From 14e44691ef0b61220d390afb745496b7d62945ee Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Tue, 30 May 2017 21:15:44 +0200

Subject: [PATCH 04/27] Added pkispawn options for two-step installation.

New --skip-configuration and --skip-installation options have

been added to pkispawn to provide a mechanism to set the

pki_skip_configuration and pki_skip_installation parameters

without changing the deployment configuration file.

https://pagure.io/dogtagpki/issue/2707

Change-Id: I069b51b5be65dee2fe0f4ca75e3693bcd21007de

---

 base/server/sbin/pkispawn | 40 ++++++++++++++++++++++++++++++++++------

 1 file changed, 34 insertions(+), 6 deletions(-)

diff --git a/base/server/sbin/pkispawn b/base/server/sbin/pkispawn

index 9e2ebc8..742f579 100755

--- a/base/server/sbin/pkispawn

+++ b/base/server/sbin/pkispawn

@@ -91,6 +91,18 @@ def main(argv):

         dest='precheck', action='store_true',

         help='Execute pre-checks and exit')

+    parser.optional.add_argument(

+        '--skip-configuration',

+        dest='skip_configuration',

+        action='store_true',

+        help='skip configuration step')

+

+    parser.optional.add_argument(

+        '--skip-installation',

+        dest='skip_installation',

+        action='store_true',

+        help='skip installation step')

+

     args = parser.process_command_line_arguments()

     config.default_deployment_cfg = \

@@ -475,6 +487,24 @@ def main(argv):

         sys.exit(1)

     start_logging()

+

+    # Read the specified PKI configuration file.

+    rv = parser.read_pki_configuration_file()

+    if rv != 0:

+        config.pki_log.error(log.PKI_UNABLE_TO_PARSE_1, rv,

+                             extra=config.PKI_INDENTATION_LEVEL_0)

+        sys.exit(1)

+

+    # --skip-configuration

+    if args.skip_configuration:

+        parser.set_property(deployer.subsystem_name,

+                            'pki_skip_configuration', 'True')

+

+    # --skip-installation

+    if args.skip_installation:

+        parser.set_property(deployer.subsystem_name,

+                            'pki_skip_installation', 'True')

+

     create_master_dictionary(parser)

     if not interactive and \

@@ -635,23 +665,21 @@ def start_logging():

 def create_master_dictionary(parser):

-    # Read the specified PKI configuration file.

-    rv = parser.read_pki_configuration_file()

-    if rv != 0:

-        config.pki_log.error(log.PKI_UNABLE_TO_PARSE_1, rv,

-                             extra=config.PKI_INDENTATION_LEVEL_0)

-        sys.exit(1)

     # Read in the PKI slots configuration file.

     parser.compose_pki_slots_dictionary()

+

     config.pki_log.debug(log.PKI_DICTIONARY_SLOTS,

                          extra=config.PKI_INDENTATION_LEVEL_0)

     config.pki_log.debug(pkilogging.log_format(parser.slots_dict),

                          extra=config.PKI_INDENTATION_LEVEL_0)

+

     # Combine the various sectional dictionaries into a PKI master dictionary

     parser.compose_pki_master_dictionary()

+

     parser.mdict['pki_spawn_log'] = \

         config.pki_log_dir + "/" + config.pki_log_name

+

     config.pki_log.debug(log.PKI_DICTIONARY_MASTER,

                          extra=config.PKI_INDENTATION_LEVEL_0)

     config.pki_log.debug(pkilogging.log_format(parser.mdict),

-- 

1.8.3.1

From 9af1746463bec2e62c990279d857635f693cfac7 Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Tue, 30 May 2017 21:07:59 +0200

Subject: [PATCH 05/27] Fixed two-step subordinate CA installation.

