IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity
1550b5ab50
freeipa/ipatests/test_xmlrpc/test_dns_plugin.py

5911 lines
217 KiB
Python
Raw Normal View History

Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
# Authors:
# Pavel Zuna <pzuna@redhat.com>
#
# Copyright (C) 2010 Red Hat
# see file 'COPYING' for use and warranty information
#
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
Change FreeIPA license to GPLv3+ The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
2010-12-09 06:59:11 -06:00
# along with this program. If not, see <http://www.gnu.org/licenses/>.
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
"""
Test the `ipalib/plugins/dns.py` module.
"""
Fix a slew of tests. - Skip the DNS tests if DNS isn't configured - Add new attributes to user entries (displayname, cn and initials) - Make the nsaccountlock value consistent - Fix the cert subject for cert tests
2010-12-09 13:57:34 -06:00
import nose
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
from ipalib import api, errors
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
from ipalib.util import normalize_zone
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
from ipapython.dnsutil import DNSName
Use DN objects instead of strings * Convert every string specifying a DN into a DN object * Every place a dn was manipulated in some fashion it was replaced by the use of DN operators * Add new DNParam parameter type for parameters which are DN's * DN objects are used 100% of the time throughout the entire data pipeline whenever something is logically a dn. * Many classes now enforce DN usage for their attributes which are dn's. This is implmented via ipautil.dn_attribute_property(). The only permitted types for a class attribute specified to be a DN are either None or a DN object. * Require that every place a dn is used it must be a DN object. This translates into lot of:: assert isinstance(dn, DN) sprinkled through out the code. Maintaining these asserts is valuable to preserve DN type enforcement. The asserts can be disabled in production. The goal of 100% DN usage 100% of the time has been realized, these asserts are meant to preserve that. The asserts also proved valuable in detecting functions which did not obey their function signatures, such as the baseldap pre and post callbacks. * Moved ipalib.dn to ipapython.dn because DN class is shared with all components, not just the server which uses ipalib. * All API's now accept DN's natively, no need to convert to str (or unicode). * Removed ipalib.encoder and encode/decode decorators. Type conversion is now explicitly performed in each IPASimpleLDAPObject method which emulates a ldap.SimpleLDAPObject method. * Entity & Entry classes now utilize DN's * Removed __getattr__ in Entity & Entity clases. There were two problems with it. It presented synthetic Python object attributes based on the current LDAP data it contained. There is no way to validate synthetic attributes using code checkers, you can't search the code to find LDAP attribute accesses (because synthetic attriutes look like Python attributes instead of LDAP data) and error handling is circumscribed. Secondly __getattr__ was hiding Python internal methods which broke class semantics. * Replace use of methods inherited from ldap.SimpleLDAPObject via IPAdmin class with IPAdmin methods. Directly using inherited methods was causing us to bypass IPA logic. Mostly this meant replacing the use of search_s() with getEntry() or getList(). Similarly direct access of the LDAP data in classes using IPAdmin were replaced with calls to getValue() or getValues(). * Objects returned by ldap2.find_entries() are now compatible with either the python-ldap access methodology or the Entity/Entry access methodology. * All ldap operations now funnel through the common IPASimpleLDAPObject giving us a single location where we interface to python-ldap and perform conversions. * The above 4 modifications means we've greatly reduced the proliferation of multiple inconsistent ways to perform LDAP operations. We are well on the way to having a single API in IPA for doing LDAP (a long range goal). * All certificate subject bases are now DN's * DN objects were enhanced thusly: - find, rfind, index, rindex, replace and insert methods were added - AVA, RDN and DN classes were refactored in immutable and mutable variants, the mutable variants are EditableAVA, EditableRDN and EditableDN. By default we use the immutable variants preserving important semantics. To edit a DN cast it to an EditableDN and cast it back to DN when done editing. These issues are fully described in other documentation. - first_key_match was removed - DN equalty comparison permits comparison to a basestring * Fixed ldapupdate to work with DN's. This work included: - Enhance test_updates.py to do more checking after applying update. Add test for update_from_dict(). Convert code to use unittest classes. - Consolidated duplicate code. - Moved code which should have been in the class into the class. - Fix the handling of the 'deleteentry' update action. It's no longer necessary to supply fake attributes to make it work. Detect case where subsequent update applies a change to entry previously marked for deletetion. General clean-up and simplification of the 'deleteentry' logic. - Rewrote a couple of functions to be clearer and more Pythonic. - Added documentation on the data structure being used. - Simplfy the use of update_from_dict() * Removed all usage of get_schema() which was being called prior to accessing the .schema attribute of an object. If a class is using internal lazy loading as an optimization it's not right to require users of the interface to be aware of internal optimization's. schema is now a property and when the schema property is accessed it calls a private internal method to perform the lazy loading. * Added SchemaCache class to cache the schema's from individual servers. This was done because of the observation we talk to different LDAP servers, each of which may have it's own schema. Previously we globally cached the schema from the first server we connected to and returned that schema in all contexts. The cache includes controls to invalidate it thus forcing a schema refresh. * Schema caching is now senstive to the run time context. During install and upgrade the schema can change leading to errors due to out-of-date cached schema. The schema cache is refreshed in these contexts. * We are aware of the LDAP syntax of all LDAP attributes. Every attribute returned from an LDAP operation is passed through a central table look-up based on it's LDAP syntax. The table key is the LDAP syntax it's value is a Python callable that returns a Python object matching the LDAP syntax. There are a handful of LDAP attributes whose syntax is historically incorrect (e.g. DistguishedNames that are defined as DirectoryStrings). The table driven conversion mechanism is augmented with a table of hard coded exceptions. Currently only the following conversions occur via the table: - dn's are converted to DN objects - binary objects are converted to Python str objects (IPA convention). - everything else is converted to unicode using UTF-8 decoding (IPA convention). However, now that the table driven conversion mechanism is in place it would be trivial to do things such as converting attributes which have LDAP integer syntax into a Python integer, etc. * Expected values in the unit tests which are a DN no longer need to use lambda expressions to promote the returned value to a DN for equality comparison. The return value is automatically promoted to a DN. The lambda expressions have been removed making the code much simpler and easier to read. * Add class level logging to a number of classes which did not support logging, less need for use of root_logger. * Remove ipaserver/conn.py, it was unused. * Consolidated duplicate code wherever it was found. * Fixed many places that used string concatenation to form a new string rather than string formatting operators. This is necessary because string formatting converts it's arguments to a string prior to building the result string. You can't concatenate a string and a non-string. * Simplify logic in rename_managed plugin. Use DN operators to edit dn's. * The live version of ipa-ldap-updater did not generate a log file. The offline version did, now both do. https://fedorahosted.org/freeipa/ticket/1670 https://fedorahosted.org/freeipa/ticket/1671 https://fedorahosted.org/freeipa/ticket/1672 https://fedorahosted.org/freeipa/ticket/1673 https://fedorahosted.org/freeipa/ticket/1674 https://fedorahosted.org/freeipa/ticket/1392 https://fedorahosted.org/freeipa/ticket/2872
2012-05-13 06:36:35 -05:00
from ipapython.dn import DN
Make an ipa-tests package Rename the 'tests' directory to 'ipa-tests', and create an ipa-tests RPM containing the test suite Part of the work for: https://fedorahosted.org/freeipa/ticket/3654
2013-05-21 06:40:27 -05:00
from ipatests.test_xmlrpc import objectclasses
Use absolute imports In Python 3, implicit relative imports will not be supported. Use fully-qualified imports everywhere. Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-07-31 03:15:01 -05:00
from ipatests.test_xmlrpc.xmlrpc_test import (Declarative, fuzzy_digits,
fuzzy_uuid)
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
try:
from ipaserver.plugins.ldap2 import ldap2
except ImportError:
have_ldap2 = False
else:
have_ldap2 = True
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
_dns_zone_record = DNSName(u'@')
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
# default value of idnssoamname is local DNS server
self_server_ns = normalize_zone(api.env.host)
self_server_ns_dnsname = DNSName(self_server_ns)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
zone1 = u'dnszone.test'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
zone1_dnsname = DNSName(zone1)
zone1_absolute = u'%s.' % zone1
zone1_absolute_dnsname = DNSName(zone1_absolute)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
zone1_ip = u'172.16.29.111'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
zone1_dn = DN(('idnsname',zone1_absolute), api.env.container_dns, api.env.basedn)
zone1_ns = u'ns1.%s' % zone1_absolute
zone1_ns_dnsname = DNSName(zone1_ns)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
zone1_ns_dn = DN(('idnsname','ns1'), zone1_dn)
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
zone1_self_server_ns_dn = DN(('idnsname',self_server_ns), zone1_dn)
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
zone1_rname = u'root.%s' % zone1_absolute
zone1_rname_dnsname = DNSName(zone1_rname)
zone1_permission = u'Manage DNS zone %s' % zone1_absolute
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
zone1_permission_dn = DN(('cn',zone1_permission),
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
api.env.container_permission,api.env.basedn)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
zone1_txtrec_dn = DN(('idnsname', '_kerberos'), zone1_dn)
DNS tests: warning if forward zone is inactive Ticket: https://fedorahosted.org/freeipa/ticket/4721 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-01-14 10:06:56 -06:00
zone1_sub = u'sub.%s' % zone1_absolute
zone1_sub_dnsname = DNSName(zone1_sub)
zone1_sub_dn = DN(('idnsname', zone1_sub),
api.env.container_dns, api.env.basedn)
zone1_sub_fw = u'fw.%s' % zone1_sub
zone1_sub_fw_dnsname = DNSName(zone1_sub_fw)
zone1_sub_fw_dn = DN(('idnsname', zone1_sub_fw),
api.env.container_dns, api.env.basedn)
zone1_sub2_fw = u'fw.sub2.%s' % zone1_sub
zone1_sub2_fw_dnsname = DNSName(zone1_sub2_fw)
zone1_sub2_fw_dn = DN(('idnsname', zone1_sub2_fw),
api.env.container_dns, api.env.basedn)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
zone2 = u'zone2.test'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
zone2_dnsname = DNSName(zone2)
zone2_absolute = u'%s.' % zone2
zone2_absolute_dnsname = DNSName(zone2_absolute)
zone2_dn = DN(('idnsname', zone2_absolute), api.env.container_dns, api.env.basedn)
zone2_ns = u'ns1.%s' % zone2_absolute
zone2_ns_dnsname = DNSName(zone2_ns)
zone2_rname = u'root.%s' % zone2_absolute
zone2_rname_dnsname = DNSName(zone2_rname)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
zone3 = u'zone3.test'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
zone3_dnsname = DNSName(zone3)
zone3_absolute = u'%s.' % zone3
zone3_absolute_dnsname = DNSName(zone3_absolute)
zone3_ip = u'172.16.70.1'
zone3_ip2 = u'172.16.70.129'
zone3_dn = DN(('idnsname', zone3_absolute), api.env.container_dns, api.env.basedn)
zone3_ns = u'ns1.%s' % zone3_absolute
zone3_ns_dnsname = DNSName(zone3_ns)
zone3_ns2 = u'ns2.%s' % zone3_absolute
zone3_ns2_dnsname = DNSName(zone3_ns2)
zone3_rname = u'root.%s' % zone3_absolute
zone3_rname_dnsname = DNSName(zone3_rname)
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
zone3_ns2_arec = u'ns2'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
zone3_ns2_arec_dnsname = DNSName(zone3_ns2_arec)
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
zone3_ns2_arec_dn = DN(('idnsname',zone3_ns2_arec), zone3_dn)
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
zone3_ns2_arec_absolute = u'%s.%s' % (zone3_ns2_arec, zone3_absolute)
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
Test DNS: test zone normalization Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 07:11:58 -05:00
zone4_upper = u'ZONE4.test'
zone4 = u'zone4.test.'
zone4_dnsname = DNSName(zone4)
zone4_dn = DN(('idnsname', zone4), api.env.container_dns, api.env.basedn)
zone4_ns = u'ns1.%s' % zone4
zone4_ns_dnsname = DNSName(zone4_ns)
zone4_rname = u'root.%s' % zone4
zone4_rname_dnsname = DNSName(zone4_rname)
Test DNS: add zone with consecutive dash characters Test for ticket: https://fedorahosted.org/freeipa/ticket/4268 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:29:30 -05:00
zone5 = u'zone--5.test.'
zone5_dnsname = DNSName(zone5)
zone5_dn = DN(('idnsname', zone5), api.env.container_dns, api.env.basedn)
zone5_ns = u'ns1.%s' % zone5
zone5_ns_dnsname = DNSName(zone5_ns)
zone5_rname = u'root.%s' % zone5
zone5_rname_dnsname = DNSName(zone5_rname)
Ipatests DNS SOA Record Maintenance https://fedorahosted.org/freeipa/ticket/4746 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-27 10:17:10 -05:00
zone6b = u'zone6b.test'
zone6b_absolute = u'%s.' % zone6b
zone6b_dnsname = DNSName(zone6b)
zone6b_absolute_dnsname = DNSName(zone6b_absolute)
zone6b_dn = DN(('idnsname', zone6b), api.env.container_dns, api.env.basedn)
zone6b_absolute_dn = DN(('idnsname', zone6b_absolute),
api.env.container_dns, api.env.basedn)
zone6b_rname = u'hostmaster'
zone6b_rname_dnsname = DNSName(zone6b_rname)
zone6b_ip = u'172.16.70.1'
zone6b_ns_arec = u'ns'
zone6b_ns = u'%s.%s' % (zone6b_ns_arec, zone6b_absolute)
zone6b_ns_arec_dnsname = DNSName(zone6b_ns_arec)
zone6b_ns_arec_dn = DN(('idnsname', zone6b_ns_arec), zone6b_dn)
zone6b_ns_dnsname = DNSName(zone6b_ns)
zone6b_absolute_arec_dn = DN(('idnsname', zone6b_ns_arec), zone6b_absolute_dn)
zone6 = u'zone6.test'
zone6_invalid = u'invalid-zone.zone6..test'
zone6_absolute = u'%s.' % zone6
zone6_dnsname = DNSName(zone6)
zone6_absolute_dnsname = DNSName(zone6_absolute)
zone6_dn = DN(('idnsname', zone6), api.env.container_dns, api.env.basedn)
zone6_absolute_dn = DN(('idnsname', zone6_absolute),
api.env.container_dns, api.env.basedn)
zone6_ns_relative = u'ns1'
zone6_absolute_arec_dn = DN(('idnsname', zone6_ns_relative), zone6_absolute_dn)
zone6_ns = u'%s.%s' % (zone6_ns_relative, zone6_absolute)
zone6_ns_relative_dnsname = DNSName(zone6_ns_relative)
zone6_ns_dnsname = DNSName(zone6_ns)
zone6_ns_arec_dnsname = DNSName(zone6_ns_relative)
zone6_ns_invalid_dnsname = u'invalid name server! ..%s' % zone6_absolute
zone6_rname = u'root.%s' % zone6_absolute
zone6_rname_dnsname = DNSName(zone6_rname)
zone6_rname_default = u'hostmaster'
zone6_rname_default_dnsname = DNSName(zone6_rname_default)
zone6_rname_relative_dnsname = DNSName(u'root')
zone6_rname_absolute_dnsname = DNSName(u'root.%s' % zone6_absolute)
zone6_rname_invalid_dnsname = u'invalid ! @ ! .. root..%s' % zone6_absolute
zone6_unresolvable_ns_relative = u'unresolvable'
zone6_unresolvable_ns = u'%s.%s' % (zone6_unresolvable_ns_relative,
zone6_absolute)
zone6_unresolvable_ns_dnsname = DNSName(zone6_unresolvable_ns)
zone6_unresolvable_ns_relative_dnsname = DNSName(zone6_unresolvable_ns_relative)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
revzone1 = u'31.16.172.in-addr.arpa.'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
revzone1_dnsname = DNSName(revzone1)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
revzone1_ip = u'172.16.31.0'
revzone1_ipprefix = u'172.16.31.'
revzone1_dn = DN(('idnsname', revzone1), api.env.container_dns, api.env.basedn)
revzone2 = u'30.15.172.in-addr.arpa.'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
revzone2_dnsname = DNSName(revzone2)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
revzone2_ip = u'172.15.30.0/24'
revzone2_dn = DN(('idnsname',revzone2), api.env.container_dns, api.env.basedn)
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
revzone3_classless1 = u'70.16.172.in-addr.arpa.'
revzone3_classless1_dnsname = DNSName(revzone3_classless1)
revzone3_classless1_ip = u'172.16.70.0'
revzone3_classless1_ipprefix = u'172.16.70.'
