Backup CS.cfg before modifying it

https://fedorahosted.org/freeipa/ticket/4166

Reviewed-By: Petr Viktorin <pviktori@redhat.com>

install/tools/ipa-upgradeconfig

@@ -1085,6 +1085,7 @@ def main():
         sub_dict['SUBJECT_BASE'] = subject_base
 
     ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
+    ca.backup_config()
 
     # migrate CRL publish dir before the location in ipa.conf is updated
     ca_restart = migrate_crl_publish_dir(ca)

ipaserver/install/cainstance.py

@@ -404,6 +404,7 @@ class CAInstance(DogtagInstance):
                 self.step("creating pki-ca instance", self.create_instance)
             self.step("configuring certificate server instance", self.__configure_instance)
         self.step("stopping certificate server instance to update CS.cfg", self.stop_instance)
+        self.step("backing up CS.cfg", self.backup_config)
         self.step("disabling nonces", self.__disable_nonce)
         self.step("set up CRL publishing", self.__enable_crl_publish)
         self.step("enable PKIX certificate path discovery and validation", self.enable_pkix)
@@ -733,6 +734,12 @@ class CAInstance(DogtagInstance):
 
         self.log.debug("completed creating ca instance")
 
+    def backup_config(self):
+        try:
+            backup_config(self.dogtag_constants)
+        except Exception, e:
+            root_logger.warning("Failed to backup CS.cfg: %s", e)
+
     def __disable_nonce(self):
         # Turn off Nonces
         update_result = installutils.update_file(
@@ -1587,6 +1594,11 @@ class CAInstance(DogtagInstance):
                       'subsystemCert cert-pki-ca': 'ca.subsystem.cert',
                       'Server-Cert cert-pki-ca': 'ca.sslserver.cert'}
 
+        try:
+            backup_config(dogtag_constants)
+        except Exception, e:
+            syslog.syslog(syslog.LOG_ERR, "Failed to backup CS.cfg: %s" % e)
+
         DogtagInstance.update_cert_cs_cfg(
             nickname, cert, directives,
             dogtag.configured_constants().CS_CFG_PATH,
@@ -1715,6 +1727,15 @@ def install_replica_ca(config, postinstall=False):
 
     return ca
 
+def backup_config(dogtag_constants=None):
+    """
+    Create a backup copy of CS.cfg
+    """
+    if dogtag_constants is None:
+        dogtag_constants = dogtag.configured_constants()
+
+    shutil.copy(dogtag_constants.CS_CFG_PATH,
+                dogtag_constants.CS_CFG_PATH + '.ipabkp')
 
 def update_people_entry(dercert):
     """