The initialization scriptlet has been fixed to verify the subsystem

existence properly when running the second step of the two-step

subordinate CA installation.

https://pagure.io/dogtagpki/issue/2707

Change-Id: I0cc8ca21fda8637b4b34f4c5a1c108d213f638f8

---

 .../pki/server/deployment/scriptlets/initialization.py       | 12 +++++++++---

 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/base/server/python/pki/server/deployment/scriptlets/initialization.py b/base/server/python/pki/server/deployment/scriptlets/initialization.py

index 4dc4e9a..1ae77e4 100644

--- a/base/server/python/pki/server/deployment/scriptlets/initialization.py

+++ b/base/server/python/pki/server/deployment/scriptlets/initialization.py

@@ -54,13 +54,19 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):

         else:

             config.pki_log.info(log.INITIALIZATION_SPAWN_1, __name__,

                                 extra=config.PKI_INDENTATION_LEVEL_1)

+

+            # Verify that the subsystem already exists for the following cases:

+            # - External CA (Step 2)

+            # - Stand-alone PKI (Step 2)

+            # - Two-step installation (Step 2)

+

             if (deployer.mdict['pki_subsystem'] == "CA" or

                 config.str2bool(deployer.mdict['pki_standalone'])) and \

-                    config.str2bool(deployer.mdict['pki_external_step_two']):

-                # verify that this External CA (Step 2), or Stand-alone PKI

-                # (Step 2) currently EXISTS for this "instance"

+                    config.str2bool(deployer.mdict['pki_external_step_two']) or \

+               config.str2bool(deployer.mdict['pki_skip_installation']):

                 deployer.instance.verify_subsystem_exists()

                 deployer.mdict['pki_skip_installation'] = "True"

+

             else:

                 # verify that this type of "subsystem" does NOT yet

                 # exist for this "instance"

-- 

1.8.3.1

From 0984d8a114b326a75b2c32cd9da2b7dee23920bb Mon Sep 17 00:00:00 2001

From: Ade Lee <alee@redhat.com>

Date: Fri, 26 May 2017 22:57:07 -0400

Subject: [PATCH 07/27] Convert CMC code to use AES

* Switched out CrytoUtil calls that use DES and replaced them

  with AES equivalents.  Removed these now unneeded methods.

* Added 16 byte constant IV for AES operations.  This must be

  replaced by a randomly generated IV.  Added TODOs where IVs

  should be replaced.

* Corrected misspellings of "enreypted" in both request fields

  and variable names

* Removed some code from null checks where the result could

  never be null.  These cases were flagged in eclipse as dead

  code.

Change-Id: Iec0c0e86fd772af8b3c9588f11a0ea1e517776fb

---

 .../src/com/netscape/cmstools/CMCRequest.java      |  18 +++-

 .../netscape/cms/profile/common/EnrollProfile.java | 111 ++++++++++++++-------

 .../cms/servlet/common/CMCOutputTemplate.java      |  40 ++++----

 .../com/netscape/cmsutil/crypto/CryptoUtil.java    |  84 ++--------------

 4 files changed, 113 insertions(+), 140 deletions(-)

diff --git a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java

index 9c41403..8d49b20 100644

--- a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java

+++ b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java

@@ -52,6 +52,9 @@ import org.mozilla.jss.asn1.SET;

 import org.mozilla.jss.asn1.UTF8String;

 import org.mozilla.jss.crypto.CryptoToken;

 import org.mozilla.jss.crypto.DigestAlgorithm;

+import org.mozilla.jss.crypto.EncryptionAlgorithm;

+import org.mozilla.jss.crypto.IVParameterSpec;

+import org.mozilla.jss.crypto.KeyWrapAlgorithm;

 import org.mozilla.jss.crypto.ObjectNotFoundException;

 import org.mozilla.jss.crypto.PrivateKey;

 import org.mozilla.jss.crypto.Signature;

@@ -1718,19 +1721,30 @@ public class CMCRequest {

             CryptoToken token = CryptoUtil.getKeyStorageToken(tokenName);

             SymmetricKey symKey = CryptoUtil.unwrap(

                     token,

+                    SymmetricKey.AES,

+                    128,

                     SymmetricKey.Usage.DECRYPT,

                     privKey,

-                    recipient.getEncryptedKey().toByteArray());

