import certmonger-0.79.6-5.el8
This commit is contained in:
commit
94b42d705f
1
.certmonger.metadata
Normal file
1
.certmonger.metadata
Normal file
@ -0,0 +1 @@
|
||||
7eac3ce49718df4be8f47ec92ae3a951eb4ac435 SOURCES/certmonger-0.79.6.tar.gz
|
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
SOURCES/certmonger-0.79.6.tar.gz
|
@ -0,0 +1,293 @@
|
||||
From fd17f002b2f4150a1fddc2582a21c6c03933a28a Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Fri, 23 Feb 2018 10:43:44 -0500
|
||||
Subject: [PATCH] NSS crypto policy sets minimum RSA and DSA key size to 2048
|
||||
|
||||
Remove keys < 2048 for the NSS tests. This affects some of the
|
||||
OpenSSL tests as well where they run in a combined loop.
|
||||
|
||||
Where it was not invasive to do I left the 1024/1536 for OpenSSL.
|
||||
---
|
||||
tests/001-keyiread-dsa/expected.out | 6 +++---
|
||||
tests/001-keyiread-dsa/run.sh | 2 +-
|
||||
tests/001-keyiread-rsa/expected.out | 2 --
|
||||
tests/001-keyiread-rsa/run.sh | 2 +-
|
||||
tests/001-keyiread/expected.out | 2 --
|
||||
tests/001-keyiread/run.sh | 2 +-
|
||||
tests/002-keygen-rsa/expected.out | 6 ------
|
||||
tests/002-keygen-rsa/run.sh | 2 +-
|
||||
tests/002-keygen/expected.out | 18 ------------------
|
||||
tests/002-keygen/run.sh | 2 +-
|
||||
tests/003-csrgen-rsa/expected.out | 6 ------
|
||||
tests/003-csrgen-rsa/run.sh | 4 ++--
|
||||
tests/003-csrgen/expected.out | 8 --------
|
||||
tests/003-csrgen/run.sh | 4 ++--
|
||||
tests/004-selfsign-rsa/expected.out | 2 --
|
||||
tests/004-selfsign-rsa/run.sh | 2 +-
|
||||
tests/004-selfsign/expected.out | 2 --
|
||||
tests/004-selfsign/run.sh | 2 +-
|
||||
18 files changed, 14 insertions(+), 60 deletions(-)
|
||||
|
||||
diff --git a/tests/001-keyiread-dsa/expected.out b/tests/001-keyiread-dsa/expected.out
|
||||
index b09db0ae..50643176 100644
|
||||
--- a/tests/001-keyiread-dsa/expected.out
|
||||
+++ b/tests/001-keyiread-dsa/expected.out
|
||||
@@ -1,4 +1,4 @@
|
||||
-OK (DSA:1024).
|
||||
-OK (DSA:1024).
|
||||
-OK (DSA:1024).
|
||||
+OK (DSA:2048).
|
||||
+OK (DSA:2048).
|
||||
+OK (DSA:2048).
|
||||
Test complete.
|
||||
diff --git a/tests/001-keyiread-dsa/run.sh b/tests/001-keyiread-dsa/run.sh
|
||||
index 9f96b3bc..68f6d1c3 100755
|
||||
--- a/tests/001-keyiread-dsa/run.sh
|
||||
+++ b/tests/001-keyiread-dsa/run.sh
|
||||
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
||||
source "$srcdir"/functions
|
||||
initnssdb "$tmpdir"
|
||||
|
||||
-for size in 1024 ; do
|
||||
+for size in 2048 ; do
|
||||
# Generate a self-signed cert.
|
||||
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
||||
-s "cn=T$size" -c "cn=T$size" \
|
||||
diff --git a/tests/001-keyiread-rsa/expected.out b/tests/001-keyiread-rsa/expected.out
|
||||
index 727897d1..3daa51f2 100644
|
||||
--- a/tests/001-keyiread-rsa/expected.out
|
||||
+++ b/tests/001-keyiread-rsa/expected.out
|
||||
@@ -1,5 +1,3 @@
|
||||
-OK (RSA:1024).
|
||||
-OK (RSA:1536).
|
||||
OK (RSA:2048).
|
||||
OK (RSA:3072).
|
||||
OK (RSA:4096).
|
||||
diff --git a/tests/001-keyiread-rsa/run.sh b/tests/001-keyiread-rsa/run.sh
|
||||
index c7b77686..ec31c7c7 100755
|
||||
--- a/tests/001-keyiread-rsa/run.sh
|
||||
+++ b/tests/001-keyiread-rsa/run.sh
|
||||
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
||||
source "$srcdir"/functions
|
||||
initnssdb "$tmpdir"
|
||||
|
||||
-for size in 1024 1536 2048 3072 4096 ; do
|
||||
+for size in 2048 3072 4096 ; do
|
||||
# Generate a self-signed cert.
|
||||
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
||||
-s "cn=T$size" -c "cn=T$size" \
|
||||
diff --git a/tests/001-keyiread/expected.out b/tests/001-keyiread/expected.out
|
||||
index 727897d1..3daa51f2 100644
|
||||
--- a/tests/001-keyiread/expected.out
|
||||
+++ b/tests/001-keyiread/expected.out
|
||||
@@ -1,5 +1,3 @@
|
||||
-OK (RSA:1024).
|
||||
-OK (RSA:1536).
|
||||
OK (RSA:2048).
|
||||
OK (RSA:3072).
|
||||
OK (RSA:4096).
|
||||
diff --git a/tests/001-keyiread/run.sh b/tests/001-keyiread/run.sh
|
||||
index ce1428ed..0b31df95 100755
|
||||
--- a/tests/001-keyiread/run.sh
|
||||
+++ b/tests/001-keyiread/run.sh
|
||||
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
||||
source "$srcdir"/functions
|
||||
initnssdb "$tmpdir"
|
||||
|
||||
-for size in 1024 1536 2048 3072 4096 ; do
|
||||
+for size in 2048 3072 4096 ; do
|
||||
# Generate a self-signed cert.
|
||||
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
||||
-s "cn=T$size" -c "cn=T$size" \
|
||||
diff --git a/tests/002-keygen-rsa/expected.out b/tests/002-keygen-rsa/expected.out
|
||||
index 3e6e9f3c..f7c146d0 100644
|
||||
--- a/tests/002-keygen-rsa/expected.out
|
||||
+++ b/tests/002-keygen-rsa/expected.out
|
||||
@@ -1,9 +1,3 @@
|
||||
-[nss:1024]
|
||||
-OK.
|
||||
-OK (RSA:1024).
|
||||
-[nss:1536]
|
||||
-OK.
|
||||
-OK (RSA:1536).
|
||||
[nss:2048]
|
||||
OK.
|
||||
OK (RSA:2048).
|
||||
diff --git a/tests/002-keygen-rsa/run.sh b/tests/002-keygen-rsa/run.sh
|
||||
index 476f4127..c0c59249 100755
|
||||
--- a/tests/002-keygen-rsa/run.sh
|
||||
+++ b/tests/002-keygen-rsa/run.sh
|
||||
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
||||
source "$srcdir"/functions
|
||||
initnssdb "$tmpdir"
|
||||
|
||||
-for size in 1024 1536 2048 3072 4096 ; do
|
||||
+for size in 2048 3072 4096 ; do
|
||||
echo "[nss:$size]"
|
||||
# Generate a key.
|
||||
cat > entry.$size <<- EOF
|
||||
diff --git a/tests/002-keygen/expected.out b/tests/002-keygen/expected.out
|
||||
index dcd1af06..b8fbea56 100644
|
||||
--- a/tests/002-keygen/expected.out
|
||||
+++ b/tests/002-keygen/expected.out
|
||||
@@ -1,21 +1,3 @@
|
||||
-[nss:1024]
|
||||
-OK.
|
||||
-OK (RSA:1024).
|
||||
-OK.
|
||||
-OK (RSA:1024 after RSA:1024).
|
||||
-OK.
|
||||
-OK (RSA:1024 after RSA:1024).
|
||||
-keyi1024
|
||||
-keyi1024 (candidate (next))
|
||||
-[nss:1536]
|
||||
-OK.
|
||||
-OK (RSA:1536).
|
||||
-OK.
|
||||
-OK (RSA:1536 after RSA:1536).
|
||||
-OK.
|
||||
-OK (RSA:1536 after RSA:1536).
|
||||
-keyi1536
|
||||
-keyi1536 (candidate (next))
|
||||
[nss:2048]
|
||||
OK.
|
||||
OK (RSA:2048).
|
||||
diff --git a/tests/002-keygen/run.sh b/tests/002-keygen/run.sh
|
||||
index 08af1523..94230e6f 100755
|
||||
--- a/tests/002-keygen/run.sh
|
||||
+++ b/tests/002-keygen/run.sh
|
||||
@@ -7,7 +7,7 @@ scheme="${scheme:-dbm:}"
|
||||
source "$srcdir"/functions
|
||||
initnssdb "$scheme$tmpdir"
|
||||
|
||||
-for size in 1024 1536 2048 3072 4096 ; do
|
||||
+for size in 2048 3072 4096 ; do
|
||||
echo "[nss:$size]"
|
||||
# Generate a key.
|
||||
cat > entry.$size <<- EOF
|
||||
diff --git a/tests/003-csrgen-rsa/expected.out b/tests/003-csrgen-rsa/expected.out
|
||||
index c9dec729..def53fe4 100644
|
||||
--- a/tests/003-csrgen-rsa/expected.out
|
||||
+++ b/tests/003-csrgen-rsa/expected.out
|
||||
@@ -1,10 +1,4 @@
|
||||
pk12util: PKCS12 EXPORT SUCCESSFUL
|
||||
-1024 OK.
|
||||
-Signature OK
|
||||
-pk12util: PKCS12 EXPORT SUCCESSFUL
|
||||
-1536 OK.
|
||||
-Signature OK
|
||||
-pk12util: PKCS12 EXPORT SUCCESSFUL
|
||||
2048 OK.
|
||||
Signature OK
|
||||
pk12util: PKCS12 EXPORT SUCCESSFUL
|
||||
diff --git a/tests/003-csrgen-rsa/run.sh b/tests/003-csrgen-rsa/run.sh
|
||||
index 4cd84084..bb8ebecb 100755
|
||||
--- a/tests/003-csrgen-rsa/run.sh
|
||||
+++ b/tests/003-csrgen-rsa/run.sh
|
||||
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
||||
source "$srcdir"/functions
|
||||
initnssdb "$tmpdir"
|
||||
|
||||
-for size in 1024 1536 2048 3072 4096 ; do
|
||||
+for size in 2048 3072 4096 ; do
|
||||
# Build a self-signed certificate.
|
||||
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
||||
-s "cn=T$size" -c "cn=T$size" \
|
||||
@@ -147,7 +147,7 @@ iterate() {
|
||||
|
||||
iteration=1
|
||||
|
||||
-for size in 1024 ; do
|
||||
+for size in 2048 ; do
|
||||
iterate "$size" "$subject" "$hostname" "$email" "$principal" "$ku" "$eku" "$challengepassword" "$certfname" "$ca" "$capathlen" "$crldp" "$ocsp" "$nscomment"
|
||||
done
|
||||
|
||||
diff --git a/tests/003-csrgen/expected.out b/tests/003-csrgen/expected.out
|
||||
index 8e6cac6e..04342c0f 100644
|
||||
--- a/tests/003-csrgen/expected.out
|
||||
+++ b/tests/003-csrgen/expected.out
|
||||
@@ -1,13 +1,5 @@
|
||||
pk12util: PKCS12 EXPORT SUCCESSFUL
|
||||
Signature OK
|
||||
-minicert.openssl.1024.pem: OK
|
||||
-1024 OK.
