Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Bug 1809273 - CRL generation performs an unindexed search. #377

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix Bug 1809273 - CRL generation performs an unindexed search. #377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions base/ca/shared/conf/crlcaissuer.ldif
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
dn: cn=allRevokedCertsByIssuer-{instanceId}, cn={database}, cn=ldbm database, cn=plugins, cn=config
objectClass: top
objectClass: vlvSearch
cn: allRevokedCertsByIssuer-{instanceId}
vlvBase: ou=certificateRepository,ou=ca,{rootSuffix}
vlvScope: 1
vlvFilter: (&(certStatus=REVOKED)(|(!(issuerName=*))(issuerName={caIssuerDN})))

dn: cn=allRevokedCertsByIssuer-{instanceId}Index, cn=allRevokedCerts-{instanceId}, cn={database}, cn=ldbm database, cn=plugins, cn=config
objectClass: top
objectClass: vlvIndex
cn: allRevokedCertsByIssuer-{instanceId}Index
vlvSort: serialno
vlvEnabled: 0
vlvUses: 0
7 changes: 7 additions & 0 deletions base/ca/shared/conf/crlcaissuertasks.ldif
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
dn: cn=index1160589779, cn=index, cn=tasks, cn=config
objectclass: top
objectclass: extensibleObject
cn: index1160589779
ttl: 10
nsinstance: {database}
nsindexVLVAttribute: allRevokedCertsByIssuer-{instanceId}
32 changes: 30 additions & 2 deletions base/server/python/pki/server/cli/db.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -806,6 +806,19 @@ def print_help(self):
print('Usage: pki-server %s-db-upgrade [OPTIONS]' % self.parent.parent.name)
print()
print(' -i, --instance <instance ID> Instance ID (default: pki-tomcat).')
if self.parent.parent.name == "ca":
print(' --action <action> update-vlv-indexes or:')
print(' fix-missing-issuer-names')
print(' (default: fix-missing-issuer-names)')
print(' --issuer_dn <Issuer DN> CA signing cert issuer dn')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be --issuer-dn.

print(' required only for update-vlv-indexes')
print(' --vlv-file <VLV File> LDIF file with desired vlv indexes')
print(' required only for update-vlv-indexes')
print(' --vlv-tasks-file <VLV Tasks> LDIF file with desired vlv tasks')
print(' required only for update-vlv-indexes')
else:
print(' --action <action> fix-missing-issuer-names')
print(' (default: fix-missing-issuer-names)')
print(' --as-current-user Run as current user.')
print(' -v, --verbose Run in verbose mode.')
print(' --debug Run in debug mode.')
Expand All @@ -816,7 +829,8 @@ def execute(self, argv):
try:
opts, _ = getopt.gnu_getopt(argv, 'i:v', [
'instance=',
'as-current-user',
'as-current-user', "action=", "issuer-dn=",
'vlv-file=', 'vlv-tasks-file=',
'verbose', 'debug', 'help'])

except getopt.GetoptError as e:
Expand All @@ -831,6 +845,7 @@ def execute(self, argv):
cmd = [subsystem_name + '-db-upgrade']

for o, a in opts:
logging.info('opt %s', o)
if o in ('-i', '--instance'):
instance_name = a

Expand All @@ -849,6 +864,20 @@ def execute(self, argv):
self.print_help()
sys.exit()

elif o == '--issuer-dn':
logging.info('--issuer-dn')
cmd.extend(['--issuer-dn', a])

elif o == '--action':
logging.info('--action')
cmd.extend(['--action', a])

elif o == '--vlv-file':
cmd.extend(['--vlv-file', a])

elif o == '--vlv-tasks-file':
cmd.extend(['--vlv-tasks-file', a])

else:
logging.error('Invalid option: %s', o)
self.print_help()
Expand All @@ -868,5 +897,4 @@ def execute(self, argv):
logging.error('No %s subsystem in instance %s.',
subsystem_name.upper(), instance_name)
sys.exit(1)

subsystem.run(cmd, as_current_user=as_current_user)
6 changes: 6 additions & 0 deletions base/server/python/pki/server/deployment/scriptlets/configuration.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -802,6 +802,12 @@ def spawn(self, deployer):
setup_db_manager=setup_db_manager,
setup_vlv_indexes=setup_vlv_indexes)

update_crl_vlv_indexes = (subsystem.type == 'CA')
if update_crl_vlv_indexes:
subsystem.update_database(
issuer_dn=deployer.mdict['pki_ca_signing_subject_dn'],
update_crl_vlv_indexes=update_crl_vlv_indexes)

