Importing a ca chain only imports the first certificate

[Firstyear]

A ca chain pem file is just a series of pem certs concatinated. NSS of course, when presented with a chain file will only import the first certificate, and will silently ignore the rest.

This can create user confusion who expect to be able to import a chain file.

While we can't fix NSS, we CAN fix dsctl instance tls import commands such that when a chain file is presented we can inform the user they need to split it and import the components individually.

[mreynolds389]

Related downstream bug: https://bugzilla.redhat.com/show_bug.cgi?id=1878808

[mreynolds389]

Allow CA bundles to be imported

78ee3a5..4a1e3bd 389-ds-base-2.2 -> 389-ds-base-2.2
b5e5afb..007e215 389-ds-base-2.1 -> 389-ds-base-2.1
ef2ec82..98aa09d 389-ds-base-2.0 -> 389-ds-base-2.0
ce0bda6..6f77f66 389-ds-base-1.4.4 -> 389-ds-base-1.4.4
fd904d5..1aaed99 389-ds-base-1.4.3 -> 389-ds-base-1.4.3

[mreynolds389]

Fix regression

dde3fc6..69235d8 389-ds-base-2.2 -> 389-ds-base-2.2
c9c7a01..7abaa06 389-ds-base-2.1 -> 389-ds-base-2.1
98aa09d..12bca39 389-ds-base-2.0 -> 389-ds-base-2.0
6f77f66..8cf6cfd 389-ds-base-1.4.4 -> 389-ds-base-1.4.4
1aaed99..7f311bb 389-ds-base-1.4.3 -> 389-ds-base-1.4.3

[aivanov389]

after this commit (at least, in the version 2.0, commit 98aa09d) the file security.py uses the function "log.info()". The result is that it is impossible to set some (maybe even any?) security property:

[root@ldap-model Admin]# /usr/sbin/dsconf model security set --tls-protocol-min="TLS1.2"
Error: name 'log' is not defined


[root@ldap-model Admin]# /usr/sbin/dsconf slapd-model security set --allow-weak-dh-param yes
Error: name 'log' is not defined

It's probably a mistype in the argument name of the functions "def _security_generic_get(inst, basedn, logs, args, attrs_map):" and "def _security_generic_set(inst, basedn, logs, args, attrs_map):". The argument name "logs" should be replaced by "log"?

def _security_generic_get(inst, basedn, **logs**, args, attrs_map):
    result = {}
    for attr, props in attrs_map.items():
        val = props.cls(inst).get_attr_val_utf8(props.attr)
        if val is None:
            val = ""
        result[props.attr.lower()] = val
    if args.json:
        print(json.dumps({'type': 'list', 'items': result}, indent=4))
    else:
        print('\n'.join([f'{attr}: {value or ""}' for attr, value in result.items()]))


def _security_generic_set(inst, basedn, **logs**, args, attrs_map):
    for attr, props in attrs_map.items():
        arg = getattr(args, attr.replace('-', '_'))
        if arg is None:
            continue
        dsobj = props.cls(inst)
        if arg != "":
            dsobj.replace(props.attr, arg)
        else:
            dsobj.remove_all(props.attr)
    log.info(f"Successfully updated security configuration ({props.attr})")

[progier389]

The 'log' typo is now fixed. See issue 5539

[mreynolds389]

d992302..c6613be 389-ds-base-2.2 -> 389-ds-base-2.2
fdc7a57..5f51502 389-ds-base-2.1 -> 389-ds-base-2.1
9a71f2b..332e487 389-ds-base-2.0 -> 389-ds-base-2.0
a8cb9f4..b85508b 389-ds-base-1.4.3 -> 389-ds-base-1.4.3

[mreynolds389]

Fix CI test

064a3f7..764a306 389-ds-base-2.2 -> 389-ds-base-2.2
055c14d..9476a78 389-ds-base-2.1 -> 389-ds-base-2.1
f8aca8e..0ffe4ab 389-ds-base-2.0 -> 389-ds-base-2.0
35b76e0..e10f1c6 389-ds-base-1.4.3 -> 389-ds-base-1.4.3

[progier389]

ba7ad9a4f..ee1e525b0 389-ds-base-1.4.3 -> 389-ds-base-1.4.3
Because BZ 2149967 part was not included in 1.4.3 branch unlike main and 2.x branches