+                    recipient.getEncryptedKey().toByteArray(),

+                    KeyWrapAlgorithm.RSA);

+

             if (symKey == null) {

                 System.out.println(method + "symKey returned null from CryptoUtil.unwrap(). Abort!");

                 System.exit(1);

             }

             System.out.println(method + "symKey unwrapped.");

+            // TODO(alee) The code below should be replaced by code that generates a random IV

+            byte[] iv = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };

+            IVParameterSpec default_iv = new IVParameterSpec(iv);

+

             byte challenge[] = CryptoUtil.decryptUsingSymmetricKey(

                     token,

+                    default_iv,

                     encCI.getEncryptedContent().toByteArray(),

-                    symKey);

+                    symKey,

+                    EncryptionAlgorithm.AES_128_CBC);

+

             if (challenge == null) {

                 System.out

                         .println(method + "challenge returned null from CryptoUtil.decryptUsingSymmetricKey(). Abort!");

diff --git a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java

index 1443a0a..12fb736 100644

--- a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java

+++ b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java

@@ -45,7 +45,11 @@ import org.mozilla.jss.asn1.SET;

 import org.mozilla.jss.asn1.UTF8String;

 import org.mozilla.jss.crypto.CryptoToken;

 import org.mozilla.jss.crypto.DigestAlgorithm;

+import org.mozilla.jss.crypto.EncryptionAlgorithm;

 import org.mozilla.jss.crypto.HMACAlgorithm;

+import org.mozilla.jss.crypto.IVParameterSpec;

+import org.mozilla.jss.crypto.KeyGenAlgorithm;

+import org.mozilla.jss.crypto.KeyWrapAlgorithm;

 import org.mozilla.jss.crypto.PrivateKey;

 import org.mozilla.jss.crypto.SymmetricKey;

 import org.mozilla.jss.pkcs10.CertificationRequest;

@@ -399,6 +403,10 @@ public abstract class EnrollProfile extends BasicProfile

                 String tokenName = CMS.getConfigStore().getString("cmc.token", CryptoUtil.INTERNAL_TOKEN_NAME);

                 token = CryptoUtil.getCryptoToken(tokenName);

+                // TODO(alee) Replace the IV definition with a call that generates a random IV of  the correct length

+                byte[] iv = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };

+                IVParameterSpec ivps = new IVParameterSpec(iv);

+

                 PublicKey userPubKey = X509Key.parsePublicKey(new DerValue(req_key_data));

                 if (userPubKey == null) {

                     msg = method + "userPubKey null after X509Key.parsePublicKey";

@@ -406,37 +414,57 @@ public abstract class EnrollProfile extends BasicProfile

                     throw new EBaseException(msg);

                 }

-                SymmetricKey symKey = CryptoUtil.generateKey(token);

-                byte[] pop_encreyptedData = CryptoUtil.encryptUsingSymmetricKey(

-                        token, symKey, challenge);

-                if (pop_encreyptedData == null) {

-                    msg = method + "pop_encreyptedData null";

+                SymmetricKey symKey = CryptoUtil.generateKey(

+                        token,

+                        KeyGenAlgorithm.AES,

+                        128,

+                        null,

+                        true);

+

+                byte[] pop_encryptedData = CryptoUtil.encryptUsingSymmetricKey(

+                        token,

+                        symKey,

+                        challenge,

+                        EncryptionAlgorithm.AES_128_CBC,

+                        ivps);

+

+                if (pop_encryptedData == null) {

+                    msg = method + "pop_encryptedData null";

                     CMS.debug(msg);

                     throw new EBaseException(msg);

                 }

-                byte[] pop_sysPubEncreyptedSession = CryptoUtil.wrapUsingPublicKey(

-                        token, issuanceProtPubKey, symKey);

-                if (pop_sysPubEncreyptedSession == null) {

-                    msg = method + "pop_sysPubEncreyptedSession null";

+                byte[] pop_sysPubEncryptedSession =  CryptoUtil.wrapUsingPublicKey(

