Turn on NSSOCSP check in mod_nss conf

Turn on NSSOCSP directive during install/replica install/upgrade.
That check whether the certificate which is used for login is
revoked or not using OSCP.

Marks the server cert in httpd NSS DB as trusted peer ('P,,')
to avoid chicken and egg problem when it is needed to contact
the OCSP responder when httpd is starting.

https://pagure.io/freeipa/issue/6370

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>

ipaserver/install/httpinstance.py

@@ -29,6 +29,7 @@ import pipes
 import locale
 
 import six
+from augeas import Augeas
 
 from ipalib.install import certmonger
 from ipaserver.install import service
@@ -153,6 +154,7 @@ class HTTPInstance(service.Service):
                   self.set_mod_nss_protocol)
         self.step("setting mod_nss password file", self.__set_mod_nss_passwordfile)
         self.step("enabling mod_nss renegotiate", self.enable_mod_nss_renegotiate)
+        self.step("enabling mod_nss OCSP", self.enable_mod_nss_ocsp)
         self.step("adding URL rewriting rules", self.__add_include)
         self.step("configuring httpd", self.__configure_http)
         self.step("setting up httpd keytab", self.request_service_keytab)
@@ -259,6 +261,31 @@ class HTTPInstance(service.Service):
         installutils.set_directive(paths.HTTPD_NSS_CONF, 'NSSRenegotiation', 'on', False)
         installutils.set_directive(paths.HTTPD_NSS_CONF, 'NSSRequireSafeNegotiation', 'on', False)
 
+    def enable_mod_nss_ocsp(self):
+        aug = Augeas(flags=Augeas.NO_LOAD | Augeas.NO_MODL_AUTOLOAD)
+
+        aug.set('/augeas/load/Httpd/lens', 'Httpd.lns')
+        aug.set('/augeas/load/Httpd/incl', paths.HTTPD_NSS_CONF)
+        aug.load()
+
+        path = '/files{}/VirtualHost'.format(paths.HTTPD_NSS_CONF)
+
+        ocsp_comment = aug.get(
+                        '{}/#comment[.=~regexp("NSSOCSP .*")]'.format(path))
+        ocsp_dir = aug.get('{}/directive[.="NSSOCSP"]'.format(path))
+
+        if ocsp_dir is None and ocsp_comment is not None:
+            # Directive is missing, comment is present
+            aug.set('{}/#comment[.=~regexp("NSSOCSP .*")]'.format(path),
+                    'NSSOCSP')
+            aug.rename('{}/#comment[.="NSSOCSP"]'.format(path), 'directive')
+        elif ocsp_dir is None:
+            # Directive is missing and comment is missing
+            aug.set('{}/directive[last()+1]'.format(path), "NSSOCSP")
+
+        aug.set('{}/directive[. = "NSSOCSP"]/arg'.format(path), 'on')
+        aug.save()
+
     def set_mod_nss_cipher_suite(self):
         ciphers = ','.join(NSS_CIPHER_SUITE)
         installutils.set_directive(paths.HTTPD_NSS_CONF, 'NSSCipherSuite', ciphers, False)
@@ -351,6 +378,7 @@ class HTTPInstance(service.Service):
                           create=True)
         self.disable_system_trust()
         self.create_password_conf()
+
         if self.pkcs12_info:
             if self.ca_is_configured:
                 trust_flags = 'CT,C,C'
@@ -375,6 +403,8 @@ class HTTPInstance(service.Service):
             self.__set_mod_nss_nickname(nickname)
             self.add_cert_to_service()
 
+            db.trust_root_cert(nickname, "P,,")
+
         else:
             if not self.promote:
                 ca_args = [

ipaserver/install/server/upgrade.py

@@ -1392,6 +1392,24 @@ def fix_trust_flags():
     sysupgrade.set_upgrade_state('http', 'fix_trust_flags', True)
 
 
+def fix_server_cert_trust_flags():
+    root_logger.info(
+        '[Fixing server certificate trust flags in %s]' %
+        paths.HTTPD_ALIAS_DIR)
+
+    if sysupgrade.get_upgrade_state('http', 'fix_serv_cert_trust_flags'):
+        root_logger.info("Trust flags already processed")
+        return
+
+    db = certs.CertDB(api.env.realm, nssdir=paths.HTTPD_ALIAS_DIR)
+    sc_nickname = installutils.get_directive(paths.HTTPD_NSS_CONF,
+                                             "NSSNickname")
+    # Add trust flag which set certificate trusted for SSL connections.
+    db.trust_root_cert(sc_nickname, "P,,")
+
+    sysupgrade.set_upgrade_state('http', 'fix_serv_cert_trust_flags', True)
+
+
 def update_mod_nss_protocol(http):
     root_logger.info('[Updating mod_nss protocol versions]')
 
@@ -1404,6 +1422,11 @@ def update_mod_nss_protocol(http):
     sysupgrade.set_upgrade_state('nss.conf', 'protocol_updated_tls12', True)
 
 
+def enable_mod_nss_ocsp(http):
+    root_logger.info('[Updating mod_nss enabling OCSP]')
+    http.enable_mod_nss_ocsp()
+
+
 def update_mod_nss_cipher_suite(http):
     root_logger.info('[Updating mod_nss cipher suite]')
 
@@ -1671,7 +1694,9 @@ def upgrade_configuration():
     update_ipa_httpd_service_conf(http)
     update_mod_nss_protocol(http)
     update_mod_nss_cipher_suite(http)
+    enable_mod_nss_ocsp(http)
     fix_trust_flags()
+    fix_server_cert_trust_flags()
     update_http_keytab(http)
     http.configure_gssproxy()
     http.start()

ipaserver/setup.py

@@ -61,6 +61,7 @@ if __name__ == '__main__':
             "pyasn1",
             "requests",
             "six",
+            "python-augeas",
         ],
         entry_points={
             'custodia.authorizers': [