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
revzone3_classless1_dn = DN(('idnsname', revzone3_classless1), api.env.container_dns, api.env.basedn)
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
revzone3_classless2 = u'128/25.70.16.172.in-addr.arpa.'
revzone3_classless2_dnsname = DNSName(revzone3_classless2)
revzone3_classless2_ip = u'172.16.70.128'
revzone3_classless2_ipprefix = u'172.16.70.'
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
revzone3_classless2_dn = DN(('idnsname', revzone3_classless2), api.env.container_dns, api.env.basedn)
Allow to add managed permission for reverse zones Ticket: https://fedorahosted.org/freeipa/ticket/4422 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-04 03:20:04 -05:00
revzone3_classless2_permission = u'Manage DNS zone %s' % revzone3_classless2
revzone3_classless2_permission_dn = DN(('cn', revzone3_classless2_permission),
api.env.container_permission, api.env.basedn)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
name1 = u'testdnsres'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
name1_dnsname = DNSName(name1)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
name1_dn = DN(('idnsname',name1), zone1_dn)
Test: DNS NS validation Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 11:09:22 -05:00
name_ns = u'testdnsres-ns'
name_ns_dnsname = DNSName(name_ns)
name_ns_dn = DN(('idnsname',name_ns), zone1_dn)
Fix DNS record rename test bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 12:11:27 -05:00
name_ns_renamed = u'testdnsres-ns-renamed'
name_ns_renamed_dnsname = DNSName(name_ns_renamed)
Test: DNS NS validation Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 11:09:22 -05:00
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
revname1 = u'80'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
revname1_dnsname = DNSName(revname1)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
revname1_ip = revzone1_ipprefix + revname1
revname1_dn = DN(('idnsname',revname1), revzone1_dn)
revname2 = u'81'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
revname2_dnsname = DNSName(revname2)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
revname2_ip = revzone1_ipprefix + revname2
revname2_dn = DN(('idnsname',revname2), revzone1_dn)
cname = u'testcnamerec'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
cname_dnsname = DNSName(cname)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
cname_dn = DN(('idnsname',cname), zone1_dn)
dname = u'testdns-dname'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
dname_dnsname = DNSName(dname)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
dname_dn = DN(('idnsname',dname), zone1_dn)
DNSSEC: Test: DLV record Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-17 10:26:13 -05:00
dlv = u'dlv'
dlv_dnsname = DNSName(dlv)
dlv_dn = DN(('idnsname', dlv), zone1_dn)
dlvrec = u'60485 5 1 2BB183AF5F22588179A53B0A98631FAD1A292118'
Tests: DNS dsrecord validation Part of: https://fedorahosted.org/freeipa/ticket/3801 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-20 11:53:49 -05:00
ds = u'ds'
ds_dnsname = DNSName(ds)
ds_dn = DN(('idnsname', ds), zone1_dn)
ds_rec = u'0 0 0 00'
Test DNS: TLSA record Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:28:17 -05:00
tlsa = u'tlsa'
tlsa_dnsname = DNSName(tlsa)
tlsa_dn = DN(('idnsname', tlsa), zone1_dn)
tlsarec_err1 = u'300 0 1 d2abde240d7cd3ee6b4b28c54df034b97983a1d16e8a410e4561cb106618e971'
tlsarec_err2 = u'0 300 1 d2abde240d7cd3ee6b4b28c54df034b97983a1d16e8a410e4561cb106618e971'
tlsarec_err3 = u'0 0 300 d2abde240d7cd3ee6b4b28c54df034b97983a1d16e8a410e4561cb106618e971'
tlsarec_ok = u'0 0 1 d2abde240d7cd3ee6b4b28c54df034b97983a1d16e8a410e4561cb106618e971'
Test DNS: wildcard in RR owner Only test, issue was fixed in https://fedorahosted.org/freeipa/ticket/3169 Ticket: https://fedorahosted.org/freeipa/ticket/3148 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-28 11:56:10 -05:00
wildcard_rec1 = u'*.test'
wildcard_rec1_dnsname = DNSName(wildcard_rec1)
wildcard_rec1_dn = DN(('idnsname',wildcard_rec1), zone1_dn)
wildcard_rec1_addr = u'172.16.15.55'
wildcard_rec1_test1 = u'a.test.%s' % zone1_absolute
wildcard_rec1_test2 = u'b.test.%s' % zone1_absolute
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
nsrev = u'128/28'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
nsrev_dnsname = DNSName(nsrev)
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
nsrev_dn = DN(('idnsname',nsrev), revzone3_classless1_dn)
cnamerev = u'129'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
cnamerev_dnsname = DNSName(cnamerev)
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
cnamerev_dn = DN(('idnsname',cnamerev), revzone3_classless1_dn)
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
cnamerev_hostname = u'129.128/25.70.16.172.in-addr.arpa.'
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
ptr_revzone3 = u'129'
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
ptr_revzone3_dnsname = DNSName(ptr_revzone3)
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
ptr_revzone3_dn = DN(('idnsname',cnamerev), revzone3_classless2_dn)
ptr_revzone3_hostname = zone3_ns2;
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
relnxname = u'does-not-exist-test'
absnxname = u'does.not.exist.test.'
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
arec1 = u'172.16.29.111'
arec2 = u'172.31.254.222'
arec3 = u'172.16.250.123'
fwd_ip = u'172.16.31.80'
allowtransfer_tofwd = u'%s;' % fwd_ip
Use private IPv4 addresses for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:03:59 -06:00
allowquery_restricted_in = u'!192.0.2/24;any;'
allowquery_restricted_out = u'!192.0.2.0/24;any;'
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
idnzone1 = u'\u010d.test.'
idnzone1_punycoded = u'xn--bea.test.'
idnzone1_dnsname = DNSName(idnzone1)
idnzone1_dn = DN(('idnsname',idnzone1_punycoded), api.env.container_dns, api.env.basedn)
idnzone1_mname = u'ns1.%s' % idnzone1
idnzone1_mname_punycoded = u'ns1.%s' % idnzone1_punycoded
idnzone1_mname_dnsname = DNSName(idnzone1_mname)
idnzone1_mname_dn = DN(('idnsname','ns1'), idnzone1_dn)
idnzone1_rname = u'root.%s' % idnzone1
idnzone1_rname_punycoded = u'root.%s' % idnzone1_punycoded
idnzone1_rname_dnsname = DNSName(idnzone1_rname)
idnzone1_ip = u'172.16.11.1'
revidnzone1 = u'15.16.172.in-addr.arpa.'
revidnzone1_dnsname = DNSName(revidnzone1)
revidnzone1_ip = u'172.16.15.0/24'
revidnzone1_dn = DN(('idnsname', revidnzone1), api.env.container_dns, api.env.basedn)
idnzone1_permission = u'Manage DNS zone %s' % idnzone1
idnzone1_permission_dn = DN(('cn',idnzone1_permission),
api.env.container_permission,api.env.basedn)
idnres1 = u'sk\xfa\u0161ka'
idnres1_punycoded = u'xn--skka-rra23d'
idnres1_dnsname = DNSName(idnres1)
idnres1_dn = DN(('idnsname',idnres1_punycoded), idnzone1_dn)
idnrescname1 = u'\u0161\u0161'
idnrescname1_punycoded = u'xn--pgaa'
idnrescname1_dnsname = DNSName(idnrescname1)
idnrescname1_dn = DN(('idnsname',idnrescname1_punycoded), idnzone1_dn)
idnresdname1 = u'\xe1\xe1'
idnresdname1_punycoded = u'xn--1caa'
idnresdname1_dnsname = DNSName(idnresdname1)
idnresdname1_dn = DN(('idnsname',idnresdname1_punycoded), idnzone1_dn)
idndomain1 = u'\u010d\u010d\u010d.test'
idndomain1_punycoded = u'xn--beaaa.test'
idndomain1_dnsname = DNSName(idndomain1)
dnsafsdbres1 = u'sk\xfa\u0161ka-c'
dnsafsdbres1_punycoded = u'xn--skka-c-qya83f'
dnsafsdbres1_dnsname = DNSName(dnsafsdbres1)
dnsafsdbres1_dn = DN(('idnsname',dnsafsdbres1_punycoded), idnzone1_dn)
idnzone1_txtrec_dn = DN(('idnsname', '_kerberos'), idnzone1_dn)
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
fwzone1 = u'fwzone1.test.'
fwzone1_dnsname = DNSName(fwzone1)
fwzone1_dn = DN(('idnsname', fwzone1), api.env.container_dns, api.env.basedn)
fwzone1_permission = u'Manage DNS zone %s' % fwzone1
fwzone1_permission_dn = DN(('cn', fwzone1_permission),
api.env.container_permission, api.env.basedn)
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
fwzone2 = u'fwzone2.test.'
fwzone2_dnsname = DNSName(fwzone2)
fwzone2_dn = DN(('idnsname', fwzone2), api.env.container_dns, api.env.basedn)
fwzone3 = u'fwzone3.test.'
fwzone3_dnsname = DNSName(fwzone3)
fwzone3_dn = DN(('idnsname', fwzone3), api.env.container_dns, api.env.basedn)
fwzone_search_all_name = u'fwzone'
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
forwarder1 = u'172.16.15.1'
forwarder2 = u'172.16.15.2'
forwarder3 = u'172.16.15.3'
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
forwarder4 = u'172.16.15.4'
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
zone_findtest = u'.find.test.'
zone_findtest_master = u'master.find.test.'
zone_findtest_master_dnsname = DNSName(zone_findtest_master)
zone_findtest_master_dn = DN(('idnsname', zone_findtest_master),
api.env.container_dns, api.env.basedn)
zone_findtest_master_ns = u'ns1.%s' % zone_findtest_master
zone_findtest_master_ns_dnsname = DNSName(zone_findtest_master_ns)
zone_findtest_master_rname = u'root.%s' % zone_findtest_master
zone_findtest_master_rname_dnsname = DNSName(zone_findtest_master_rname)
zone_findtest_forward = u'forward.find.test.'
zone_findtest_forward_dnsname = DNSName(zone_findtest_forward)
zone_findtest_forward_dn = DN(('idnsname', zone_findtest_forward), api.env.container_dns, api.env.basedn)
Tests: DNS wildcard records Ticket: https://fedorahosted.org/freeipa/ticket/4488 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-08-20 10:26:34 -05:00
zone_fw_wildcard = u'*.wildcardforwardzone.test.'
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
nonexistent_fwzone = u'non-existent.fwzone.test.'
nonexistent_fwzone_dnsname = DNSName(nonexistent_fwzone)
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
zone_root = u'.'
zone_root_dnsname = DNSName(zone_root)
zone_root_ip = u'172.16.29.222'
zone_root_dn = DN(('idnsname', zone_root),
api.env.container_dns, api.env.basedn)
zone_root_ns = u'ns'
zone_root_ns_dnsname = DNSName(zone_root_ns)
zone_root_ns_dn = DN(('idnsname', zone_root_ns), zone_root_dn)
zone_root_rname = u'root.example.com.'
zone_root_rname_dnsname = DNSName(zone_root_rname)
zone_root_permission = u'Manage DNS zone %s' % zone_root
zone_root_permission_dn = DN(('cn', zone_root_permission),
api.env.container_permission, api.env.basedn)
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
def _get_nameservers_ldap(conn):
base_dn = DN(('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'), api.env.basedn)
ldap_filter = '(&(objectClass=ipaConfigObject)(cn=DNS))'
dns_masters = []
try:
entries = conn.find_entries(filter=ldap_filter, base_dn=base_dn)[0]
for entry in entries:
try:
master = entry.dn[1]['cn']
dns_masters.append(master)
except (IndexError, KeyError):
pass
except errors.NotFound:
return []
return dns_masters
def get_nameservers():
plugable: Pass API to plugins on initialization rather than using set_api https://fedorahosted.org/freeipa/ticket/3090 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-06-22 05:58:43 -05:00
ldap = ldap2(api)
Port from python-krbV to python-gssapi python-krbV library is deprecated and doesn't work with python 3. Replacing all it's usages with python-gssapi. - Removed Backend.krb and KRB5_CCache classes They were wrappers around krbV classes that cannot really work without them - Added few utility functions for querying GSSAPI credentials in krb_utils module. They provide replacements for KRB5_CCache. - Merged two kinit_keytab functions - Changed ldap plugin connection defaults to match ipaldap - Unified getting default realm Using api.env.realm instead of krbV call Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-07-20 09:04:07 -05:00
ldap.connect()
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
nameservers = [normalize_zone(x) for x in _get_nameservers_ldap(ldap)]
return nameservers
# FIXME to avoid this hack with nameservers, tests should be functional
nameservers = []
# get list of nameservers from LDAP
get_nameservers_error = None
if have_ldap2:
try:
nameservers = get_nameservers()
except Exception as e:
get_nameservers_error = e
else:
if not nameservers:
# if DNS is installed there must be at least one IPA DNS server
get_nameservers_error = "No DNS servers found in LDAP"
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
class test_dns(Declarative):
Move test skipping to class setup Currently, each DNS test case first checks if DNS is configured by creating and deleting a test zone. This takes quite a lot of time. This patch moves the check to the setUpClass method, so the check is only done once for all the tests. Similarly, if the server is not available, entire XMLRPC test classes are now skipped. Additionally, CLItests that hit the server are skipped if the server isn't available.
2012-03-28 03:42:23 -05:00
@classmethod
tests: Use PEP8-compliant setup/teardown method names The setUp/dearDown names are used in the unittest module, but there is no reason to use them in non-`unittest` test cases. Nose supports both styles (but mixing them can cause trouble when calling super()'s methods). Pytest only supports the new ones. https://fedorahosted.org/freeipa/ticket/4610 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-10-07 05:48:22 -05:00
def setup_class(cls):
super(test_dns, cls).setup_class()
Move test skipping to class setup Currently, each DNS test case first checks if DNS is configured by creating and deleting a test zone. This takes quite a lot of time. This patch moves the check to the setUpClass method, so the check is only done once for all the tests. Similarly, if the server is not available, entire XMLRPC test classes are now skipped. Additionally, CLItests that hit the server are skipped if the server isn't available.