+                        token,

+                        issuanceProtPubKey,

+                        symKey,

+                        KeyWrapAlgorithm.RSA);

+

+                if (pop_sysPubEncryptedSession == null) {

+                    msg = method + "pop_sysPubEncryptedSession null";

                     CMS.debug(msg);

                     throw new EBaseException(msg);

                 }

-                byte[] pop_userPubEncreyptedSession = CryptoUtil.wrapUsingPublicKey(

-                        token, userPubKey, symKey);

-                if (pop_userPubEncreyptedSession == null) {

-                    msg = method + "pop_userPubEncreyptedSession null";

+

+                byte[] pop_userPubEncryptedSession = CryptoUtil.wrapUsingPublicKey(

+                        token,

+                        userPubKey,

+                        symKey,

+                        KeyWrapAlgorithm.RSA);

+

+                if (pop_userPubEncryptedSession == null) {

+                    msg = method + "pop_userPubEncryptedSession null";

                     CMS.debug(msg);

                     throw new EBaseException(msg);

                 }

                 CMS.debug(method + "POP challenge fields generated successfully...setting request extData");

-                req.setExtData("pop_encreyptedData", pop_encreyptedData);

+                req.setExtData("pop_encryptedData", pop_encryptedData);

-                req.setExtData("pop_sysPubEncreyptedSession", pop_sysPubEncreyptedSession);

+                req.setExtData("pop_sysPubEncryptedSession", pop_sysPubEncryptedSession);

-                req.setExtData("pop_userPubEncreyptedSession", pop_userPubEncreyptedSession);

+                req.setExtData("pop_userPubEncryptedSession", pop_userPubEncryptedSession);

                 // now compute and set witness

                 CMS.debug(method + "now compute and set witness");

@@ -1038,19 +1066,19 @@ public abstract class EnrollProfile extends BasicProfile

         }

         // now verify the POP witness

-        byte[] pop_encreyptedData = req.getExtDataInByteArray("pop_encreyptedData");

-        if (pop_encreyptedData == null) {

+        byte[] pop_encryptedData = req.getExtDataInByteArray("pop_encryptedData");

+        if (pop_encryptedData == null) {

             msg = method +

-                    "pop_encreyptedData not found in request:" +

+                    "pop_encryptedData not found in request:" +

                     reqId.toString();

             CMS.debug(msg);

             return null;

         }

-        byte[] pop_sysPubEncreyptedSession = req.getExtDataInByteArray("pop_sysPubEncreyptedSession");

-        if (pop_sysPubEncreyptedSession == null) {

+        byte[] pop_sysPubEncryptedSession = req.getExtDataInByteArray("pop_sysPubEncryptedSession");

+        if (pop_sysPubEncryptedSession == null) {

             msg = method +

-                    "pop_sysPubEncreyptedSession not found in request:" +

+                    "pop_sysPubEncryptedSession not found in request:" +

                     reqId.toString();

             CMS.debug(msg);

             return null;

@@ -1082,17 +1110,31 @@ public abstract class EnrollProfile extends BasicProfile

             SymmetricKey symKey = CryptoUtil.unwrap(

                     token,

+                    SymmetricKey.AES,

+                    128,

                     SymmetricKey.Usage.DECRYPT,

                     issuanceProtPrivKey,

-                    pop_sysPubEncreyptedSession);

+                    pop_sysPubEncryptedSession,

+                    KeyWrapAlgorithm.RSA);

+

             if (symKey == null) {

                 msg = "symKey null after CryptoUtil.unwrap returned";

                 CMS.debug(msg);

                 return null;

             }

+            // TODO(alee) The code below should be replaced by code that gets the IV from the Pop request

+            // This IV is supposed to be random

+            byte[] iv = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };

+            IVParameterSpec default_iv = new IVParameterSpec(iv);

+

             byte[] challenge_b = CryptoUtil.decryptUsingSymmetricKey(

-                    token, pop_encreyptedData, symKey);

+                    token,

+                    default_iv,

+                    pop_encryptedData,

+                    symKey,

+                    EncryptionAlgorithm.AES_128_CBC);

