.println("    getJssName: encoded UID");

+                        ret = addNameElement(ret, new OBJECT_IDENTIFIER("0.9.2342.19200300.100.1.1"),

+                                             n, split[1]);

+                    } else {

+                        // System.out.println("    getJssName: not encoded UID");

+                        ret.addElement(new AVA(new OBJECT_IDENTIFIER("0.9.2342.19200300.100.1.1"),

+                                               new PrintableString(split[1])));

+                    }

+                    //                 System.out.println("UID found : " + split[1]);

+                }

+

+                if (split[0].equals("C")) {

+                    ret.addCountryName(split[1]);

+                    //                   System.out.println("C found : " + split[1]);

+                    continue;

+                }

+

+                if (split[0].equals("CN")) {

+                    if (enable_encoding && isEncoded(split[1])) {

+                        // System.out.println("    getJssName: encoded CN");

+                        ret = addNameElement (ret, Name.commonName, n, split[1]);

+                    } else {

+                        // System.out.println("    getJssName: not encoded CN");

+                        ret.addCommonName(split[1]);

+                    }

+                    //                  System.out.println("CN found : " + split[1]);

+                    continue;

+                }

+

+                if (split[0].equals("L")) {

+                    if (enable_encoding && isEncoded(split[1])) {

+                        ret = addNameElement (ret, Name.localityName, n, split[1]);

+                    } else {

+                        ret.addLocalityName(split[1]);

+                    }

+                    //                 System.out.println("L found : " + split[1]);

+                    continue;

+                }

+

+                if (split[0].equals("O")) {

+                    if (enable_encoding && isEncoded(split[1])) {

+                        // System.out.println("    getJssName: encoded O");

+                        ret = addNameElement (ret, Name.organizationName, n, split[1]);

+                    } else {

+                        // System.out.println("    getJssName: not encoded O");

+                        ret.addOrganizationName(split[1]);

+                    }

+                    //                System.out.println("O found : " + split[1]);

+                    continue;

+                }

+

+                if (split[0].equals("ST")) {

+                    if (enable_encoding && isEncoded(split[1])) {

+                        ret = addNameElement (ret, Name.stateOrProvinceName, n, split[1]);

+                    } else {

+                        ret.addStateOrProvinceName(split[1]);

+                    }

+                    //               System.out.println("ST found : " + split[1]);

+                    continue;

+                }

+

+                if (split[0].equals("OU")) {

+                    if (enable_encoding && isEncoded(split[1])) {

+                        // System.out.println("    getJssName: encoded OU");

+                        ret = addNameElement (ret, Name.organizationalUnitName, n, split[1]);

+                    } else {

+                        // System.out.println("    getJssName: not encoded OU");

+                        ret.addOrganizationalUnitName(split[1]);

+                    }

+                    //              System.out.println("OU found : " + split[1]);

+                    continue;

+                }

+            } catch (Exception e) {

+                System.out.println("CryptoUtil: Error constructing RDN: " + rdnStr + " Error: " + e.toString());

+                continue;

+            }

+        }

+

+        return ret;

+    }

     public static KeyIdentifier createKeyIdentifier(KeyPair keypair)

             throws NoSuchAlgorithmException, InvalidKeyException {

         String method = "CryptoUtil: createKeyIdentifier: ";

@@ -1848,6 +2039,7 @@ public class CryptoUtil {

         PKCS10 pkcs10 = new PKCS10(key);

         X500Name name = new X500Name(subjectName);

+

         X500Signer signer = new X500Signer(sig, name);

         pkcs10.encodeAndSign(signer);

-- 

1.8.3.1

From b974f1d9daf393efc19308bac42b955c601090b7 Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Thu, 15 Jul 2021 13:24:26 -0500

Subject: [PATCH 2/5] Add GitLab synchronization job

The .gitlab-ci.yml has been added to define a job to

synchronize a branch from an upstream repository to a

GitLab repository.