2012-03-28 03:42:23 -05:00
Switch client to JSON-RPC Modify ipalib.rpc to support JSON-RPC in addition to XML-RPC. This is done by subclassing and extending xmlrpclib, because our existing code relies on xmlrpclib internals. The URI to use is given in the new jsonrpc_uri env variable. When it is not given, it is generated from xmlrpc_uri by replacing /xml with /json. The rpc_json_uri env variable existed before, but was unused, undocumented and not set the install scripts. This patch removes it in favor of jsonrpc_uri (for consistency with xmlrpc_uri). Add the rpc_protocol env variable to control the protocol IPA uses. rpc_protocol defaults to 'jsonrpc', but may be changed to 'xmlrpc'. Make backend.Executioner and tests use the backend specified by rpc_protocol. For compatibility with unwrap_xml, decoding JSON now gives tuples instead of lists. Design: http://freeipa.org/page/V3/JSON-RPC Ticket: https://fedorahosted.org/freeipa/ticket/3299
2012-12-19 03:25:24 -06:00
if not api.Backend.rpcclient.isconnected():
api.Backend.rpcclient.connect(fallback=False)
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
if not have_ldap2:
raise nose.SkipTest('server plugin not available')
if get_nameservers_error is not None:
raise nose.SkipTest('unable to get list of nameservers (%s)' % get_nameservers_error)
Fix a slew of tests. - Skip the DNS tests if DNS isn't configured - Add new attributes to user entries (displayname, cn and initials) - Make the nsaccountlock value consistent - Fix the cert subject for cert tests
2010-12-09 13:57:34 -06:00
try:
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
api.Command['dnszone_add'](zone1,
idnssoarname = zone1_rname,
Fix a slew of tests. - Skip the DNS tests if DNS isn't configured - Add new attributes to user entries (displayname, cn and initials) - Make the nsaccountlock value consistent - Fix the cert subject for cert tests
2010-12-09 13:57:34 -06:00
)
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
api.Command['dnszone_del'](zone1)
Fix a slew of tests. - Skip the DNS tests if DNS isn't configured - Add new attributes to user entries (displayname, cn and initials) - Make the nsaccountlock value consistent - Fix the cert subject for cert tests
2010-12-09 13:57:34 -06:00
except errors.NotFound:
raise nose.SkipTest('DNS is not configured')
except errors.DuplicateEntry:
pass
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
cleanup_commands = [
Test DNS: add zone with consecutive dash characters Test for ticket: https://fedorahosted.org/freeipa/ticket/4268 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:29:30 -05:00
('dnszone_del', [zone1, zone2, zone3, zone4, zone5, revzone1, revzone2,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
revzone3_classless1, revzone3_classless2,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
idnzone1, revidnzone1],
Use default reverse zone consistently When a new reverse zone is to be generated based on an IP address without a network prefix length, we need to use some default value. While netaddr library default ones (32b for IPv4 and 128b for IPv6) are not very sensible we should use the defaults already applied in installers. That is 24b for IPv6 and 64 for IPv6. Test case has been added to cover the new default. https://fedorahosted.org/freeipa/ticket/2461
2012-09-05 02:56:27 -05:00
{'continue': True}),
Add missing global options in dnsconfig Add a support for new global options in bind-dyndb-ldap, that is: * idnsforwardpolicy: Default policy for conditional forwarding * idnsallowsyncptr: Allow globaly PTR synchronization for dynamic updates * idnszonerefresh: Default interval between regular polls of the name server for new DNS zones https://fedorahosted.org/freeipa/ticket/2439
2012-03-07 08:54:38 -06:00
('dnsconfig_mod', [], {'idnsforwarders' : None,
'idnsforwardpolicy' : None,
'idnsallowsyncptr' : None,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
}),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
('permission_del', [zone1_permission, idnzone1_permission,
Allow to add managed permission for reverse zones Ticket: https://fedorahosted.org/freeipa/ticket/4422 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-04 03:20:04 -05:00
revzone3_classless2_permission], {'force': True}
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
]
tests = [
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to retrieve non-existent zone %r' % zone1,
command=('dnszone_show', [zone1], {}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.NotFound(
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
reason=u'%s: DNS zone not found' % zone1_absolute),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
),
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
dict(
desc='Try to retrieve non-existent IDN zone %r' % idnzone1,
command=('dnszone_show', [idnzone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS zone not found' % idnzone1),
),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to update non-existent zone %r' % zone1,
command=('dnszone_mod', [zone1], {'idnssoaminimum': 3500}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.NotFound(
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
reason=u'%s: DNS zone not found' % zone1_absolute),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to delete non-existent zone %r' % zone1,
command=('dnszone_del', [zone1], {}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.NotFound(
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
reason=u'%s: DNS zone not found' % zone1_absolute),
Improve hostname and domain name validation DNS plugin did not check DNS zone and DNS record validity and user was thus able to create domains like "foo bar" or other invalid DNS labels which would really confuse both user and bind-dyndb-ldap plugin. This patch at first consolidates hostname/domain name validators so that they use common functions and we don't have regular expressions and other checks defined in several places. These new cleaned validators are then used for zone/record name validation. https://fedorahosted.org/freeipa/ticket/2384
2012-02-28 02:05:01 -06:00
),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Create zone %r' % zone1,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dnszone_add', [zone1], {
'idnssoarname': zone1_rname,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
}
),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': zone1_absolute_dnsname,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone1_absolute_dnsname],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
Fill new DNS zone update policy by default For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by default and let users just switch the policy on or off. https://fedorahosted.org/freeipa/ticket/2441
2012-06-04 10:53:34 -05:00
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnszone,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to create duplicate zone %r' % zone1,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dnszone_add', [zone1], {
'idnssoarname': zone1_rname,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
}
),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.DuplicateEntry(
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
message=u'DNS zone with name "%s" already exists' % zone1_absolute),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
),
Enforce that all NS records are resolvable Bind cannot load a zone if any of its name server records is not resolvable. https://fedorahosted.org/freeipa/ticket/838
2011-01-27 10:16:22 -06:00
dict(
desc='Try to create a zone with nonexistent NS entry',
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dnszone_add', [zone2], {
'idnssoamname': zone2_ns,
'idnssoarname': zone2_rname,
Enforce that all NS records are resolvable Bind cannot load a zone if any of its name server records is not resolvable. https://fedorahosted.org/freeipa/ticket/838
2011-01-27 10:16:22 -06:00
}
),
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
expected=errors.NotFound(reason='Nameserver \'%s\' does not have a corresponding A/AAAA record' % (zone2_ns)),
Enforce that all NS records are resolvable Bind cannot load a zone if any of its name server records is not resolvable. https://fedorahosted.org/freeipa/ticket/838
2011-01-27 10:16:22 -06:00
),
dict(
desc='Create a zone with nonexistent NS entry with --force',
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dnszone_add', [zone2], {
'idnssoamname': zone2_ns,
'idnssoarname': zone2_rname,
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'force': True,
Enforce that all NS records are resolvable Bind cannot load a zone if any of its name server records is not resolvable. https://fedorahosted.org/freeipa/ticket/838
2011-01-27 10:16:22 -06:00
}
),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': zone2_absolute_dnsname,
Enforce that all NS records are resolvable Bind cannot load a zone if any of its name server records is not resolvable. https://fedorahosted.org/freeipa/ticket/838
2011-01-27 10:16:22 -06:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone2_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone2_absolute_dnsname],
Enforce that all NS records are resolvable Bind cannot load a zone if any of its name server records is not resolvable. https://fedorahosted.org/freeipa/ticket/838
2011-01-27 10:16:22 -06:00
'idnszoneactive': [u'TRUE'],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoamname': [zone2_ns_dnsname],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone2_rname_dnsname],
Enforce that all NS records are resolvable Bind cannot load a zone if any of its name server records is not resolvable. https://fedorahosted.org/freeipa/ticket/838
2011-01-27 10:16:22 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
Fill new DNS zone update policy by default For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by default and let users just switch the policy on or off. https://fedorahosted.org/freeipa/ticket/2441
2012-06-04 10:53:34 -05:00
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
Test DNS: test zone normalization Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 07:11:58 -05:00
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'messages': (
Fix warning message should not contain CLI commands Message is now universal for both CLI and WebUI Ticket: https://fedorahosted.org/freeipa/ticket/4647 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-11-13 07:02:02 -06:00
{'message': u"Semantic of setting Authoritative nameserver "
u"was changed. "
u"It is used only for setting the SOA MNAME "
u"attribute.\n"
u"NS record(s) can be edited in zone "
u"apex - '@'. ",
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'code': 13005,
'type': u'warning',
'name': u'OptionSemanticChangedWarning'},
)
Test DNS: test zone normalization Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 07:11:58 -05:00
},
),
DNS missing tests * try to remove non-existent permission * try to remove idnssoamname using dnszone-mod --name-server= Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-01 06:21:19 -05:00
dict(
desc='Try to remove value of "idnssomrname" attribute using dnszone-mod --name-server=',
command=(
'dnszone_mod', [zone2], {
'idnssoamname': None,
}
),
expected=errors.ValidationError(name='name_server', error=u"is required"),
),
Test DNS: test zone normalization Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 07:11:58 -05:00
dict(
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
desc='Create a zone with upper case name',
Test DNS: test zone normalization Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 07:11:58 -05:00
command=(
'dnszone_add', [zone4_upper], {
'idnssoarname': zone4_rname,
}
),
expected={
'value': zone4_dnsname,
'summary': None,
'result': {
'dn': zone4_dn,
'idnsname': [zone4_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
Test DNS: test zone normalization Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 07:11:58 -05:00
'idnssoarname': [zone4_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
Test DNS: add zone with consecutive dash characters Test for ticket: https://fedorahosted.org/freeipa/ticket/4268 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:29:30 -05:00
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict( # https://fedorahosted.org/freeipa/ticket/4268
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
desc='Create a zone with consecutive dash characters',
Test DNS: add zone with consecutive dash characters Test for ticket: https://fedorahosted.org/freeipa/ticket/4268 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:29:30 -05:00
command=(
'dnszone_add', [zone5], {
'idnssoarname': zone5_rname,
}
),
expected={
'value': zone5_dnsname,
'summary': None,
'result': {
'dn': zone5_dn,
'idnsname': [zone5_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
Test DNS: add zone with consecutive dash characters Test for ticket: https://fedorahosted.org/freeipa/ticket/4268 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:29:30 -05:00
'idnssoarname': [zone5_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
Test DNS: test zone normalization Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 07:11:58 -05:00
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
Fill new DNS zone update policy by default For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by default and let users just switch the policy on or off. https://fedorahosted.org/freeipa/ticket/2441
2012-06-04 10:53:34 -05:00
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnszone,
Enforce that all NS records are resolvable Bind cannot load a zone if any of its name server records is not resolvable. https://fedorahosted.org/freeipa/ticket/838
2011-01-27 10:16:22 -06:00
},
},
),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Retrieve zone %r' % zone1,
command=('dnszone_show', [zone1], {}),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': zone1_absolute_dnsname,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone1_absolute_dnsname],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Update zone %r' % zone1,
command=('dnszone_mod', [zone1], {'idnssoarefresh': 5478}),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': zone1_absolute_dnsname,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone1_absolute_dnsname],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
NSEC3PARAM tests Ticket: https://fedorahosted.org/freeipa/ticket/4413 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-01 06:39:57 -05:00
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
},
),
dict(
desc='Try to add invalid NSEC3PARAM record to zone %s' % (zone1),
command=('dnszone_mod', [zone1], {'nsec3paramrecord': u'0 0 0 0 X'}),
expected=errors.ValidationError(name="nsec3param_rec",
error=(u'expected format: <0-255> <0-255> <0-65535> '
u'even-length_hexadecimal_digits_or_hyphen')
)
),
dict(
desc='Try to add invalid NSEC3PARAM record to zone %s' % (zone1),
command=('dnszone_mod', [zone1], {'nsec3paramrecord': u'0 0 0 X'}),
expected=errors.ValidationError(name="nsec3param_rec",
error=(u'expected format: <0-255> <0-255> <0-65535> '
u'even-length_hexadecimal_digits_or_hyphen')
)
),
dict(
desc='Try to add invalid NSEC3PARAM record to zone %s' % (zone1),
command=('dnszone_mod', [zone1], {'nsec3paramrecord': u'333 0 0 -'}),
expected=errors.ValidationError(name="nsec3param_rec",
error=u'algorithm value: allowed interval 0-255'
)
),
dict(
desc='Try to add invalid NSEC3PARAM record to zone %s' % (zone1),
command=('dnszone_mod', [zone1], {'nsec3paramrecord': u'0 333 0 -'}),
expected=errors.ValidationError(name="nsec3param_rec",
error=u'flags value: allowed interval 0-255'
)
),
dict(
desc='Try to add invalid NSEC3PARAM record to zone %s' % (zone1),
command=('dnszone_mod', [zone1], {'nsec3paramrecord': u'0 0 65536 -'}),
expected=errors.ValidationError(name="nsec3param_rec",
error=u'iterations value: allowed interval 0-65535'
)
),
dict(
desc='Try to add invalid NSEC3PARAM record to zone %s' % (zone1),
command=('dnszone_mod', [zone1], {'nsec3paramrecord': u'0 0 0 A'}),
expected=errors.ValidationError(name="nsec3param_rec",
error=(u'expected format: <0-255> <0-255> <0-65535> '
u'even-length_hexadecimal_digits_or_hyphen')
)
),
dict(
desc='Add NSEC3PARAM record to zone %s' % (zone1),
command=('dnszone_mod', [zone1], {'nsec3paramrecord': u'0 0 0 -'}),
expected={
'value': zone1_absolute_dnsname,
'summary': None,
'result': {
'idnsname': [zone1_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
NSEC3PARAM tests Ticket: https://fedorahosted.org/freeipa/ticket/4413 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-01 06:39:57 -05:00
'idnssoarname': [zone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'nsec3paramrecord': [u'0 0 0 -'],
},
},
),
dict(
desc='Delete NSEC3PARAM record from zone %s' % (zone1),
command=('dnszone_mod', [zone1], {'nsec3paramrecord': u''}),
expected={
'value': zone1_absolute_dnsname,
'summary': None,
'result': {
'idnsname': [zone1_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
NSEC3PARAM tests Ticket: https://fedorahosted.org/freeipa/ticket/4413 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-01 06:39:57 -05:00
'idnssoarname': [zone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'idnssoaminimum': [fuzzy_digits],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
},
},
),
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to create reverse zone %r with NS record in it' % revzone1,
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dnszone_add', [revzone1], {
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
'idnssoamname': u'ns',
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'idnssoarname': zone1_rname,
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
}
),
expected=errors.ValidationError(name='name-server',
error=u"Nameserver for reverse zone cannot be a relative DNS name"),
),
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Create reverse zone %r' % revzone1,
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dnszone_add', [revzone1], {
'idnssoarname': zone1_rname,
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
}
),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': revzone1_dnsname,
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': revzone1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [revzone1_dnsname],
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
Fill new DNS zone update policy by default For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by default and let users just switch the policy on or off. https://fedorahosted.org/freeipa/ticket/2441
2012-06-04 10:53:34 -05:00
'idnsupdatepolicy': [u'grant %(realm)s krb5-subdomain %(zone)s PTR;'
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
% dict(realm=api.env.realm, zone=revzone1)],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnszone,
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
},
},
),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
dict(
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
desc='Search for zones with admin email %r' % (zone1_rname),
command=('dnszone_find', [], {'idnssoarname': zone1_rname}),
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
expected={
'summary': None,
'count': 2,
'truncated': False,
'result': [{
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': revzone1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [revzone1_dnsname],
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
},
{
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone1_absolute_dnsname],
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
}],
},
),
dict(
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
desc='Search for zones with admin email %r with --forward-only' % zone1_rname,
command=('dnszone_find', [], {'idnssoarname': zone1_rname, 'forward_only' : True}),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [{
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone1_absolute_dnsname],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
}],
},
),
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Delete reverse zone %r' % revzone1,
command=('dnszone_del', [revzone1], {}),
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': [revzone1_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'summary': u'Deleted DNS zone "%s"' % revzone1,