|
||||
-pk12util: PKCS12 EXPORT SUCCESSFUL
|
||||
-Signature OK
|
||||
-minicert.openssl.1536.pem: OK
|
||||
-1536 OK.
|
||||
-pk12util: PKCS12 EXPORT SUCCESSFUL
|
||||
-Signature OK
|
||||
minicert.openssl.2048.pem: OK
|
||||
2048 OK.
|
||||
pk12util: PKCS12 EXPORT SUCCESSFUL
|
||||
diff --git a/tests/003-csrgen/run.sh b/tests/003-csrgen/run.sh
|
||||
index 7c169ed9..31466b5c 100755
|
||||
--- a/tests/003-csrgen/run.sh
|
||||
+++ b/tests/003-csrgen/run.sh
|
||||
@@ -5,7 +5,7 @@ cd "$tmpdir"
|
||||
source "$srcdir"/functions
|
||||
initnssdb "$tmpdir"
|
||||
|
||||
-for size in 1024 1536 2048 3072 4096 ; do
|
||||
+for size in 2048 3072 4096 ; do
|
||||
# Build a self-signed certificate.
|
||||
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
||||
-s "cn=T$size" -c "cn=T$size" \
|
||||
@@ -199,7 +199,7 @@ iterate() {
|
||||
|
||||
iteration=1
|
||||
|
||||
-for size in 1024 ; do
|
||||
+for size in 2048 ; do
|
||||
iterate "$size" "$subject" "$hostname" "$email" "$principal" "$ku" "$eku" "$challengepassword" "$certfname" "$ca" "$capathlen" "$crldp" "$ocsp" "$nscomment" "$subjectder" "$ipaddress" "$freshestcrl" "$no_ocsp_check" "$profile" "$ns_certtype"
|
||||
done
|
||||
|
||||
diff --git a/tests/004-selfsign-rsa/expected.out b/tests/004-selfsign-rsa/expected.out
|
||||
index dd5029ec..0eb84ef1 100644
|
||||
--- a/tests/004-selfsign-rsa/expected.out
|
||||
+++ b/tests/004-selfsign-rsa/expected.out
|
||||
@@ -1,5 +1,3 @@
|
||||
-1024 OK.
|
||||
-1536 OK.
|
||||
2048 OK.
|
||||
3072 OK.
|
||||
4096 OK.
|
||||
diff --git a/tests/004-selfsign-rsa/run.sh b/tests/004-selfsign-rsa/run.sh
|
||||
index 6f9285b6..c1dd4c80 100755
|
||||
--- a/tests/004-selfsign-rsa/run.sh
|
||||
+++ b/tests/004-selfsign-rsa/run.sh
|
||||
@@ -33,7 +33,7 @@ function setupca() {
|
||||
EOF
|
||||
}
|
||||
|
||||
-for size in 1024 1536 2048 3072 4096 ; do
|
||||
+for size in 2048 3072 4096 ; do
|
||||
# Build a self-signed certificate.
|
||||
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
||||
-s "cn=T$size" -c "cn=T$size" \
|
||||
diff --git a/tests/004-selfsign/expected.out b/tests/004-selfsign/expected.out
|
||||
index dd5029ec..0eb84ef1 100644
|
||||
--- a/tests/004-selfsign/expected.out
|
||||
+++ b/tests/004-selfsign/expected.out
|
||||
@@ -1,5 +1,3 @@
|
||||
-1024 OK.
|
||||
-1536 OK.
|
||||
2048 OK.
|
||||
3072 OK.
|
||||
4096 OK.
|
||||
diff --git a/tests/004-selfsign/run.sh b/tests/004-selfsign/run.sh
|
||||
index 7bb368ec..eb1df4ee 100755
|
||||
--- a/tests/004-selfsign/run.sh
|
||||
+++ b/tests/004-selfsign/run.sh
|
||||
@@ -43,7 +43,7 @@ function setupca() {
|
||||
EOF
|
||||
}
|
||||
|
||||
-for size in 1024 1536 2048 3072 4096 ; do
|
||||
+for size in 2048 3072 4096 ; do
|
||||
# Build a self-signed certificate.
|
||||
run_certutil -d "$tmpdir" -S -g $size -n keyi$size \
|
||||
-s "cn=T$size" -c "cn=T$size" \
|
||||
--
|
||||
2.16.2
|
||||
|
788
SOURCES/0002-Convert-tests-to-use-python3.patch
Normal file
788
SOURCES/0002-Convert-tests-to-use-python3.patch
Normal file
@ -0,0 +1,788 @@
|
||||
From 653cd0571fe92c9fd4323f93ff23b9720c00fd5f Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Tue, 31 Jul 2018 13:09:02 -0400
|
||||
Subject: [PATCH] Convert tests to use python3
|
||||
|
||||
---
|
||||
tests/028-dbus/expected.out | 32 +-
|
||||
tests/028-dbus/expected.out.nodsa | 22 +-
|
||||
tests/028-dbus/prequal.sh | 8 +-
|
||||
tests/028-dbus/run.sh | 9 +-
|
||||
tests/028-dbus/runsub.sh | 2 +-
|
||||
tests/028-dbus/simpleprop.py | 14 +-
|
||||
tests/028-dbus/walk.py | 392 ++++++++++----------
|
||||
tests/038-ms-v2-template/extract-extdata.py | 5 +-
|
||||
8 files changed, 243 insertions(+), 241 deletions(-)
|
||||
|
||||
diff --git a/tests/028-dbus/expected.out b/tests/028-dbus/expected.out
|
||||
index ca3179e..1d8bec4 100644
|
||||
--- a/tests/028-dbus/expected.out
|
||||
+++ b/tests/028-dbus/expected.out
|
||||
@@ -1,5 +1,3 @@
|
||||
-Certificate in file "${tmpdir}/test.crt" issued by CA and saved.
|
||||
-Certificate in file "${tmpdir}/test.crt" issued by CA and saved.
|
||||
[[ getcert ]]
|
||||
State MONITORING, stuck: no.
|
||||
Number of certificates and requests being tracked: 1.
|
||||
@@ -187,13 +185,13 @@ dbus.Array([dbus.ObjectPath('/org/fedorahosted/certmonger/cas/CA1'), dbus.Object
|
||||
dbus.Array([dbus.ObjectPath('/org/fedorahosted/certmonger/requests/Request2')], signature=dbus.Signature('o'))
|
||||
|
||||
[ /org/fedorahosted/certmonger: org.fedorahosted.certmonger.get_supported_key_types ]
|
||||
-dbus.Array([dbus.String(u'RSA'), dbus.String(u'DSA'), dbus.String(u'EC')], signature=dbus.Signature('s'))
|
||||
+dbus.Array([dbus.String('RSA'), dbus.String('DSA'), dbus.String('EC')], signature=dbus.Signature('s'))
|
||||
|
||||
[ /org/fedorahosted/certmonger: org.fedorahosted.certmonger.get_supported_key_storage ]
|
||||
-dbus.Array([dbus.String(u'NSSDB'), dbus.String(u'FILE')], signature=dbus.Signature('s'))
|
||||
+dbus.Array([dbus.String('NSSDB'), dbus.String('FILE')], signature=dbus.Signature('s'))
|
||||
|
||||
[ /org/fedorahosted/certmonger: org.fedorahosted.certmonger.get_supported_cert_storage ]
|
||||
-dbus.Array([dbus.String(u'NSSDB'), dbus.String(u'FILE')], signature=dbus.Signature('s'))
|
||||
+dbus.Array([dbus.String('NSSDB'), dbus.String('FILE')], signature=dbus.Signature('s'))
|
||||
|
||||
[ /org/fedorahosted/certmonger : org.fedorahosted.certmonger.remove_known_ca ]
|
||||
OK
|
||||
@@ -433,19 +431,19 @@ Buddy
|
||||
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_cert_info ]
|
||||
-(dbus.String(u'CN=$UUID,CN=Local Signing Authority'), dbus.String(u'$UUID'), dbus.String(u'CN=localhost'), dbus.Int64(tomorrow), dbus.Array([], signature=dbus.Signature('s')), dbus.Array([dbus.String(u'localhost')], signature=dbus.Signature('s')), dbus.Array([dbus.String(u'host/localhost@LOCALHOST')], signature=dbus.Signature('s')), dbus.Int64(9L), dbus.Array([dbus.String(u'1.3.6.1.5.5.7.3.1')], signature=dbus.Signature('s')))
|
||||
+(dbus.String('CN=$UUID,CN=Local Signing Authority'), dbus.String('$UUID'), dbus.String('CN=localhost'), dbus.Int64(tomorrow), dbus.Array([], signature=dbus.Signature('s')), dbus.Array([dbus.String('localhost')], signature=dbus.Signature('s')), dbus.Array([dbus.String('host/localhost@LOCALHOST')], signature=dbus.Signature('s')), dbus.Int64(9), dbus.Array([dbus.String('1.3.6.1.5.5.7.3.1')], signature=dbus.Signature('s')))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_cert_last_checked ]
|
||||
recently
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_cert_storage_info ]
|
||||
-(dbus.String(u'FILE'), dbus.String(u'$tmpdir/test.crt'))
|
||||
+(dbus.String('FILE'), dbus.String('$tmpdir/test.crt'))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_csr_data ]
|
||||
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_csr_info ]
|
||||
-(dbus.String(u'CN=localhost'), dbus.Array([], signature=dbus.Signature('s')), dbus.Array([dbus.String(u'localhost')], signature=dbus.Signature('s')), dbus.Array([dbus.String(u'host/localhost@LOCALHOST')], signature=dbus.Signature('s')), dbus.Int64(9L), dbus.Array([dbus.String(u'id-kp-serverAuth')], signature=dbus.Signature('s')))
|
||||
+(dbus.String('CN=localhost'), dbus.Array([], signature=dbus.Signature('s')), dbus.Array([dbus.String('localhost')], signature=dbus.Signature('s')), dbus.Array([dbus.String('host/localhost@LOCALHOST')], signature=dbus.Signature('s')), dbus.Int64(9), dbus.Array([dbus.String('id-kp-serverAuth')], signature=dbus.Signature('s')))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_key_pin ]
|
||||
|
||||
@@ -454,19 +452,19 @@ recently
|
||||
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_key_storage_info ]
|
||||
-(dbus.String(u'FILE'), dbus.String(u'$tmpdir/test.key'))
|
||||
+(dbus.String('FILE'), dbus.String('$tmpdir/test.key'))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_key_type_and_size ]
|
||||
-(dbus.String(u'RSA'), dbus.Int64(512L))
|
||||
+(dbus.String('RSA'), dbus.Int64(512))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_monitoring ]
|
||||
1
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_notification_info ]
|
||||
-(dbus.String(u'stdout'), dbus.String(u'daemon.notice'))
|
||||
+(dbus.String('stdout'), dbus.String('daemon.notice'))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_status ]
|
||||
-(dbus.String(u'MONITORING'), dbus.Boolean(False))
|
||||
+(dbus.String('MONITORING'), dbus.Boolean(False))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_ca ]
|
||||
/org/fedorahosted/certmonger/cas/CA1
|
||||
@@ -482,7 +480,7 @@ recently
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2 : org.fedorahosted.certmonger.request.modify ]
|
||||
1 on /org/fedorahosted/certmonger/requests/Request2
|
||||
-After setting template-eku to 1.2.3.4.5.6.7.8.9.10, we got dbus.Array([dbus.String(u'1.2.3.4.5.6.7.8.9.10')], signature=dbus.Signature('s'), variant_level=1)
|
||||
+After setting template-eku to 1.2.3.4.5.6.7.8.9.10, we got dbus.Array([dbus.String('1.2.3.4.5.6.7.8.9.10')], signature=dbus.Signature('s'), variant_level=1)
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.rekey ]
|
||||
1
|
||||
@@ -713,7 +711,7 @@ dbus.Array([], signature=dbus.Signature('s'))
|
||||
</node>
|
||||
|
||||
[ /org/fedorahosted/certmonger/cas/CA2: org.fedorahosted.certmonger.ca.get_config_file_path ]
|
||||
-$tmpdir/cas/20180327134236
