From fbdb8d864c084c616809b04d52681f2199c3003b Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Fri, 12 Jan 2024 09:50:31 -0500 Subject: [PATCH] Skip DogtagCertsConfigCheck for PKI versions 11.5.0 Certificates are no longer stored in CS.cfg in 11.5.0+ Resolves: RHEL-21367 --- ...sConfigCheck-for-PKI-versions-11.5.0.patch | 46 +++++++++++++++ ...I-11.5.0-not-storing-certs-in-CS.cfg.patch | 59 +++++++++++++++++++ freeipa-healthcheck.spec | 7 ++- 3 files changed, 111 insertions(+), 1 deletion(-) create mode 100644 0004-Skip-DogtagCertsConfigCheck-for-PKI-versions-11.5.0.patch create mode 100644 0005-test-Handle-PKI-11.5.0-not-storing-certs-in-CS.cfg.patch diff --git a/0004-Skip-DogtagCertsConfigCheck-for-PKI-versions-11.5.0.patch b/0004-Skip-DogtagCertsConfigCheck-for-PKI-versions-11.5.0.patch new file mode 100644 index 0000000..a31c062 --- /dev/null +++ b/0004-Skip-DogtagCertsConfigCheck-for-PKI-versions-11.5.0.patch @@ -0,0 +1,46 @@ +From e556edc0b1cb607caa50f760d5059877f35fbcdc Mon Sep 17 00:00:00 2001 +From: Rob Crittenden +Date: Thu, 11 Jan 2024 14:40:02 -0500 +Subject: [PATCH] Skip DogtagCertsConfigCheck for PKI versions >= 11.5.0 + +In 11.5.0 the PKI project stopped storing the certificate +blobs in CS.cfg. If we continue to check it we will report a +false positive so skip it in that case. + +Fixes: https://github.com/freeipa/freeipa-healthcheck/issues/317 + +Signed-off-by: Rob Crittenden +--- + src/ipahealthcheck/dogtag/ca.py | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/src/ipahealthcheck/dogtag/ca.py b/src/ipahealthcheck/dogtag/ca.py +index 4afa5d7..ddf5ece 100644 +--- a/src/ipahealthcheck/dogtag/ca.py ++++ b/src/ipahealthcheck/dogtag/ca.py +@@ -16,6 +16,8 @@ from ipaserver.install import krainstance + from ipapython.directivesetter import get_directive + from cryptography.hazmat.primitives.serialization import Encoding + ++import pki.util ++ + logger = logging.getLogger() + + +@@ -30,6 +32,13 @@ class DogtagCertsConfigCheck(DogtagPlugin): + logger.debug("No CA configured, skipping dogtag config check") + return + ++ pki_version = pki.util.Version(pki.specification_version()) ++ if pki_version >= pki.util.Version("11.5.0"): ++ logger.debug( ++ "PKI 11.5.0 no longer stores certificats in CS.cfg" ++ ) ++ return ++ + kra = krainstance.KRAInstance(api.env.realm) + + blobs = {'auditSigningCert cert-pki-ca': 'ca.audit_signing.cert', +-- +2.42.0 + diff --git a/0005-test-Handle-PKI-11.5.0-not-storing-certs-in-CS.cfg.patch b/0005-test-Handle-PKI-11.5.0-not-storing-certs-in-CS.cfg.patch new file mode 100644 index 0000000..3c62ac0 --- /dev/null +++ b/0005-test-Handle-PKI-11.5.0-not-storing-certs-in-CS.cfg.patch @@ -0,0 +1,59 @@ +From cafe01a23a36c408c8c60357ad2651688dc63599 Mon Sep 17 00:00:00 2001 +From: Rob Crittenden +Date: Fri, 12 Jan 2024 10:17:18 -0500 +Subject: [PATCH] test: Handle PKI >= 11.5.0 not storing certs in CS.cfg + +Update the test to expect 0 results if the PKI version is +>= 11.5.0. + +Fixes: https://github.com/freeipa/freeipa-healthcheck/issues/317 + +Signed-off-by: Rob Crittenden +--- + tests/test_dogtag_ca.py | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tests/test_dogtag_ca.py b/tests/test_dogtag_ca.py +index 0820aba..1f61dea 100644 +--- a/tests/test_dogtag_ca.py ++++ b/tests/test_dogtag_ca.py +@@ -2,12 +2,16 @@ + # Copyright (C) 2019 FreeIPA Contributors see COPYING for license + # + ++import pki.util + from util import capture_results, CAInstance, KRAInstance + from base import BaseTest + from ipahealthcheck.core import config, constants + from ipahealthcheck.dogtag.plugin import registry + from ipahealthcheck.dogtag.ca import DogtagCertsConfigCheck + from unittest.mock import Mock, patch ++import pytest ++ ++pki_version = pki.util.Version(pki.specification_version()) + + + class mock_Cert: +@@ -43,6 +47,9 @@ class TestCACerts(BaseTest): + Mock(return_value=KRAInstance()), + } + ++ @pytest.mark.skipif( ++ pki_version >= pki.util.Version("11.5.0"), ++ reason='Does not apply to PKI 11.5.0+') + @patch('ipahealthcheck.dogtag.ca.get_directive') + @patch('ipaserver.install.certs.CertDB') + def test_ca_certs_ok(self, mock_certdb, mock_directive): +@@ -71,6 +78,9 @@ class TestCACerts(BaseTest): + assert result.source == 'ipahealthcheck.dogtag.ca' + assert result.check == 'DogtagCertsConfigCheck' + ++ @pytest.mark.skipif( ++ pki_version >= pki.util.Version("11.5.0"), ++ reason='Does not apply to PKI 11.5.0+') + @patch('ipahealthcheck.dogtag.ca.get_directive') + @patch('ipaserver.install.certs.CertDB') + def test_cert_missing_from_file(self, mock_certdb, mock_directive): +-- +2.42.0 + diff --git a/freeipa-healthcheck.spec b/freeipa-healthcheck.spec index 96ae015..558f23a 100644 --- a/freeipa-healthcheck.spec +++ b/freeipa-healthcheck.spec @@ -17,7 +17,7 @@ Name: %{prefix}-healthcheck Version: 0.16 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Health check tool for %{productname} BuildArch: noarch License: GPLv3 @@ -28,6 +28,8 @@ Source1: ipahealthcheck.conf Patch0001: 0001-Remove-ipaclustercheck.patch Patch0002: 0002-Don-t-fail-if-a-service-name-cannot-be-looked-up-in-.patch Patch0003: 0003-Temporarily-disable-the-ipa-ods-exporter-service-sta.patch +Patch0004: 0004-Skip-DogtagCertsConfigCheck-for-PKI-versions-11.5.0.patch +Patch0005: 0005-test-Handle-PKI-11.5.0-not-storing-certs-in-CS.cfg.patch Requires: %{name}-core = %{version}-%{release} Requires: %{prefix}-server @@ -157,6 +159,9 @@ PYTHONPATH=src PATH=$PATH:$RPM_BUILD_ROOT/usr/bin pytest-3 tests/test_* %changelog +* Fri Jan 12 2024 Rob Crittenden - 0.16-3 +- Skip DogtagCertsConfigCheck for PKI versions 11.5.0 (RHEL-21367) + * Tue Nov 14 2023 Rob Crittenden - 0.16-2 - Don't fail if a service name cannot be looked up in LDAP - Disable the ipa-ods-exporter service check