+

             if (challenge_b == null) {

                 msg = method + "challenge_b null after decryptUsingSymmetricKey returned";

                 CMS.debug(msg);

@@ -1596,23 +1638,16 @@ public abstract class EnrollProfile extends BasicProfile

                     witness_bytes,

                     hashAlg, macAlg);

-            String authMgrID =

-                    (String) sessionContext.get(SessionContext.AUTH_MANAGER_ID);

             String auditSubjectID = null;

             if (verified) {

-                // update auditSubjectID

-                if (sessionContext != null) {

-                    auditSubjectID = (String)

-                            sessionContext.get(SessionContext.USER_ID);

-                    CMS.debug(method + "current auditSubjectID was:"+ auditSubjectID);

-                    CMS.debug(method + "identity verified. Updating auditSubjectID");

-                    CMS.debug(method + "updated auditSubjectID is:"+ ident_string);

-                    auditSubjectID = ident_string;

-                    sessionContext.put(SessionContext.USER_ID, auditSubjectID);

-                } else { //very unlikely

-                    CMS.debug(method + "sessionContext null; cannot update auditSubjectID");

-                }

+                auditSubjectID = (String)

+                        sessionContext.get(SessionContext.USER_ID);

+                CMS.debug(method + "current auditSubjectID was:"+ auditSubjectID);

+                CMS.debug(method + "identity verified. Updating auditSubjectID");

+                CMS.debug(method + "updated auditSubjectID is:"+ ident_string);

+                auditSubjectID = ident_string;

+                sessionContext.put(SessionContext.USER_ID, auditSubjectID);

                 auditMessage = CMS.getLogMessage(

                         AuditEvent.CMC_PROOF_OF_IDENTIFICATION,

diff --git a/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java b/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java

index c130a1e..8e47298 100644

--- a/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java

+++ b/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java

@@ -43,6 +43,7 @@ import org.mozilla.jss.asn1.SEQUENCE;

 import org.mozilla.jss.asn1.SET;

 import org.mozilla.jss.asn1.UTF8String;

 import org.mozilla.jss.crypto.DigestAlgorithm;

+import org.mozilla.jss.crypto.EncryptionAlgorithm;

 import org.mozilla.jss.crypto.SignatureAlgorithm;

 import org.mozilla.jss.pkcs11.PK11PubKey;

 import org.mozilla.jss.pkix.cert.Certificate;

@@ -433,10 +434,7 @@ public class CMCOutputTemplate {

             ResponseBody respBody = new ResponseBody(controlSeq,

                     cmsSeq, otherMsgSeq);

-            if (respBody != null)

-                CMS.debug(method + " after new ResponseBody, respBody not null");

-            else

-                CMS.debug(method + " after new ResponseBody, respBody null");

+            CMS.debug(method + " after new ResponseBody, respBody not null");

             ContentInfo contentInfo = getContentInfo(respBody, certs);

             ByteArrayOutputStream fos = new ByteArrayOutputStream();

@@ -489,30 +487,25 @@ public class CMCOutputTemplate {

         CMS.debug(method + "popChallengeRequired true");

         byte[] cmc_msg = req.getExtDataInByteArray(IEnrollProfile.CTX_CERT_REQUEST);

-        byte[] pop_encreyptedData = req.getExtDataInByteArray("pop_encreyptedData");

+        byte[] pop_encryptedData = req.getExtDataInByteArray("pop_encryptedData");

         //don't need this for encryptedPOP, but need to check for existence anyway

-        byte[] pop_sysPubEncreyptedSession = req.getExtDataInByteArray("pop_sysPubEncreyptedSession");

-        byte[] pop_userPubEncreyptedSession = req.getExtDataInByteArray("pop_userPubEncreyptedSession");

-        if ((pop_encreyptedData != null) &&

-                (pop_sysPubEncreyptedSession != null) &&

-                (pop_userPubEncreyptedSession != null)) {

+        byte[] pop_sysPubEncryptedSession = req.getExtDataInByteArray("pop_sysPubEncryptedSession");