Allow primary keys to use different type than unicode. Also return list of primary keys instead of a single unicode CSV value from LDAPDelete-based commands. This introduces a new capability 'primary_key_types' for backward compatibility with old clients. Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-03-27 08:04:00 -05:00
'result': {'failed': []},
Add new dnszone-find test Implement a test for new dnszone-find option --forward-only. Fix example for reverse zone (zone was not fully qualified and DNS plugin would forbid adding PTR records). https://fedorahosted.org/freeipa/ticket/1473
2011-07-14 04:14:14 -05:00
},
),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to retrieve non-existent record %r in zone %r' % (name1, zone1),
command=('dnsrecord_show', [zone1, name1], {}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.NotFound(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
reason=u'%s: DNS resource record not found' % name1),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to delete non-existent record %r in zone %r' % (name1, zone1),
command=('dnsrecord_del', [zone1, name1], {'del_all' : True}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.NotFound(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
reason=u'%s: DNS resource record not found' % name1),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
),
Refactor dnsrecord processing Current DNS record processing architecture has many flaws, including custom execute() methods which does not take advantage of base LDAP commands or nonstandard and confusing DNS record option processing. This patch refactors DNS record processing with the following improvements: * Every DNS record has now own Parameter type. Each DNS record consists from one or more "parts" which are also Parameters. This architecture will enable much easier implementation of future per-DNS-type API. * Validation is now not written as a separate function for every parameter but is delegated to DNS record parts. * Normalization is also delegated to DNS record parts. * Since standard LDAP base commands execute method is now used, dnsrecord-add and dnsrecord-mod correctly supports --setattr and --addattr options. * In order to prevent confusion unsupported DNS record types are now hidden. They are still present in the plugin so that old clients receive proper validation error. The patch also contains several fixes: * Fix domain-name validation and normalization- allow domain names that are not fully qualified. For example --cname-rec=bar is a valid domain-name for bind which will translate it then as bar.<owning-domain>. This change implies, that fully qualified domain names must end with '.'. * Do not let user accidentally remove entire zone with command "ipa dnsrecord-del @ --del-all". * Fix --ttl and --class option processing in dnsrecord-add and dnsrecord-mod. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
2012-01-06 08:12:41 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to delete root zone record \'@\' in %r' % (zone1),
command=('dnsrecord_del', [zone1, u'@'], {'del_all' : True}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.ValidationError(name='del_all',
error=u"Zone record '@' cannot be deleted"),
Refactor dnsrecord processing Current DNS record processing architecture has many flaws, including custom execute() methods which does not take advantage of base LDAP commands or nonstandard and confusing DNS record option processing. This patch refactors DNS record processing with the following improvements: * Every DNS record has now own Parameter type. Each DNS record consists from one or more "parts" which are also Parameters. This architecture will enable much easier implementation of future per-DNS-type API. * Validation is now not written as a separate function for every parameter but is delegated to DNS record parts. * Normalization is also delegated to DNS record parts. * Since standard LDAP base commands execute method is now used, dnsrecord-add and dnsrecord-mod correctly supports --setattr and --addattr options. * In order to prevent confusion unsupported DNS record types are now hidden. They are still present in the plugin so that old clients receive proper validation error. The patch also contains several fixes: * Fix domain-name validation and normalization- allow domain names that are not fully qualified. For example --cname-rec=bar is a valid domain-name for bind which will translate it then as bar.<owning-domain>. This change implies, that fully qualified domain names must end with '.'. * Do not let user accidentally remove entire zone with command "ipa dnsrecord-del @ --del-all". * Fix --ttl and --class option processing in dnsrecord-add and dnsrecord-mod. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
2012-01-06 08:12:41 -06:00
),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Create record %r in zone %r' % (zone1, name1),
command=('dnsrecord_add', [zone1, name1], {'arecord': arec2}),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': name1_dnsname,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': name1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnsrecord,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec2],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Search for all records in zone %r' % zone1,
command=('dnsrecord_find', [zone1], {}),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
expected={
'summary': None,
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'count': 3,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'truncated': False,
'result': [
{
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_dn,
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [_dns_zone_record],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
},
Integrate realmdomains with IPA DNS Add an entry to realmdomains when a DNS zone is added to IPA. Delete the related entry from realmdomains when the DNS zone is deleted from IPA. Add _kerberos TXT record to DNS zone when a new realmdomain is added. Delete _kerberos TXT record from DNS zone when realmdomain is deleted. Add unit tests to cover new functionality. https://fedorahosted.org/freeipa/ticket/3544
2013-04-12 08:20:07 -05:00
{
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_txtrec_dn,
Integrate realmdomains with IPA DNS Add an entry to realmdomains when a DNS zone is added to IPA. Delete the related entry from realmdomains when the DNS zone is deleted from IPA. Add _kerberos TXT record to DNS zone when a new realmdomain is added. Delete _kerberos TXT record from DNS zone when realmdomain is deleted. Add unit tests to cover new functionality. https://fedorahosted.org/freeipa/ticket/3544
2013-04-12 08:20:07 -05:00
'txtrecord': [api.env.realm],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [DNSName(u'_kerberos')],
Integrate realmdomains with IPA DNS Add an entry to realmdomains when a DNS zone is added to IPA. Delete the related entry from realmdomains when the DNS zone is deleted from IPA. Add _kerberos TXT record to DNS zone when a new realmdomain is added. Delete _kerberos TXT record from DNS zone when realmdomain is deleted. Add unit tests to cover new functionality. https://fedorahosted.org/freeipa/ticket/3544
2013-04-12 08:20:07 -05:00
},
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
{
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': name1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec2],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
},
],
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add A record to %r in zone %r' % (name1, zone1),
command=('dnsrecord_add', [zone1, name1], {'arecord': arec3}),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': name1_dnsname,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': name1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec2, arec3],
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnsrecord,
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Remove A record from %r in zone %r' % (name1, zone1),
command=('dnsrecord_del', [zone1, name1], {'arecord': arec2}),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': [name1_dnsname],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec3],
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
},
},
),
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add AAAA record to %r in zone %r using dnsrecord_mod' % (name1, zone1),
command=('dnsrecord_mod', [zone1, name1], {'aaaarecord': u'::1'}),
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': name1_dnsname,
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec3],
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
'aaaarecord': [u'::1'],
},
},
),
Always handle NotFound error in dnsrecord-mod When there were no updated attrs when modifying a nonexistent DNS record, the error was not handled and caused an internal server error later (old_entry was used uninitialized). https://fedorahosted.org/freeipa/ticket/3055
2012-09-14 11:05:12 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to modify nonexistent record in zone %r' % zone1,
Always handle NotFound error in dnsrecord-mod When there were no updated attrs when modifying a nonexistent DNS record, the error was not handled and caused an internal server error later (old_entry was used uninitialized). https://fedorahosted.org/freeipa/ticket/3055
2012-09-14 11:05:12 -05:00
command=('dnsrecord_mod',
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
[zone1, u'ghostname'],
Always handle NotFound error in dnsrecord-mod When there were no updated attrs when modifying a nonexistent DNS record, the error was not handled and caused an internal server error later (old_entry was used uninitialized). https://fedorahosted.org/freeipa/ticket/3055
2012-09-14 11:05:12 -05:00
{'aaaarecord': u'f001:baad::1'}),
expected=errors.NotFound(
reason=u'ghostname: DNS resource record not found'),
),
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Modify AAAA record in %r in zone %r' % (name1, zone1),
command=('dnsrecord_mod', [zone1, name1], {'aaaarecord': u'ff02::1'}),
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': name1_dnsname,
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec3],
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
'aaaarecord': [u'ff02::1'],
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Remove AAAA record from %r in zone %r using dnsrecord_mod' % (name1, zone1),
command=('dnsrecord_mod', [zone1, name1], {'aaaarecord': u''}),
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': name1_dnsname,
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec3],
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
},
},
),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add invalid MX record to zone %r using dnsrecord_add' % (zone1),
command=('dnsrecord_add', [zone1, u'@'], {'mxrecord': zone1_ns }),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.ValidationError(name='mx_rec',
error=u'format must be specified as "PREFERENCE EXCHANGER" ' +
u' (see RFC 1035 for details)'),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add MX record to zone %r using dnsrecord_add' % (zone1),
command=('dnsrecord_add', [zone1, u'@'], {'mxrecord': u"0 %s" % zone1_ns }),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': _dns_zone_record,
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
'summary': None,
'result': {
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnszone,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [_dns_zone_record],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'mxrecord': [u"0 %s" % zone1_ns],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add invalid SRV record to zone %r using dnsrecord_add' % (zone1),
command=('dnsrecord_add', [zone1, u'_foo._tcp'], {'srvrecord': zone1_ns}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.ValidationError(name='srv_rec',
error=u'format must be specified as "PRIORITY WEIGHT PORT TARGET" ' +
u' (see RFC 2782 for details)'),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
),
Add SRV record target validator Add missing SRV record target validator to filter out possible user errors. https://fedorahosted.org/freeipa/ticket/2308
2012-02-03 07:25:53 -06:00
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add SRV record to zone %r both via parts and a raw value' % (zone1),
command=('dnsrecord_add', [zone1, u'_foo._tcp'], {'srv_part_priority': 0,
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
'srv_part_weight' : 0,
'srv_part_port' : 123,
'srv_part_target' : u'foo.bar.',
'srvrecord': [u"1 100 1234 %s" \
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
% zone1_ns]}),
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
expected=errors.ValidationError(name='srv_target',
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
error=u'Raw value of a DNS record was already set by ' +
u'"srv_rec" option'),
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add SRV record to zone %r using dnsrecord_add' % (zone1),
command=('dnsrecord_add', [zone1, u'_foo._tcp'], {'srvrecord': u"0 100 1234 %s" % zone1_ns}),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': DNSName(u'_foo._tcp'),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
'summary': None,
'result': {
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnsrecord,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': DN(('idnsname', u'_foo._tcp'), zone1_dn),
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [DNSName(u'_foo._tcp')],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'srvrecord': [u"0 100 1234 %s" % zone1_ns],
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
},
},
),
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to modify SRV record in zone %r without specifying modified value' % (zone1),
command=('dnsrecord_mod', [zone1, u'_foo._tcp'], {'srv_part_priority': 1,}),
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
expected=errors.RequirementError(name='srvrecord'),
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to modify SRV record in zone %r with non-existent modified value' % (zone1),
command=('dnsrecord_mod', [zone1, u'_foo._tcp'], {'srv_part_priority': 1,
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
'srvrecord' : [u"0 100 1234 %s" % absnxname] }),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.AttrValueNotFound(attr='SRV record',
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
value=u'0 100 1234 %s' % absnxname),
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to modify SRV record in zone %r with invalid part value' % (zone1),
command=('dnsrecord_mod', [zone1, u'_foo._tcp'], {'srv_part_priority': 100000,
'srvrecord' : [u"0 100 1234 %s" % zone1_ns] }),
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
expected=errors.ValidationError(name='srv_priority', error=u'can be at most 65535'),
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Modify SRV record in zone %r using parts' % (zone1),
command=('dnsrecord_mod', [zone1, u'_foo._tcp'], {'srv_part_priority': 1,
'srvrecord' : [u"0 100 1234 %s" % zone1_ns] }),
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': DNSName(u'_foo._tcp'),
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [DNSName(u'_foo._tcp')],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'srvrecord': [u"1 100 1234 %s" % zone1_ns],
Harden raw record processing in DNS plugin There were cases where DNS plugin was too tolerant in a raw DNS record option (--<rrtype-rec) processing. It let people specify DNS record parts options in dnsrecord-mod operations for some record without specifying the record that should be updated. It also ignored DNS record parts in dnsrecord-add operation when the raw DNS record value was already set via --<rrtype>-rec option. This patch hardens the processing and returns error in both described cases to make the processes clearer and more robust. All these use cases were also covered by new unit tests. https://fedorahosted.org/freeipa/ticket/2551
2012-03-22 11:35:39 -05:00
},
},
),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add invalid LOC record to zone %r using dnsrecord_add' % (zone1),
command=('dnsrecord_add', [zone1, u'@'], {'locrecord': u"91 11 42.4 N 16 36 29.6 E 227.64" }),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.ValidationError(name='lat_deg',
error=u'can be at most 90'),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add LOC record to zone %r using dnsrecord_add' % (zone1),
Modify DNS tests with LOC records to workaround bug in python-dns. Older versions of dnspython have problems with implicit values for size and h/v precision so our tests use explicit value. See https://github.com/rthalley/dnspython/issues/47 This change is necessary because we want to test if data visible over DNS protocol matches data visible over LDAP. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-17 08:31:10 -06:00
command=('dnsrecord_add', [zone1, u'@'], {'locrecord': u"49 11 42.4 N 16 36 29.6 E 227.64m 10m 10.0m 0.1"}),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': _dns_zone_record,
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
'summary': None,
'result': {
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnszone,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [_dns_zone_record],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'mxrecord': [u"0 %s" % zone1_ns],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
Modify DNS tests with LOC records to workaround bug in python-dns. Older versions of dnspython have problems with implicit values for size and h/v precision so our tests use explicit value. See https://github.com/rthalley/dnspython/issues/47 This change is necessary because we want to test if data visible over DNS protocol matches data visible over LDAP. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-17 08:31:10 -06:00
'locrecord': [u"49 11 42.400 N 16 36 29.600 E 227.64 10.00 10.00 0.10"],
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add CNAME record to %r using dnsrecord_add' % (name1),
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
command=('dnsrecord_add', [zone1, name1], {'cnamerecord': absnxname}),
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
expected=errors.ValidationError(name='cnamerecord',
Improve CNAME record validation Refactor DNS RR conflict validator so that it is better extensible in the future. Also check that there is only one CNAME defined for a DNS record. PTR+CNAME record combination is no longer allowed as we found out it does not make sense to have this combination. https://fedorahosted.org/freeipa/ticket/3450
2013-04-02 04:58:31 -05:00
error=u'CNAME record is not allowed to coexist with any other '
u'record (RFC 1034, section 3.6.2)'),
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
),
Improve CNAME record validation Refactor DNS RR conflict validator so that it is better extensible in the future. Also check that there is only one CNAME defined for a DNS record. PTR+CNAME record combination is no longer allowed as we found out it does not make sense to have this combination. https://fedorahosted.org/freeipa/ticket/3450
2013-04-02 04:58:31 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add multiple CNAME record %r using dnsrecord_add' % (cname),
command=('dnsrecord_add', [zone1, cname], {'cnamerecord':
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
[u'1.%s' % absnxname, u'2.%s' % absnxname]}),
Improve CNAME record validation Refactor DNS RR conflict validator so that it is better extensible in the future. Also check that there is only one CNAME defined for a DNS record. PTR+CNAME record combination is no longer allowed as we found out it does not make sense to have this combination. https://fedorahosted.org/freeipa/ticket/3450
2013-04-02 04:58:31 -05:00
expected=errors.ValidationError(name='cnamerecord',
error=u'only one CNAME record is allowed per name (RFC 2136, section 1.1.5)'),
),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add CNAME record to %r using dnsrecord_add' % (cname),
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
command=('dnsrecord_add', [zone1, cname], {'cnamerecord': absnxname}),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': cname_dnsname,
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
'summary': None,
'result': {
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnsrecord,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': cname_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [cname_dnsname],
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
'cnamerecord': [absnxname],
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
},
},
),