|
||||
+$tmpdir/cas/date
|
||||
|
||||
[ /org/fedorahosted/certmonger/cas/CA2: org.fedorahosted.certmonger.ca.get_nickname ]
|
||||
SelfSign
|
||||
@@ -828,7 +826,7 @@ dbus.Array([], signature=dbus.Signature('s'))
|
||||
</node>
|
||||
|
||||
[ /org/fedorahosted/certmonger/cas/CA3: org.fedorahosted.certmonger.ca.get_config_file_path ]
|
||||
-$tmpdir/cas/20180327134236-1
|
||||
+$tmpdir/cas/date-1
|
||||
|
||||
[ /org/fedorahosted/certmonger/cas/CA3: org.fedorahosted.certmonger.ca.get_nickname ]
|
||||
IPA
|
||||
@@ -941,7 +939,7 @@ dbus.Array([], signature=dbus.Signature('s'))
|
||||
</node>
|
||||
|
||||
[ /org/fedorahosted/certmonger/cas/CA4: org.fedorahosted.certmonger.ca.get_config_file_path ]
|
||||
-$tmpdir/cas/20180327134236-2
|
||||
+$tmpdir/cas/date-2
|
||||
|
||||
[ /org/fedorahosted/certmonger/cas/CA4: org.fedorahosted.certmonger.ca.get_nickname ]
|
||||
certmaster
|
||||
@@ -1054,7 +1052,7 @@ dbus.Array([], signature=dbus.Signature('s'))
|
||||
</node>
|
||||
|
||||
[ /org/fedorahosted/certmonger/cas/CA5: org.fedorahosted.certmonger.ca.get_config_file_path ]
|
||||
-$tmpdir/cas/20180327134236-3
|
||||
+$tmpdir/cas/date-3
|
||||
|
||||
[ /org/fedorahosted/certmonger/cas/CA5: org.fedorahosted.certmonger.ca.get_nickname ]
|
||||
dogtag-ipa-renew-agent
|
||||
diff --git a/tests/028-dbus/expected.out.nodsa b/tests/028-dbus/expected.out.nodsa
|
||||
index a23af40..5082ee0 100644
|
||||
--- a/tests/028-dbus/expected.out.nodsa
|
||||
+++ b/tests/028-dbus/expected.out.nodsa
|
||||
@@ -187,13 +187,13 @@ dbus.Array([dbus.ObjectPath('/org/fedorahosted/certmonger/cas/CA1'), dbus.Object
|
||||
dbus.Array([dbus.ObjectPath('/org/fedorahosted/certmonger/requests/Request2')], signature=dbus.Signature('o'))
|
||||
|
||||
[ /org/fedorahosted/certmonger: org.fedorahosted.certmonger.get_supported_key_types ]
|
||||
-dbus.Array([dbus.String(u'RSA'), dbus.String(u'EC')], signature=dbus.Signature('s'))
|
||||
+dbus.Array([dbus.String('RSA'), dbus.String('EC')], signature=dbus.Signature('s'))
|
||||
|
||||
[ /org/fedorahosted/certmonger: org.fedorahosted.certmonger.get_supported_key_storage ]
|
||||
-dbus.Array([dbus.String(u'NSSDB'), dbus.String(u'FILE')], signature=dbus.Signature('s'))
|
||||
+dbus.Array([dbus.String('NSSDB'), dbus.String('FILE')], signature=dbus.Signature('s'))
|
||||
|
||||
[ /org/fedorahosted/certmonger: org.fedorahosted.certmonger.get_supported_cert_storage ]
|
||||
-dbus.Array([dbus.String(u'NSSDB'), dbus.String(u'FILE')], signature=dbus.Signature('s'))
|
||||
+dbus.Array([dbus.String('NSSDB'), dbus.String('FILE')], signature=dbus.Signature('s'))
|
||||
|
||||
[ /org/fedorahosted/certmonger : org.fedorahosted.certmonger.remove_known_ca ]
|
||||
OK
|
||||
@@ -432,19 +432,19 @@ Buddy
|
||||
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_cert_info ]
|
||||
-(dbus.String(u'CN=$UUID,CN=Local Signing Authority'), dbus.String(u'$UUID'), dbus.String(u'CN=localhost'), dbus.Int64(tomorrow), dbus.Array([], signature=dbus.Signature('s')), dbus.Array([dbus.String(u'localhost')], signature=dbus.Signature('s')), dbus.Array([dbus.String(u'host/localhost@LOCALHOST')], signature=dbus.Signature('s')), dbus.Int64(9L), dbus.Array([dbus.String(u'1.3.6.1.5.5.7.3.1')], signature=dbus.Signature('s')))
|
||||
+(dbus.String('CN=$UUID,CN=Local Signing Authority'), dbus.String('$UUID'), dbus.String('CN=localhost'), dbus.Int64(tomorrow), dbus.Array([], signature=dbus.Signature('s')), dbus.Array([dbus.String('localhost')], signature=dbus.Signature('s')), dbus.Array([dbus.String('host/localhost@LOCALHOST')], signature=dbus.Signature('s')), dbus.Int64(9), dbus.Array([dbus.String('1.3.6.1.5.5.7.3.1')], signature=dbus.Signature('s')))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_cert_last_checked ]
|
||||
recently
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_cert_storage_info ]
|
||||
-(dbus.String(u'FILE'), dbus.String(u'$tmpdir/test.crt'))
|
||||
+(dbus.String('FILE'), dbus.String('$tmpdir/test.crt'))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_csr_data ]
|
||||
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_csr_info ]
|
||||
-(dbus.String(u'CN=localhost'), dbus.Array([], signature=dbus.Signature('s')), dbus.Array([dbus.String(u'localhost')], signature=dbus.Signature('s')), dbus.Array([dbus.String(u'host/localhost@LOCALHOST')], signature=dbus.Signature('s')), dbus.Int64(9L), dbus.Array([dbus.String(u'id-kp-serverAuth')], signature=dbus.Signature('s')))
|
||||
+(dbus.String('CN=localhost'), dbus.Array([], signature=dbus.Signature('s')), dbus.Array([dbus.String('localhost')], signature=dbus.Signature('s')), dbus.Array([dbus.String('host/localhost@LOCALHOST')], signature=dbus.Signature('s')), dbus.Int64(9), dbus.Array([dbus.String('id-kp-serverAuth')], signature=dbus.Signature('s')))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_key_pin ]
|
||||
|
||||
@@ -453,19 +453,19 @@ recently
|
||||
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_key_storage_info ]
|
||||
-(dbus.String(u'FILE'), dbus.String(u'$tmpdir/test.key'))
|
||||
+(dbus.String('FILE'), dbus.String('$tmpdir/test.key'))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_key_type_and_size ]
|
||||
-(dbus.String(u'RSA'), dbus.Int64(512L))
|
||||
+(dbus.String('RSA'), dbus.Int64(512))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_monitoring ]
|
||||
1
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_notification_info ]
|
||||
-(dbus.String(u'stdout'), dbus.String(u'daemon.notice'))
|
||||
+(dbus.String('stdout'), dbus.String('daemon.notice'))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_status ]
|
||||
-(dbus.String(u'MONITORING'), dbus.Boolean(False))
|
||||
+(dbus.String('MONITORING'), dbus.Boolean(False))
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.get_ca ]
|
||||
/org/fedorahosted/certmonger/cas/CA1
|
||||
@@ -481,7 +481,7 @@ recently
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2 : org.fedorahosted.certmonger.request.modify ]
|
||||
1 on /org/fedorahosted/certmonger/requests/Request2
|
||||
-After setting template-eku to 1.2.3.4.5.6.7.8.9.10, we got dbus.Array([dbus.String(u'1.2.3.4.5.6.7.8.9.10')], signature=dbus.Signature('s'), variant_level=1)
|
||||
+After setting template-eku to 1.2.3.4.5.6.7.8.9.10, we got dbus.Array([dbus.String('1.2.3.4.5.6.7.8.9.10')], signature=dbus.Signature('s'), variant_level=1)
|
||||
|
||||
[ /org/fedorahosted/certmonger/requests/Request2: org.fedorahosted.certmonger.request.rekey ]
|
||||
1
|
||||
diff --git a/tests/028-dbus/prequal.sh b/tests/028-dbus/prequal.sh
|
||||
index e645c19..4fe79c8 100755
|
||||
--- a/tests/028-dbus/prequal.sh
|
||||
+++ b/tests/028-dbus/prequal.sh
|
||||
@@ -9,19 +9,19 @@ if test -z "$DBUSDAEMON" ; then
|
||||
echo dbus-daemon not found
|
||||
exit 1
|
||||
fi
|
||||
-if ! python -c 'import os' 2> /dev/null ; then
|
||||
+if ! python3 -c 'import os' 2> /dev/null ; then
|
||||
echo python not found
|
||||
exit 1
|
||||
fi
|
||||
-if ! python -c 'import dbus' 2> /dev/null ; then
|
||||
+if ! python3 -c 'import dbus' 2> /dev/null ; then
|
||||
echo python-dbus not found
|
||||
exit 1
|
||||
fi
|
||||
-if ! python -c 'import xml' 2> /dev/null ; then
|
||||
+if ! python3 -c 'import xml' 2> /dev/null ; then
|
||||
echo python-xml not found
|
||||
exit 1
|
||||
fi
|
||||
-if ! python -c 'import xml.etree.ElementTree' 2> /dev/null ; then
|
||||
+if ! python3 -c 'import xml.etree.ElementTree' 2> /dev/null ; then
|
||||
echo python-xml does not include etree.ElementTree
|
||||
exit 1
|
||||
fi
|
||||
diff --git a/tests/028-dbus/run.sh b/tests/028-dbus/run.sh
|
||||
index c468d51..ee90875 100755
|
||||
--- a/tests/028-dbus/run.sh
|
||||
+++ b/tests/028-dbus/run.sh
|
||||
@@ -23,7 +23,7 @@ EOF
|
||||
$DBUSDAEMON --session --print-address=3 --print-pid=4 --fork 3> $tmpdir/address 4> $tmpdir/pid
|
||||
if test -s $tmpdir/pid ; then
|
||||
env DBUS_SESSION_BUS_ADDRESS=`cat $tmpdir/address` \
|
||||
- $toolsdir/../../src/certmonger-session -n -c $tmpdir/runsub.sh
|
||||
+ $toolsdir/../../src/certmonger-session -n -c $tmpdir/runsub.sh > /dev/null
|
||||
fi
|
||||
kill `cat $tmpdir/pid`
|
||||
|
||||
@@ -33,8 +33,8 @@ now=`date +%s`
|
||||
for i in `seq 240` ; do
|
||||
recently=$(($now-$i))
|
||||
tomorrow=$(($now-$i+24*60*60))
|
||||
- sed -i -e s/^$recently'$/recently/g' -e s/"("$recently"L)"/'(recently)'/g \
|
||||
- -e s/^$tomorrow'$/tomorrow/g' -e s/"("$tomorrow"L)"/'(tomorrow)'/g $tmpdir/runsub.out
|
||||
+ sed -i -e s/^$recently'$/recently/g' -e s/"("$recently")"/'(recently)'/g \
|
||||
+ -e s/^$tomorrow'$/tomorrow/g' -e s/"("$tomorrow")"/'(tomorrow)'/g $tmpdir/runsub.out
|
||||
done
|
||||
|
||||
cat $tmpdir/runsub.out | \
|
||||
@@ -43,4 +43,5 @@ sed -r -e 's,CN=........-........-........-........,CN=$UUID,g' \
|
||||
-e "s|$libexecdir|\$libexecdir|g" \
|
||||
-e "s|$tmpdir|\$tmpdir|g" \
|
||||
-e "s|expires:.*|expires: sometime|g" \
|
||||
- -e "s|u'(00)?[0-9a-fA-F]{32}|u'"'$UUID|g'
|
||||
+ -e "s|'(00)?[0-9a-fA-F]{32}|'"'$UUID|g' \
|
||||
+ -e "s|cas\/[0-9]{14}|cas\/date|g"
|
||||
diff --git a/tests/028-dbus/runsub.sh b/tests/028-dbus/runsub.sh
|
||||
index 3510d79..fe6766c 100755
|
||||
--- a/tests/028-dbus/runsub.sh
|
||||
+++ b/tests/028-dbus/runsub.sh
|
||||
@@ -22,5 +22,5 @@ echo ""
|
||||
echo "[[ API ]]"
|
||||
for i in ./*.py ; do
|
||||
echo "[" `basename "$i"` "]"
