Author: jdsn Date: Sat Feb 2 02:43:41 2008 New Revision: 44117 URL: http://svn.opensuse.org/viewcvs/yast?rev=44117&view=rev Log: initial checkin of Fate #2613 (not yep complete) Added: trunk/ca-management/src/crlExport.ycp Modified: trunk/ca-management/MAINTAINER trunk/ca-management/src/crl.ycp Modified: trunk/ca-management/MAINTAINER URL: http://svn.opensuse.org/viewcvs/yast/trunk/ca-management/MAINTAINER?rev=44117&r1=44116&r2=44117&view=diff ============================================================================== --- trunk/ca-management/MAINTAINER (original) +++ trunk/ca-management/MAINTAINER Sat Feb 2 02:43:41 2008 @@ -1 +1,2 @@ Michael Calmer +J. Daniel Schmidt Modified: trunk/ca-management/src/crl.ycp URL: http://svn.opensuse.org/viewcvs/yast/trunk/ca-management/src/crl.ycp?rev=44117&r1=44116&r2=44117&view=diff ============================================================================== --- trunk/ca-management/src/crl.ycp (original) +++ trunk/ca-management/src/crl.ycp Sat Feb 2 02:43:41 2008 @@ -25,6 +25,7 @@ import "YaPI::CaManagement"; include "ca-management/crlDefault.ycp"; + include "ca-management/crlExport.ycp"; // help text 1/4 string CRLHelptext = _("<p>Here, see the most important values of the CRL.</p>"); @@ -199,12 +200,14 @@ `PushButton (`id (`view) , _("&View")), `PushButton (`id (`defaults) , _("&Default")), `HStretch(), - `MenuButton (_("Export"), - [ - `item(`id(`exportFile), _("to &File") ), - `item(`id(`exportLDAP), _("to &LDAP")) - ] - ), + // Fate (#2613) + `PushButton (`id (`exportDialog) , _("Export")), + //`MenuButton (_("Export"), + // [ + // `item(`id(`exportFile), _("to &File") ), + // `item(`id(`exportLDAP), _("to &LDAP")) + // ] + // ), `HSpacing (1) ) ); @@ -223,7 +226,7 @@ * Handle events in a tab of a dialog */ symbol handleCRLTab (map event) { - any ui = event["ID"]:nil; + any ui = event["ID"]:nil; if (ui == `gererateCRL) { createCRL (CaMgm::currentCA); @@ -232,20 +235,24 @@ if (ui == `view) { showLongCRLDescription (CaMgm::currentCA); - } - if (ui == `exportLDAP) - { - exportToLDAP ("CRL", CaMgm::currentCA, "" ,"", "", ""); - } - if (ui == `exportFile) - { - exportCRLtoFile (CaMgm::currentCA); } +// if (ui == `exportLDAP) +// { +// exportToLDAP ("CRL", CaMgm::currentCA, "" ,"", "", ""); +// } +// if (ui == `exportFile) +// { +// exportCRLtoFile (CaMgm::currentCA); +// } + if (ui == `exportDialog) // (Fate #2613) + { + exportCRL(CaMgm::currentCA); + } if (ui == `defaults) { - editCRLDefaults (CaMgm::currentCA); - } - return (symbol) ui; + editCRLDefaults (CaMgm::currentCA); + } + return (symbol) ui; } } Added: trunk/ca-management/src/crlExport.ycp URL: http://svn.opensuse.org/viewcvs/yast/trunk/ca-management/src/crlExport.ycp?rev=44117&view=auto ============================================================================== --- trunk/ca-management/src/crlExport.ycp (added) +++ trunk/ca-management/src/crlExport.ycp Sat Feb 2 02:43:41 2008 @@ -0,0 +1,332 @@ +/** + * + * File: + * crlExport.ycp + * + * Module: + * CA Management + * + * Summary: + * Export a CRL to a local file or an LDAP directory. + * Possibility to setup a cron job to do this automatically. + * + * Authors: + * J. Daniel Schmidt + * + * $Id: crlExport.ycp 1 2007-11-20 12:15:18Z jdsn $ + * + * Export a CRL for a selected CA + * + */ + + +{ + +textdomain "ca-management"; + +import "CaMgm"; +import "Wizard"; +import "Label"; +import "Popup"; +import "YaPI::CaManagement"; +include "ca-management/util.ycp"; +include "ca-management/new_cert_callbacks.ycp"; + +map uiInfo = UI::GetDisplayInfo(); +boolean textmode = (boolean) uiInfo["TextMode"]:nil; + +float hspace = textmode ? 4 : 3; +float vspace = textmode ? 