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add other record to CNAME record %r using dnsrecord_add' % (cname),
command=('dnsrecord_add', [zone1, cname], {'arecord': arec1}),
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
expected=errors.ValidationError(name='cnamerecord',
Improve CNAME record validation Refactor DNS RR conflict validator so that it is better extensible in the future. Also check that there is only one CNAME defined for a DNS record. PTR+CNAME record combination is no longer allowed as we found out it does not make sense to have this combination. https://fedorahosted.org/freeipa/ticket/3450
2013-04-02 04:58:31 -05:00
error=u'CNAME record is not allowed to coexist with any other '
u'record (RFC 1034, section 3.6.2)'),
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add other record to CNAME record %r using dnsrecord_mod' % (cname),
command=('dnsrecord_mod', [zone1, cname], {'arecord': arec1}),
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
expected=errors.ValidationError(name='cnamerecord',
Improve CNAME record validation Refactor DNS RR conflict validator so that it is better extensible in the future. Also check that there is only one CNAME defined for a DNS record. PTR+CNAME record combination is no longer allowed as we found out it does not make sense to have this combination. https://fedorahosted.org/freeipa/ticket/3450
2013-04-02 04:58:31 -05:00
error=u'CNAME record is not allowed to coexist with any other '
u'record (RFC 1034, section 3.6.2)'),
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add A record and delete CNAME record in %r with dnsrecord_mod' % (cname),
command=('dnsrecord_mod', [zone1, cname], {'arecord': arec1,
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
'cnamerecord': None}),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': cname_dnsname,
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [cname_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec1],
Enforce CNAME constrains for DNS commands RFC 1912 states that no record (besides PTR) is allowed to coexist with any other record type. When BIND detects this situation, it refuses to load such records. Enforce the constrain for dnsrecord-mod and dnsrecord-add commands. https://fedorahosted.org/freeipa/ticket/2601
2012-07-13 05:23:38 -05:00
},
},
),
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add multiple DNAME records to %r using dnsrecord_add' % (dname),
command=('dnsrecord_add', [zone1, name1], {'dnamerecord':
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
[u'foo-1.%s' % absnxname, u'foo-2.%s' % absnxname]}),
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
expected=errors.ValidationError(name='dnamerecord',
error=u'only one DNAME record is allowed per name (RFC 6672, section 2.4)'),
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add DNAME record to %r using dnsrecord_add' % (dname),
command=('dnsrecord_add', [zone1, dname],
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
{'dnamerecord': u'd.%s' % absnxname, 'arecord': arec1}),
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': dname_dnsname,
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': dname_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [dname_dnsname],
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
'dnamerecord': [u'd.%s' % absnxname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec1],
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add CNAME record to %r using dnsrecord_add' % (dname),
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
command=('dnsrecord_add', [zone1, dname], {'cnamerecord': u'foo-1.%s'
% absnxname}),
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
expected=errors.ValidationError(name='cnamerecord',
error=u'CNAME record is not allowed to coexist with any other '
u'record (RFC 1034, section 3.6.2)'),
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add NS record to %r using dnsrecord_add' % (dname),
command=('dnsrecord_add', [zone1, dname],
{'nsrecord': u'%s.%s.' % (name1, zone1)}),
Test: DNS NS validation Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 11:09:22 -05:00
expected=errors.ValidationError(name='nsrecord',
error=u'NS record is not allowed to coexist with an DNAME '
u'record except when located in a zone root record '
Fix DNS record rename test bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 12:11:27 -05:00
'(RFC 2181, section 6.1)'),
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add NS+DNAME record to %r zone record using dnsrecord_add' % (zone2),
command=('dnsrecord_add', [zone2, u'@'],
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
{'dnamerecord': u'd.%s' % absnxname,
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': zone1_ns, 'force': True}),
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
expected = {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': _dns_zone_record,
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
'summary': None,
'result': {
'objectclass': objectclasses.dnszone,
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
'dnamerecord': [u'd.%s' % absnxname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone2_dn,
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': [zone1_ns] + nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [_dns_zone_record]
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
}
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Delete zone %r' % zone2,
command=('dnszone_del', [zone2], {}),
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': [zone2_absolute_dnsname],
'summary': u'Deleted DNS zone "%s"' % zone2_absolute,
Allow primary keys to use different type than unicode. Also return list of primary keys instead of a single unicode CSV value from LDAPDelete-based commands. This introduces a new capability 'primary_key_types' for backward compatibility with old clients. Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-03-27 08:04:00 -05:00
'result': {'failed': []},
Improve DNAME record validation Extend DNS RR conflict check and forbid DNAME+NS combination unless it is done in root DNS zone record. Add tests to verify this enforced check. https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 04:59:16 -05:00
},
),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add invalid KX record %r using dnsrecord_add' % (name1),
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
command=('dnsrecord_add', [zone1, name1], {'kxrecord': absnxname}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.ValidationError(name='kx_rec',
error=u'format must be specified as "PREFERENCE EXCHANGER" ' +
u' (see RFC 2230 for details)'),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add KX record to %r using dnsrecord_add' % (name1),
command=('dnsrecord_add', [zone1, name1], {'kxrecord': u'1 foo-1' }),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': name1_dnsname,
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
'summary': None,
'result': {
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnsrecord,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': name1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec3],
Refactor dnsrecord processing Current DNS record processing architecture has many flaws, including custom execute() methods which does not take advantage of base LDAP commands or nonstandard and confusing DNS record option processing. This patch refactors DNS record processing with the following improvements: * Every DNS record has now own Parameter type. Each DNS record consists from one or more "parts" which are also Parameters. This architecture will enable much easier implementation of future per-DNS-type API. * Validation is now not written as a separate function for every parameter but is delegated to DNS record parts. * Normalization is also delegated to DNS record parts. * Since standard LDAP base commands execute method is now used, dnsrecord-add and dnsrecord-mod correctly supports --setattr and --addattr options. * In order to prevent confusion unsupported DNS record types are now hidden. They are still present in the plugin so that old clients receive proper validation error. The patch also contains several fixes: * Fix domain-name validation and normalization- allow domain names that are not fully qualified. For example --cname-rec=bar is a valid domain-name for bind which will translate it then as bar.<owning-domain>. This change implies, that fully qualified domain names must end with '.'. * Do not let user accidentally remove entire zone with command "ipa dnsrecord-del @ --del-all". * Fix --ttl and --class option processing in dnsrecord-add and dnsrecord-mod. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
2012-01-06 08:12:41 -06:00
'kxrecord': [u'1 foo-1'],
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
},
},
),
Add DNS record modification command The DNS record plugin does not support modification of a record. One can only add A type addresses to a DNS record or remove the current ones. To actually change a DNS record value it has to be removed and then added with a desired value. This patch adds a new DNS plugin command "dnsrecord-mod" which enables user to: - modify a DNS record value (note than DNS record can hold multiple values and those will be overwritten) - remove a DNS record when an empty value is passed New tests for this new command have been added to the CLI test suite. https://fedorahosted.org/freeipa/ticket/1137
2011-07-12 02:11:00 -05:00
Fix TXT record parsing TXT record validation fails to parse the record if it contains spaces. Standard DNS part parser uses a space to divide record parts. A special parser thus need to be implemented for this RR type. https://fedorahosted.org/freeipa/ticket/2306
2012-02-03 03:01:27 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add TXT record to %r using dnsrecord_add' % (name1),
command=('dnsrecord_add', [zone1, name1], {'txtrecord': u'foo bar' }),
Fix TXT record parsing TXT record validation fails to parse the record if it contains spaces. Standard DNS part parser uses a space to divide record parts. A special parser thus need to be implemented for this RR type. https://fedorahosted.org/freeipa/ticket/2306
2012-02-03 03:01:27 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': name1_dnsname,
Fix TXT record parsing TXT record validation fails to parse the record if it contains spaces. Standard DNS part parser uses a space to divide record parts. A special parser thus need to be implemented for this RR type. https://fedorahosted.org/freeipa/ticket/2306
2012-02-03 03:01:27 -06:00
'summary': None,
'result': {
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnsrecord,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': name1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [arec3],
Fix TXT record parsing TXT record validation fails to parse the record if it contains spaces. Standard DNS part parser uses a space to divide record parts. A special parser thus need to be implemented for this RR type. https://fedorahosted.org/freeipa/ticket/2306
2012-02-03 03:01:27 -06:00
'kxrecord': [u'1 foo-1'],
'txtrecord': [u'foo bar'],
},
},
),
Fix NSEC record conversion NSEC record needs special treatment as it is not composed from a fixed set of DNS parts divided by space, but it contains a multivalued DNS part "types" containing a list of RR types it covers. There was already a special method for parsing raw NSEC record to DNS parts, but the other direction was missing. This patch adds special NSEC convertor to fix this issue. https://fedorahosted.org/freeipa/ticket/2307
2012-02-03 03:41:21 -06:00
Fix precallback validators in DNS plugin DNS plugin contains several RR type record validators run in pre_callback which cannot be used as standard param validator as it needs more data and resources that standard validators provide. However, the precallback validators are not run for DNS records created by new structured options and thus an invalid value may slip in. This patch moves the execution of these precallback validators _after_ the processing of structured DNS options. It also cleans them up a little and makes them more robust. https://fedorahosted.org/freeipa/ticket/2550
2012-03-21 07:25:42 -05:00
dict(
Test: DNS NS validation Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 11:09:22 -05:00
desc='Try to add unresolvable absolute NS record to %r using dnsrecord_add' % (name_ns),
command=('dnsrecord_add', [zone1, name_ns], {'nsrecord': absnxname}),
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
expected=errors.NotFound(reason=u"Nameserver '%s' does not have a corresponding A/AAAA record" % absnxname),
Allow relative DNS name in NS validator Precallback validator was failing when a zone-relative name was used as a NS record (for example record "ns" in a zone "example.com"). However, this is valid in BIND and we should allow it as well. Imports in dns module had to be switched to absolute imports (available from Python 2.5) to deal with a conflict of IPA dns module and dnspython module. https://fedorahosted.org/freeipa/ticket/2630
2012-05-29 08:06:31 -05:00
),
dict(
Test: DNS NS validation Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 11:09:22 -05:00
desc='Try to add unresolvable relative NS record to %r using dnsrecord_add' % (name_ns),
command=('dnsrecord_add', [zone1, name_ns], {'nsrecord': relnxname}),
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
expected=errors.NotFound(reason=u"Nameserver '%s.%s.' does not "
"have a corresponding A/AAAA record" % (relnxname, zone1)),
Fix precallback validators in DNS plugin DNS plugin contains several RR type record validators run in pre_callback which cannot be used as standard param validator as it needs more data and resources that standard validators provide. However, the precallback validators are not run for DNS records created by new structured options and thus an invalid value may slip in. This patch moves the execution of these precallback validators _after_ the processing of structured DNS options. It also cleans them up a little and makes them more robust. https://fedorahosted.org/freeipa/ticket/2550
2012-03-21 07:25:42 -05:00
),
dict(
Test: DNS NS validation Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 11:09:22 -05:00
desc='Add unresolvable NS record with --force to %r using dnsrecord_add' % (name_ns),
command=('dnsrecord_add', [zone1, name_ns], {'nsrecord': absnxname,
Fix precallback validators in DNS plugin DNS plugin contains several RR type record validators run in pre_callback which cannot be used as standard param validator as it needs more data and resources that standard validators provide. However, the precallback validators are not run for DNS records created by new structured options and thus an invalid value may slip in. This patch moves the execution of these precallback validators _after_ the processing of structured DNS options. It also cleans them up a little and makes them more robust. https://fedorahosted.org/freeipa/ticket/2550
2012-03-21 07:25:42 -05:00
'force' : True}),
expected={
Test: DNS NS validation Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 11:09:22 -05:00
'value': name_ns_dnsname,
Fix precallback validators in DNS plugin DNS plugin contains several RR type record validators run in pre_callback which cannot be used as standard param validator as it needs more data and resources that standard validators provide. However, the precallback validators are not run for DNS records created by new structured options and thus an invalid value may slip in. This patch moves the execution of these precallback validators _after_ the processing of structured DNS options. It also cleans them up a little and makes them more robust. https://fedorahosted.org/freeipa/ticket/2550
2012-03-21 07:25:42 -05:00
'summary': None,
'result': {
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnsrecord,
Test: DNS NS validation Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 11:09:22 -05:00
'dn': name_ns_dn,
'idnsname': [name_ns_dnsname],
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
'nsrecord': [absnxname],
Fix precallback validators in DNS plugin DNS plugin contains several RR type record validators run in pre_callback which cannot be used as standard param validator as it needs more data and resources that standard validators provide. However, the precallback validators are not run for DNS records created by new structured options and thus an invalid value may slip in. This patch moves the execution of these precallback validators _after_ the processing of structured DNS options. It also cleans them up a little and makes them more robust. https://fedorahosted.org/freeipa/ticket/2550
2012-03-21 07:25:42 -05:00
},
},
),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to to rename DNS zone %r root record' % (zone1),
Fix DNS record rename test bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 12:11:27 -05:00
command=('dnsrecord_mod', [zone1, u'@'], {'rename': u'renamed-zone',}),
Add rename option for DNS records This option will make renaming DNS records much easier. Add a unit test for this new functionality. https://fedorahosted.org/freeipa/ticket/2600
2012-05-29 08:58:36 -05:00
expected=errors.ValidationError(name='rename',
error=u'DNS zone root record cannot be renamed')
),
Fix DNS record rename test bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 12:11:27 -05:00
Add rename option for DNS records This option will make renaming DNS records much easier. Add a unit test for this new functionality. https://fedorahosted.org/freeipa/ticket/2600
2012-05-29 08:58:36 -05:00
dict(
Fix DNS record rename test bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 12:11:27 -05:00
desc='Rename DNS record %r to %r' % (name_ns, name_ns_renamed),
command=('dnsrecord_mod', [zone1, name_ns], {'rename': name_ns_renamed,}),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
expected={
Fix DNS record rename test bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 12:11:27 -05:00
'value': name_ns_dnsname,
Add rename option for DNS records This option will make renaming DNS records much easier. Add a unit test for this new functionality. https://fedorahosted.org/freeipa/ticket/2600
2012-05-29 08:58:36 -05:00
'summary': None,
'result': {
Fix DNS record rename test bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 12:11:27 -05:00
'idnsname': [name_ns_renamed_dnsname],
'nsrecord': [absnxname],
Add rename option for DNS records This option will make renaming DNS records much easier. Add a unit test for this new functionality. https://fedorahosted.org/freeipa/ticket/2600
2012-05-29 08:58:36 -05:00
},
},
),
dict(
Fix DNS record rename test bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 12:11:27 -05:00
desc='Delete record %r in zone %r' % (name1, zone1),
command=('dnsrecord_del', [zone1, name1],
DNSSEC: Test: DLV record Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-17 10:26:13 -05:00
{'del_all': True}),
Add rename option for DNS records This option will make renaming DNS records much easier. Add a unit test for this new functionality. https://fedorahosted.org/freeipa/ticket/2600
2012-05-29 08:58:36 -05:00
expected={
Fix DNS record rename test bind-dyndb-ldap's bug caused test failure https://fedorahosted.org/bind-dyndb-ldap/ticket/123 Owners with NS record works with the bug Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-21 12:11:27 -05:00
'value': [name1_dnsname],
'summary': u'Deleted record "%s"' % name1,
Allow primary keys to use different type than unicode. Also return list of primary keys instead of a single unicode CSV value from LDAPDelete-based commands. This introduces a new capability 'primary_key_types' for backward compatibility with old clients. Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-03-27 08:04:00 -05:00
'result': {'failed': []},
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
},
),
DNSSEC: Test: DLV record Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-17 10:26:13 -05:00
dict(
desc='Add DLV record to %r using dnsrecord_add' % (dlv),
command=('dnsrecord_add', [zone1, dlv], {'dlvrecord': dlvrec}),
expected={
'value': dlv_dnsname,
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': dlv_dn,
'idnsname': [dlv_dnsname],
'dlvrecord': [dlvrec],
},
},
),
Tests: DNS dsrecord validation Part of: https://fedorahosted.org/freeipa/ticket/3801 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-20 11:53:49 -05:00
dict(
desc='Try to add DS record to zone %r apex, using dnsrecord_add' % (zone1),
