websms/freeipa
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Imported Debian patch 4.0.5-6~numeezy

Browse Source
This commit is contained in:
Alexandre Ellert
2016-02-17 15:07:45 +01:00
committed by Mario Fetka
parent c44de33144
commit 10dfc9587b
1203 changed files with 53869 additions and 241462 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
install/certmonger/Makefile.am
View File

@@ -3,7 +3,6 @@ NULL =
appdir = $(libexecdir)/certmonger/
app_SCRIPTS = \
dogtag-ipa-ca-renew-agent-submit \
ipa-server-guard \
$(NULL)
EXTRA_DIST = \

23
install/certmonger/Makefile.in
View File

@@ -1,7 +1,7 @@
# Makefile.in generated by automake 1.15 from Makefile.am.
# Makefile.in generated by automake 1.14.1 from Makefile.am.
# @configure_input@
# Copyright (C) 1994-2014 Free Software Foundation, Inc.
# Copyright (C) 1994-2013 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
@@ -15,17 +15,7 @@
@SET_MAKE@
VPATH = @srcdir@
am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
false; \
elif test -n '$(MAKE_HOST)'; then \
true; \
elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
true; \
else \
false; \
fi; \
}
am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
am__make_running_with_option = \
case $${target_option-} in \
?) ;; \
@@ -87,12 +77,12 @@ NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
subdir = certmonger
DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/config.h
CONFIG_CLEAN_FILES =
@@ -146,7 +136,6 @@ am__can_run_installinfo = \
*) (install-info --version) >/dev/null 2>&1;; \
esac
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
am__DIST_COMMON = $(srcdir)/Makefile.in
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
@@ -237,7 +226,6 @@ NULL =
appdir = $(libexecdir)/certmonger/
app_SCRIPTS = \
dogtag-ipa-ca-renew-agent-submit \
ipa-server-guard \
$(NULL)
EXTRA_DIST = \
@@ -263,6 +251,7 @@ $(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__confi
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign certmonger/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --foreign certmonger/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
@@ -470,8 +459,6 @@ uninstall-am: uninstall-appSCRIPTS
pdf-am ps ps-am tags-am uninstall uninstall-am \
uninstall-appSCRIPTS
.PRECIOUS: Makefile
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.

