Explicit SSNv2 hex input #4893
Explicit SSNv2 hex input #4893
Conversation
| if config.str2bool(self.mdict['pki_random_serial_numbers_enable']): | ||
| subsystem.set_config('dbs.enableRandomSerialNumbers', 'true') | ||
| subsystem.set_config('dbs.randomSerialNumberCounter', '0') |
There was a problem hiding this comment.
I'm thinking to disallow this param for SSNv2 and ask the admin to use RSNv3 instead. We can do that separately later.
There was a problem hiding this comment.
Is there a reason to explicitly avoid this configuration? It should work.
| if key_id_generator == 'legacy2': | ||
| serial_dn = 'ou=keyRepository,ou=ranges_v2' | ||
| else: | ||
| serial_dn = 'ou=keyRepository,ou=ranges' | ||
| subsystem.set_config('dbs.serialRangeDN', serial_dn) |
There was a problem hiding this comment.
We can simplify this code since the generator can only be legacy2 here. Same thing for the legacy case above.
.github/workflows/ca-ssnv2-test.yml
Outdated
| #################################################################################################### | ||
| # Try to install with wrong parameter foramt | ||
| - name: Create CA with unsupported range format |
There was a problem hiding this comment.
Typo: foramt
We probably should run this step before the correct pkispawn invocation. That will simulate the actual scenario that people might encounter, i.e. run pkispawn with the wrong params first, then rerun it with the correct params.
| serial_dn = 'ou=keyRepository,ou=ranges' | ||
| subsystem.set_config('dbs.serialRangeDN', serial_dn) | ||
|
|
||
| else: #random |
There was a problem hiding this comment.
I think pylint requires 2 spaces before the # sign.
Since SSNv2 ranges number requires the format `0x...` to be correctly interpreted as hex number, an exception is introduced when a decimal number is provided. This approach make explicit the hex or dec number are in use and avoid later problems.
fmarco76
force-pushed
the
explicitSSNv2HexInput
branch
from
8b3b298 to
688b516
Compare
fmarco76
force-pushed
the
explicitSSNv2HexInput
branch
from
688b516 to
9d8b059
Compare
|
@edewata Thanks! I have updated to fix your comments. It remains the doubt if the SSNv2 with random should be supported which I think it is acceptable. If it is not the case we can fix in following PRs. |
|
When
legacy2generator is in use the hex input parameter must have the0x...format. If decimal value are provided thepkispawnfails to make aware the user on what value are used.