command=('dnsrecord_add', [zone1, zone1_absolute], {'dsrecord': ds_rec}),
expected=errors.ValidationError(
name="dsrecord",
error=u'DS record must not be in zone apex (RFC 4035 section 2.4)'
),
),
dict(
desc='Try to add DS record %r without NS record in RRset, using dnsrecord_add' % (ds),
command=('dnsrecord_add', [zone1, ds], {'dsrecord': ds_rec}),
expected=errors.ValidationError(
name="dsrecord",
error=u'DS record requires to coexist with an NS record (RFC 4592 section 4.6, RFC 4035 section 2.4)'
),
),
dict(
desc='Add NS record to %r using dnsrecord_add' % (ds),
command=('dnsrecord_add', [zone1, ds],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
{'nsrecord': zone1_ns, 'force': True}),
Tests: DNS dsrecord validation Part of: https://fedorahosted.org/freeipa/ticket/3801 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-08-20 11:53:49 -05:00
expected={
'value': ds_dnsname,
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': ds_dn,
'idnsname': [ds_dnsname],
'nsrecord': [zone1_ns],
},
},
),
dict(
desc='Add DS record to %r using dnsrecord_add' % (ds),
command=('dnsrecord_add', [zone1, ds],
{'dsrecord': ds_rec}),
expected={
'value': ds_dnsname,
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': ds_dn,
'idnsname': [ds_dnsname],
'nsrecord': [zone1_ns],
'dsrecord': [ds_rec],
},
},
),
dict(
desc='Try to delete NS record (with DS record) %r using dnsrecord_del' % (ds),
command=('dnsrecord_del', [zone1, ds],
{'nsrecord': zone1_ns}),
expected=errors.ValidationError(
name="dsrecord",
error=u'DS record requires to coexist with an NS record (RFC 4592 section 4.6, RFC 4035 section 2.4)'
),
),
dict(
desc='Delete NS+DS record %r in zone %r' % (ds, zone1),
command=('dnsrecord_del', [zone1, ds], {'nsrecord': zone1_ns, 'dsrecord': ds_rec}),
expected={
'value': [ds_dnsname],
'summary': u'Deleted record "%s"' % ds,
'result': {'failed': []},
},
),
DNSSEC: Test: DLV record Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-17 10:26:13 -05:00
dict(
desc='Delete record %r in zone %r' % (dlv, zone1),
command=('dnsrecord_del', [zone1, dlv], {'del_all': True}),
expected={
'value': [dlv_dnsname],
'summary': u'Deleted record "%s"' % dlv,
'result': {'failed': []},
},
),
Test DNS: TLSA record Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:28:17 -05:00
dict(
desc='Try to add invalid TLSA record to %r using dnsrecord_add (1)' % (tlsa),
command=('dnsrecord_add', [zone1, tlsa], {'tlsarecord': tlsarec_err1}),
expected=errors.ValidationError(
name="cert_usage",
error=u'can be at most 255'
),
),
dict(
desc='Try to add invalid TLSA record to %r using dnsrecord_add (2)' % (tlsa),
command=('dnsrecord_add', [zone1, tlsa], {'tlsarecord': tlsarec_err2}),
expected=errors.ValidationError(
name="selector",
error=u'can be at most 255'
),
),
dict(
desc='Try to add invalid TLSA record to %r using dnsrecord_add (3)' % (tlsa),
command=('dnsrecord_add', [zone1, tlsa], {'tlsarecord': tlsarec_err3}),
expected=errors.ValidationError(
name="matching_type",
error=u'can be at most 255'
),
),
dict(
desc='Add TLSA record to %r using dnsrecord_add' % (tlsa),
command=('dnsrecord_add', [zone1, tlsa], {'tlsarecord': tlsarec_ok}),
expected={
'value': tlsa_dnsname,
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': tlsa_dn,
'idnsname': [tlsa_dnsname],
'tlsarecord': [tlsarec_ok],
},
},
),
dict(
Fix dnsrecord-mod raise error if last record attr is removed Removing last record attribute causes output type validation error Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-09-04 08:48:16 -05:00
desc='Remove record using dnsrecord-mod %r in zone %r' % (tlsa, zone1),
command=('dnsrecord_mod', [zone1, tlsa], {'tlsarecord': ''}),
Test DNS: TLSA record Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:28:17 -05:00
expected={
Fix dnsrecord-mod raise error if last record attr is removed Removing last record attribute causes output type validation error Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-09-04 08:48:16 -05:00
'value': tlsa_dnsname,
Test DNS: TLSA record Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-04 09:28:17 -05:00
'summary': u'Deleted record "%s"' % tlsa,
'result': {'failed': []},
},
),
Fix dnszone-add name_from_ip server validation Ticket 1627 contained a (temporary hack-ish) fix for dnszone-add name_from_ip validation which works fine for CLI. However, when the command is not proceeded via CLI and sent directly to the RPC server, the server throws Internal Server Error. Make sure that the server returns a reasonable error. Also implement 2 unit cases testing this option https://fedorahosted.org/freeipa/ticket/1941
2011-10-11 03:54:34 -05:00
dict(
desc='Try to create a reverse zone from invalid IP',
command=(
'dnszone_add', [], {
'name_from_ip': u'foo',
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'idnssoamname': zone1_ns,
'idnssoarname': zone1_rname,
Fix dnszone-add name_from_ip server validation Ticket 1627 contained a (temporary hack-ish) fix for dnszone-add name_from_ip validation which works fine for CLI. However, when the command is not proceeded via CLI and sent directly to the RPC server, the server throws Internal Server Error. Make sure that the server returns a reasonable error. Also implement 2 unit cases testing this option https://fedorahosted.org/freeipa/ticket/1941
2011-10-11 03:54:34 -05:00
}
),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.ValidationError(name='name_from_ip',
error=u'invalid IP network format'),
Fix dnszone-add name_from_ip server validation Ticket 1627 contained a (temporary hack-ish) fix for dnszone-add name_from_ip validation which works fine for CLI. However, when the command is not proceeded via CLI and sent directly to the RPC server, the server throws Internal Server Error. Make sure that the server returns a reasonable error. Also implement 2 unit cases testing this option https://fedorahosted.org/freeipa/ticket/1941
2011-10-11 03:54:34 -05:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Create reverse zone from IP/netmask %r using name_from_ip option' % revzone1_ip,
Fix dnszone-add name_from_ip server validation Ticket 1627 contained a (temporary hack-ish) fix for dnszone-add name_from_ip validation which works fine for CLI. However, when the command is not proceeded via CLI and sent directly to the RPC server, the server throws Internal Server Error. Make sure that the server returns a reasonable error. Also implement 2 unit cases testing this option https://fedorahosted.org/freeipa/ticket/1941
2011-10-11 03:54:34 -05:00
command=(
'dnszone_add', [], {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'name_from_ip': revzone1_ip,
'idnssoarname': zone1_rname,
Fix dnszone-add name_from_ip server validation Ticket 1627 contained a (temporary hack-ish) fix for dnszone-add name_from_ip validation which works fine for CLI. However, when the command is not proceeded via CLI and sent directly to the RPC server, the server throws Internal Server Error. Make sure that the server returns a reasonable error. Also implement 2 unit cases testing this option https://fedorahosted.org/freeipa/ticket/1941
2011-10-11 03:54:34 -05:00
}
),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': revzone1_dnsname,
Fix dnszone-add name_from_ip server validation Ticket 1627 contained a (temporary hack-ish) fix for dnszone-add name_from_ip validation which works fine for CLI. However, when the command is not proceeded via CLI and sent directly to the RPC server, the server throws Internal Server Error. Make sure that the server returns a reasonable error. Also implement 2 unit cases testing this option https://fedorahosted.org/freeipa/ticket/1941
2011-10-11 03:54:34 -05:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': revzone1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [revzone1_dnsname],
Fix dnszone-add name_from_ip server validation Ticket 1627 contained a (temporary hack-ish) fix for dnszone-add name_from_ip validation which works fine for CLI. However, when the command is not proceeded via CLI and sent directly to the RPC server, the server throws Internal Server Error. Make sure that the server returns a reasonable error. Also implement 2 unit cases testing this option https://fedorahosted.org/freeipa/ticket/1941
2011-10-11 03:54:34 -05:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Fix dnszone-add name_from_ip server validation Ticket 1627 contained a (temporary hack-ish) fix for dnszone-add name_from_ip validation which works fine for CLI. However, when the command is not proceeded via CLI and sent directly to the RPC server, the server throws Internal Server Error. Make sure that the server returns a reasonable error. Also implement 2 unit cases testing this option https://fedorahosted.org/freeipa/ticket/1941
2011-10-11 03:54:34 -05:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
Fill new DNS zone update policy by default For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by default and let users just switch the policy on or off. https://fedorahosted.org/freeipa/ticket/2441
2012-06-04 10:53:34 -05:00
'idnsupdatepolicy': [u'grant %(realm)s krb5-subdomain %(zone)s PTR;'
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
% dict(realm=api.env.realm, zone=revzone1)],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnszone,
Fix dnszone-add name_from_ip server validation Ticket 1627 contained a (temporary hack-ish) fix for dnszone-add name_from_ip validation which works fine for CLI. However, when the command is not proceeded via CLI and sent directly to the RPC server, the server throws Internal Server Error. Make sure that the server returns a reasonable error. Also implement 2 unit cases testing this option https://fedorahosted.org/freeipa/ticket/1941
2011-10-11 03:54:34 -05:00
},
},
),
Use default reverse zone consistently When a new reverse zone is to be generated based on an IP address without a network prefix length, we need to use some default value. While netaddr library default ones (32b for IPv4 and 128b for IPv6) are not very sensible we should use the defaults already applied in installers. That is 24b for IPv6 and 64 for IPv6. Test case has been added to cover the new default. https://fedorahosted.org/freeipa/ticket/2461
2012-09-05 02:56:27 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Create reverse zone from IP %r using name_from_ip option' % revzone2_ip,
Use default reverse zone consistently When a new reverse zone is to be generated based on an IP address without a network prefix length, we need to use some default value. While netaddr library default ones (32b for IPv4 and 128b for IPv6) are not very sensible we should use the defaults already applied in installers. That is 24b for IPv6 and 64 for IPv6. Test case has been added to cover the new default. https://fedorahosted.org/freeipa/ticket/2461
2012-09-05 02:56:27 -05:00
command=(
'dnszone_add', [], {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'name_from_ip': revzone2_ip,
'idnssoarname': zone1_rname,
Use default reverse zone consistently When a new reverse zone is to be generated based on an IP address without a network prefix length, we need to use some default value. While netaddr library default ones (32b for IPv4 and 128b for IPv6) are not very sensible we should use the defaults already applied in installers. That is 24b for IPv6 and 64 for IPv6. Test case has been added to cover the new default. https://fedorahosted.org/freeipa/ticket/2461
2012-09-05 02:56:27 -05:00
}
),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': revzone2_dnsname,
Use default reverse zone consistently When a new reverse zone is to be generated based on an IP address without a network prefix length, we need to use some default value. While netaddr library default ones (32b for IPv4 and 128b for IPv6) are not very sensible we should use the defaults already applied in installers. That is 24b for IPv6 and 64 for IPv6. Test case has been added to cover the new default. https://fedorahosted.org/freeipa/ticket/2461
2012-09-05 02:56:27 -05:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': revzone2_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [revzone2_dnsname],
Use default reverse zone consistently When a new reverse zone is to be generated based on an IP address without a network prefix length, we need to use some default value. While netaddr library default ones (32b for IPv4 and 128b for IPv6) are not very sensible we should use the defaults already applied in installers. That is 24b for IPv6 and 64 for IPv6. Test case has been added to cover the new default. https://fedorahosted.org/freeipa/ticket/2461
2012-09-05 02:56:27 -05:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Use default reverse zone consistently When a new reverse zone is to be generated based on an IP address without a network prefix length, we need to use some default value. While netaddr library default ones (32b for IPv4 and 128b for IPv6) are not very sensible we should use the defaults already applied in installers. That is 24b for IPv6 and 64 for IPv6. Test case has been added to cover the new default. https://fedorahosted.org/freeipa/ticket/2461
2012-09-05 02:56:27 -05:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-subdomain %(zone)s PTR;'
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
% dict(realm=api.env.realm, zone=revzone2)],
Use default reverse zone consistently When a new reverse zone is to be generated based on an IP address without a network prefix length, we need to use some default value. While netaddr library default ones (32b for IPv4 and 128b for IPv6) are not very sensible we should use the defaults already applied in installers. That is 24b for IPv6 and 64 for IPv6. Test case has been added to cover the new default. https://fedorahosted.org/freeipa/ticket/2461
2012-09-05 02:56:27 -05:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add PTR record %r to %r using dnsrecord_add' % (revname1, revzone1),
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
command=('dnsrecord_add', [revzone1, revname1], {'ptrrecord': absnxname}),
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': revname1_dnsname,
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
'summary': None,
'result': {
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnsrecord,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': revname1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [revname1_dnsname],
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
'ptrrecord': [absnxname],
Improve DNS record data validation Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
2011-11-09 10:35:52 -06:00
},
},
),
Fix structured DNS record output Recent LDAP refactoring replaced entry_attrs regular dict with normalized keys (i.e. lowercase) with LDAPEntry instance which keys may not be normalized. This broke CND command output when --structured and --all options were used. Force lowercase normalization of the LDAPEntry keys in DNS plugin structured format postprocessing. Also add a missing test for DNS record structured output. https://fedorahosted.org/freeipa/ticket/3526
2013-03-21 08:54:46 -05:00
dict(
desc='Show record %r in zone %r with --structured and --all options'\
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
% (revname1, revzone1),
command=('dnsrecord_show', [revzone1, revname1],
Fix structured DNS record output Recent LDAP refactoring replaced entry_attrs regular dict with normalized keys (i.e. lowercase) with LDAPEntry instance which keys may not be normalized. This broke CND command output when --structured and --all options were used. Force lowercase normalization of the LDAPEntry keys in DNS plugin structured format postprocessing. Also add a missing test for DNS record structured output. https://fedorahosted.org/freeipa/ticket/3526
2013-03-21 08:54:46 -05:00
{'structured': True, 'all': True}),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': revname1_dnsname,
Fix structured DNS record output Recent LDAP refactoring replaced entry_attrs regular dict with normalized keys (i.e. lowercase) with LDAPEntry instance which keys may not be normalized. This broke CND command output when --structured and --all options were used. Force lowercase normalization of the LDAPEntry keys in DNS plugin structured format postprocessing. Also add a missing test for DNS record structured output. https://fedorahosted.org/freeipa/ticket/3526
2013-03-21 08:54:46 -05:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': revname1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [revname1_dnsname],
Fix structured DNS record output Recent LDAP refactoring replaced entry_attrs regular dict with normalized keys (i.e. lowercase) with LDAPEntry instance which keys may not be normalized. This broke CND command output when --structured and --all options were used. Force lowercase normalization of the LDAPEntry keys in DNS plugin structured format postprocessing. Also add a missing test for DNS record structured output. https://fedorahosted.org/freeipa/ticket/3526
2013-03-21 08:54:46 -05:00
'objectclass': objectclasses.dnsrecord,
'dnsrecords': [
{
'dnstype': u'PTR',
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
'dnsdata': absnxname,
'ptr_part_hostname': absnxname,
Fix structured DNS record output Recent LDAP refactoring replaced entry_attrs regular dict with normalized keys (i.e. lowercase) with LDAPEntry instance which keys may not be normalized. This broke CND command output when --structured and --all options were used. Force lowercase normalization of the LDAPEntry keys in DNS plugin structured format postprocessing. Also add a missing test for DNS record structured output. https://fedorahosted.org/freeipa/ticket/3526
2013-03-21 08:54:46 -05:00
},
],
},
},
),
Global DNS options Implement API for DNS global options supported in bind-dyndb-ldap. Currently, global DNS option overrides any relevant option in named.conf. Thus they are not filled by default they are left as a possibility for a user. Bool encoding had to be fixed so that Bool LDAP attribute can also be deleted and not just set to True or False. https://fedorahosted.org/freeipa/ticket/2216
2012-02-10 05:54:49 -06:00
dict(
desc='Update global DNS settings',
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
command=('dnsconfig_mod', [], {'idnsforwarders' : [fwd_ip],}),
Global DNS options Implement API for DNS global options supported in bind-dyndb-ldap. Currently, global DNS option overrides any relevant option in named.conf. Thus they are not filled by default they are left as a possibility for a user. Bool encoding had to be fixed so that Bool LDAP attribute can also be deleted and not just set to True or False. https://fedorahosted.org/freeipa/ticket/2216
2012-02-10 05:54:49 -06:00
expected={
Allow primary keys to use different type than unicode. Also return list of primary keys instead of a single unicode CSV value from LDAPDelete-based commands. This introduces a new capability 'primary_key_types' for backward compatibility with old clients. Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-03-27 08:04:00 -05:00
'value': None,
Global DNS options Implement API for DNS global options supported in bind-dyndb-ldap. Currently, global DNS option overrides any relevant option in named.conf. Thus they are not filled by default they are left as a possibility for a user. Bool encoding had to be fixed so that Bool LDAP attribute can also be deleted and not just set to True or False. https://fedorahosted.org/freeipa/ticket/2216
2012-02-10 05:54:49 -06:00
'summary': None,
fix forwarder validation errors Fix tests, validation in dnsconfig mod, wuser warning Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-10-21 06:59:42 -05:00
u'messages': (
DNSSEC: Improve global forwarders validation Validation now provides more detailed information and less false positives failures. https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-22 08:29:21 -05:00
{u'message': lambda x: x.startswith(
u"DNS server %s: query '. SOA':" % fwd_ip),
fix forwarder validation errors Fix tests, validation in dnsconfig mod, wuser warning Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-10-21 06:59:42 -05:00
u'code': 13006,
u'type':u'warning',
DNSSEC: Improve global forwarders validation Validation now provides more detailed information and less false positives failures. https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-22 08:29:21 -05:00
u'name': u'DNSServerValidationWarning'},