278
install/certmonger/dogtag-ipa-ca-renew-agent-submit
View File

@@ -19,8 +19,6 @@
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
from __future__ import print_function
import os
# Prevent garbage from readline on standard output
# (see https://fedorahosted.org/freeipa/ticket/4064)
@@ -33,9 +31,6 @@ import tempfile
import shutil
import base64
import contextlib
import json
import six
from ipapython import ipautil
from ipapython.dn import DN
@@ -58,92 +53,23 @@ UNCONFIGURED = 4
WAIT_WITH_DELAY = 5
OPERATION_NOT_SUPPORTED_BY_HELPER = 6
if six.PY3:
unicode = str
@contextlib.contextmanager
def ldap_connect():
conn = None
tmpdir = tempfile.mkdtemp(prefix="tmp-")
try:
conn = ldap2(api)
conn.connect(ccache=os.environ['KRB5CCNAME'])
principal = str('host/%s@%s' % (api.env.host, api.env.realm))
ccache = ipautil.kinit_hostprincipal(paths.KRB5_KEYTAB, tmpdir,
principal)
conn = ldap2(shared_instance=False, ldap_uri=api.env.ldap_uri)
conn.connect(ccache=ccache)
yield conn
finally:
if conn is not None and conn.isconnected():
conn.disconnect()
def call_handler(_handler, *args, **kwargs):
"""
Request handler call wrapper
Before calling the handler, get the original profile name and cookie from
the provided cookie, if there is one. If the profile name does not match
the requested profile name, drop the cookie and restart the request.
After calling the handler, put the requested profile name and cookie
returned by the handler in a new cookie and return it.
"""
operation = os.environ['CERTMONGER_OPERATION']
if operation == 'POLL':
cookie = os.environ.pop('CERTMONGER_CA_COOKIE', None)
if cookie is not None:
try:
context = json.loads(cookie)
if not isinstance(context, dict):
raise TypeError
except (TypeError, ValueError):
return (UNCONFIGURED, "Invalid cookie: %r" % cookie)
else:
return (UNCONFIGURED, "Cookie not provided")
if 'profile' in context:
profile = context.pop('profile')
try:
if profile is not None:
if not isinstance(profile, unicode):
raise TypeError
profile = profile.encode('raw_unicode_escape')
except (TypeError, UnicodeEncodeError):
return (UNCONFIGURED,
"Invalid 'profile' in cookie: %r" % profile)
else:
return (UNCONFIGURED, "No 'profile' in cookie")
# If profile has changed between SUBMIT and POLL, restart request
if os.environ.get('CERTMONGER_CA_PROFILE') != profile:
os.environ['CERTMONGER_OPERATION'] = 'SUBMIT'
context = {}
if 'cookie' in context:
cookie = context.pop('cookie')
try:
if not isinstance(cookie, unicode):
raise TypeError
cookie = cookie.encode('raw_unicode_escape')
except (TypeError, UnicodeEncodeError):
return (UNCONFIGURED,
"Invalid 'cookie' in cookie: %r" % cookie)
os.environ['CERTMONGER_CA_COOKIE'] = cookie
else:
context = {}
result = _handler(*args, **kwargs)
if result[0] in (WAIT, WAIT_WITH_DELAY):
context['cookie'] = result[-1].decode('raw_unicode_escape')
profile = os.environ.get('CERTMONGER_CA_PROFILE')
if profile is not None:
profile = profile.decode('raw_unicode_escape')
context['profile'] = profile
cookie = json.dumps(context)
os.environ['CERTMONGER_CA_COOKIE'] = cookie
if result[0] in (WAIT, WAIT_WITH_DELAY):
result = result[:-1] + (cookie,)
return result
shutil.rmtree(tmpdir)
def request_cert():
"""
@@ -154,25 +80,15 @@ def request_cert():
path = paths.DOGTAG_IPA_RENEW_AGENT_SUBMIT
args = [path] + sys.argv[1:]
if os.environ.get('CERTMONGER_CA_PROFILE') == 'caCACert':
args += ['-N', '-O', 'bypassCAnotafter=true']
result = ipautil.run(args, raiseonerr=False, env=os.environ,
capture_output=True)
if six.PY2:
sys.stderr.write(result.raw_error_output)
else:
# Write bytes directly
sys.stderr.buffer.write(result.raw_error_output) #pylint: disable=no-member
stdout, stderr, rc = ipautil.run(args, raiseonerr=False, env=os.environ)
sys.stderr.write(stderr)
sys.stderr.flush()
syslog.syslog(syslog.LOG_NOTICE,
"dogtag-ipa-renew-agent returned %d" % result.returncode)
syslog.syslog(syslog.LOG_NOTICE, "dogtag-ipa-renew-agent returned %d" % rc)
stdout = result.output
if stdout.endswith('\n'):
stdout = stdout[:-1]
rc = result.returncode
if rc == WAIT_WITH_DELAY:
delay, sep, cookie = stdout.partition('\n')
return (rc, delay, cookie)
