Fix ops flag mask master #4649
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,136 @@ | ||
| name: CA with HSM and custom operation key flags | ||
|
|
||
| on: workflow_call | ||
|
|
||
| env: | ||
| DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }} | ||
|
|
||
| jobs: | ||
| # docs/installation/ca/Installing_CA_with_HSM.md | ||
| test: | ||
| name: Test | ||
| runs-on: ubuntu-latest | ||
| env: | ||
| SHARED: /tmp/workdir/pki | ||
| steps: | ||
| - name: Clone repository | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Retrieve PKI images | ||
| uses: actions/cache@v3 | ||
| with: | ||
| key: pki-images-${{ github.sha }} | ||
| path: pki-images.tar | ||
|
|
||
| - name: Load PKI images | ||
| run: docker load --input pki-images.tar | ||
|
|
||
| - name: Create network | ||
| run: docker network create example | ||
|
|
||
| - name: Set up DS container | ||
| run: | | ||
| tests/bin/ds-container-create.sh ds | ||
| env: | ||
| IMAGE: ${{ env.DB_IMAGE }} | ||
| HOSTNAME: ds.example.com | ||
| PASSWORD: Secret.123 | ||
|
|
||
| - name: Connect DS container to network | ||
| run: docker network connect example ds --alias ds.example.com | ||
|
|
||
| - name: Set up PKI container | ||
| run: | | ||
| tests/bin/runner-init.sh pki | ||
| env: | ||
| HOSTNAME: pki.example.com | ||
|
|
||
| - name: Connect PKI container to network | ||
| run: docker network connect example pki --alias pki.example.com | ||
|
|
||
| - name: Install dependencies | ||
| run: | | ||
| docker exec pki dnf install -y softhsm | ||
|
|
||
| - name: Create SoftHSM token | ||
| run: | | ||
| # allow PKI user to access SoftHSM files | ||
| docker exec pki usermod pkiuser -a -G ods | ||
|
|
||
| # create SoftHSM token for PKI server | ||
| docker exec pki runuser -u pkiuser -- \ | ||
| softhsm2-util \ | ||
| --init-token \ | ||
| --label HSM \ | ||
| --so-pin Secret.HSM \ | ||
| --pin Secret.HSM \ | ||
| --free | ||
|
|
||
| docker exec pki ls -laR /var/lib/softhsm/tokens | ||
|
|
||
| - name: Install CA with HSM and no sign flag | ||
| run: | | ||
| docker exec pki pkispawn \ | ||
| -f /usr/share/pki/server/examples/installation/ca.cfg \ | ||
| -s CA \ | ||
| -D pki_instance_name=pki-failing-tomcat \ | ||
| -D pki_ds_url=ldap://ds.example.com:3389 \ | ||
| -D pki_hsm_enable=True \ | ||
| -D pki_token_name=HSM \ | ||
| -D pki_token_password=Secret.HSM \ | ||
| -D pki_server_database_password=Secret.123 \ | ||
| -D pki_ca_signing_token=HSM \ | ||
| -D pki_ocsp_signing_token=HSM \ | ||
| -D pki_audit_signing_token=HSM \ | ||
| -D pki_subsystem_token=HSM \ | ||
| -D pki_sslserver_token=internal \ | ||
| -D pki_ca_signing_opsFlagMask=sign \ | ||
| -v | ||
| continue-on-error: true | ||
| id: hsm_no_sign | ||
|
|
||
| - name: Check the install with no sign ops failed | ||
| if: job.steps.hsm_no_sign.status != failure() | ||
| run: exit 1 | ||
|
|
||
| - name: Install CA with HSM reintroducing sign flag | ||
| run: | | ||
| docker exec pki pkispawn \ | ||
| -f /usr/share/pki/server/examples/installation/ca.cfg \ | ||
| -s CA \ | ||
| -D pki_ds_url=ldap://ds.example.com:3389 \ | ||
| -D pki_hsm_enable=True \ | ||
| -D pki_token_name=HSM \ | ||
| -D pki_token_password=Secret.HSM \ | ||
| -D pki_server_database_password=Secret.123 \ | ||
| -D pki_ca_signing_token=HSM \ | ||
| -D pki_ocsp_signing_token=HSM \ | ||
| -D pki_audit_signing_token=HSM \ | ||
| -D pki_subsystem_token=HSM \ | ||
| -D pki_sslserver_token=internal \ | ||
| -D pki_ca_signing_opsFlag=sign \ | ||
| -D pki_ca_signing_opsFlagMask=sign \ | ||
| -v | ||
|
|
||
| - name: Gather artifacts | ||
| if: always() | ||
| run: | | ||
| tests/bin/ds-artifacts-save.sh --output=/tmp/artifacts/pki ds | ||
| tests/bin/pki-artifacts-save.sh pki | ||
| continue-on-error: true | ||
|
|
||
| - name: Remove CA | ||
| run: docker exec pki pkidestroy -i pki-tomcat -s CA -v | ||
|
|
||
| - name: Remove SoftHSM token | ||
| run: | | ||
| docker exec pki ls -laR /var/lib/softhsm/tokens | ||
| docker exec pki runuser -u pkiuser -- softhsm2-util --delete-token --token HSM | ||
|
|
||
| - name: Upload artifacts | ||
| if: always() | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: ca-hsm | ||
| path: | | ||
| /tmp/artifacts/pki | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not too familiar with how the flag & mask work in NSS, but does this mean the mask should ultimately disable the
signoperation in NSS so the installation should fail too? Or doesopsFlagMasksimply remove the values fromopsFlag(in that case the mask might not be that useful since the user can just specify the correctopsFlagwithout the masked value in the first place)?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
opsFlagMask is applied to the flags identified by NSS, then the opsFlag are added to the remaining operation. This test show that the opsFlag are added to the resulting list. (I will change all opsFlag* is opFlags*)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
OK, does it mean the
opsFlagparam overridesopsFlagMask? Does it work that way too with--keyOpFlagsOnand--keyOpFlagsOffincertutil? We probably should document this behavior.