(cherry picked from commit 27912b9e4311d4f12499f9f1b59e0b4bf4c5bac5)

---

 .gitlab-ci.yml                                    | 22 +++++++++++

 docs/development/Synchronizing-GitLab-Branch.adoc | 48 +++++++++++++++++++++++

 2 files changed, 70 insertions(+)

 create mode 100644 .gitlab-ci.yml

 create mode 100644 docs/development/Synchronizing-GitLab-Branch.adoc

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml

new file mode 100644

index 0000000..249e240

--- /dev/null

+++ b/.gitlab-ci.yml

@@ -0,0 +1,22 @@

+image: fedora

+

+sync:

+

+  script:

+    - echo "Synchronizing $CI_COMMIT_BRANCH branch from $UPSTREAM_URL to $CI_PROJECT_URL"

+    - dnf install -y git

+    - git remote set-url origin https://sync:$ACCESS_TOKEN@$CI_SERVER_HOST/$CI_PROJECT_PATH.git

+    - git remote remove upstream || true

+    - git remote add upstream $UPSTREAM_URL

+    - git remote -v

+    - git fetch upstream $CI_COMMIT_BRANCH

+    - git checkout upstream/$CI_COMMIT_BRANCH

+    - git log origin/$CI_COMMIT_BRANCH..upstream/$CI_COMMIT_BRANCH --oneline

+    - GIT_SSL_NO_VERIFY=true git push origin HEAD:$CI_COMMIT_BRANCH

+

+  rules:

+    - if: $SYNC == "true"

+

+  tags:

+    # Use shared runners.

+    - shared

diff --git a/docs/development/Synchronizing-GitLab-Branch.adoc b/docs/development/Synchronizing-GitLab-Branch.adoc

new file mode 100644

index 0000000..b0937f2

--- /dev/null

+++ b/docs/development/Synchronizing-GitLab-Branch.adoc

@@ -0,0 +1,48 @@

+= Synchronizing GitLab Branch =

+

+== Overview ==

+

+This page describes the procedure to synchronize a branch from an upstream repository

+to a GitLab repository.

+

+== Creating Access Token ==

+

+In the GitLab repository create a project access token with a **write_repository** permission.

+

+See link:https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#creating-a-project-access-token[Creating a project access token].

+

+== Configuring Synchronization ==

+

+In the GitLab repository create the following variables:

+

+* `UPSTREAM_URL`: The URL of the upstream repository.

+** Unselect **Protect variable** to synchronize unprotected branches.

+* `ACCESS_TOKEN`: The value of the access token.

+** Unselect **Protect variable** to synchronize unprotected branches.

+** Select **Mask variable** to keep the access token hidden.

+

+See link:https://docs.gitlab.com/ee/ci/variables/#add-a-cicd-variable-to-a-project[Add a CI/CD variable to a project].

+

+== Running Synchronization Manually ==

+

+In the GitLab repository run a pipeline with the following parameters:

+

+* **Run for branch name or tag**: The branch to be synchronized.

+* **Variables**:

+** `SYNC`: `true`

+

+See link:https://docs.gitlab.com/ee/ci/pipelines/#run-a-pipeline-manually[Run a pipeline manually].

+

+== Scheduling Automatic Synchronization ==

+

+In the GitLab repository create a schedule with the following parameters:

+

+* **Interval Pattern**: The frequency of synchronization.

+** To synchronize every hour, enter: `0 * * * *`

+* **Target Branch**: The branch to be synchronized.

+* **Variables**:

+** `SYNC`: `true`

+

+Additional schedules can be created for synchronizing other branches.

+

+See link:https://docs.gitlab.com/ee/ci/pipelines/schedules.html#configuring-pipeline-schedules[Configuring pipeline schedules].

-- 

1.8.3.1

From 32fcaab4585e893742018855c142d01716430cdb Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Wed, 28 Jul 2021 16:21:27 -0700

Subject: [PATCH 3/5] Bug1959937 - TPS Allowing Token Transactions while the CA

 is Down

This patch propagates the exception thrown when revocation/unrevocation

fails so that the token record is not updated on TPS; This allows

the TPS token to be consistent with the certs on the CA.

fixes https://bugzilla.redhat.com/show_bug.cgi?id=1959937

(cherry picked from commit 2f7ed836ab20988386e651c1000f4e12eff6c0af)

---

 base/tps/src/org/dogtagpki/server/tps/TPSTokendb.java | 14 ++++++++++----

 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/base/tps/src/org/dogtagpki/server/tps/TPSTokendb.java b/base/tps/src/org/dogtagpki/server/tps/TPSTokendb.java

index b58c24f..147f346 100644

--- a/base/tps/src/org/dogtagpki/server/tps/TPSTokendb.java

+++ b/base/tps/src/org/dogtagpki/server/tps/TPSTokendb.java

@@ -616,7 +616,7 @@ public class TPSTokendb {

     }

     private void revokeCert(TokenRecord tokenRecord, TPSCertRecord cert, String tokenReason,