+        byte[] pop_userPubEncryptedSession = req.getExtDataInByteArray("pop_userPubEncryptedSession");

+        if ((pop_encryptedData != null) &&

+                (pop_sysPubEncryptedSession != null) &&

+                (pop_userPubEncryptedSession != null)) {

             // generate encryptedPOP here

             // algs are hard-coded for now

             try {

                 EnvelopedData envData = CryptoUtil.createEnvelopedData(

-                        pop_encreyptedData,

-                        pop_userPubEncreyptedSession);

+                        pop_encryptedData,

+                        pop_userPubEncryptedSession);

                 if (envData == null) {

                     msg = "envData null returned by createEnvelopedData";

                     throw new EBaseException(method + msg);

                 }

                 ContentInfo ci = new ContentInfo(envData);

-                if (ci == null) {

-                    msg = "ci null from new ContentInfo";

-                    CMS.debug(msg);

-                    throw new EBaseException(method + msg);

-                }

                 CMS.debug(method + "now we can compose encryptedPOP");

                 TaggedRequest.Template tReqTemplate = new TaggedRequest.Template();

@@ -524,17 +517,18 @@ public class CMCOutputTemplate {

                     throw new EBaseException(method + msg);

                 }

+                // TODO(alee) The code below should be replaced by code that generates a random IV

+                byte[] default_iv = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };

+

+                OBJECT_IDENTIFIER oid = EncryptionAlgorithm.AES_128_CBC.toOID();

+                AlgorithmIdentifier aid = new AlgorithmIdentifier(oid, new OCTET_STRING(default_iv));

+

                 encPop = new EncryptedPOP(

                         tReq,

                         ci,

-                        CryptoUtil.getDefaultEncAlg(),

+                        aid,

                         CryptoUtil.getDefaultHashAlg(),

                         new OCTET_STRING(req.getExtDataInByteArray("pop_witness")));

-                if (encPop == null) {

-                    msg = "encPop null returned by new EncryptedPOP";

-                    CMS.debug(msg);

-                    throw new EBaseException(method + msg);

-                }

             } catch (Exception e) {

                 CMS.debug(method + " excepton:" + e);

diff --git a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java

index 8b8c443..95b8f81 100644

--- a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java

+++ b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java

@@ -2572,15 +2572,15 @@ public class CryptoUtil {

             throw new Exception(method + msg);

         }

+        // TODO(alee) Replace the below with a random IV that is likely passed in

+        byte[] default_iv = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };

+        OBJECT_IDENTIFIER oid = EncryptionAlgorithm.AES_128_CBC.toOID();

+        AlgorithmIdentifier aid = new AlgorithmIdentifier(oid, new OCTET_STRING(default_iv));

+

         EncryptedContentInfo encCInfo = new EncryptedContentInfo(

                 ContentInfo.DATA,

-                getDefaultEncAlg(),

+                aid,

                 new OCTET_STRING(encContent));

-        if (encCInfo == null) {

-            msg = method + "encCInfo null from new EncryptedContentInfo";

-            System.out.println(msg);

-            throw new Exception(method + msg);

-        }

         Name name = new Name();

         name.addCommonName("unUsedIssuerName"); //unused; okay for cmc EncryptedPOP

@@ -2589,11 +2589,6 @@ public class CryptoUtil {

                 new IssuerAndSerialNumber(name, new INTEGER(0)), //unUsed

                 new AlgorithmIdentifier(RSA_ENCRYPTION, new NULL()),

                 new OCTET_STRING(encSymKey));

-        if (recipient == null) {

-            msg = method + "recipient null from new RecipientInfo";

-            System.out.println(msg);

-            throw new Exception(method + msg);

-        }

         SET recipients = new SET();

         recipients.addElement(recipient);

@@ -2615,77 +2610,14 @@ public class CryptoUtil {

      * the defaults

      */

-    private static byte default_iv[] = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };

-    private static IVParameterSpec default_IV = new IVParameterSpec(default_iv);