|
||||
- python $i
|
||||
+ python3 $i
|
||||
done
|
||||
diff --git a/tests/028-dbus/simpleprop.py b/tests/028-dbus/simpleprop.py
|
||||
index e4f937e..35d9591 100644
|
||||
--- a/tests/028-dbus/simpleprop.py
|
||||
+++ b/tests/028-dbus/simpleprop.py
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python
|
||||
+#!/usr/bin/python3
|
||||
import dbus
|
||||
|
||||
# Get a handle for the main certmonger interface.
|
||||
@@ -19,7 +19,7 @@ ca = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
|
||||
# Toggle the helper a couple of times.
|
||||
ca_ext_h = o.Get('org.fedorahosted.certmonger.ca', 'external-helper')
|
||||
-print ca_ext_h, "->",
|
||||
+print(ca_ext_h, "-> ", end='')
|
||||
|
||||
if ca_ext_h.split()[0] == ca_ext_h:
|
||||
ca_ext_h += ' -k admin@localhost'
|
||||
@@ -28,7 +28,7 @@ else:
|
||||
ca.Set('org.fedorahosted.certmonger.ca', 'external-helper', ca_ext_h)
|
||||
|
||||
ca_ext_h = o.Get('org.fedorahosted.certmonger.ca', 'external-helper')
|
||||
-print ca_ext_h, "->",
|
||||
+print(ca_ext_h, "-> ", end='')
|
||||
|
||||
if ca_ext_h.split()[0] == ca_ext_h:
|
||||
ca_ext_h += ' -k admin@localhost'
|
||||
@@ -37,20 +37,20 @@ else:
|
||||
ca.Set('org.fedorahosted.certmonger.ca', 'external-helper', ca_ext_h)
|
||||
|
||||
ca_ext_h = o.Get('org.fedorahosted.certmonger.ca', 'external-helper')
|
||||
-print ca_ext_h
|
||||
+print(ca_ext_h)
|
||||
|
||||
# Toggle the "is-default" value a couple of times.
|
||||
isdef = ca.Get('org.fedorahosted.certmonger.ca', 'is-default')
|
||||
-print isdef, "->",
|
||||
+print(isdef, "-> ", end='')
|
||||
|
||||
ca.Set('org.fedorahosted.certmonger.ca', 'is-default', not isdef)
|
||||
|
||||
isdef = ca.Get('org.fedorahosted.certmonger.ca', 'is-default')
|
||||
-print isdef, "->",
|
||||
+print(isdef, "-> ", end='')
|
||||
|
||||
ca.Set('org.fedorahosted.certmonger.ca', 'is-default', not isdef)
|
||||
|
||||
isdef = ca.Get('org.fedorahosted.certmonger.ca', 'is-default')
|
||||
-print isdef
|
||||
+print(isdef)
|
||||
|
||||
cm.remove_known_ca(path)
|
||||
diff --git a/tests/028-dbus/walk.py b/tests/028-dbus/walk.py
|
||||
index f60ca93..683d94e 100644
|
||||
--- a/tests/028-dbus/walk.py
|
||||
+++ b/tests/028-dbus/walk.py
|
||||
@@ -1,4 +1,4 @@
|
||||
-#!/usr/bin/python
|
||||
+#!/usr/bin/python3
|
||||
import dbus
|
||||
import xml.etree.ElementTree
|
||||
import os
|
||||
@@ -9,217 +9,219 @@ bus = dbus.SessionBus()
|
||||
|
||||
# Check that reading a property directly produces the same value as reading it via GetAll().
|
||||
def check_props(objpath, interface):
|
||||
- o = bus.get_object('org.fedorahosted.certmonger', objpath)
|
||||
- i = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
- props = i.GetAll(interface)
|
||||
- for prop in props.keys():
|
||||
- value = props[prop]
|
||||
- if value != i.Get(interface, prop):
|
||||
- print("%s: property %s.%s mismatch (%s, %s)" % (objpath, interface, prop, value, i.Get(interface, prop)))
|
||||
- return False
|
||||
- return True
|
||||
+ o = bus.get_object('org.fedorahosted.certmonger', objpath)
|
||||
+ i = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
+ props = i.GetAll(interface)
|
||||
+ for prop in props.keys():
|
||||
+ value = props[prop]
|
||||
+ if value != i.Get(interface, prop):
|
||||
+ print("%s: property %s.%s mismatch (%s, %s)" % (objpath, interface, prop, value, i.Get(interface, prop)))
|
||||
+ return False
|
||||
+ return True
|
||||
|
||||
# Try to call the method.
|
||||
def examine_method(objpath, interface, method, idata):
|
||||
- in_args = 0
|
||||
- out_args = 0
|
||||
- o = bus.get_object('org.fedorahosted.certmonger', objpath)
|
||||
- i = dbus.Interface(o, interface)
|
||||
- for child in idata.getchildren():
|
||||
- if child.tag == 'arg':
|
||||
- if child.get('direction') != 'out':
|
||||
- in_args = in_args + 1
|
||||
- else:
|
||||
- out_args = out_args + 1
|
||||
- if in_args == 0:
|
||||
- # Takes no inputs, so just call it.
|
||||
- m = i.get_dbus_method(method)
|
||||
- if out_args == 0:
|
||||
- m()
|
||||
- print("[ %s: %s.%s ]\n" % (objpath, interface, method))
|
||||
- elif out_args == 1:
|
||||
- result = m()
|
||||
- print("[ %s: %s.%s ]\n%s\n" % (objpath, interface, method, result))
|
||||
- else:
|
||||
- result = m()
|
||||
- print("[ %s: %s.%s ]\n%s\n" % (objpath, interface, method, result))
|
||||
- elif method == 'Get' or method == 'Set' or method == 'GetAll':
|
||||
- # We check on properties elsewhere.
|
||||
- return True
|
||||
- # Per-method exercise.
|
||||
- elif method == 'add_known_ca' or method == 'remove_known_ca':
|
||||
- (result, path) = i.add_known_ca('Test CA', '/usr/bin/env', [])
|
||||
- if not result:
|
||||
- print("[ %s : %s.%s ]: add_known_ca error\n" % (objpath, interface, method))
|
||||
- return False
|
||||
- result = i.remove_known_ca(path)
|
||||
- if not result:
|
||||
- print("[ %s : %s.%s ]: remove_known_ca error\n" % (objpath, interface, method))
|
||||
- return False
|
||||
- print("[ %s : %s.%s ]\nOK\n" % (objpath, interface, method))
|
||||
- elif method == 'add_request' or method == 'remove_request':
|
||||
- tmpdir = os.getenv('TMPDIR')
|
||||
- if not tmpdir or tmpdir == '':
|
||||
- tmpdir = '/tmp'
|
||||
- properties = {
|
||||
- 'nickname': 'foo',
|
||||
- 'cert-storage': 'file',
|
||||
- 'cert-file': tmpdir + "/028-certfile",
|
||||
- 'key-storage': 'file',
|
||||
- 'key-file': tmpdir + "/028-keyfile",
|
||||
- 'template-email': ['root@localhost', 'toor@localhost'],
|
||||
- }
|
||||
- (result, path) = i.add_request(properties)
|
||||
- if not result:
|
||||
- print("[ %s : %s.%s ]: add_request error\n" % (objpath, interface, method))
|
||||
- return False
|
||||
- result = i.remove_request(path)
|
||||
- if not result:
|
||||
- print("[ %s : %s.%s ]: remove_request error\n" % (objpath, interface, method))
|
||||
- return False
|
||||
- print("[ %s : %s.%s ]\nOK\n" % (objpath, interface, method))
|
||||
- elif method == 'find_ca_by_nickname':
|
||||
- capath = i.find_ca_by_nickname('local')
|
||||
- o = bus.get_object('org.fedorahosted.certmonger', capath)
|
||||
- i = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
- if i.Get('org.fedorahosted.certmonger.ca', 'nickname') != 'local':
|
||||
- print("[ %s : %s.%s ] error: %s\n" % (objpath, interface, method, i.Get('org.fedorahosted.certmonger.ca', 'nickname')))
|
||||
- return False
|
||||
- print("[ %s : %s.%s ]\nOK\n" % (objpath, interface, method))
|
||||
- elif method == 'find_request_by_nickname':
|
||||
- reqpath = i.find_request_by_nickname('Buddy')
|
||||
- o = bus.get_object('org.fedorahosted.certmonger', reqpath)
|
||||
- i = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
- if i.Get('org.fedorahosted.certmonger.request', 'nickname') != 'Buddy':
|
||||
- print("[ %s : %s.%s ] error: %s\n" % (objpath, interface, method, i.Get('org.fedorahosted.certmonger.request', 'nickname')))
|
||||
- return False
|
||||
- print("[ %s : %s.%s ]\nOK\n" % (objpath, interface, method))
|
||||
- elif method == 'modify':
|
||||
- mods = {}
|
||||
- propname = "template-eku"
|
||||
- propval = '1.2.3.4.5.6.7.8.9.10'
|
||||
- mods[propname] = [propval,]
|
||||
- status, path = i.modify(mods)
|
||||
- if not status:
|
||||
- print("[ %s : %s.%s ] error\n" % (objpath, interface, method))
|
||||
- return False
|
||||
- print("[ %s : %s.%s ]\n%d on %s" % (objpath, interface, method, status, path))
|
||||
- props = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
- prop = props.Get(interface, 'template-eku')
|
||||
- print("After setting %s to %s, we got %s\n" % (propname, propval, prop))
|
||||
- else:
|
||||
- # We're in FIXME territory.
|
||||
- print('FIXME: need support for "%s"' % method)
|
||||
- return False
|
||||
- # If we caused things to start churning, wait for them to settle.
|
||||
+ in_args = 0
|
||||
+ out_args = 0
|
||||
+ o = bus.get_object('org.fedorahosted.certmonger', objpath)
|
||||
+ i = dbus.Interface(o, interface)
|
||||
+ for child in idata.getchildren():
|
||||
+ if child.tag == 'arg':
|
||||
+ if child.get('direction') != 'out':
|
||||
+ in_args = in_args + 1
|
||||
+ else:
|
||||
+ out_args = out_args + 1
|
||||
+ if in_args == 0:
|
||||
+ # Takes no inputs, so just call it.
|
||||
+ m = i.get_dbus_method(method)
|
||||
+ if out_args == 0:
|
||||
+ m()
|
||||
+ print("[ %s: %s.%s ]\n" % (objpath, interface, method))
|
||||
+ elif out_args == 1:
|
||||
+ result = m()
|
||||
+ print("[ %s: %s.%s ]\n%s\n" % (objpath, interface, method, result))
|
||||
+ else:
|
||||
+ result = m()
|
||||
+ print("[ %s: %s.%s ]\n%s\n" % (objpath, interface, method, result))
|
||||
+ elif method == 'Get' or method == 'Set' or method == 'GetAll':
|
||||
+ # We check on properties elsewhere.