-            String ipAddress, String remoteUser) {

+            String ipAddress, String remoteUser) throws Exception {

         String method = "TPSTokendb.revokeCert";

         String logMsg;

@@ -678,12 +678,15 @@ public class TPSTokendb {

             tdbActivity(ActivityDatabase.OP_CERT_REVOCATION, tokenRecord,

                     ipAddress, e.getMessage(), "failure", remoteUser);

-            // continue revoking the next certificate

+            // bail out if revocation failed; This will allow the token

+            // status info to be consistent with that of the certs on the

+            // CA

+            throw e;

         }

     }

     private void unrevokeCert(TokenRecord tokenRecord, TPSCertRecord cert, String tokenReason,

-            String ipAddress, String remoteUser) {

+            String ipAddress, String remoteUser) throws Exception {

         String method = "TPSTokendb.unrevokeCert";

         String logMsg;

@@ -733,7 +736,10 @@ public class TPSTokendb {

             tdbActivity(ActivityDatabase.OP_CERT_RESTORATION, tokenRecord,

                     ipAddress, e.getMessage(), "failure", remoteUser);

-            // continue unrevoking the next certificate

+            // bail out if revocation failed; This will allow the token

+            // status info to be consistent with that of the certs on the

+            // CA

+            throw e;

         }

     }

-- 

1.8.3.1

From d413394b2673e94e21dd645e588e934cc05c932b Mon Sep 17 00:00:00 2001

From: Fraser Tweedale <ftweedal@redhat.com>

Date: Thu, 30 May 2019 19:42:42 +1000

Subject: [PATCH 4/5] AuthorityService.getCert/Chain: avoid NPE if CA is not

 ready

If a LWCA is not ready (i.e. key replication and signing unit

initialisation has not completed), asking for its certificate (or

chain) results in a NullPointerException.  Update

AuthorityService.getCert() and .getChain() to raise

ResourceNotFoundException instead.

Part of: https://pagure.io/dogtagpki/issue/3102

(cherry picked from commit a491bb99f273a3bd2f8c9540c8c18b2604adc035)

---

 .../src/org/dogtagpki/server/ca/rest/AuthorityService.java | 14 ++++++++++++--

 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java b/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java

index 36ddc6f..12388c9 100644

--- a/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java

+++ b/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java

@@ -140,8 +140,13 @@ public class AuthorityService extends SubsystemService implements AuthorityResou

         if (ca == null)

             throw new ResourceNotFoundException("CA \"" + aidString + "\" not found");

+        org.mozilla.jss.crypto.X509Certificate cert = ca.getCaX509Cert();

+        if (cert == null)

+            throw new ResourceNotFoundException(

+                "Certificate for CA \"" + aidString + "\" not available");

+

         try {

-            return Response.ok(ca.getCaX509Cert().getEncoded()).build();

+            return Response.ok(cert.getEncoded()).build();

         } catch (CertificateEncodingException e) {

             // this really is a 500 Internal Server Error

             throw new PKIException("Error encoding certificate: " + e);

@@ -167,9 +172,14 @@ public class AuthorityService extends SubsystemService implements AuthorityResou

         if (ca == null)

             throw new ResourceNotFoundException("CA \"" + aidString + "\" not found");

+        netscape.security.x509.CertificateChain chain = ca.getCACertChain();

+        if (chain == null)

+            throw new ResourceNotFoundException(

+                "Certificate chain for CA \"" + aidString + "\" not available");

+

         ByteArrayOutputStream out = new ByteArrayOutputStream();

         try {

-            ca.getCACertChain().encode(out);

+            chain.encode(out);

         } catch (IOException e) {

             throw new PKIException("Error encoding certificate chain: " + e);

         }

-- 

1.8.3.1

From dae038b021e8623b920df8abf3abd5d48ab0636c Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Wed, 14 Jul 2021 17:24:59 -0700

Subject: [PATCH 5/5] Bug1979710-TPS: separate config actions by profile

 permission list

This patch addresses the issue that TPS agent operations on tokens,

activities, and profiles are not limited by the types (profiles)

permmtted to the agent (as described in the documentation).

This is a regression from 8.x.

The affected operations are:

 - findProfiles

 - getProfiles

 - updateProfile

 - changeStatus (of a profile)

 - retrieveTokens

 - getToken

 - modifyToken

 - changeTokenStatus

 - retrieveActivities

 - getActivity

Note that some operations that seem like should be affected are not

due to the fact that they are TPS admin operations and are shielded

from entering the TPS service at the activity level.  For example,