fix forwarder validation errors Fix tests, validation in dnsconfig mod, wuser warning Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-10-21 06:59:42 -05:00
),
Global DNS options Implement API for DNS global options supported in bind-dyndb-ldap. Currently, global DNS option overrides any relevant option in named.conf. Thus they are not filled by default they are left as a possibility for a user. Bool encoding had to be fixed so that Bool LDAP attribute can also be deleted and not just set to True or False. https://fedorahosted.org/freeipa/ticket/2216
2012-02-10 05:54:49 -06:00
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'idnsforwarders': [fwd_ip],
Global DNS options Implement API for DNS global options supported in bind-dyndb-ldap. Currently, global DNS option overrides any relevant option in named.conf. Thus they are not filled by default they are left as a possibility for a user. Bool encoding had to be fixed so that Bool LDAP attribute can also be deleted and not just set to True or False. https://fedorahosted.org/freeipa/ticket/2216
2012-02-10 05:54:49 -06:00
},
},
),
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add invalid allow-query to zone %r' % zone1,
command=('dnszone_mod', [zone1], {'idnsallowquery': u'foo'}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.ValidationError(name='allow_query',
Switch %r specifiers to '%s' in Public errors This switch drops the preceding 'u' from strings within Public error messages. This patch also addresses the related unfriendly 'u' from re-raising errors from netaddr.IPAddress by passing a bytestring through the function. Also switched ValidationError to TypeError in validate_scalar per jcholast@redhat.com. Ticket: https://fedorahosted.org/freeipa/ticket/3121 Ticket: https://fedorahosted.org/freeipa/ticket/2588
2012-11-08 09:06:35 -06:00
error=u"failed to detect a valid IP address from 'foo'"),
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add allow-query ACL to zone %r' % zone1,
command=('dnszone_mod', [zone1], {'idnsallowquery': allowquery_restricted_in}),
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': zone1_absolute_dnsname,
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone1_absolute_dnsname],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'mxrecord': [u'0 ns1.dnszone.test.'],
Modify DNS tests with LOC records to workaround bug in python-dns. Older versions of dnspython have problems with implicit values for size and h/v precision so our tests use explicit value. See https://github.com/rthalley/dnspython/issues/47 This change is necessary because we want to test if data visible over DNS protocol matches data visible over LDAP. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-17 08:31:10 -06:00
'locrecord': [u"49 11 42.400 N 16 36 29.600 E 227.64 10.00 10.00 0.10"],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
Use private IPv4 addresses for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:03:59 -06:00
'idnsallowquery': [allowquery_restricted_out],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnsallowtransfer': [u'none;'],
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add invalid allow-transfer to zone %r' % zone1,
command=('dnszone_mod', [zone1], {'idnsallowtransfer': u'10.'}),
Fix expected error messages in tests Have the test suite check error messages. Since XMLRPC doesn't give us structured error information, just compare the resulting text. Fix messages that tests expect to cause. Minor changes: Make netgroup-mod's NotFound message consistent with other objects and methods. In test_automember_plugin, test with nonexistent automember rules of both types, instead of nonexistent users. https://fedorahosted.org/freeipa/ticket/2549
2012-03-27 08:27:11 -05:00
expected=errors.ValidationError(name='allow_transfer',
Switch %r specifiers to '%s' in Public errors This switch drops the preceding 'u' from strings within Public error messages. This patch also addresses the related unfriendly 'u' from re-raising errors from netaddr.IPAddress by passing a bytestring through the function. Also switched ValidationError to TypeError in validate_scalar per jcholast@redhat.com. Ticket: https://fedorahosted.org/freeipa/ticket/3121 Ticket: https://fedorahosted.org/freeipa/ticket/2588
2012-11-08 09:06:35 -06:00
error=u"failed to detect a valid IP address from '10.'"),
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add allow-transer ACL to zone %r' % zone1,
command=('dnszone_mod', [zone1], {'idnsallowtransfer': fwd_ip}),
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': zone1_absolute_dnsname,
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone1_absolute_dnsname],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'mxrecord': [u'0 ns1.dnszone.test.'],
Modify DNS tests with LOC records to workaround bug in python-dns. Older versions of dnspython have problems with implicit values for size and h/v precision so our tests use explicit value. See https://github.com/rthalley/dnspython/issues/47 This change is necessary because we want to test if data visible over DNS protocol matches data visible over LDAP. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-17 08:31:10 -06:00
'locrecord': [u"49 11 42.400 N 16 36 29.600 E 227.64 10.00 10.00 0.10"],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
Use private IPv4 addresses for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:03:59 -06:00
'idnsallowquery': [allowquery_restricted_out],
'idnsallowtransfer': [allowtransfer_tofwd],
Query and transfer ACLs for DNS zones Provide a way to specify BIND allow-query and allow-transfer ACLs for DNS zones. IMPORTANT: new bind-dyndb-ldap adds a zone transfer ability. To avoid zone information leaks to unintended places, allow-transfer ACL for every zone is by default set to none and has to be explicitly enabled by an Administrator. This is done both for new DNS zones and old DNS zones during RPM update via new DNS upgrade plugin. https://fedorahosted.org/freeipa/ticket/1211
2012-02-24 02:30:39 -06:00
},
},
),
Fix DNS SOA serial parameters boundaries Set correct boundaries for DNS SOA serial parameters (see RFC 1035, 2181). https://fedorahosted.org/freeipa/ticket/2568
2012-09-04 09:05:34 -05:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Set SOA serial of zone %r to high number' % zone1,
Modernize number literals Use Python-3 compatible syntax, without breaking compatibility with py 2.7 - Octals literals start with 0o to prevent confusion - The "L" at the end of large int literals is not required as they use long on Python 2 automatically. - Using 'int' instead of 'long' for small numbers is OK in all cases except strict type checking checking, e.g. type(0). https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-15 09:38:06 -05:00
command=('dnszone_mod', [zone1], {'idnssoaserial': 4294967295}),
Fix DNS SOA serial parameters boundaries Set correct boundaries for DNS SOA serial parameters (see RFC 1035, 2181). https://fedorahosted.org/freeipa/ticket/2568
2012-09-04 09:05:34 -05:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': zone1_absolute_dnsname,
Fix DNS SOA serial parameters boundaries Set correct boundaries for DNS SOA serial parameters (see RFC 1035, 2181). https://fedorahosted.org/freeipa/ticket/2568
2012-09-04 09:05:34 -05:00
'summary': None,
'result': {
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone1_absolute_dnsname],
Fix DNS SOA serial parameters boundaries Set correct boundaries for DNS SOA serial parameters (see RFC 1035, 2181). https://fedorahosted.org/freeipa/ticket/2568
2012-09-04 09:05:34 -05:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
Fix DNS SOA serial parameters boundaries Set correct boundaries for DNS SOA serial parameters (see RFC 1035, 2181). https://fedorahosted.org/freeipa/ticket/2568
2012-09-04 09:05:34 -05:00
'mxrecord': [u'0 ns1.dnszone.test.'],
Modify DNS tests with LOC records to workaround bug in python-dns. Older versions of dnspython have problems with implicit values for size and h/v precision so our tests use explicit value. See https://github.com/rthalley/dnspython/issues/47 This change is necessary because we want to test if data visible over DNS protocol matches data visible over LDAP. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-17 08:31:10 -06:00
'locrecord': [u"49 11 42.400 N 16 36 29.600 E 227.64 10.00 10.00 0.10"],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone1_rname_dnsname],
Fix DNS SOA serial parameters boundaries Set correct boundaries for DNS SOA serial parameters (see RFC 1035, 2181). https://fedorahosted.org/freeipa/ticket/2568
2012-09-04 09:05:34 -05:00
'idnssoaserial': [u'4294967295'],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
Use private IPv4 addresses for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:03:59 -06:00
'idnsallowquery': [allowquery_restricted_out],
'idnsallowtransfer': [allowtransfer_tofwd],
Fix DNS SOA serial parameters boundaries Set correct boundaries for DNS SOA serial parameters (see RFC 1035, 2181). https://fedorahosted.org/freeipa/ticket/2568
2012-09-04 09:05:34 -05:00
},
},
),
Add reverse DNS record when forward is created Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
2012-02-24 07:15:24 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to create duplicate PTR record for %r with --a-create-reverse' % name1,
command=('dnsrecord_add', [zone1, name1], {'arecord': revname1_ip,
Add reverse DNS record when forward is created Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
2012-02-24 07:15:24 -06:00
'a_extra_create_reverse' : True}),
Use private IPv4 addresses for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:03:59 -06:00
expected=errors.DuplicateEntry(message=u'Reverse record for IP '
'address %s already exists in reverse zone '
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'%s.' % (revname1_ip, revzone1)),
Add reverse DNS record when forward is created Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
2012-02-24 07:15:24 -06:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Create A record %r in zone %r with --a-create-reverse' % (name1, zone1),
command=('dnsrecord_add', [zone1, name1], {'arecord': revname2_ip,
Add reverse DNS record when forward is created Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
2012-02-24 07:15:24 -06:00
'a_extra_create_reverse' : True}),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': name1_dnsname,
Add reverse DNS record when forward is created Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
2012-02-24 07:15:24 -06:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': name1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [name1_dnsname],
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'objectclass': objectclasses.dnsrecord,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'arecord': [revname2_ip],
Add reverse DNS record when forward is created Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
2012-02-24 07:15:24 -06:00
},
},
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Check reverse record for %r created via --a-create-reverse' % name1,
command=('dnsrecord_show', [revzone1, revname2], {}),
Add reverse DNS record when forward is created Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
2012-02-24 07:15:24 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': revname2_dnsname,
Add reverse DNS record when forward is created Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
2012-02-24 07:15:24 -06:00
'summary': None,
'result': {
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': revname2_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [revname2_dnsname],
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'ptrrecord': [name1 + '.' + zone1 + '.'],
Add reverse DNS record when forward is created Adding reverse DNS record may be a time consuming task, especially for IPv6 addresses. Having a way to automatically create a reverse record when a forward record is created could speed up the process. host-add command already has this possibility. This patch takes advantage of the new per-type API and adds new options for A/AAAA record types: --a-create-reverse and --aaaa-create-reverse. These commands can be used to automatically create reverse records for new A/AAAA addresses (both forward and reverse zones need to be managed by FreeIPA server): ipa dnsrecord-add example.com foo --a-rec=10.0.0.1 --a-create-reverse This command would add a new A record to record foo in zone example.com and a PTR record to appropriate reverse zone for IP address 10.0.0.1 (for example PTR record 1 in zone 0.0.10.in-addr.arpa. pointing to foo.example.com.). Few modification were done to new DNS API to support this feature: - Refactor --ip-address option handling from host-add and place it to dns.py to be used by both modules - Add support for "extra" per-type options - Hide DNS record part options in dnsrecord_find command as they have no effect for this command https://fedorahosted.org/freeipa/ticket/2009
2012-02-24 07:15:24 -06:00
},
},
),
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
dict(
desc='Try to add per-zone permission for unknown zone',
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
command=('dnszone_add_permission', [absnxname], {}),
expected=errors.NotFound(reason=u'%s: DNS zone not found' % absnxname)
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Add per-zone permission for zone %r' % zone1,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dnszone_add_permission', [zone1], {}
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
expected=dict(
result=True,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
value=zone1_permission,
summary=u'Added system permission "%s"' % zone1_permission,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Try to add duplicate per-zone permission for zone %r' % zone1,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dnszone_add_permission', [zone1], {}
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
expected=errors.DuplicateEntry(message=u'permission with name '
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'"%s" already exists' % zone1_permission)
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Make sure the permission was created %r' % zone1,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'permission_show', [zone1_permission], {}
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
expected=dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
value=zone1_permission,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
summary=None,
result={
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_permission_dn,
'cn': [zone1_permission],
Rewrite the Permission plugin Ticket: https://fedorahosted.org/freeipa/ticket/3566 Design: http://www.freeipa.org/page/V3/Permissions_V2
2013-11-13 09:31:58 -06:00
'objectclass': objectclasses.system_permission,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
'ipapermissiontype': [u'SYSTEM'],
},
),
),
Make sure SYSTEM permissions can be retreived with --all --raw Part of the work for: https://fedorahosted.org/freeipa/ticket/4034
2013-12-13 04:10:28 -06:00
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Retrieve the permission %r with --all --raw' % zone1,
Make sure SYSTEM permissions can be retreived with --all --raw Part of the work for: https://fedorahosted.org/freeipa/ticket/4034
2013-12-13 04:10:28 -06:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'permission_show', [zone1_permission], {}
Make sure SYSTEM permissions can be retreived with --all --raw Part of the work for: https://fedorahosted.org/freeipa/ticket/4034
2013-12-13 04:10:28 -06:00
),
expected=dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
value=zone1_permission,
Make sure SYSTEM permissions can be retreived with --all --raw Part of the work for: https://fedorahosted.org/freeipa/ticket/4034
2013-12-13 04:10:28 -06:00
summary=None,
result={
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dn': zone1_permission_dn,
'cn': [zone1_permission],
Make sure SYSTEM permissions can be retreived with --all --raw Part of the work for: https://fedorahosted.org/freeipa/ticket/4034
2013-12-13 04:10:28 -06:00
'objectclass': objectclasses.system_permission,
'ipapermissiontype': [u'SYSTEM'],
},
),
),
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
dict(
desc='Try to remove per-zone permission for unknown zone',
Use reserved domain names for tests https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 05:51:08 -06:00
command=('dnszone_remove_permission', [absnxname], {}),
expected=errors.NotFound(reason=u'%s: DNS zone not found'
% absnxname)
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Remove per-zone permission for zone %r' % zone1,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'dnszone_remove_permission', [zone1], {}
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
expected=dict(
result=True,
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
value=zone1_permission,
summary=u'Removed system permission "%s"' % zone1_permission,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
),
dict(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
desc='Make sure the permission for zone %r was deleted' % zone1,
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
command=(
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
'permission_show', [zone1_permission], {}
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
expected=errors.NotFound(reason=u'%s: permission not found'
Rename variables in test xmlrpc/dns_plugin https://fedorahosted.org/freeipa/ticket/4139
2014-01-30 06:04:29 -06:00
% zone1_permission)
Per-domain DNS record permissions IPA implements read/write permissions for DNS record or zones. Provided set of permissions and privileges can, however, only grant access to the whole DNS tree, which may not be appropriate. Administrators may miss more fine-grained permissions allowing them to delegate access per-zone. Create a new IPA auxiliary objectclass ipaDNSZone allowing a managedBy attribute for a DNS zone. This attribute will hold a group DN (in this case a permission) which allows its members to read or write in a zone. Member permissions in given zone will only have 2 limitations: 1) Members cannot delete the zone 2) Members cannot edit managedBy attribute Current DNS deny ACI used to enforce read access is removed so that DNS privileges are based on allow ACIs only, which is much more flexible approach as deny ACIs have always precedence and limit other extensions. Per-zone access is allowed in 3 generic ACIs placed in cn=dns,$SUFFIX so that no special ACIs has to be added to DNS zones itselves. 2 new commands have been added which allows an administrator to create the system permission allowing the per-zone access and fill a zone's managedBy attribute: * dnszone-add-permission: Add per-zone permission * dnszone-remove-permission: Remove per-zone permission https://fedorahosted.org/freeipa/ticket/2511
2012-06-27 06:10:10 -05:00
),
DNS missing tests * try to remove non-existent permission * try to remove idnssoamname using dnszone-mod --name-server= Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-01 06:21:19 -05:00
dict(
desc='Try to remove non-existent per-zone permission for zone %r' % zone1,
command=(
'dnszone_remove_permission', [zone1], {}
),
expected=errors.NotFound(reason=u'%s: permission not found'
% zone1_permission)
),
Add new version of DNS plugin: complete rework with baseldap + unit tests. Ticket #36 Ticket #450
2010-11-08 21:34:14 -06:00
dict(
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
desc='Try to create zone %r with relative nameserver' % zone3,
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
command=(
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'dnszone_add', [zone3], {
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
'idnssoamname': u'ns',
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoarname': zone3_rname,
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
}
),
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
expected=errors.NotFound(reason=u"Nameserver 'ns.%s' does not have a corresponding A/AAAA record"
% zone3_absolute)
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
),
dict(
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
desc='Try to create zone %r with nameserver in the zone itself' % zone3,
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
command=(
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'dnszone_add', [zone3], {
'idnssoamname': zone3_absolute,