|
||||
+ return True
|
||||
+ # Per-method exercise.
|
||||
+ elif method == 'add_known_ca' or method == 'remove_known_ca':
|
||||
+ (result, path) = i.add_known_ca('Test CA', '/usr/bin/env', [])
|
||||
+ if not result:
|
||||
+ print("[ %s : %s.%s ]: add_known_ca error\n" % (objpath, interface, method))
|
||||
+ return False
|
||||
+ result = i.remove_known_ca(path)
|
||||
+ if not result:
|
||||
+ print("[ %s : %s.%s ]: remove_known_ca error\n" % (objpath, interface, method))
|
||||
+ return False
|
||||
+ print("[ %s : %s.%s ]\nOK\n" % (objpath, interface, method))
|
||||
+ elif method == 'add_request' or method == 'remove_request':
|
||||
+ tmpdir = os.getenv('TMPDIR')
|
||||
+ if not tmpdir or tmpdir == '':
|
||||
+ tmpdir = '/tmp'
|
||||
+ properties = {
|
||||
+ 'nickname': 'foo',
|
||||
+ 'cert-storage': 'file',
|
||||
+ 'cert-file': tmpdir + "/028-certfile",
|
||||
+ 'key-storage': 'file',
|
||||
+ 'key-file': tmpdir + "/028-keyfile",
|
||||
+ 'template-email': ['root@localhost', 'toor@localhost'],
|
||||
+ }
|
||||
+ (result, path) = i.add_request(properties)
|
||||
+ if not result:
|
||||
+ print("[ %s : %s.%s ]: add_request error\n" % (objpath, interface, method))
|
||||
+ return False
|
||||
+ result = i.remove_request(path)
|
||||
+ if not result:
|
||||
+ print("[ %s : %s.%s ]: remove_request error\n" % (objpath, interface, method))
|
||||
+ return False
|
||||
+ print("[ %s : %s.%s ]\nOK\n" % (objpath, interface, method))
|
||||
+ elif method == 'find_ca_by_nickname':
|
||||
+ capath = i.find_ca_by_nickname('local')
|
||||
+ o = bus.get_object('org.fedorahosted.certmonger', capath)
|
||||
+ i = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
+ if i.Get('org.fedorahosted.certmonger.ca', 'nickname') != 'local':
|
||||
+ print("[ %s : %s.%s ] error: %s\n" % (objpath, interface, method, i.Get('org.fedorahosted.certmonger.ca', 'nickname')))
|
||||
+ return False
|
||||
+ print("[ %s : %s.%s ]\nOK\n" % (objpath, interface, method))
|
||||
+ elif method == 'find_request_by_nickname':
|
||||
+ reqpath = i.find_request_by_nickname('Buddy')
|
||||
+ if not reqpath:
|
||||
+ return False
|
||||
+ o = bus.get_object('org.fedorahosted.certmonger', reqpath)
|
||||
+ i = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
+ if i.Get('org.fedorahosted.certmonger.request', 'nickname') != 'Buddy':
|
||||
+ print("[ %s : %s.%s ] error: %s\n" % (objpath, interface, method, i.Get('org.fedorahosted.certmonger.request', 'nickname')))
|
||||
+ return False
|
||||
+ print("[ %s : %s.%s ]\nOK\n" % (objpath, interface, method))
|
||||
+ elif method == 'modify':
|
||||
+ mods = {}
|
||||
+ propname = "template-eku"
|
||||
+ propval = '1.2.3.4.5.6.7.8.9.10'
|
||||
+ mods[propname] = [propval,]
|
||||
+ status, path = i.modify(mods)
|
||||
+ if not status:
|
||||
+ print("[ %s : %s.%s ] error\n" % (objpath, interface, method))
|
||||
+ return False
|
||||
+ print("[ %s : %s.%s ]\n%d on %s" % (objpath, interface, method, status, path))
|
||||
+ props = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
+ prop = props.Get(interface, 'template-eku')
|
||||
+ print("After setting %s to %s, we got %s\n" % (propname, propval, prop))
|
||||
+ else:
|
||||
+ # We're in FIXME territory.
|
||||
+ print('FIXME: need support for "%s"' % method)
|
||||
+ return False
|
||||
+ # If we caused things to start churning, wait for them to settle.
|
||||
if method == 'resubmit':
|
||||
props = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
prop = props.Get(interface, 'status')
|
||||
while prop != 'MONITORING':
|
||||
time.sleep(1)
|
||||
prop = props.Get(interface, 'status')
|
||||
- return True
|
||||
+ return True
|
||||
|
||||
def iget(child, proxy, interface, prop):
|
||||
- value = proxy.Get(interface, prop)
|
||||
- if not value:
|
||||
- if child.get('type') == 'b':
|
||||
- value = False
|
||||
- elif child.get('type') == 'n' or child.get('type') == 'x':
|
||||
- value = 0
|
||||
- elif child.get('type') == 's':
|
||||
- value = ''
|
||||
- elif child.get('type') == 'as':
|
||||
- value = ['']
|
||||
- else:
|
||||
- print("%s.%s: %s" % (interface, prop, child.get('type')))
|
||||
- return False
|
||||
- return value
|
||||
+ value = proxy.Get(interface, prop)
|
||||
+ if not value:
|
||||
+ if child.get('type') == 'b':
|
||||
+ value = False
|
||||
+ elif child.get('type') == 'n' or child.get('type') == 'x':
|
||||
+ value = 0
|
||||
+ elif child.get('type') == 's':
|
||||
+ value = ''
|
||||
+ elif child.get('type') == 'as':
|
||||
+ value = ['']
|
||||
+ else:
|
||||
+ print("%s.%s: %s" % (interface, prop, child.get('type')))
|
||||
+ return False
|
||||
+ return value
|
||||
|
||||
def examine_interface(objpath, interface, idata):
|
||||
- o = bus.get_object('org.fedorahosted.certmonger', objpath)
|
||||
- i = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
- for child in idata.getchildren():
|
||||
- if child.tag == 'property':
|
||||
- prop = child.get('name')
|
||||
- if child.get('access') == 'read':
|
||||
- # Check that we can read it.
|
||||
- value = i.Get(interface, prop)
|
||||
- elif child.get('access') == 'readwrite':
|
||||
- if prop == 'external-helper' or prop == 'scep-ca-identifier':
|
||||
- cai = dbus.Interface(o, 'org.fedorahosted.certmonger.ca')
|
||||
- if cai.get_type() != 'EXTERNAL':
|
||||
- print("%s: warning: property %s.%s not settable on this object" % (objpath, interface, prop))
|
||||
- continue
|
||||
- # Check that we can read it, tweak it, and then reset it.
|
||||
- value = iget(child, i, interface, prop)
|
||||
- i.Set(interface, prop, value)
|
||||
- newvalue = None
|
||||
- if child.get('type') == 'b':
|
||||
- newvalue = not value
|
||||
- elif child.get('type') == 'n' or child.get('type') == 'x':
|
||||
- newvalue = value + 1
|
||||
- elif child.get('type') == 's':
|
||||
- newvalue = 'x' + value
|
||||
- elif child.get('type') == 'as':
|
||||
- newvalue = ['x'] + value
|
||||
- else:
|
||||
- print("%s.%s: %s" % (interface, prop, child.get('type')))
|
||||
- return False
|
||||
- if newvalue:
|
||||
- if newvalue == value:
|
||||
- print("%s: error determining new value: (%s, %s): %s" % (objpath, interface, prop, value))
|
||||
- return False
|
||||
- i.Set(interface, prop, newvalue)
|
||||
- if newvalue != iget(child, i, interface, prop):
|
||||
- print("%s: property %s.%s not set: (%s, %s)" % (objpath, interface, prop, value, newvalue))
|
||||
- return False
|
||||
- i.Set(interface, prop, value)
|
||||
- if value != iget(child, i, interface, prop):
|
||||
- print("%s: property %s.%s not reset: (%s, %s)" % (objpath, interface, prop, newvalue, value))
|
||||
- return False
|
||||
- elif child.tag == 'method':
|
||||
- method = child.get('name')
|
||||
- if not examine_method(objpath, interface, method, child):
|
||||
- return False
|
||||
- elif child.tag == 'signal':
|
||||
- continue
|
||||
- else:
|
||||
- print "FIXME: handle child tag %s" % child.tag
|
||||
- return False
|
||||
- return True
|
||||
+ o = bus.get_object('org.fedorahosted.certmonger', objpath)
|
||||
+ i = dbus.Interface(o, 'org.freedesktop.DBus.Properties')
|
||||
+ for child in idata.getchildren():
|
||||
+ if child.tag == 'property':
|
||||
+ prop = child.get('name')
|
||||
+ if child.get('access') == 'read':
|
||||
+ # Check that we can read it.
|
||||
+ value = i.Get(interface, prop)
|
||||
+ elif child.get('access') == 'readwrite':
|
||||
+ if prop == 'external-helper' or prop == 'scep-ca-identifier':
|
||||
+ cai = dbus.Interface(o, 'org.fedorahosted.certmonger.ca')
|
||||
+ if cai.get_type() != 'EXTERNAL':
|
||||
+ print("%s: warning: property %s.%s not settable on this object" % (objpath, interface, prop))
|
||||
+ continue
|
||||
+ # Check that we can read it, tweak it, and then reset it.
|
||||
+ value = iget(child, i, interface, prop)
|
||||
+ i.Set(interface, prop, value)
|
||||
+ newvalue = None
|
||||
+ if child.get('type') == 'b':
|
||||
+ newvalue = not value
|
||||
+ elif child.get('type') == 'n' or child.get('type') == 'x':
|
||||
+ newvalue = value + 1
|
||||
+ elif child.get('type') == 's':
|
||||
+ newvalue = 'x' + value
|
||||
+ elif child.get('type') == 'as':
|
||||
+ newvalue = ['x'] + value
|
||||
+ else:
|
||||
+ print("%s.%s: %s" % (interface, prop, child.get('type')))
|
||||
+ return False
|
||||
+ if newvalue:
|
||||
+ if newvalue == value:
|
||||
+ print("%s: error determining new value: (%s, %s): %s" % (objpath, interface, prop, value))
|
||||
+ return False
|
||||
+ i.Set(interface, prop, newvalue)
|
||||
+ if newvalue != iget(child, i, interface, prop):
|
||||
+ print("%s: property %s.%s not set: (%s, %s)" % (objpath, interface, prop, value, newvalue))
|
||||
+ return False
|
||||
+ i.Set(interface, prop, value)
|
||||
+ if value != iget(child, i, interface, prop):
|
||||
+ print("%s: property %s.%s not reset: (%s, %s)" % (objpath, interface, prop, newvalue, value))
|
||||
+ return False
|
||||
+ elif child.tag == 'method':
|
||||
+ method = child.get('name')
|
||||
+ if not examine_method(objpath, interface, method, child):
|
||||
+ return False
|
||||
+ elif child.tag == 'signal':
|
||||
+ continue
|
||||
+ else:
|
||||
+ print("FIXME: handle child tag %s" % child.tag)
|
||||
+ return False
|
||||
+ return True
|
||||
|
||||
def examine_object(objpath):
|
||||
- o = bus.get_object('org.fedorahosted.certmonger', objpath)
|
||||
- i = dbus.Interface(o, 'org.freedesktop.DBus.Introspectable')
|
||||
- idata = i.Introspect()
|
||||
- x = xml.etree.ElementTree.XML(idata)
|
||||
+ o = bus.get_object('org.fedorahosted.certmonger', objpath)
|
||||
+ i = dbus.Interface(o, 'org.freedesktop.DBus.Introspectable')
|
||||
+ idata = i.Introspect()
|
||||
+ x = xml.etree.ElementTree.XML(idata)
|
||||
|
||||
- # Check if the object supports properties interfaces.