-

-    // this generates a temporary 128 bit AES symkey with defaults

-    public static SymmetricKey generateKey(CryptoToken token) throws Exception {

-        return generateKey(token,

-//TODO:                KeyGenAlgorithm.AES, 128,

-                KeyGenAlgorithm.DES3, 128 /*unused*/,

-                null, true);

-    }

-

-    // decryptUsingSymmetricKey with default algorithms

-    public static byte[] decryptUsingSymmetricKey(CryptoToken token, byte[] encryptedData, SymmetricKey wrappingKey) throws Exception {

-        return decryptUsingSymmetricKey(token, default_IV, encryptedData,

-                wrappingKey,

-                EncryptionAlgorithm.DES3_CBC_PAD);

-//TODO:                EncryptionAlgorithm.AES_128_CBC);

-    }

-

-    // encryptUsingSymmetricKey with default algorithms

-    public static byte[] encryptUsingSymmetricKey(CryptoToken token, SymmetricKey wrappingKey, byte[] data) throws Exception {

-        return encryptUsingSymmetricKey(

-                token,

-                wrappingKey,

-                data,

-                EncryptionAlgorithm.DES3_CBC_PAD,

-//TODO:                EncryptionAlgorithm.AES_128_CBC,

-                default_IV);

-    }

-

-    // wrapUsingPublicKey using default algorithm

-    public static byte[] wrapUsingPublicKey(CryptoToken token, PublicKey wrappingKey, SymmetricKey data) throws Exception {

-        return wrapUsingPublicKey(token, wrappingKey, data, KeyWrapAlgorithm.RSA);

-    }

-

-    // unwrap sym key using default algorithms

-    public static SymmetricKey unwrap(CryptoToken token, SymmetricKey.Usage usage, PrivateKey wrappingKey, byte[] wrappedSymKey) throws Exception {

-        return unwrap(

-               token,

-//TODO:               SymmetricKey.AES,

-               SymmetricKey.DES3,

-               0,

-               usage,

-               wrappingKey,

-               wrappedSymKey,

-               getDefaultKeyWrapAlg());

-    }

-

-    public static AlgorithmIdentifier getDefaultEncAlg()

-           throws Exception {

-        OBJECT_IDENTIFIER oid =

-                EncryptionAlgorithm.DES3_CBC.toOID();

-//TODO:                EncryptionAlgorithm.AES_128_CBC.toOID();

-

-        AlgorithmIdentifier aid =

-                new AlgorithmIdentifier(oid, new OCTET_STRING(default_iv));

-        return aid;

-    }

-

     public static String getDefaultHashAlgName() {

         return ("SHA-256");

     }

-    public static KeyWrapAlgorithm getDefaultKeyWrapAlg() {

-        return KeyWrapAlgorithm.RSA;

-    }

-

     public static AlgorithmIdentifier getDefaultHashAlg()

            throws Exception {

         AlgorithmIdentifier hashAlg;

-            hashAlg = new AlgorithmIdentifier(CryptoUtil.getHashAlgorithmOID("SHA-256"));

+            hashAlg = new AlgorithmIdentifier(CryptoUtil.getHashAlgorithmOID(getDefaultHashAlgName()));

         return hashAlg;

     }

@@ -2768,8 +2700,6 @@ public class CryptoUtil {

      */

     public static String getNameFromHashAlgorithm(AlgorithmIdentifier ai)

            throws NoSuchAlgorithmException {

-        OBJECT_IDENTIFIER oid = null;

-

         System.out.println("CryptoUtil: getNameFromHashAlgorithm: " + ai.getOID().toString());

         if (ai != null) {

             if (ai.getOID().equals((DigestAlgorithm.SHA256).toOID())) {

-- 

1.8.3.1

From 772e05e746570c13afeb60516c07a3fb95ca3e78 Mon Sep 17 00:00:00 2001

From: "Endi S. Dewata" <edewata@redhat.com>

Date: Thu, 1 Jun 2017 23:38:04 +0200

Subject: [PATCH 10/27] Removed superfluous deployment configuration backup.

