<div dir="ltr"><div>Proposal looks good, <br></div><div><br></div><div>Looking for patch sets related to this.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Nov 22, 2019 at 2:39 PM Kurzynski, Zbigniew <<a href="mailto:zbigniew.kurzynski@intel.com">zbigniew.kurzynski@intel.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi everyone, <br>
I think it is good time to do some code refactoring in phosphor-certificate-manager.<br>
The certificate manager supports few certificate types, each is managed by a separate service instance.<br>
phosphor-certificate-manager@authority.service, phosphor-certificate-manager@bmcweb.service, phosphor-certificate-manager@nslcd.service<br>
Initially the certificate manager was designed to support single certificate file. But now one of its instances supports multiple files and the code for that case differs quite much from the rest.<br>
I would like to propose a small refactoring of this code in following steps:<br>
<br>
Step 1.<br>
Create a new subclass of Certificate. The base class will remain as is, focusing on single certificate approach, while its derived child will extend it with support for multiple certificates.<br>
The Manager class seems quite generic and I would leave it as is. Two instances will operate on the base Certificate class, while the third will use class derived from the Certificate.<br>
<br>
Step 2.<br>
Moving files:<br>
1. meta-phosphor/recipes-phosphor/certificate/phosphor-nslcd-cert-config/env<br>
2. meta-phosphor/recipes-phosphor/certificate/phosphor-nslcd-authority-cert-config/env<br>
3. meta-phosphor/recipes-phosphor/certificate/phosphor-bmcweb-cert-config/env<br>
to repository phosphor-certificate-manager under a new directory 'service'<br>
<br>
Getting rid of below recipes and moving their functionality to <a href="http://phosphor-certificate-manager_git.bb" rel="noreferrer" target="_blank">phosphor-certificate-manager_git.bb</a> if possible.<br>
<a href="http://phosphor-bmcweb-cert-config.bb" rel="noreferrer" target="_blank">phosphor-bmcweb-cert-config.bb</a>, <a href="http://phosphor-nslcd-cert-config.bb" rel="noreferrer" target="_blank">phosphor-nslcd-cert-config.bb</a>, <a href="http://phosphor-nslcd-authority-cert-config.bb" rel="noreferrer" target="_blank">phosphor-nslcd-authority-cert-config.bb</a><br>
<br>
Step 3.<br>
Changing the way of managing and storing TrustStore certificates.<br>
<br>
Now all certificates are stored and managed directly in a /etc/ssl/certs/authority/ , but files in that directory are subject to many restrictions like: <br>
the files must be named using the subject name's hash and an extension of '.0',<br>
If there are two files with the same hash they should have different extension number,<br>
Extension numbers cannot have gaps, which is a problem when we delete some certificates.<br>
<br>
I propose to store certificate files in a separate location, where file names do not have such restrictions.<br>
And put in this folder /etc/ssl/certs/authority/ only soft links to original files.<br>
Each time when any of certificate will be changed/deleted/added the manager should simply delete all links from /etc/ssl/certs/authority and the recreate them by iterating all certs files.<br>
<br>
Please let me know if you have any concerns.<br>
<br>
-Zbigniew<br>
--------------------------------------------------------------------<br>
<br>
Intel Technology Poland sp. z o.o.<br>
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.<br>
<br>
Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek<br>
przegladanie lub rozpowszechnianie jest zabronione.<br>
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by<br>
others is strictly prohibited.<br>
<br>
</blockquote></div>