# Start/Restart this Tomcat PKI Process
# Optionally prepare to enable a java debugger
# (e. g. - 'eclipse'):
Expand Down
23 changes: 23 additions & 0 deletions base/server/python/pki/server/subsystem.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -888,6 +888,29 @@ def init_database(

self.run(cmd, as_current_user=as_current_user)

def update_database(
self,
issuer_dn,
update_crl_vlv_indexes=False,
as_current_user=False):

if self.name != 'ca':
return
cmd = [self.name + '-db-upgrade']
if update_crl_vlv_indexes:
cmd.extend(['--action', 'update-vlv-indexes'])
cmd.extend(['--vlv-file', 'crlcaissuer.ldif'])
cmd.extend(['--vlv-tasks-file', 'crlcaissuertasks.ldif'])
cmd.extend(['--issuer-dn', issuer_dn])

if logger.isEnabledFor(logging.DEBUG):
cmd.append('--debug')

elif logger.isEnabledFor(logging.INFO):
cmd.append('--verbose')

self.run(cmd, as_current_user=as_current_user)

def empty_database(self, force=False, as_current_user=False):

cmd = [self.name + '-db-empty']
Expand Down
39 changes: 39 additions & 0 deletions base/server/src/com/netscape/cms/servlet/csadmin/LDAPConfigurator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,14 @@ public LDAPConfigurator(LDAPConnection connection, String instanceId, LDAPConfig
params.put("dbuser", dbuser);
}

public LDAPConfigurator(LDAPConnection connection, String instanceId, String caIssuerDN, LDAPConfig ldapConfig)
throws Exception {

this(connection,instanceId, ldapConfig);
params.put("caIssuerDN", caIssuerDN);

}

public LDAPConnection getConnection() {
return connection;
}
Expand Down Expand Up @@ -148,6 +156,37 @@ public void createVLVIndexes(String subsystem) throws Exception {
importFile("/usr/share/pki/" + subsystem + "/conf/vlv.ldif", true);
}

public void createAdditionalVLVIndexes(String subsystem, String vlvLdifFileName) throws Exception {
logger.info("Creating additional VLV indexes in file: ", vlvLdifFileName);

importFile("/usr/share/pki/" + subsystem + "/conf/" + vlvLdifFileName,true);
}

public void rebuildAdditionalVLVIndexes(String subsystem, String vlvTasksFileName) throws Exception {
logger.info("Rebuilding Additional VLV indexes in file: ", vlvTasksFileName);

File file = new File("/usr/share/pki/" + subsystem + "/conf/" + vlvTasksFileName);
File tmpFile = File.createTempFile("pki-" + subsystem + "-reindex-additional", ".ldif");

try {
customizeFile(file, tmpFile);

LDIF ldif = new LDIF(tmpFile.getAbsolutePath());
LDIFRecord record = ldif.nextRecord();
if (record == null)
return;

importLDIFRecord(record, false);

String dn = record.getDN();
waitForTask(dn);

} finally {
tmpFile.delete();
}

}

public void rebuildVLVIndexes(String subsystem) throws Exception {

logger.info("Rebuilding VLV indexes");
Expand Down
102 changes: 101 additions & 1 deletion base/server/src/org/dogtagpki/server/cli/CADBUpgradeCLI.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,17 +18,25 @@

package org.dogtagpki.server.cli;

import java.security.cert.CertificateException;

import org.apache.commons.cli.CommandLine;
import org.apache.commons.cli.Option;
import org.apache.commons.lang.StringUtils;
import org.dogtagpki.cli.CLI;
import org.mozilla.jss.netscape.security.x509.X509CertImpl;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.netscape.certsrv.base.EBaseException;
import com.netscape.cms.servlet.csadmin.LDAPConfigurator;
import com.netscape.cmscore.ldapconn.LDAPConfig;
import com.netscape.cmscore.ldapconn.LdapBoundConnection;

import netscape.ldap.LDAPAttribute;
import netscape.ldap.LDAPAttributeSet;
import netscape.ldap.LDAPEntry;
import netscape.ldap.LDAPException;
import netscape.ldap.LDAPModification;
import netscape.ldap.LDAPSearchResults;
import netscape.ldap.LDAPv3;
Expand All @@ -44,13 +52,68 @@ public CADBUpgradeCLI(CLI parent) {
super("upgrade", "Upgrade CA database", parent);
}

public void upgrade(LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exception {
public void createOptions() {