|
||||
- props = False
|
||||
- for child in x.getchildren():
|
||||
- if child.tag == 'interface':
|
||||
- if child.get('name') == 'org.freedesktop.DBus.Properties':
|
||||
- props = True
|
||||
+ # Check if the object supports properties interfaces.
|
||||
+ props = False
|
||||
+ for child in x.getchildren():
|
||||
+ if child.tag == 'interface':
|
||||
+ if child.get('name') == 'org.freedesktop.DBus.Properties':
|
||||
+ props = True
|
||||
|
||||
- # Look at the interfaces and child nodes.
|
||||
- for child in x.getchildren():
|
||||
- if child.tag == 'interface':
|
||||
- if props and not check_props(objpath, child.get('name')):
|
||||
- return False
|
||||
- if not examine_interface(objpath, child.get('name'), child):
|
||||
- return False
|
||||
- elif child.tag == 'node':
|
||||
- if objpath == '/':
|
||||
- childpath = '/' + child.get('name')
|
||||
- else:
|
||||
- childpath = objpath + '/' + child.get('name')
|
||||
- examine_object(childpath)
|
||||
- else:
|
||||
- print "FIXME: handle child tag %s" % child.tag
|
||||
- return False
|
||||
- return True
|
||||
+ # Look at the interfaces and child nodes.
|
||||
+ for child in x.getchildren():
|
||||
+ if child.tag == 'interface':
|
||||
+ if props and not check_props(objpath, child.get('name')):
|
||||
+ return False
|
||||
+ if not examine_interface(objpath, child.get('name'), child):
|
||||
+ return False
|
||||
+ elif child.tag == 'node':
|
||||
+ if objpath == '/':
|
||||
+ childpath = '/' + child.get('name')
|
||||
+ else:
|
||||
+ childpath = objpath + '/' + child.get('name')
|
||||
+ examine_object(childpath)
|
||||
+ else:
|
||||
+ print("FIXME: handle child tag %s" % child.tag)
|
||||
+ return False
|
||||
+ return True
|
||||
|
||||
if not examine_object('/'):
|
||||
- sys.exit(1)
|
||||
+ sys.exit(1)
|
||||
sys.exit(0)
|
||||
diff --git a/tests/038-ms-v2-template/extract-extdata.py b/tests/038-ms-v2-template/extract-extdata.py
|
||||
index 1a845fd..9f9d910 100755
|
||||
--- a/tests/038-ms-v2-template/extract-extdata.py
|
||||
+++ b/tests/038-ms-v2-template/extract-extdata.py
|
||||
@@ -1,10 +1,11 @@
|
||||
-#!/usr/bin/python2
|
||||
+#!/usr/bin/python3
|
||||
|
||||
# Given `openssl asn1parse` output of a CSR, look for the V2 Template
|
||||
# extension and output its data if found. Nonzero exit status if
|
||||
# not found.
|
||||
|
||||
import binascii
|
||||
+import os
|
||||
import re
|
||||
import sys
|
||||
|
||||
@@ -21,7 +22,7 @@ for line in sys.stdin:
|
||||
#
|
||||
if state == STATE_FOUND and 'OCTET STRING' in line:
|
||||
result = re.search(r'\[HEX DUMP\]:(\w*)', line)
|
||||
- sys.stdout.write(binascii.unhexlify(result.group(1)))
|
||||
+ os.write(1, binascii.unhexlify(result.group(1)))
|
||||
state = STATE_DONE
|
||||
break
|
||||
|
||||
--
|
||||
2.17.0
|
||||
|
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,49 @@
|
||||
From c029b32c04a9a5993b9c8715fb82421fee613137 Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Fri, 31 Aug 2018 10:37:12 -0400
|
||||
Subject: [PATCH 2/7] Include the token name when a PIN is provided but is
|
||||
unused
|
||||
|
||||
This improves the output so the user will know which token
|
||||
the PIN is missing for. Theoretically it should be the token
|
||||
they asked for but this will show certmogner's view of it.
|
||||
---
|
||||
src/certread-n.c | 6 +++---
|
||||
src/keygen-n.c | 4 ++--
|
||||
2 files changed, 5 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/src/certread-n.c b/src/certread-n.c
|
||||
index f2e78c07..57a38dcf 100644
|
||||
--- a/src/certread-n.c
|
||||
+++ b/src/certread-n.c
|
||||
@@ -259,9 +259,9 @@ cm_certread_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
if ((pin != NULL) &&
|
||||
(strlen(pin) > 0) &&
|
||||
(cb_data.n_attempts == 0)) {
|
||||
- cm_log(1, "PIN was not needed to auth to cert "
|
||||
- "db, though one was provided. "
|
||||
- "Treating this as an error.\n");
|
||||
+ cm_log(1, "PIN was not needed to auth to token "
|
||||
+ "%s, though one was provided. "
|
||||
+ "Treating this as an error.\n", token);
|
||||
goto next_slot;
|
||||
}
|
||||
}
|
||||
diff --git a/src/keygen-n.c b/src/keygen-n.c
|
||||
index 8078a520..84b0bbd3 100644
|
||||
--- a/src/keygen-n.c
|
||||
+++ b/src/keygen-n.c
|
||||
@@ -400,8 +400,8 @@ next_slot:
|
||||
(strlen(pin) > 0) &&
|
||||
(cb_data.n_attempts == 0)) {
|
||||
cm_log(1, "PIN was not needed to auth to key "
|
||||
- "store, though one was provided. "
|
||||
- "Treating this as an error.\n");
|
||||
+ "store token %s, though one was provided. "
|
||||
+ "Treating this as an error.\n", token);
|
||||
PK11_FreeSlotList(slotlist);
|
||||
error = NSS_ShutdownContext(ctx);
|
||||
if (error != SECSuccess) {
|
||||
--
|
||||
2.14.4
|
||||
|
@ -0,0 +1,134 @@
|
||||
From f396b19b2c222fa0a50e9bb9704059af4578e678 Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Fri, 31 Aug 2018 12:08:35 -0400
|
||||
Subject: [PATCH 3/7] Add utility function to get the internal token name
|
||||
|
||||
The NSS internal token is the default if no token is specified for
|
||||
the cert or the key.
|
||||
---
|
||||
src/certread-n.c | 6 +++++-
|
||||
src/certsave-n.c | 3 +++
|
||||
src/keygen-n.c | 3 +++
|
||||
src/keyiread-n.c | 3 +++
|
||||
src/submit-n.c | 5 ++++-
|
||||
src/util-n.c | 6 ++++++
|
||||
src/util-n.h | 1 +
|
||||
7 files changed, 25 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/certread-n.c b/src/certread-n.c
|
||||
index 57a38dcf..1d9217c6 100644
|
||||
--- a/src/certread-n.c
|
||||
+++ b/src/certread-n.c
|
||||
@@ -190,6 +190,9 @@ cm_certread_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
cm_log(1, "Error reading PIN for cert db.\n");
|
||||
_exit(CM_SUB_STATUS_ERROR_AUTH);
|
||||
}
|
||||
+ if (entry->cm_cert_token == NULL) {
|
||||
+ entry->cm_cert_token = util_internal_token_name();
|
||||
+ }
|
||||
PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);
|
||||
for (sle = slotlist->head;
|
||||
((sle != NULL) && (sle->slot != NULL));
|
||||
@@ -253,7 +256,8 @@ cm_certread_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
}
|
||||
error = PK11_Authenticate(sle->slot, PR_TRUE, &cb_data);
|
||||
if (error != SECSuccess) {
|
||||
- cm_log(1, "Error authenticating to cert db.\n");
|
||||
+ cm_log(1, "certread-n: Error authenticating to cert db "
|
||||
+ "slot %s.\n", PK11_GetTokenName(sle->slot));
|
||||
goto next_slot;
|
||||
}
|
||||
if ((pin != NULL) &&
|
||||
diff --git a/src/certsave-n.c b/src/certsave-n.c
|
||||
index af176ce5..193309c5 100644
|
||||
--- a/src/certsave-n.c
|
||||
+++ b/src/certsave-n.c
|
||||
@@ -214,6 +214,9 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
_exit(CM_SUB_STATUS_ERROR_AUTH);
|
||||
}
|
||||
PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);
|
||||
+ if (entry->cm_cert_token == NULL) {
|
||||
+ entry->cm_cert_token = util_internal_token_name();
|
||||
+ }
|
||||
for (sle = slotlist->head;
|
||||
((sle != NULL) && (sle->slot != NULL));
|
||||
sle = sle->next)
|
||||
diff --git a/src/keygen-n.c b/src/keygen-n.c
|
||||
index 84b0bbd3..f7fdf6c0 100644
|
||||
--- a/src/keygen-n.c
|
||||
+++ b/src/keygen-n.c
|
||||
@@ -272,6 +272,9 @@ cm_keygen_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
cm_log(1, "Error locating token for key generation.\n");
|
||||
_exit(CM_SUB_STATUS_ERROR_NO_TOKEN);
|
||||
}
|
||||
+ if (entry->cm_cert_token == NULL) {
|
||||
+ entry->cm_cert_token = util_internal_token_name();
|
||||
+ }
|
||||
/* Walk the list looking for the requested slot, or the first one if
|
||||
* none was requested. */
|
||||
slot = NULL;
|
||||
diff --git a/src/keyiread-n.c b/src/keyiread-n.c
|
||||
index 89913aa2..b8408bf1 100644
|
||||
--- a/src/keyiread-n.c
|
||||
+++ b/src/keyiread-n.c
|
||||
@@ -152,6 +152,9 @@ cm_keyiread_n_get_keys(struct cm_store_entry *entry, int readwrite)
|
||||
_exit(CM_SUB_STATUS_ERROR_AUTH);
|
||||
}
|
||||
PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);
|
||||
+ if (entry->cm_key_token == NULL) {
|
||||
+ entry->cm_key_token = util_internal_token_name();
|
||||
+ }
|
||||
n_tokens = 0;
|
||||
pubkey = NULL;
|
||||
/* In practice, the internal slot is either a non-storage slot (in
|
||||
diff --git a/src/submit-n.c b/src/submit-n.c
|
||||
index 872153ea..da07d253 100644
|
||||
--- a/src/submit-n.c
|
||||
+++ b/src/submit-n.c
|
||||
@@ -346,6 +346,9 @@ cm_submit_n_decrypt_envelope(const unsigned char *envelope,
|
||||
cm_log(1, "Error reading PIN for key storage.\n");
|
||||
goto done;
|
||||
}
|
||||
+ if (args->entry->cm_key_token == NULL) {
|
||||
+ args->entry->cm_key_token = util_internal_token_name();
|
||||
+ }
|
||||
PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);
|
||||
n_tokens = 0;
|
||||
/* In practice, the internal slot is either a non-storage slot (in
|
||||
@@ -402,7 +405,7 @@ cm_submit_n_decrypt_envelope(const unsigned char *envelope,
|
||||
}
|
||||
error = PK11_Authenticate(slot, PR_TRUE, &cb_data);
|
||||
if (error != SECSuccess) {
|
||||
- cm_log(1, "Error authenticating to token "
|
||||
+ cm_log(1, "submit-n: Error authenticating to token "
|
||||
"\"%s\".\n", token);
|
||||
goto done;
|
||||
}
|
||||
diff --git a/src/util-n.c b/src/util-n.c
|
||||
index 7805e58e..293e2583 100644
|
||||
--- a/src/util-n.c
|
||||
+++ b/src/util-n.c
|
||||
@@ -287,3 +287,9 @@ util_set_db_entry_cert_owner(const char *dbdir, struct cm_store_entry *entry)
|
||||
util_set_db_owner_perms(dbdir, secmoddb, entry->cm_cert_owner,
|
||||
entry->cm_cert_perms);
|
||||
}
|
||||
+
|
||||
+char *
|
||||
+util_internal_token_name()
|
||||
+{
|
||||
+ return strdup(PK11_GetTokenName(PK11_GetInternalKeySlot()));
|
||||
+}
|
||||
diff --git a/src/util-n.h b/src/util-n.h
|
||||
index 8a918d5c..637fd4b1 100644
|
||||
--- a/src/util-n.h
|
||||
+++ b/src/util-n.h
|
||||
@@ -29,5 +29,6 @@ void util_set_db_entry_key_owner(const char *dbdir,
|
||||
struct cm_store_entry *entry);
|
||||
void util_set_db_entry_cert_owner(const char *dbdir,
|
||||
struct cm_store_entry *entry);
|
||||
+char * util_internal_token_name();
|
||||
|
||||
#endif
|
||||
--
|
||||
2.14.4
|
||||
|
@ -0,0 +1,41 @@
|
||||
From 6ebe5695a626c6cd254b249bbebf9846bcb936c0 Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Tue, 4 Sep 2018 11:06:13 -0400
|
||||
Subject: [PATCH 4/7] Only de-duplicate certificates within the same token
|
||||
|
||||
certmonger may not have read/write access to tokens other than
|
||||
the one it is examining so don't try to de-duplicate certificates
|
||||
on other tokens.