@@ -194,7 +110,7 @@ def store_cert():
try:
attempts = int(cookie)
except ValueError:
return (UNCONFIGURED, "Invalid cookie: %r" % cookie)
return (UNCONFIGURED, "Invalid cookie")
else:
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
@@ -229,13 +145,13 @@ def store_cert():
conn.add_entry(entry)
except errors.EmptyModlist:
pass
except Exception as e:
except Exception, e:
attempts += 1
if attempts < 10:
syslog.syslog(
syslog.LOG_ERR,
"Updating renewal certificate failed: %s. Sleeping 30s" % e)
return (WAIT_WITH_DELAY, 30, str(attempts))
return (WAIT_WITH_DELAY, 30, attempts)
else:
syslog.syslog(
syslog.LOG_ERR,
@@ -259,8 +175,7 @@ def request_and_store_cert():
state, sep, cookie = cookie.partition(':')
if state not in ('request', 'store'):
return (UNCONFIGURED,
"Invalid cookie: %r" % os.environ['CERTMONGER_CA_COOKIE'])
return (UNCONFIGURED, "Invalid cookie")
else:
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
@@ -270,7 +185,7 @@ def request_and_store_cert():
else:
os.environ['CERTMONGER_CA_COOKIE'] = cookie
result = call_handler(request_cert)
result = request_cert()
if result[0] == WAIT:
return (result[0], 'request:%s' % result[1])
elif result[0] == WAIT_WITH_DELAY:
@@ -289,7 +204,7 @@ def request_and_store_cert():
os.environ['CERTMONGER_CA_COOKIE'] = cookie
os.environ['CERTMONGER_CERTIFICATE'] = cert
result = call_handler(store_cert)
result = store_cert()
if result[0] == WAIT:
return (result[0], 'store:%s:%s' % (cert, result[1]))
elif result[0] == WAIT_WITH_DELAY:
@@ -297,10 +212,9 @@ def request_and_store_cert():
else:
return result
def retrieve_or_reuse_cert():
def retrieve_cert():
"""
Retrieve certificate from LDAP. If the certificate is not available, reuse
the old certificate.
Retrieve new certificate from LDAP.
"""
csr = os.environ.get('CERTMONGER_CSR')
if not csr:
@@ -310,9 +224,7 @@ def retrieve_or_reuse_cert():
if not nickname:
return (REJECTED, "No friendly name in the certificate request")
cert = os.environ.get('CERTMONGER_CERTIFICATE')
if not cert:
return (REJECTED, "New certificate requests not supported")
syslog.syslog(syslog.LOG_NOTICE, "Updating certificate for %s" % nickname)
with ldap_connect() as conn:
try:
@@ -321,45 +233,18 @@ def retrieve_or_reuse_cert():
('cn', 'ipa'), ('cn', 'etc'), api.env.basedn),
['usercertificate'])
except errors.NotFound:
pass
else:
cert = entry.single_value['usercertificate']
cert = base64.b64encode(cert)
cert = x509.make_pem(cert)
syslog.syslog(
syslog.LOG_INFO,
"Updated certificate for %s not available" % nickname)
# No cert available yet, tell certmonger to wait another 8 hours
return (WAIT_WITH_DELAY, 8 * 60 * 60)
cert = entry.single_value['usercertificate']
cert = base64.b64encode(cert)
cert = x509.make_pem(cert)
return (ISSUED, cert)
def retrieve_cert_continuous():
"""
Retrieve new certificate from LDAP. Repeat every eight hours until the
certificate is available.
"""
old_cert = os.environ.get('CERTMONGER_CERTIFICATE')
if old_cert:
old_cert = x509.normalize_certificate(old_cert)
result = call_handler(retrieve_or_reuse_cert)
if result[0] != ISSUED:
return result
new_cert = x509.normalize_certificate(result[1])
if new_cert == old_cert:
syslog.syslog(syslog.LOG_INFO, "Updated certificate not available")
# No cert available yet, tell certmonger to wait another 8 hours
return (WAIT_WITH_DELAY, 8 * 60 * 60, '')
return result
def retrieve_cert():
"""
Retrieve new certificate from LDAP.
"""
result = call_handler(retrieve_cert_continuous)
if result[0] == WAIT_WITH_DELAY:
return (REJECTED, "Updated certificate not available")
return result
def export_csr():
"""
This does not actually renew the cert, it just writes the CSR provided
@@ -381,106 +266,39 @@ def export_csr():
try:
with open(csr_file, 'wb') as f:
f.write(csr)
except Exception as e:
except Exception, e:
return (UNREACHABLE, "Failed to write %s: %s" % (csr_file, e))
return (ISSUED, cert)
def renew_ca_cert():
"""
This is used for automatic CA certificate renewal.
"""
cert = os.environ.get('CERTMONGER_CERTIFICATE')
if not cert:
return (REJECTED, "New certificate requests not supported")
is_self_signed = x509.is_self_signed(cert)
