ipa/SOURCES/0018-ipa_upgrade_handle_double-encoded_certificates_rhbz#1658310.patch
2021-09-10 11:03:31 +00:00

154 lines
5.9 KiB
Diff

From 8ee3779ded64ff55c3981fb8c2db50cdcd3abc5b Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Nov 30 2018 14:20:59 +0000
Subject: ipa upgrade: handle double-encoded certificates
Issue is linked to the ticket
#3477 LDAP upload CA cert sometimes double-encodes the value
In old FreeIPA releases (< 3.2), the upgrade plugin was encoding twice
the value of the certificate in cn=cacert,cn=ipa,cn=etc,$BASEDN.
The fix for 3477 is only partial as it prevents double-encoding when a
new cert is uploaded but does not fix wrong values already present in LDAP.
With this commit, the code first tries to read a der cert. If it fails,
it logs a debug message and re-writes the value caCertificate;binary
to repair the entry.
Fixes https://pagure.io/freeipa/issue/7775
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
---
diff --git a/ipaserver/install/plugins/upload_cacrt.py b/ipaserver/install/plugins/upload_cacrt.py
index 85c67e7..763da1e 100644
--- a/ipaserver/install/plugins/upload_cacrt.py
+++ b/ipaserver/install/plugins/upload_cacrt.py
@@ -115,7 +115,18 @@ class update_upload_cacrt(Updater):
entry.single_value['cACertificate;binary'] = ca_cert
ldap.add_entry(entry)
else:
- if b'' in entry['cACertificate;binary']:
+ force_write = False
+ try:
+ _cert_bin = entry['cACertificate;binary']
+ except ValueError:
+ # BZ 1644874
+ # sometimes the cert is badly stored, twice encoded
+ # force write to fix the value
+ logger.debug('Fixing the value of cACertificate;binary '
+ 'in entry %s', entry.dn)
+ force_write = True
+
+ if force_write or b'' in entry['cACertificate;binary']:
entry.single_value['cACertificate;binary'] = ca_cert
ldap.update_entry(entry)
From 2b0f3a1abb9067a0a5ba8e59762bc41dc51608e2 Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Nov 30 2018 14:20:59 +0000
Subject: ipatests: add upgrade test for double-encoded cacert
Create a test for upgrade with the following scenario:
- install master
- write a double-encoded cert in the entry
cn=cacert,,cn=ipa,cn=etc,$basedn
to simulate bug 7775
- call ipa-server-upgrade
- check that the upgrade fixed the value
The upgrade should finish successfully and repair
the double-encoded cert.
Related to https://pagure.io/freeipa/issue/7775
Reviewed-By: Christian Heimes <cheimes@redhat.com>
---
diff --git a/ipatests/test_integration/test_upgrade.py b/ipatests/test_integration/test_upgrade.py
index cbf5f39..e0175bc 100644
--- a/ipatests/test_integration/test_upgrade.py
+++ b/ipatests/test_integration/test_upgrade.py
@@ -6,6 +6,9 @@
Module provides tests to verify that the upgrade script works.
"""
+import base64
+from cryptography.hazmat.primitives import serialization
+from ipapython.dn import DN
from ipatests.test_integration.base import IntegrationTest
from ipatests.pytest_ipa.integration import tasks
@@ -21,3 +24,35 @@ class TestUpgrade(IntegrationTest):
assert ("DN: cn=Schema Compatibility,cn=plugins,cn=config does not \
exists or haven't been updated" not in cmd.stdout_text)
assert cmd.returncode == 0
+
+ def test_double_encoded_cacert(self):
+ """Test for BZ 1644874
+
+ In old IPA version, the entry cn=CAcert,cn=ipa,cn=etc,$basedn
+ could contain a double-encoded cert, which leads to ipa-server-upgrade
+ failure.
+ Force a double-encoded value then call upgrade to check the fix.
+ """
+ # Read the current entry from LDAP
+ ldap = self.master.ldap_connect()
+ basedn = self.master.domain.basedn # pylint: disable=no-member
+ dn = DN(('cn', 'CAcert'), ('cn', 'ipa'), ('cn', 'etc'), basedn)
+ entry = ldap.get_entry(dn) # pylint: disable=no-member
+ # Extract the certificate as DER then double-encode
+ cacert = entry['cacertificate;binary'][0]
+ cacert_der = cacert.public_bytes(serialization.Encoding.DER)
+ cacert_b64 = base64.b64encode(cacert_der)
+ # overwrite the value with double-encoded cert
+ entry.single_value['cACertificate;binary'] = cacert_b64
+ ldap.update_entry(entry) # pylint: disable=no-member
+
+ # try the upgrade
+ self.master.run_command(['ipa-server-upgrade'])
+
+ # read the value after upgrade, should be fixed
+ entry = ldap.get_entry(dn) # pylint: disable=no-member
+ try:
+ _cacert = entry['cacertificate;binary']
+ except ValueError:
+ raise AssertionError('%s contains a double-encoded cert'
+ % entry.dn)
From 2a299c786f93e67446d5fd227fe14884b4e0d293 Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Dec 06 2018 10:37:26 +0000
Subject: ipatests: fix TestUpgrade::test_double_encoded_cacert
The test is using a stale ldap connection to the master
(obtained before calling upgrade, and the upgrade stops
and starts 389-ds, breaking the connection).
The fix re-connects before using the ldap handle.
Related to https://pagure.io/freeipa/issue/7775
---
diff --git a/ipatests/test_integration/test_upgrade.py b/ipatests/test_integration/test_upgrade.py
index e0175bc..5cc890e 100644
--- a/ipatests/test_integration/test_upgrade.py
+++ b/ipatests/test_integration/test_upgrade.py
@@ -49,6 +49,8 @@ class TestUpgrade(IntegrationTest):
# try the upgrade
self.master.run_command(['ipa-server-upgrade'])
+ # reconnect to the master (upgrade stops 389-ds)
+ ldap = self.master.ldap_connect()
# read the value after upgrade, should be fixed
entry = ldap.get_entry(dn) # pylint: disable=no-member
try: