Fix Bug 1809273 - CRL generation performs an unindexed search.

base/ca/shared/conf/crlcaissuer.ldif

@@ -0,0 +1,15 @@
+dn: cn=allRevokedCertsByIssuer-{instanceId}, cn={database}, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: vlvSearch
+cn: allRevokedCertsByIssuer-{instanceId}
+vlvBase: ou=certificateRepository,ou=ca,{rootSuffix}
+vlvScope: 1
+vlvFilter: (&(certStatus=REVOKED)(|(!(issuerName=*))(issuerName={caIssuerDN}))) 
+
+dn: cn=allRevokedCertsByIssuer-{instanceId}Index, cn=allRevokedCerts-{instanceId}, cn={database}, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: vlvIndex
+cn: allRevokedCertsByIssuer-{instanceId}Index
+vlvSort: serialno
+vlvEnabled: 0
+vlvUses: 0

base/ca/shared/conf/crlcaissuertasks.ldif

@@ -0,0 +1,7 @@
+dn: cn=index1160589779, cn=index, cn=tasks, cn=config
+objectclass: top
+objectclass: extensibleObject
+cn: index1160589779
+ttl: 10
+nsinstance: {database}
+nsindexVLVAttribute: allRevokedCertsByIssuer-{instanceId}

base/server/python/pki/server/cli/db.py

@@ -806,6 +806,19 @@ def print_help(self):
         print('Usage: pki-server %s-db-upgrade [OPTIONS]' % self.parent.parent.name)
         print()
         print('  -i, --instance <instance ID>       Instance ID (default: pki-tomcat).')
+        if self.parent.parent.name == "ca":
+            print('      --action <action>              update-vlv-indexes or:')
+            print('                                         fix-missing-issuer-names')
+            print('                                         (default: fix-missing-issuer-names)')
+            print('      --issuer_dn <Issuer DN>        CA signing cert issuer dn')
+            print('                                         required only for update-vlv-indexes')
+            print('      --vlv-file <VLV File>          LDIF file with desired vlv indexes')
+            print('                                         required only for update-vlv-indexes')
+            print('      --vlv-tasks-file <VLV Tasks>   LDIF file with desired vlv tasks')
+            print('                                         required only for update-vlv-indexes')
+        else:
+            print('      --action <action>              fix-missing-issuer-names')
+            print('                                         (default: fix-missing-issuer-names)')
         print('      --as-current-user              Run as current user.')
         print('  -v, --verbose                      Run in verbose mode.')
         print('      --debug                        Run in debug mode.')
@@ -816,7 +829,8 @@ def execute(self, argv):
         try:
             opts, _ = getopt.gnu_getopt(argv, 'i:v', [
                 'instance=',
-                'as-current-user',
+                'as-current-user', "action=", "issuer-dn=",
+                'vlv-file=', 'vlv-tasks-file=',
                 'verbose', 'debug', 'help'])
 
         except getopt.GetoptError as e:
@@ -831,6 +845,7 @@ def execute(self, argv):
         cmd = [subsystem_name + '-db-upgrade']
 
         for o, a in opts:
+            logging.info('opt %s', o)
             if o in ('-i', '--instance'):
                 instance_name = a
 
@@ -849,6 +864,20 @@ def execute(self, argv):
                 self.print_help()
                 sys.exit()
 
+            elif o == '--issuer-dn':
+                logging.info('--issuer-dn')
+                cmd.extend(['--issuer-dn', a])
+
+            elif o == '--action':
+                logging.info('--action')
+                cmd.extend(['--action', a])
+
+            elif o == '--vlv-file':
+                cmd.extend(['--vlv-file', a])
+
+            elif o == '--vlv-tasks-file':
+                cmd.extend(['--vlv-tasks-file', a])
+
             else:
                 logging.error('Invalid option: %s', o)
                 self.print_help()
@@ -868,5 +897,4 @@ def execute(self, argv):
             logging.error('No %s subsystem in instance %s.',
                           subsystem_name.upper(), instance_name)
             sys.exit(1)
-
         subsystem.run(cmd, as_current_user=as_current_user)

base/server/python/pki/server/deployment/scriptlets/configuration.py

@@ -802,6 +802,12 @@ def spawn(self, deployer):
             setup_db_manager=setup_db_manager,
             setup_vlv_indexes=setup_vlv_indexes)
 
+        update_crl_vlv_indexes = (subsystem.type == 'CA')
+        if update_crl_vlv_indexes:
+            subsystem.update_database(
+                issuer_dn=deployer.mdict['pki_ca_signing_subject_dn'],
+                update_crl_vlv_indexes=update_crl_vlv_indexes)
+
         # Start/Restart this Tomcat PKI Process
         # Optionally prepare to enable a java debugger
         # (e. g. - 'eclipse'):

base/server/python/pki/server/subsystem.py

@@ -888,6 +888,29 @@ def init_database(
 
         self.run(cmd, as_current_user=as_current_user)
 
+    def update_database(
+            self,
+            issuer_dn,
+            update_crl_vlv_indexes=False,
+            as_current_user=False):
+
+        if self.name != 'ca':
+            return
+        cmd = [self.name + '-db-upgrade']
+        if update_crl_vlv_indexes:
+            cmd.extend(['--action', 'update-vlv-indexes'])
+            cmd.extend(['--vlv-file', 'crlcaissuer.ldif'])
+            cmd.extend(['--vlv-tasks-file', 'crlcaissuertasks.ldif'])
+            cmd.extend(['--issuer-dn', issuer_dn])
+
+        if logger.isEnabledFor(logging.DEBUG):
+            cmd.append('--debug')
+
+        elif logger.isEnabledFor(logging.INFO):
+            cmd.append('--verbose')
+
+        self.run(cmd, as_current_user=as_current_user)
+
     def empty_database(self, force=False, as_current_user=False):
 
         cmd = [self.name + '-db-empty']

base/server/src/com/netscape/cms/servlet/csadmin/LDAPConfigurator.java

@@ -76,6 +76,14 @@ public LDAPConfigurator(LDAPConnection connection, String instanceId, LDAPConfig
         params.put("dbuser", dbuser);
     }
 
+    public LDAPConfigurator(LDAPConnection connection, String instanceId, String caIssuerDN, LDAPConfig ldapConfig)
+            throws Exception {
+
+        this(connection,instanceId, ldapConfig);
+        params.put("caIssuerDN", caIssuerDN);
+
+    }
+
     public LDAPConnection getConnection() {
         return connection;
     }
@@ -148,6 +156,37 @@ public void createVLVIndexes(String subsystem) throws Exception {
         importFile("/usr/share/pki/" + subsystem + "/conf/vlv.ldif", true);
     }
 
+    public void createAdditionalVLVIndexes(String subsystem, String vlvLdifFileName) throws Exception {
+        logger.info("Creating additional  VLV indexes in file: ", vlvLdifFileName);
+
+        importFile("/usr/share/pki/" + subsystem + "/conf/" + vlvLdifFileName,true);
+    }
+
+    public void rebuildAdditionalVLVIndexes(String subsystem, String vlvTasksFileName) throws Exception {
+        logger.info("Rebuilding Additional VLV indexes in file: ", vlvTasksFileName);
+
+        File file = new File("/usr/share/pki/" + subsystem + "/conf/" + vlvTasksFileName);
+        File tmpFile = File.createTempFile("pki-" + subsystem + "-reindex-additional", ".ldif");
+
+        try {
+            customizeFile(file, tmpFile);
+
+            LDIF ldif = new LDIF(tmpFile.getAbsolutePath());
+            LDIFRecord record = ldif.nextRecord();
+            if (record == null)
+                return;
+
+            importLDIFRecord(record, false);
+
+            String dn = record.getDN();
+            waitForTask(dn);
+
+        } finally {
+            tmpFile.delete();
+        }
+
+    }
+
     public void rebuildVLVIndexes(String subsystem) throws Exception {
 
         logger.info("Rebuilding VLV indexes");

base/server/src/org/dogtagpki/server/cli/CADBUpgradeCLI.java

@@ -18,17 +18,25 @@
 
 package org.dogtagpki.server.cli;
 
+import java.security.cert.CertificateException;
+
+import org.apache.commons.cli.CommandLine;
+import org.apache.commons.cli.Option;
+import org.apache.commons.lang.StringUtils;
 import org.dogtagpki.cli.CLI;
 import org.mozilla.jss.netscape.security.x509.X509CertImpl;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.netscape.certsrv.base.EBaseException;
+import com.netscape.cms.servlet.csadmin.LDAPConfigurator;
 import com.netscape.cmscore.ldapconn.LDAPConfig;
 import com.netscape.cmscore.ldapconn.LdapBoundConnection;
 
 import netscape.ldap.LDAPAttribute;
 import netscape.ldap.LDAPAttributeSet;
 import netscape.ldap.LDAPEntry;
+import netscape.ldap.LDAPException;
 import netscape.ldap.LDAPModification;
 import netscape.ldap.LDAPSearchResults;
 import netscape.ldap.LDAPv3;
@@ -44,13 +52,68 @@ public CADBUpgradeCLI(CLI parent) {
         super("upgrade", "Upgrade CA database", parent);
     }
 
-    public void upgrade(LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exception {
+    public void createOptions() {
+
+        Option action = new Option(null, "action", true, "Desired CA database upgrade action");
+        action.setArgName("action");
+        options.addOption(action);
+
+
+        Option issuerDn = new Option(null, "issuer-dn", true, "Optional CA issuer DN");
+        issuerDn.setArgName("issuer-dn");
+        options.addOption(issuerDn);
+
+        Option vlvFile = new Option(null,"vlv-file",true, "Vlv file to update vlv indexes");
+        vlvFile.setArgName("vlv-file");
+        options.addOption(vlvFile);
+
+        Option vlvTasksFile = new Option(null,"vlv-tasks-file",true, "Vlv tasks file to update vlv indexes");
+        vlvTasksFile.setArgName("vlv-tasks-file");
+        options.addOption(vlvTasksFile);
+
+    }
+
+    public void execute(CommandLine cmd) throws Exception {
+        this.cmd = cmd;
+        super.execute(cmd);
+    }
+
+    public void upgrade(String instanceId, LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exception {
+
+        if (cmd.hasOption("action")) {
+            String caIssuerDn = null;
+            String actionVal = cmd.getOptionValue("action");
+            logger.info("Attempting to execute a specific action: " + actionVal);
+
+            if (cmd.hasOption("issuer-dn")) {
+                caIssuerDn = cmd.getOptionValue("issuer-dn");
+            }
+
+            if ("update-vlv-indexes".equals(actionVal)) {
+                updateVlvIndexes(instanceId, caIssuerDn, ldapConfig, conn);
+                return;
+            } else if ("fix-missing-issuer-names".equals(actionVal)) {
+                fixMissingIssuerNames(ldapConfig, conn);
+                return;
+            } else {
+                logger.info("Invalid action requested: " + actionVal);
+                return;
+            }
+        }
+
+        //Take default action which is to upgrade the db with missing issuerNames
+        fixMissingIssuerNames(ldapConfig, conn);
+    }
+
+    private void fixMissingIssuerNames(LDAPConfig ldapConfig, LdapBoundConnection conn)
+            throws EBaseException, LDAPException, CertificateException {
 
         logger.info("Searching certificates records with missing issuerName");
 
         String baseDN = ldapConfig.getBaseDN();
         String certRepoDN = "ou=certificateRepository,ou=ca," + baseDN;
 
+
         LDAPSearchResults results = conn.search(
                 certRepoDN,
                 LDAPv3.SCOPE_ONE,
@@ -79,4 +142,41 @@ public void upgrade(LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exce
             conn.modify(entry.getDN(), mods);
         }
     }
+
+    private void updateVlvIndexes(String instanceId, String caIssuerDn, LDAPConfig ldapConfig, LdapBoundConnection conn)
+            throws Exception {
+
+        String actionVal = cmd.getOptionValue("action");
+
+        if (StringUtils.isEmpty(actionVal)) {
+            logger.info("Invalid number of args for updateVlvIndexes");
+            return;
+        }
+
+        if (!cmd.hasOption("vlv-file")) {
+            logger.info("Command must have a value for argument vlv-file");
+            return;
+        }
+
+        if (StringUtils.isEmpty(caIssuerDn)) {
+            logger.info("Command must have a value for argument issuerDN ");
+            return;
+        }
+
+        String vlvName = cmd.getOptionValue("vlv-file");
+        String vlvTasksName = cmd.getOptionValue("vlv-tasks-file");
+
+        if (StringUtils.isEmpty(vlvName) || StringUtils.isEmpty(vlvTasksName)) {
+            logger.info("Command must include vlv-fle and vlv-tasks-file arguments");
+            return;
+        }
+
+        LDAPConfigurator ldapConfigurator = new LDAPConfigurator(conn, instanceId, caIssuerDn, ldapConfig);
+
+        ldapConfigurator.createAdditionalVLVIndexes("ca", vlvName);
+        ldapConfigurator.rebuildAdditionalVLVIndexes("ca", vlvTasksName);
+
+    }
+
+    private CommandLine cmd = null;
 }

base/server/src/org/dogtagpki/server/cli/SubsystemDBUpgradeCLI.java

@@ -117,7 +117,7 @@ public void execute(CommandLine cmd) throws Exception {
         LdapBoundConnection conn = new LdapBoundConnection(socketFactory, connInfo, authInfo);
 
         try {
-            upgrade(ldapConfig, conn);
+            upgrade(instanceId, ldapConfig, conn);
 
         } finally {
             conn.disconnect();
@@ -126,6 +126,6 @@ public void execute(CommandLine cmd) throws Exception {
         System.out.println(parent.parent.name.toUpperCase() + " database upgraded");
     }
 
-    public void upgrade(LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exception {
+    public void upgrade(String instanceId,LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exception {
     }
 }