|
||||
---
|
||||
src/certsave-n.c | 8 +++++---
|
||||
1 file changed, 5 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/certsave-n.c b/src/certsave-n.c
|
||||
index 193309c5..d0152cad 100644
|
||||
--- a/src/certsave-n.c
|
||||
+++ b/src/certsave-n.c
|
||||
@@ -391,8 +391,9 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
!CERT_LIST_EMPTY(certlist) &&
|
||||
!CERT_LIST_END(node, certlist);
|
||||
node = CERT_LIST_NEXT(node)) {
|
||||
- if (!SECITEM_ItemsAreEqual(&subject,
|
||||
- &node->cert->derSubject)) {
|
||||
+ if ((!SECITEM_ItemsAreEqual(&subject,
|
||||
+ &node->cert->derSubject)) &&
|
||||
+ (sle->slot == node->cert->slot)) {
|
||||
cm_log(3, "Found a "
|
||||
"certificate "
|
||||
"with the same "
|
||||
@@ -441,7 +442,8 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
node = CERT_LIST_NEXT(node)) {
|
||||
if ((node->cert->nickname != NULL) &&
|
||||
(strcmp(entry->cm_cert_nickname,
|
||||
- node->cert->nickname) != 0))
|
||||
+ node->cert->nickname) != 0) &&
|
||||
+ (sle->slot == node->cert->slot))
|
||||
{
|
||||
i++;
|
||||
cm_log(3, "Found a "
|
||||
--
|
||||
2.14.4
|
||||
|
@ -0,0 +1,30 @@
|
||||
From 697dd085e7b2ce15eefc454509987270131d7f1e Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Tue, 4 Sep 2018 16:59:28 -0400
|
||||
Subject: [PATCH 5/7] Ensure that an OpenSSL random seed file exists when
|
||||
testing
|
||||
|
||||
Otherwise some openssl command-line invocations will fail and
|
||||
because of the way the tests are done the error message is not
|
||||
shown.
|
||||
---
|
||||
tests/Makefile.am | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/tests/Makefile.am b/tests/Makefile.am
|
||||
index 4e407434..fe368dc0 100644
|
||||
--- a/tests/Makefile.am
|
||||
+++ b/tests/Makefile.am
|
||||
@@ -433,6 +433,9 @@ subdirs += \
|
||||
endif
|
||||
|
||||
check: all
|
||||
+ if [ ! -e $$HOME/.rnd ] ; then \
|
||||
+ openssl rand -writerand $$HOME/.rnd; \
|
||||
+ fi
|
||||
for required in certutil cmsutil pk12util openssl diff cmp mktemp \
|
||||
dos2unix unix2dos dbus-launch ; do \
|
||||
which $$required || exit 1; \
|
||||
--
|
||||
2.14.4
|
||||
|
29
SOURCES/0008-Log-test-failures-of-bad-pin.patch
Normal file
29
SOURCES/0008-Log-test-failures-of-bad-pin.patch
Normal file
@ -0,0 +1,29 @@
|
||||
From e93ecadec7c868f4227e084ffb65c70a6efd7314 Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Tue, 4 Sep 2018 18:12:18 -0400
|
||||
Subject: [PATCH 6/7] Log test failures of bad pin
|
||||
|
||||
Previously this would show a "don't know why" failure.
|
||||
---
|
||||
tests/tools/certsave.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/tests/tools/certsave.c b/tests/tools/certsave.c
|
||||
index ac0f73ec..fd86a4c1 100644
|
||||
--- a/tests/tools/certsave.c
|
||||
+++ b/tests/tools/certsave.c
|
||||
@@ -106,6 +106,11 @@ main(int argc, char **argv)
|
||||
printf("Failed to save (%s:%s), "
|
||||
"filesystem permissions error.\n",
|
||||
ctype, entry->cm_cert_storage_location);
|
||||
+ } else
|
||||
+ if (cm_certsave_pin_error(state) == 0) {
|
||||
+ printf("Failed to save (%s:%s), "
|
||||
+ "pin error.\n",
|
||||
+ ctype, entry->cm_cert_storage_location);
|
||||
} else {
|
||||
printf("Failed to save (%s:%s), "
|
||||
"don't know why.\n",
|
||||
--
|
||||
2.14.4
|
||||
|
@ -0,0 +1,95 @@
|
||||
From 15d406ee3afbb52832d5c61a1afb735724d109a2 Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Tue, 18 Sep 2018 10:21:28 -0400
|
||||
Subject: [PATCH 7/7] Use only PK11_ImportCert to import certs, not
|
||||
CERT_ImportCerts
|
||||
|
||||
CERT_ImportCerts always imports a given certificate into the
|
||||
certificate database, whether a token is requested or not.
|
||||
|
||||
Using PK11_ImportCert will import the cert, associate the key
|
||||
properly and will only add the certificate to the appropriate
|
||||
token.
|
||||
---
|
||||
src/certsave-n.c | 37 +++++++++++--------------------------
|
||||
1 file changed, 11 insertions(+), 26 deletions(-)
|
||||
|
||||
diff --git a/src/certsave-n.c b/src/certsave-n.c
|
||||
index d0152cad..fcb43148 100644
|
||||
--- a/src/certsave-n.c
|
||||
+++ b/src/certsave-n.c
|
||||
@@ -100,7 +100,7 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
NSSInitContext *ctx;
|
||||
CERTCertDBHandle *certdb;
|
||||
CERTCertList *certlist;
|
||||
- CERTCertificate **returned, *oldcert, cert;
|
||||
+ CERTCertificate *oldcert, *newcert, cert;
|
||||
CERTCertTrust trust;
|
||||
CERTSignedData csdata;
|
||||
CERTCertListNode *node;
|
||||
@@ -497,33 +497,18 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
}
|
||||
}
|
||||
/* Import the certificate. */
|
||||
- returned = NULL;
|
||||
- error = CERT_ImportCerts(certdb,
|
||||
- certUsageUserCertImport,
|
||||
- 1, &item, &returned,
|
||||
- PR_TRUE,
|
||||
- PR_FALSE,
|
||||
- entry->cm_cert_nickname);
|
||||
- ec = PORT_GetError();
|
||||
- if (error == SECSuccess) {
|
||||
- /* If NSS uses SQL DB storage, CERT_ImportCerts creates
|
||||
- * an incomplete internal state (the cert isn't
|
||||
- * associated with the private key, and calling
|
||||
- * PK11_FindKeyByAnyCert returns no result).
|
||||
- * As a workaround, we import the cert again using
|
||||
- * PK11_ImportCert, which magically fixes the issue.
|
||||
- * See rhbz#1532188 */
|
||||
+ newcert = CERT_DecodeCertFromPackage((char *)item->data, item->len);
|
||||
+ if (newcert != NULL) {
|
||||
error = PK11_ImportCert(sle->slot,
|
||||
- returned[0],
|
||||
+ newcert,
|
||||
CK_INVALID_HANDLE,
|
||||
- returned[0]->nickname,
|
||||
+ entry->cm_cert_nickname,
|
||||
PR_FALSE);
|
||||
}
|
||||
if (error == SECSuccess) {
|
||||
- cm_log(1, "Imported certificate \"%s\", got "
|
||||
+ cm_log(1, "Imported certificate with "
|
||||
"nickname \"%s\".\n",
|
||||
- entry->cm_cert_nickname,
|
||||
- returned[0]->nickname);
|
||||
+ entry->cm_cert_nickname);
|
||||
status = 0;
|
||||
/* Set the trust on the new certificate,
|
||||
* perhaps matching the trust on an
|
||||
@@ -536,7 +521,7 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
trust.objectSigningFlags = CERTDB_USER;
|
||||
}
|
||||
error = CERT_ChangeCertTrust(certdb,
|
||||
- returned[0],
|
||||
+ newcert,
|
||||
&trust);
|
||||
ec = PORT_GetError();
|
||||
if (error != SECSuccess) {
|
||||
@@ -621,10 +606,10 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
}
|
||||
/* If we managed to import the certificate, mark its
|
||||
* key for having its nickname removed. */
|
||||
- if ((returned != NULL) && (returned[0] != NULL)) {
|
||||
- privkey = PK11_FindKeyByAnyCert(returned[0], NULL);
|
||||
+ if (newcert != NULL) {
|
||||
+ privkey = PK11_FindKeyByAnyCert(newcert, NULL);
|
||||
privkeys = add_privkey_to_list(privkeys, privkey);
|
||||
- CERT_DestroyCertArray(returned, 1);
|
||||
+ CERT_DestroyCertificate(newcert);
|
||||
}
|
||||
/* In case we're rekeying, but failed, mark the
|
||||
* candidate key for name-clearing or removal, too. */
|
||||
--
|
||||
2.14.4
|
||||
|
@ -0,0 +1,95 @@
|
||||
From 5d2554ed31fa6bc121d94efe533f9e4fea3900aa Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Thu, 4 Oct 2018 08:21:35 -0400
|
||||
Subject: [PATCH 10/17] Fix memory leak in util_internal_token_name()
|
||||
|
||||
Allocate memory using the talloc context instead of relying on
|
||||
the caller to call free().