Option action = new Option(null, "action", true, "Desired CA database upgrade action");
action.setArgName("action");
options.addOption(action);


Option issuerDn = new Option(null, "issuer-dn", true, "Optional CA issuer DN");
issuerDn.setArgName("issuer-dn");
options.addOption(issuerDn);

Option vlvFile = new Option(null,"vlv-file",true, "Vlv file to update vlv indexes");
vlvFile.setArgName("vlv-file");
options.addOption(vlvFile);

Option vlvTasksFile = new Option(null,"vlv-tasks-file",true, "Vlv tasks file to update vlv indexes");
vlvTasksFile.setArgName("vlv-tasks-file");
options.addOption(vlvTasksFile);

}

public void execute(CommandLine cmd) throws Exception {
this.cmd = cmd;
super.execute(cmd);
}

public void upgrade(String instanceId, LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exception {

if (cmd.hasOption("action")) {
String caIssuerDn = null;
String actionVal = cmd.getOptionValue("action");
logger.info("Attempting to execute a specific action: " + actionVal);

if (cmd.hasOption("issuer-dn")) {
caIssuerDn = cmd.getOptionValue("issuer-dn");
}

if ("update-vlv-indexes".equals(actionVal)) {
updateVlvIndexes(instanceId, caIssuerDn, ldapConfig, conn);
return;
} else if ("fix-missing-issuer-names".equals(actionVal)) {
fixMissingIssuerNames(ldapConfig, conn);
return;
} else {
logger.info("Invalid action requested: " + actionVal);
return;
}
}

//Take default action which is to upgrade the db with missing issuerNames
fixMissingIssuerNames(ldapConfig, conn);
}

private void fixMissingIssuerNames(LDAPConfig ldapConfig, LdapBoundConnection conn)
throws EBaseException, LDAPException, CertificateException {

logger.info("Searching certificates records with missing issuerName");

String baseDN = ldapConfig.getBaseDN();
String certRepoDN = "ou=certificateRepository,ou=ca," + baseDN;


LDAPSearchResults results = conn.search(
certRepoDN,
LDAPv3.SCOPE_ONE,
Expand Down Expand Up @@ -79,4 +142,41 @@ public void upgrade(LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exce
conn.modify(entry.getDN(), mods);
}
}

private void updateVlvIndexes(String instanceId, String caIssuerDn, LDAPConfig ldapConfig, LdapBoundConnection conn)
throws Exception {

String actionVal = cmd.getOptionValue("action");

if (StringUtils.isEmpty(actionVal)) {
logger.info("Invalid number of args for updateVlvIndexes");
return;
}

if (!cmd.hasOption("vlv-file")) {
logger.info("Command must have a value for argument vlv-file");
return;
}

if (StringUtils.isEmpty(caIssuerDn)) {
logger.info("Command must have a value for argument issuerDN ");
return;
}

String vlvName = cmd.getOptionValue("vlv-file");
String vlvTasksName = cmd.getOptionValue("vlv-tasks-file");

if (StringUtils.isEmpty(vlvName) || StringUtils.isEmpty(vlvTasksName)) {
logger.info("Command must include vlv-fle and vlv-tasks-file arguments");
return;
}

LDAPConfigurator ldapConfigurator = new LDAPConfigurator(conn, instanceId, caIssuerDn, ldapConfig);

ldapConfigurator.createAdditionalVLVIndexes("ca", vlvName);
ldapConfigurator.rebuildAdditionalVLVIndexes("ca", vlvTasksName);

}

private CommandLine cmd = null;
}
4 changes: 2 additions & 2 deletions base/server/src/org/dogtagpki/server/cli/SubsystemDBUpgradeCLI.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ public void execute(CommandLine cmd) throws Exception {
LdapBoundConnection conn = new LdapBoundConnection(socketFactory, connInfo, authInfo);

try {
upgrade(ldapConfig, conn);
upgrade(instanceId, ldapConfig, conn);

} finally {
conn.disconnect();
Expand All @@ -126,6 +126,6 @@ public void execute(CommandLine cmd) throws Exception {
System.out.println(parent.parent.name.toUpperCase() + " database upgraded");
}

public void upgrade(LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exception {
public void upgrade(String instanceId,LDAPConfig ldapConfig, LdapBoundConnection conn) throws Exception {
}
}