0 : 1; +boolean seenSecurityInfo = false; + +// here are our settings for the CRL of this CA +boolean periodic = false; // default off +boolean file_active = true; // default on +boolean ldap_active = false; // default off +symbol fileformat = `ffpem; // default is pem +string crlfile = ""; // is set from inside the export function +integer intervalDays = 30; +integer intervalHours = 0; +map ldapCred = $[ "hostname":"", "port":"", "dn":"", + "binddn":"", "password":"" ]; + + +map crlConfFormat = $[ "options" : [ "line_can_continue", "global_values", "join_multiline", "comments_last", "flat" ], + "comments": [ "^[ \t]*#.*$", "^[ \t]*$" ], + "params" : [ $[ "match" : [ "([a-zA-Z0-9_-]+)[ \t]*=[ \t]*([^ \t]*)", "%s = %s" ] ] ] + ]; + + +define void showSecurityInfo() +{ + Popup::LongText( + // Translators: window caption + _("Security Information"), + // Translators: long help text - security information + `RichText(_("Warning!<br>Activating the automatic creation and export of a CRL will write the CA password to a config file on disk. The password will be stored there in plain text as it is needed to create a CRL. The file will only be readable for the root user.<br>Please note that this is a security risk if there are more people that have root access. They all will be able to read the CA password.")), + 50, 20 + ); + seenSecurityInfo = true; +} + + +define void updateEnabled() +{ + periodic = (boolean) UI::QueryWidget(`id(`mode_periodically), `Value); + file_active = (boolean) UI::QueryWidget(`id(`exportFile), `Value); + ldap_active = (boolean) UI::QueryWidget(`id(`exportLDAP), `Value); + UI::ChangeWidget(`id(`periodicInterval), `Enabled, periodic); + UI::ChangeWidget(`id(`fileSettings), `Enabled, file_active); + UI::ChangeWidget(`id(`ldapSettings), `Enabled, ldap_active); + if (periodic && !seenSecurityInfo) { showSecurityInfo(); } +} + + + +define void setSettings() +{ + // write settings to the UI + UI::ChangeWidget(`id(`mode_periodically), `Value, periodic); + UI::ChangeWidget(`id(`periodicInterval), `Enabled, periodic); + UI::ChangeWidget(`id(`interval_days), `Value, intervalDays); + UI::ChangeWidget(`id(`interval_hours), `Value, intervalHours); + + UI::ChangeWidget(`id(`exportFile), `Value, file_active); + UI::ChangeWidget(`id(`exportLDAP), `Value, ldap_active); + + UI::ChangeWidget(`id(`ffpem), `Value, fileformat == `ffpem ? true:false); + UI::ChangeWidget(`id(`crlfile), `Value, crlfile); + + UI::ChangeWidget(`id(`hostname), `Value, ldapCred["hostname"]:""); + UI::ChangeWidget(`id(`port), `Value, ldapCred["port"]:""); + UI::ChangeWidget(`id(`dn), `Value, ldapCred["dn"]:""); + UI::ChangeWidget(`id(`binddn), `Value, ldapCred["binddn"]:""); + UI::ChangeWidget(`id(`ldapPassword),`Value, ldapCred["password"]:""); +} + + + +define void cleanLdapCred() +{ + foreach (string key, string val, ldapCred, { + if (val == nil) ldapCred[key]=""; + }); +} + + +define void readSettings(string ca) +{ + string crlConf = sformat("/var/lib/CAM/%1/crl-export.conf", ca); + if (SCR::Execute(.target.bash, sformat("[ -f %1 ]", crlConf) ) == 0 ) + { + SCR::RegisterAgent( .temp_crlexport_agent, `ag_ini( + `IniAgent( crlConf, crlConfFormat )) ); + + periodic = SCR::Read(.temp_crlexport_agent.periodic) == "true" ? true:false; + if (periodic) seenSecurityInfo = true; + integer getDays = (integer) SCR::Read(.temp_crlexport_agent.interval_days); + intervalDays = getDays != nil ? getDays:intervalDays; + integer getHours = (integer) SCR::Read(.temp_crlexport_agent.interval_hours); + intervalHours = getHours != nil ? getHours:intervalHours; + file_active = SCR::Read(.temp_crlexport_agent.export_file) == "true" ? true:false; + ldap_active = SCR::Read(.temp_crlexport_agent.export_ldap) == "true" ? true:false; + crlfile = (string) SCR::Read(.temp_crlexport_agent.crlfilename); + if (crlfile == nil) crlfile = ""; + fileformat = SCR::Read(.temp_crlexport_agent.crlfileformat) == "der" ? `ffder:`ffpem; + ldapCred["hostname"] = (string) SCR::Read(.temp_crlexport_agent.ldap_hostname); + ldapCred["port"] = (string) SCR::Read(.temp_crlexport_agent.ldap_port); + ldapCred["dn"] = (string) SCR::Read(.temp_crlexport_agent.ldap_dn); + ldapCred["binddn"] = (string) SCR::Read(.temp_crlexport_agent.ldap_binddn); + ldapCred["password"] = (string) SCR::Read(.temp_crlexport_agent.ldap_password); + cleanLdapCred(); + + SCR::UnregisterAgent(.temp_crlexport_agent); + y2milestone("Found config file for automatic CRL export of CA %1 and read settings.", ca); + } + else + { + y2milestone("No config file found for automatic CRL export of CA %1", ca); + } +} + + + +define void writeSettings(string ca) +{ + string crlConf = sformat("/var/lib/CAM/%1/crl-export.conf", ca); + if (! (SCR::Execute(.target.bash, sformat("[ -f %1 ]", crlConf) ) == 0)) + { + SCR::Execute(.target.bash, sformat("umask 0077 && touch %1", crlConf) ); + } + + SCR::RegisterAgent( .temp_crlexport_agent, `ag_ini( + `IniAgent( crlConf, crlConfFormat )) ); + + SCR::Write(.temp_crlexport_agent.periodic, periodic ? "true":"false"); + SCR::Write(.temp_crlexport_agent.capassword, periodic ? getPassword(ca):"" ); + + SCR::Write(.temp_crlexport_agent.interval_days, sformat("%1", intervalDays)); + SCR::Write(.temp_crlexport_agent.interval_hours, sformat("%1",intervalHours)); + + SCR::Write(.temp_crlexport_agent.export_file, file_active == true ? "true":"false"); + SCR::Write(.temp_crlexport_agent.export_ldap, ldap_active == true ? "true":"false"); + + SCR::Write(.temp_crlexport_agent.crlfilename, crlfile); + SCR::Write(.temp_crlexport_agent.crlfileformat, fileformat == `ffder ? "der":"pem"); + + SCR::Write(.temp_crlexport_agent.ldap_hostname, ldapCred["hostname"]:""); + SCR::Write(.temp_crlexport_agent.ldap_port, ldapCred["port"]:""); + SCR::Write(.temp_crlexport_agent.ldap_dn, ldapCred["dn"]:""); + SCR::Write(.temp_crlexport_agent.ldap_binddn, ldapCred["binddn"]:""); + SCR::Write(.temp_crlexport_agent.ldap_password, ldapCred["password"]:""); + + SCR::UnregisterAgent(.temp_crlexport_agent); + + y2milestone("Written settings for automatic CRL export to conf file %1", crlConf); +} + + +/** +* Editing CRL defaults of a selected CA +* @param selected CA +*/ +define void exportCRL (string ca) { + + map ret = (map) YaPI::CaManagement::ReadCRLDefaults ($["caName":ca, "caPasswd":getPassword(ca)]); + y2milestone ("ReadCRLDefaults(%1) return %2", $["caName":ca], ret ); + + string caption = _("Export CRL"); + // this default can only be set inside this function + crlfile = sformat("/var/lib/CAM/%1/crl/crl.pem", ca); + + + string help_para1 = sformat("<p><b>%1</b></p>", caption); + string help_para2 = _("<p>Export the CRL of this CA once by selecting <b>Export once</b>.</p>"); + string help_para3 = _("<p>To setup a repeated recreation of the CRL select <b>Repeated recreation and export</b>. In this case set the interval for the recreation in <b>Periodic interval</b>. The interval is the sum of days and hours you set. To export every few hours set days to 0 and hours to the hourly interval. Please make sure you read and understood the <b>Security Information</b>.</p>"); + string help_para4 = _("<p>You can activate an export of the CRL to a local file or to a LDAP server or both. Setup the respective parameters in <b>Export to local file</b> and <b>Export to LDAP</b>.