|
||||
---
|
||||
src/certread-n.c | 2 +-
|
||||
src/certsave-n.c | 2 +-
|
||||
src/keygen-n.c | 2 +-
|
||||
src/keyiread-n.c | 2 +-
|
||||
src/submit-n.c | 2 +-
|
||||
src/util-n.c | 2 +-
|
||||
6 files changed, 6 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/certread-n.c b/src/certread-n.c
|
||||
index 1d9217c6..d535030b 100644
|
||||
--- a/src/certread-n.c
|
||||
+++ b/src/certread-n.c
|
||||
@@ -191,7 +191,7 @@ cm_certread_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
_exit(CM_SUB_STATUS_ERROR_AUTH);
|
||||
}
|
||||
if (entry->cm_cert_token == NULL) {
|
||||
- entry->cm_cert_token = util_internal_token_name();
|
||||
+ entry->cm_cert_token = talloc_strdup(entry, util_internal_token_name());
|
||||
}
|
||||
PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);
|
||||
for (sle = slotlist->head;
|
||||
diff --git a/src/certsave-n.c b/src/certsave-n.c
|
||||
index fcb43148..49b28324 100644
|
||||
--- a/src/certsave-n.c
|
||||
+++ b/src/certsave-n.c
|
||||
@@ -215,7 +215,7 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
}
|
||||
PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);
|
||||
if (entry->cm_cert_token == NULL) {
|
||||
- entry->cm_cert_token = util_internal_token_name();
|
||||
+ entry->cm_cert_token = talloc_strdup(entry, util_internal_token_name());
|
||||
}
|
||||
for (sle = slotlist->head;
|
||||
((sle != NULL) && (sle->slot != NULL));
|
||||
diff --git a/src/keygen-n.c b/src/keygen-n.c
|
||||
index f7fdf6c0..76a5c1d3 100644
|
||||
--- a/src/keygen-n.c
|
||||
+++ b/src/keygen-n.c
|
||||
@@ -273,7 +273,7 @@ cm_keygen_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
_exit(CM_SUB_STATUS_ERROR_NO_TOKEN);
|
||||
}
|
||||
if (entry->cm_cert_token == NULL) {
|
||||
- entry->cm_cert_token = util_internal_token_name();
|
||||
+ entry->cm_cert_token = talloc_strdup(entry, util_internal_token_name());
|
||||
}
|
||||
/* Walk the list looking for the requested slot, or the first one if
|
||||
* none was requested. */
|
||||
diff --git a/src/keyiread-n.c b/src/keyiread-n.c
|
||||
index b8408bf1..8f46ec0f 100644
|
||||
--- a/src/keyiread-n.c
|
||||
+++ b/src/keyiread-n.c
|
||||
@@ -153,7 +153,7 @@ cm_keyiread_n_get_keys(struct cm_store_entry *entry, int readwrite)
|
||||
}
|
||||
PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);
|
||||
if (entry->cm_key_token == NULL) {
|
||||
- entry->cm_key_token = util_internal_token_name();
|
||||
+ entry->cm_key_token = talloc_strdup(entry, util_internal_token_name());
|
||||
}
|
||||
n_tokens = 0;
|
||||
pubkey = NULL;
|
||||
diff --git a/src/submit-n.c b/src/submit-n.c
|
||||
index da07d253..ee6f3105 100644
|
||||
--- a/src/submit-n.c
|
||||
+++ b/src/submit-n.c
|
||||
@@ -347,7 +347,7 @@ cm_submit_n_decrypt_envelope(const unsigned char *envelope,
|
||||
goto done;
|
||||
}
|
||||
if (args->entry->cm_key_token == NULL) {
|
||||
- args->entry->cm_key_token = util_internal_token_name();
|
||||
+ args->entry->cm_key_token = talloc_strdup(args->entry, util_internal_token_name());
|
||||
}
|
||||
PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);
|
||||
n_tokens = 0;
|
||||
diff --git a/src/util-n.c b/src/util-n.c
|
||||
index 293e2583..4ab3d47b 100644
|
||||
--- a/src/util-n.c
|
||||
+++ b/src/util-n.c
|
||||
@@ -291,5 +291,5 @@ util_set_db_entry_cert_owner(const char *dbdir, struct cm_store_entry *entry)
|
||||
char *
|
||||
util_internal_token_name()
|
||||
{
|
||||
- return strdup(PK11_GetTokenName(PK11_GetInternalKeySlot()));
|
||||
+ return PK11_GetTokenName(PK11_GetInternalKeySlot());
|
||||
}
|
||||
--
|
||||
2.14.4
|
||||
|
266
SOURCES/0011-clang-Dead-assignment.patch
Normal file
266
SOURCES/0011-clang-Dead-assignment.patch
Normal file
@ -0,0 +1,266 @@
|
||||
From 648fe74986f2a84416805cfd73206e9e67166ae2 Mon Sep 17 00:00:00 2001
|
||||
From: Rob Crittenden <rcritten@redhat.com>
|
||||
Date: Thu, 13 Sep 2018 15:40:23 -0400
|
||||
Subject: [PATCH 11/17] clang: Dead assignment
|
||||
|
||||
---
|
||||
src/casave.c | 4 +++-
|
||||
src/keygen-n.c | 1 -
|
||||
src/keyiread-n.c | 1 -
|
||||
src/store-files.c | 2 --
|
||||
src/store-gen.c | 3 ---
|
||||
src/submit-e.c | 54 ++++++++++++++++++++++++++------------------------
|
||||
src/submit-u.c | 2 --
|
||||
src/tdbush.c | 8 ++++++--
|
||||
tests/tools/addcinfo.c | 1 -
|
||||
tests/tools/certsave.c | 4 +++-
|
||||
10 files changed, 40 insertions(+), 40 deletions(-)
|
||||
|
||||
diff --git a/src/casave.c b/src/casave.c
|
||||
index 5fb31b8d..bde63f99 100644
|
||||
--- a/src/casave.c
|
||||
+++ b/src/casave.c
|
||||
@@ -163,7 +163,6 @@ cm_casave_main_n(int fd, struct cm_store_ca *ca, struct cm_store_entry *e,
|
||||
decoded = CERT_DecodeCertFromPackage(package,
|
||||
strlen(package));
|
||||
p = state->certs[i]->nickname;
|
||||
- ttrust = ",,";
|
||||
switch (state->certs[i]->level) {
|
||||
case root:
|
||||
case other_root:
|
||||
@@ -178,6 +177,9 @@ cm_casave_main_n(int fd, struct cm_store_ca *ca, struct cm_store_entry *e,
|
||||
ttrust = ",,";
|
||||
}
|
||||
break;
|
||||
+ default:
|
||||
+ ttrust = ",,";
|
||||
+ break;
|
||||
}
|
||||
memset(&trust, 0, sizeof(trust));
|
||||
CERT_DecodeTrustString(&trust, ttrust);
|
||||
diff --git a/src/keygen-n.c b/src/keygen-n.c
|
||||
index 76a5c1d3..061bd2af 100644
|
||||
--- a/src/keygen-n.c
|
||||
+++ b/src/keygen-n.c
|
||||
@@ -591,7 +591,6 @@ retry_gen:
|
||||
break;
|
||||
}
|
||||
}
|
||||
- generated_size = SECKEY_PublicKeyStrengthInBits(pubkey);
|
||||
cm_log(1, "Ended up with %d bit public key.\n",
|
||||
SECKEY_PublicKeyStrengthInBits(pubkey));
|
||||
/* Check for keys with the desired name, selecting a new name if
|
||||
diff --git a/src/keyiread-n.c b/src/keyiread-n.c
|
||||
index 8f46ec0f..91b1be41 100644
|
||||
--- a/src/keyiread-n.c
|
||||
+++ b/src/keyiread-n.c
|
||||
@@ -492,7 +492,6 @@ cm_keyiread_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||
readwrite = settings->readwrite;
|
||||
keys = cm_keyiread_n_get_keys(entry, readwrite);
|
||||
alg = "";
|
||||
- size = 0;
|
||||
if (keys != NULL) {
|
||||
switch (SECKEY_GetPrivateKeyType(keys->privkey)) {
|
||||
case rsaKey:
|
||||
diff --git a/src/store-files.c b/src/store-files.c
|
||||
index 06a17485..df1fa336 100644
|
||||
--- a/src/store-files.c
|
||||
+++ b/src/store-files.c
|
||||
@@ -2182,7 +2182,6 @@ cm_store_entry_delete(struct cm_store_entry *entry)
|
||||
} else {
|
||||
cm_log(3, "No file to remove for \"%s\".\n",
|
||||
entry->cm_nickname);
|
||||
- ret = 0;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
@@ -2469,7 +2468,6 @@ cm_store_ca_delete(struct cm_store_ca *ca)
|
||||
}
|
||||
} else {
|
||||
cm_log(3, "No file to remove for \"%s\".\n", ca->cm_nickname);
|
||||
- ret = 0;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
diff --git a/src/store-gen.c b/src/store-gen.c
|
||||
index 5ce4ab84..da32afc8 100644
|
||||
--- a/src/store-gen.c
|
||||
+++ b/src/store-gen.c
|
||||
@@ -530,8 +530,6 @@ cm_store_hex_to_bin(const char *serial, unsigned char *buf, int length)
|
||||
const char *p, *q, *chars = "0123456789abcdef";
|
||||
unsigned char *b, u;
|
||||
|
||||
- p = serial;
|
||||
- b = buf;
|
||||
u = 0;
|
||||
for (p = serial, b = buf;
|
||||
((*p != '\0') && ((b - buf) < length));
|
||||
@@ -606,7 +604,6 @@ cm_store_canonicalize_path(void *parent, const char *path)
|
||||
for (p = tmp; *p != '\0'; p++) {
|
||||
if ((strncmp(p, "/.", 2) == 0) &&
|
||||
((p[2] == '/') || (p[2] == '\0'))) {
|
||||
- q = p - 1;
|
||||
memmove(p, p + 2, strlen(p + 2) + 1);
|
||||
}
|
||||
}
|
||||
diff --git a/src/submit-e.c b/src/submit-e.c
|
||||
index 8ba8e44c..d6158d7a 100644
|
||||
--- a/src/submit-e.c
|
||||
+++ b/src/submit-e.c
|
||||
@@ -587,32 +587,34 @@ cm_submit_e_postprocess_main(int fd, struct cm_store_ca *ca,
|
||||
estate->msg_length, NULL);
|
||||
msg = cm_json_new_object(estate);
|
||||
chain = cm_json_new_array(msg);
|
||||
- if (leaf != NULL) {
|
||||
- cert = cm_json_new_string(msg, leaf, -1);
|
||||
- cm_json_set(msg, CM_SUBMIT_E_CERTIFICATE, cert);
|
||||
- }
|
||||
- for (i = 0;
|
||||
- (others != NULL) && (others[i] != NULL);
|
||||
- i++) {
|
||||
- cert = cm_json_new_object(chain);
|
||||
- val = cm_json_new_string(cert, others[i], -1);
|
||||
- cm_json_set(cert, CM_SUBMIT_E_CERTIFICATE, val);
|
||||
- nthnick = talloc_asprintf(cert, "chain #%d", i + 1);
|
||||
- nick = cm_json_new_string(cert, nthnick, -1);
|
||||
- cm_json_set(cert, CM_SUBMIT_E_NICKNAME, nick);
|
||||
- cm_json_append(chain, cert);
|
||||
- }
|
||||
- if (top!= NULL) {
|
||||
- cert = cm_json_new_object(chain);
|
||||
- val = cm_json_new_string(cert, top, -1);
|
||||
- cm_json_set(cert, CM_SUBMIT_E_CERTIFICATE, val);
|
||||
- nthnick = talloc_asprintf(cert, "chain #%d", i + 1);
|
||||
- nick = cm_json_new_string(cert, nthnick, -1);
|
||||
- cm_json_set(cert, CM_SUBMIT_E_NICKNAME, nick);
|
||||
- cm_json_append(chain, cert);
|
||||
- }
|
||||
- if (cm_json_array_size(chain) > 0) {
|
||||
- cm_json_set(msg, CM_SUBMIT_E_CHAIN, chain);
|
||||
+ if (i == 0) {
|
||||
+ if (leaf != NULL) {
|
||||
+ cert = cm_json_new_string(msg, leaf, -1);
|
||||
+ cm_json_set(msg, CM_SUBMIT_E_CERTIFICATE, cert);
|
||||
+ }
|
||||
+ for (i = 0;
|
||||
+ (others != NULL) && (others[i] != NULL);
|
||||
+ i++) {
|
||||
+ cert = cm_json_new_object(chain);
|
||||
+ val = cm_json_new_string(cert, others[i], -1);
|
||||
+ cm_json_set(cert, CM_SUBMIT_E_CERTIFICATE, val);
|
||||
+ nthnick = talloc_asprintf(cert, "chain #%d", i + 1);
|
||||
+ nick = cm_json_new_string(cert, nthnick, -1);
|
||||
+ cm_json_set(cert, CM_SUBMIT_E_NICKNAME, nick);
|
||||
+ cm_json_append(chain, cert);
|
||||
+ }
|
||||
+ if (top!= NULL) {
|
||||
+ cert = cm_json_new_object(chain);
|
||||
+ val = cm_json_new_string(cert, top, -1);
|
||||