operation = os.environ.get('CERTMONGER_OPERATION')
if operation == 'SUBMIT':
state = 'retrieve'
if is_self_signed:
ca = cainstance.CAInstance(host_name=api.env.host, ldapi=False)
if ca.is_renewal_master():
state = 'request'
elif operation == 'POLL':
cookie = os.environ.get('CERTMONGER_CA_COOKIE')
if not cookie:
return (UNCONFIGURED, "Cookie not provided")
state, sep, cookie = cookie.partition(':')
if state not in ('retrieve', 'request'):
return (UNCONFIGURED,
"Invalid cookie: %r" % os.environ['CERTMONGER_CA_COOKIE'])
os.environ['CERTMONGER_CA_COOKIE'] = cookie
else:
return (OPERATION_NOT_SUPPORTED_BY_HELPER,)
if state == 'retrieve':
result = call_handler(retrieve_cert)
if result[0] == REJECTED and not is_self_signed:
syslog.syslog(syslog.LOG_ALERT,
"IPA CA certificate is about to expire, "
"use ipa-cacert-manage to renew it")
elif state == 'request':
profile = os.environ['CERTMONGER_CA_PROFILE']
os.environ['CERTMONGER_CA_PROFILE'] = 'caCACert'
result = call_handler(request_and_store_cert)
os.environ['CERTMONGER_CA_PROFILE'] = profile
if result[0] == WAIT:
return (result[0], '%s:%s' % (state, result[1]))
elif result[0] == WAIT_WITH_DELAY:
return (result[0], result[1], '%s:%s' % (state, result[2]))
else:
return result
def main():
handlers = {
'ipaStorage': store_cert,
'ipaRetrievalOrReuse': retrieve_or_reuse_cert,
'ipaRetrieval': retrieve_cert,
'ipaCSRExport': export_csr,
'ipaCACertRenewal': renew_ca_cert,
'ipaStorage': store_cert,
'ipaRetrieval': retrieve_cert,
'ipaCSRExport': export_csr,
}
api.bootstrap(context='renew')
api.finalize()
operation = os.environ.get('CERTMONGER_OPERATION')
if operation not in ('SUBMIT', 'POLL'):
return OPERATION_NOT_SUPPORTED_BY_HELPER
tmpdir = tempfile.mkdtemp(prefix="tmp-")
certs.renewal_lock.acquire()
try:
principal = str('host/%s@%s' % (api.env.host, api.env.realm))
ccache_filename = os.path.join(tmpdir, 'ccache')
os.environ['KRB5CCNAME'] = ccache_filename
ipautil.kinit_keytab(principal, paths.KRB5_KEYTAB, ccache_filename)
profile = os.environ.get('CERTMONGER_CA_PROFILE')
if profile:
handler = handlers.get(profile, request_and_store_cert)
profile = os.environ.get('CERTMONGER_CA_PROFILE')
if profile:
handler = handlers.get(profile, request_and_store_cert)
else:
ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
if ca.is_renewal_master():
handler = request_and_store_cert
else:
ca = cainstance.CAInstance(host_name=api.env.host, ldapi=False)
if ca.is_renewal_master():
handler = request_and_store_cert
else:
handler = retrieve_cert_continuous
handler = retrieve_cert
res = call_handler(handler)
for item in res[1:]:
print(item)
return res[0]
finally:
certs.renewal_lock.release()
shutil.rmtree(tmpdir)
res = handler()
for item in res[1:]:
print item
return res[0]
try:
sys.exit(main())
except Exception as e:
except Exception, e:
syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
print("Internal error")
print "Internal error"
sys.exit(UNREACHABLE)

63
install/certmonger/ipa-server-guard
View File

@@ -1,63 +0,0 @@
#!/usr/bin/python2 -E
#
# Authors:
# Jan Cholasta <jcholast@redhat.com>
#
# Copyright (C) 2015 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
from __future__ import print_function
import os
# Prevent garbage from readline on standard output
# (see https://fedorahosted.org/freeipa/ticket/4064)
if not os.isatty(1):
os.environ['TERM'] = 'dumb'
import sys
import syslog
import traceback
import six
from ipapython import ipautil
from ipaserver.install import certs
def main():
if len(sys.argv) < 2:
raise RuntimeError("Not enough arguments")
with certs.renewal_lock:
result = ipautil.run(sys.argv[1:], raiseonerr=False, env=os.environ)
if six.PY2:
sys.stdout.write(result.raw_output)
sys.stderr.write(result.raw_error_output)
else:
# Write bytes directly
sys.stdout.buffer.write(result.raw_output) #pylint: disable=no-member
sys.stderr.buffer.write(result.raw_error_output) #pylint: disable=no-member
sys.stdout.flush()
sys.stderr.flush()
return result.returncode
try:
sys.exit(main())
except Exception as e:
syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
print("Internal error")
sys.exit(3)