</p>"); + + string helptext = help_para1 + help_para2 + help_para3 + help_para4; + + term cradiobuttons = `VBox ( + `RadioButtonGroup( `id(`export_mode),`VBox( + `Left( `RadioButton(`id(`mode_once), `opt(`notify), _("Export once"), true )), + `Left( `RadioButton(`id(`mode_periodically), `opt(`notify), _("Repeated recreation and export") )) + )) + ); + + term cldapsettings = `VBox ( `id(`ldapSettings), + `TextEntry( `id(`hostname), _("&Host Name:"), ""), + `TextEntry( `id(`port), _("&Port:"), ""), + //`HBox (`HWeight (1, `ComboBox( `id(`dn), `opt(`editable), _("&DN:"), []))), + `TextEntry( `id(`dn), _("&DN:")), + `TextEntry( `id(`binddn), _("&Bind DN:"), ""), + `Password( `id(`ldapPassword), _("Pass&word")) + ) ; + + term cfilesettings = `VBox( `id(`fileSettings), `HBox( + `TextEntry(`id(`crlfile), _("Save &as"), crlfile ), + `VBox(`VSpacing(1), `PushButton(`id(`askFile), Label::BrowseButton() )) + ), + `Left( `RadioButtonGroup(`id(`fileformat), + `HBox( + `Label(_("Export Format")), + `RadioButton(`id(`ffpem), _("PEM Format"), true ), + `RadioButton(`id(`ffder), _("DER Format") ) + ) + )) + ); + + term cinterval = `Left( `id(`periodicInterval), + `HBox( + `VBox(`Label(_("Periodic interval:")), `VSpacing(1)), + `HSpacing(3), + `HSquash( `IntField( `id(`interval_days), "&days", 0, 100, 30 )), + `Label("+"), + `HSquash( `IntField( `id(`interval_hours), "&hours", 0, 23, 0 )), + `HSpacing(3), + `VBox( `VSpacing(1), `PushButton(`id(`securityInfo), _("&Security Information")) ) + ) + ); + + term contents = `HBox( `HSpacing(1), + `VBox( `Left( `Heading(_("CA Name: ") + CaMgm::currentCA) ), + `VSpacing(1), + cradiobuttons, + `HBox( + `HSpacing(3), + `VBox( + `VSpacing(vspace), + `Left( `CheckBox(`id(`exportFile), `opt(`notify), _("Export to local file"), true )), + `HBox( `HSpacing(hspace), cfilesettings ), + `VSpacing(vspace), + `Left( `CheckBox(`id(`exportLDAP), `opt(`notify), _("Export to LDAP"), false )), + `HBox( `HSpacing(hspace), cldapsettings ), + `VSpacing(vspace), + cinterval + ) + ) + ), + `HSpacing(1) + ); + + Wizard::CreateDialog(); + Wizard::SetContentsButtons ( _("Export CRL"), contents, helptext, Label::BackButton (), Label::OKButton ()); + Wizard::DisableBackButton(); + + // fill UI with settings + readSettings(ca); // read conf file if exists + setSettings(); // push data to UI + updateEnabled(); // gray out or ungray UI elements + + symbol ui = nil; + + repeat + { + ui = (symbol) UI::UserInput (); + + if (ui == `add) + { + string add_advanced_issuer_alt_name="test"; + } + if (ui == `askFile) + { + string newdirectory = UI::AskForSaveFileName( crlfile, "*.pem", _("Save as") ); + UI::ChangeWidget(`id(`exportDirectory), `Value, newdirectory); + } + if ( contains([`mode_once, `mode_periodically, `exportFile, `exportLDAP], ui )) + { + updateEnabled(); + } + if (ui == `securityInfo) + { + showSecurityInfo(); + } + if (ui == `next) + { + updateEnabled(); + fileformat = (symbol) UI::QueryWidget(`id(`fileformat), `Value); + crlfile = (string) UI::QueryWidget(`id(`crlfile), `Value); + intervalDays = (integer) UI::QueryWidget(`id(`interval_days), `Value); + intervalHours = (integer) UI::QueryWidget(`id(`interval_hours), `Value); + ldapCred["hostname"] = (string) UI::QueryWidget(`id(`hostname), `Value); + ldapCred["port"] = (string) UI::QueryWidget(`id(`port), `Value); + ldapCred["dn"] = (string) UI::QueryWidget(`id(`dn), `Value); + ldapCred["binddn"] = (string) UI::QueryWidget(`id(`binddn), `Value); + ldapCred["password"] = (string) UI::QueryWidget(`id(`ldapPassword), `Value); + cleanLdapCred(); + + // TODO only write settings if export should happen periodically + writeSettings(ca); + // else export the crl once + // exportOnce(ca, `file) + // exportOnce(ca, `ldap) + } + + } + until (contains ([`next, `abort], ui)); + + UI::CloseDialog(); +} + + +} -- To unsubscribe, e-mail: yast-commit+unsubscribe@opensuse.org For additional commands, e-mail: yast-commit+help@opensuse.org