The pkispawn has been modified to generate a temporary backup

file (instead of permanent and timestamped backup files) of the

deployment configuration file before normalizing its content.

The temporary backup will be removed automatically when the

normalization is complete.

https://pagure.io/dogtagpki/issue/2674

Change-Id: Ia541e23314acc120954fa574d1f6f885961c8047

---

 base/server/sbin/pkispawn | 7 +------

 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/base/server/sbin/pkispawn b/base/server/sbin/pkispawn

index 742f579..1aa7079 100755

--- a/base/server/sbin/pkispawn

+++ b/base/server/sbin/pkispawn

@@ -34,8 +34,6 @@ try:

     import ldap

     import os

     import requests

-    import time

-    from time import strftime as date

     import traceback

     import pki

     from pki.server.deployment import pkiconfig as config

@@ -610,12 +608,9 @@ def main(argv):

 def sanitize_user_deployment_cfg(cfg):

-    # Generate a timestamp

-    ticks = time.time()

-    timestamp = date('%Y%m%d%H%M%S', time.localtime(ticks))

     # Correct any section headings in the user's configuration file

-    for line in fileinput.FileInput(cfg, inplace=1, backup='.' + timestamp):

+    for line in fileinput.FileInput(cfg, inplace=1):

         # Remove extraneous leading and trailing whitespace from all lines

         line = line.strip()

         # Normalize section headings to match '/etc/pki/default.cfg'

-- 

1.8.3.1

From f7b6305396581f5916498cc4ea8247596bf39aaf Mon Sep 17 00:00:00 2001

From: Matthew Harmsen <mharmsen@redhat.com>

Date: Fri, 2 Jun 2017 02:10:02 +0200

Subject: [PATCH 11/27] Fixed pylint issues

- https://pagure.io/dogtagpki/issue/2713 - Build failure due to Pylint issues

---

 base/common/python/pki/cli/pkcs12.py           |  4 ++--

 base/common/python/pki/encoder.py              | 12 ++++++------

 base/server/python/pki/server/cli/audit.py     |  8 ++++----

 base/server/python/pki/server/cli/ca.py        | 16 ++++++++--------

 base/server/python/pki/server/cli/db.py        |  8 ++++----

 base/server/python/pki/server/cli/kra.py       | 20 ++++++++++----------

 base/server/python/pki/server/cli/ocsp.py      |  4 ++--

 base/server/python/pki/server/cli/subsystem.py |  4 ++--

 base/server/python/pki/server/cli/tks.py       |  4 ++--

 base/server/python/pki/server/cli/tps.py       | 20 ++++++++++----------

 base/server/python/pki/server/upgrade.py       |  3 ---

 11 files changed, 50 insertions(+), 53 deletions(-)

diff --git a/base/common/python/pki/cli/pkcs12.py b/base/common/python/pki/cli/pkcs12.py

index 8934d33..6b99fcf 100644

--- a/base/common/python/pki/cli/pkcs12.py

+++ b/base/common/python/pki/cli/pkcs12.py

@@ -62,10 +62,10 @@ class PKCS12ImportCLI(pki.cli.CLI):

         print('      --help                         Show help message.')

         print()

-    def execute(self, args):

+    def execute(self, argv):

         try:

-            opts, _ = getopt.gnu_getopt(args, 'v', [

+            opts, _ = getopt.gnu_getopt(argv, 'v', [

                 'pkcs12-file=', 'pkcs12-password=', 'pkcs12-password-file=',

                 'no-trust-flags', 'no-user-certs', 'no-ca-certs', 'overwrite',

                 'verbose', 'debug', 'help'])

diff --git a/base/common/python/pki/encoder.py b/base/common/python/pki/encoder.py

index 8485ab8..d3298bc 100644

--- a/base/common/python/pki/encoder.py

+++ b/base/common/python/pki/encoder.py

@@ -82,14 +82,14 @@ class CustomTypeEncoder(json.JSONEncoder):

     """

     # pylint: disable=E0202