Bug 476736

Summary: Make ESC to TPS communication IPv6 enabled
Product: [Retired] Dogtag Certificate System Reporter: Jack Magne <jmagne>
Component: ESCAssignee: Jack Magne <jmagne>
Status: CLOSED ERRATA QA Contact: Chandrasekar Kannan <ckannan>
Severity: medium Docs Contact:
Priority: high    
Version: unspecifiedCC: aakkiang, alee, benl, mharmsen
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-07-22 23:30:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 443788    
Attachments:
Description Flags
Patch to allow ESC to connect over Ipv6. none

Description Jack Magne 2008-12-16 20:43:43 UTC 
Description of problem:

ESC uses its own HTTP library based on NSS and NSPR to communicate with the TPS when performing token operations. We want to make the minor change required to support IPv6 for this communication.

Version-Release number of selected component (if applicable):

1.0.1.x
Comment 1 Jack Magne 2009-06-23 01:54:48 UTC 
Created attachment 349024 [details]
Patch to allow ESC to connect over Ipv6.
Comment 2 Matthew Harmsen 2009-06-23 01:59:39 UTC 
attachment (id=349024) +mharmsen
Comment 3 Jack Magne 2009-06-23 02:02:53 UTC 
$ cvs  -d :ext:jmagne.redhat.com:/cvs/dirsec commit -m  Bugzilla #47
6736 -  Make ESC to TPS communication IPv6 enabled."
cvs commit: Examining .
Enter passphrase for key '/home/jack/.ssh/id_rsa':

Checking in httpClientNss.cpp;
/cvs/dirsec/esc/src/lib/NssHttpClient/httpClientNss.cpp,v  <--  httpClientNss.c
p
new revision: 1.4; previous revision: 1.3
done
Running syncmail...
Mailing relnotes...
...syncmail done.
Running syncmail...
Mailing cvsdirsec...
...syncmail done.
Comment 4 Jack Magne 2009-06-23 02:10:23 UTC 
This problem should be resolved in the next build of ESC.

To test.

1. Make sure ESC is running on a machine that is Ipv6 compatible. 

2. Make sure TPS/CA/TKS and DRM are running on a Ipv6 compatible host. It would be fine to have the Linux ESC running on the same host.

3. Make sure that the Ipv6 compatible JSS is installed on the host where the CS subsystems are to be installed. Also make sure TPS is listening on an IPv6 socket. /sbin/lsof -i6  . Then search for port 7888.

4. Put an entry in the machine's /etc/hosts like the following:

testhost6 fe80::219:b9ff:fe42:85d7

This gives a way for esc to accept a Ipv6 host name.

5. Run ESC and put in a blank token.

6. In the phone home dialog, put in the phone home URL , using the ipv6 name like:

http://testhost6:7888/cgi-bin/home/index.cgi

7. If the phone home info is accepted, then simply try to perform a Format the token. Once ESC asks for the user authentication info, we know that we have successfully made a connection to the Ipv6 socket of TPS.
Comment 5 Asha Akkiangady 2009-07-13 19:43:33 UTC 
Verified.

Successfully Enrolled and Formatted user token, esc running on an ipv6 enabled host following the steps in comment #4.