'idnssoarname': zone3_rname,
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
}
),
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
expected=errors.NotFound(reason=u"Nameserver '%s' does not have a corresponding A/AAAA record"
% zone3_absolute)
Process relative nameserver DNS record correctly Nameserver hostname passed to dnszone_add command was always treated as FQDN even though it was a relative DNS name to the new zone. All relative names were being rejected as unresolvable. Modify --name-server option processing in dnszone_add and dnszone_mod to respect FQDN/relative DNS name and do the checks accordingly. With this change, user can add a new zone "example.com" and let dnszone_add to create NS record "ns" in it, when supplied with its IP address. IP address check is more strict so that it is not entered when no forward record is created. Places misusing the option were fixed. Nameserver option now also accepts zone name, which means that NS and A record is placed to DNS zone itself. Also "@" is accepted as a nameserver name, BIND understand it also as a zone name. As a side-effect of this change, other records with hostname part (MX, KX, NS, SRV) accept "@" as valid hostname. BIND replaces it with respective zone name as well. Unit tests were updated to test the new format. https://fedorahosted.org/freeipa/ticket/3204
2012-10-25 01:47:34 -05:00
),
Tests: tests for NSEC3PARAM records Ticket: https://fedorahosted.org/freeipa/ticket/4328 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-06 09:21:51 -05:00
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
dict(
desc='Create zone %r' % zone3,
command=(
'dnszone_add', [zone3], {
'idnssoarname': zone3_rname,
}
),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': zone3_absolute_dnsname,
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'summary': None,
'result': {
'dn': zone3_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone3_absolute_dnsname],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone3_rname_dnsname],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict(
desc='Add A record to %r in zone %r' % (zone3_ns2_arec, zone3),
command=('dnsrecord_add', [zone3, zone3_ns2_arec], {'arecord': zone3_ip2}),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': zone3_ns2_arec_dnsname,
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'summary': None,
'result': {
'dn': zone3_ns2_arec_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [zone3_ns2_arec_dnsname],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'arecord': [zone3_ip2],
'objectclass': objectclasses.dnsrecord,
},
},
),
dict(
desc='Create reverse zone %r' % revzone3_classless1,
command=(
'dnszone_add', [revzone3_classless1], {
'idnssoarname': zone3_rname,
}
),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': revzone3_classless1_dnsname,
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'summary': None,
'result': {
'dn': revzone3_classless1_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [revzone3_classless1_dnsname],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone3_rname_dnsname],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-subdomain %(zone)s PTR;'
% dict(realm=api.env.realm, zone=revzone3_classless1)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict(
desc='Create classless reverse zone %r' % revzone3_classless2,
command=(
'dnszone_add', [revzone3_classless2], {
'idnssoarname': zone3_rname,
}
),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': revzone3_classless2_dnsname,
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'summary': None,
'result': {
'dn': revzone3_classless2_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [revzone3_classless2_dnsname],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnssoarname': [zone3_rname_dnsname],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-subdomain %(zone)s PTR;'
% dict(realm=api.env.realm, zone=revzone3_classless2)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
Allow to add managed permission for reverse zones Ticket: https://fedorahosted.org/freeipa/ticket/4422 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-04 03:20:04 -05:00
dict(
desc='Add per-zone permission for classless zone %r' % revzone3_classless2,
command=(
'dnszone_add_permission', [revzone3_classless2], {}
),
expected=dict(
result=True,
value=revzone3_classless2_permission,
summary=u'Added system permission "%s"' % revzone3_classless2_permission,
),
),
dict(
desc='Remove per-zone permission for classless zone %r' % revzone3_classless2,
command=(
'dnszone_remove_permission', [revzone3_classless2], {}
),
expected=dict(
result=True,
value=revzone3_classless2_permission,
summary=u'Removed system permission "%s"' % revzone3_classless2_permission,
),
),
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
dict(
desc='Add NS record to %r in revzone %r' % (nsrev, revzone3_classless1),
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
command=('dnsrecord_add', [revzone3_classless1, nsrev], {'nsrecord': zone3_ns2_arec_absolute}),
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': nsrev_dnsname,
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'summary': None,
'result': {
'dn': nsrev_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [nsrev_dnsname],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': [zone3_ns2_arec_absolute],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'objectclass': objectclasses.dnsrecord,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
},
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
},
),
dict(
desc='Add CNAME record to %r in revzone %r' % (cnamerev, revzone3_classless1),
command=('dnsrecord_add', [revzone3_classless1, cnamerev], {'cnamerecord': cnamerev_hostname}),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': cnamerev_dnsname,
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'summary': None,
'result': {
'dn': cnamerev_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [cnamerev_dnsname],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'cnamerecord': [cnamerev_hostname],
'objectclass': objectclasses.dnsrecord,
},
},
),
dict(
desc='Add PTR record to %r in revzone %r' % (ptr_revzone3, revzone3_classless2),
command=('dnsrecord_add', [revzone3_classless2, cnamerev],
{'ptrrecord': ptr_revzone3_hostname}),
expected={
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'value': ptr_revzone3_dnsname,
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'summary': None,
'result': {
'dn': ptr_revzone3_dn,
DNS modified tests * working with absolute zone names * working with DNSName as returned value Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:13:14 -05:00
'idnsname': [ptr_revzone3_dnsname],
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
'ptrrecord': [ptr_revzone3_hostname],
'objectclass': objectclasses.dnsrecord,
},
},
),
dict(
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
desc='Create IDN zone %r' % idnzone1,
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
command=(
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'dnszone_add', [idnzone1], {
'idnssoarname': idnzone1_rname,
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
}
),
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
expected={
'value': idnzone1_dnsname,
'summary': None,
'result': {
'dn': idnzone1_dn,
'idnsname': [idnzone1_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnssoarname': [idnzone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
),
dict(
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
desc='Retrieve zone %r' % idnzone1,
command=(
'dnszone_show', [idnzone1], {}
),
expected={
'value': idnzone1_dnsname,
'summary': None,
'result': {
'dn': idnzone1_dn,
'idnsname': [idnzone1_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnssoarname': [idnzone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
},
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
),
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
dict(
desc='Retrieve zone raw %r' % idnzone1,
command=(
'dnszone_show', [idnzone1], {u'raw' : True,}
),
expected={
'value': idnzone1_dnsname,
'summary': None,
'result': {
'dn': idnzone1_dn,
'idnsname': [idnzone1_punycoded],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns],
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnssoarname': [idnzone1_rname_punycoded],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
},
DNS tests for classless reverse domains Ticket: https://fedorahosted.org/freeipa/ticket/4143 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-01-31 08:52:35 -06:00
),
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
dict(
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
desc='Find zone %r' % idnzone1,
command=(
'dnszone_find', [idnzone1], {}
),
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
expected={
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'summary': None,
'count': 1,
'truncated': False,
'result': [
{ 'dn': idnzone1_dn,
'idnsname': [idnzone1_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnssoarname': [idnzone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
],
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
},
),
dict(
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
desc='Find zone %r raw' % idnzone1_punycoded,
command=(
'dnszone_find', [idnzone1_punycoded], {'raw': True,}
),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{ 'dn': idnzone1_dn,
'idnsname': [idnzone1_punycoded],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns],
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnssoarname': [idnzone1_rname_punycoded],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
],
},
),
dict(
desc='Update zone %r' % idnzone1,
command=('dnszone_mod', [idnzone1], {'idnssoarefresh': 5478}),
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
expected={
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'value': idnzone1_dnsname,
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
'summary': None,
'result': {
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnsname': [idnzone1_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnssoarname': [idnzone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
},
),
dict(
desc='Create reverse zone %r' % revidnzone1,
command=(
'dnszone_add', [revidnzone1], {
'idnssoarname': idnzone1_rname,
}
),
expected={
'value': revidnzone1_dnsname,
'summary': None,
'result': {
'dn': revidnzone1_dn,
'idnsname': [revidnzone1_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnssoarname': [idnzone1_rname_dnsname],
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-subdomain %(zone)s PTR;'
% dict(realm=api.env.realm, zone=revidnzone1)],
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'objectclass': objectclasses.dnszone,
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
},
},
),
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
dict(
desc='Delete reverse zone %r' % revidnzone1,
command=('dnszone_del', [revidnzone1], {}),
expected={
'value': [revidnzone1_dnsname],
'summary': u'Deleted DNS zone "%s"' % revidnzone1,
'result': {'failed': []},
},
),
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
dict(
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
desc='Search for zones with name %r' % idnzone1,
command=('dnszone_find', [idnzone1], {}),
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
expected={
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'summary': None,
'count': 1,
'truncated': False,
'result': [{
'dn': idnzone1_dn,
'idnsname': [idnzone1_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnssoarname': [idnzone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [u'5478'],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
}],
},
),
dict(
desc='Try to retrieve non-existent record %r in zone %r' % (idnres1, idnzone1),
command=('dnsrecord_show', [idnzone1, idnres1], {}),
expected=errors.NotFound(
reason=u'%s: DNS resource record not found' % idnres1),
),
dict(
desc='Create record %r in zone %r' % (idnzone1, idnres1),
command=('dnsrecord_add', [idnzone1, idnres1], {'arecord': u'127.0.0.1'}),
expected={
'value': idnres1_dnsname,
'summary': None,
'result': {
'dn': idnres1_dn,
'idnsname': [idnres1_dnsname],
'objectclass': objectclasses.dnsrecord,
'arecord': [u'127.0.0.1'],
},
},
),
dict(
desc='Search for all records in zone %r' % idnzone1,
command=('dnsrecord_find', [idnzone1], {}),
expected={
'summary': None,
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'count': 2,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'truncated': False,
'result': [
{
'dn': idnzone1_dn,
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnsname': [_dns_zone_record],
},
{
'dn': idnres1_dn,
'idnsname': [idnres1_dnsname],
'arecord': [u'127.0.0.1'],
},
],
},
),
dict(
desc='Search for all records in zone %r with --pkey-only' % idnzone1,
command=('dnsrecord_find', [idnzone1], {'pkey_only':True,}),
expected={
'summary': None,
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'count': 2,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'truncated': False,
'result': [
{
'dn': idnzone1_dn,
'idnsname': [_dns_zone_record],
},
{
'dn': idnres1_dn,
'idnsname': [idnres1_dnsname],
},
],
},
),
dict(
desc='Find %r record in zone %r' % (idnzone1, idnzone1),
command=('dnsrecord_find', [idnzone1, idnzone1], {}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{
'dn': idnzone1_dn,
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
'idnsname': [_dns_zone_record],
},
],
tests: Move zone enable/disable tests to end of test_dns_plugin.py This prevents the test suite from hitting limitations in bind-dyndb-ldap 4.0. For details see https://fedorahosted.org/bind-dyndb-ldap/ticket/127 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-14 08:06:42 -06:00
},
),
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
dict(
desc='Find %r record in zone %r' % (idnres1, idnzone1),
command=('dnsrecord_find', [idnzone1, idnres1], {}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{
'dn': idnres1_dn,
'idnsname': [idnres1_dnsname],
'arecord': [u'127.0.0.1'],
},
],
},
),
dict(
desc='Find %r record in zone %r with --pkey-only' % (idnres1, idnzone1),
command=('dnsrecord_find', [idnzone1, idnres1], {'pkey_only':True,}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{
'dn': idnres1_dn,
'idnsname': [idnres1_dnsname],
},
],
},
),
dict(
desc='Find raw %r record in zone %r with --pkey-only' % (idnres1, idnzone1),
command=('dnsrecord_find', [idnzone1, idnres1],
{'pkey_only' : True, 'raw' : True,}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{
'dn': idnres1_dn,
'idnsname': [idnres1_punycoded],
},
],
},
),
dict(
desc='Find raw %r record in zone %r with --pkey-only' % (idnres1_punycoded, idnzone1),
command=('dnsrecord_find', [idnzone1, idnres1_punycoded], {'pkey_only':True, 'raw' : True}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{
'dn': idnres1_dn,
'idnsname': [idnres1_punycoded],
},
],
},
),
dict(
desc='Add A record to %r in zone %r' % (idnres1, idnzone1),
command=('dnsrecord_add', [idnzone1, idnres1], {'arecord': u'10.10.0.1'}),
expected={
'value': idnres1_dnsname,
'summary': None,
'result': {
'dn': idnres1_dn,
'idnsname': [idnres1_dnsname],
'arecord': [u'127.0.0.1', u'10.10.0.1'],
'objectclass': objectclasses.dnsrecord,
},
},
),
dict(
desc='Remove A record from %r in zone %r' % (idnres1, idnzone1),
command=('dnsrecord_del', [idnzone1, idnres1], {'arecord': u'127.0.0.1'}),
expected={
'value': [idnres1_dnsname],
'summary': None,
'result': {
'idnsname': [idnres1_dnsname],
'arecord': [u'10.10.0.1'],
},
},
),
dict(
desc='Add MX record to zone %r using dnsrecord_add' % (idnzone1),
command=('dnsrecord_add', [idnzone1, u'@'], {'mxrecord': u"0 %s" % idnzone1_mname }),
expected={
'value': _dns_zone_record,
'summary': None,
'result': {
'objectclass': objectclasses.dnszone,
'dn': idnzone1_dn,
'idnsname': [_dns_zone_record],
'mxrecord': [u"0 %s" % idnzone1_mname],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
},
},
),
Test DNS: dnsrecord-* zone.test. zone.test. should work Old ipa versions allows only "dnsrecord-* zone.test. @" This issue was fixed in ticket: https://fedorahosted.org/freeipa/ticket/3169 Ticket: https://fedorahosted.org/freeipa/ticket/4232 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-30 06:58:21 -05:00
#https://fedorahosted.org/freeipa/ticket/4232
dict(
desc='Add MX record (2) to zone %r using dnsrecord_add' % (idnzone1),
command=('dnsrecord_add', [idnzone1, idnzone1], {'mxrecord': u"10 %s" % idnzone1_mname }),
expected={
'value': idnzone1_dnsname,
'summary': None,
'result': {
'objectclass': objectclasses.dnszone,
'dn': idnzone1_dn,
'idnsname': [_dns_zone_record],
'mxrecord': [u"0 %s" % idnzone1_mname, u"10 %s" % idnzone1_mname],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
Test DNS: dnsrecord-* zone.test. zone.test. should work Old ipa versions allows only "dnsrecord-* zone.test. @" This issue was fixed in ticket: https://fedorahosted.org/freeipa/ticket/3169 Ticket: https://fedorahosted.org/freeipa/ticket/4232 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-30 06:58:21 -05:00
},
},
),
dict(
desc='Remove MX record (2) from zone %r using dnsrecord_add' % (idnzone1),
command=('dnsrecord_del', [idnzone1, idnzone1], {'mxrecord': u"10 %s" % idnzone1_mname }),
expected={
'value': [idnzone1_dnsname],
'summary': None,
'result': {
'idnsname': [_dns_zone_record],
'mxrecord': [u"0 %s" % idnzone1_mname],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
Test DNS: dnsrecord-* zone.test. zone.test. should work Old ipa versions allows only "dnsrecord-* zone.test. @" This issue was fixed in ticket: https://fedorahosted.org/freeipa/ticket/3169 Ticket: https://fedorahosted.org/freeipa/ticket/4232 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-30 06:58:21 -05:00
},
},
),
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
dict(
desc='Add KX record to zone %r using dnsrecord_add' % (idnzone1),
command=('dnsrecord_add', [idnzone1, u'@'], {'kxrecord': u"0 %s" % idnzone1_mname }),
expected={
'value': _dns_zone_record,
'summary': None,
'result': {
'objectclass': objectclasses.dnszone,
'dn': idnzone1_dn,
'idnsname': [_dns_zone_record],
'mxrecord': [u"0 %s" % idnzone1_mname],
'kxrecord': [u"0 %s" % idnzone1_mname],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
},
},
),
dict(
desc='Retrieve raw zone record of zone %r using dnsrecord_show' % (idnzone1),
command=('dnsrecord_show', [idnzone1, u'@'], {u'raw' : True}),
expected={
'value': _dns_zone_record,
'summary': None,
'result': {
'dn': idnzone1_dn,
'idnsname': [u'@'],
'mxrecord': [u"0 %s" % idnzone1_mname_punycoded],
'kxrecord': [u"0 %s" % idnzone1_mname_punycoded],
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
'nsrecord': nameservers,
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
},
},
),
dict(
desc='Add CNAME record to %r using dnsrecord_add' % (idnrescname1),
command=('dnsrecord_add', [idnzone1, idnrescname1], {'cnamerecord': idndomain1 + u'.'}),
expected={
'value': idnrescname1_dnsname,
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': idnrescname1_dn,
'idnsname': [idnrescname1_dnsname],
'cnamerecord': [idndomain1 + u'.'],
},
},
),
dict(
desc='Show raw record %r in zone %r' % (idnrescname1, idnzone1),
command=('dnsrecord_show', [idnzone1, idnrescname1], {u'raw' : True}),
expected={
'value': idnrescname1_dnsname,
'summary': None,
'result': {
'dn': idnrescname1_dn,
'idnsname': [idnrescname1_punycoded],
'cnamerecord': [idndomain1_punycoded + u'.'],
},
},
),
dict(
desc='Add DNAME record to %r using dnsrecord_add' % (idnresdname1),
command=('dnsrecord_add', [idnzone1, idnresdname1], {'dnamerecord': idndomain1 + u'.'}),
expected={
'value': idnresdname1_dnsname,
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': idnresdname1_dn,
'idnsname': [idnresdname1_dnsname],
'dnamerecord': [idndomain1 + u'.'],
},
},
),
dict(
desc='Show raw record %r in zone %r' % (idnresdname1, idnzone1),
command=('dnsrecord_show', [idnzone1, idnresdname1], {u'raw' : True}),
expected={
'value': idnresdname1_dnsname,
'summary': None,
'result': {
'dn': idnresdname1_dn,
'idnsname': [idnresdname1_punycoded],
'dnamerecord': [idndomain1_punycoded + u'.'],
},
},
),
dict(
desc='Add SRV record to zone %r using dnsrecord_add' % (idnzone1),
command=('dnsrecord_add', [idnzone1, u'_foo._tcp'], {'srvrecord': u"0 100 1234 %s" % idnzone1_mname}),
expected={
'value': DNSName(u'_foo._tcp'),
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': DN(('idnsname', u'_foo._tcp'), idnzone1_dn),
'idnsname': [DNSName(u'_foo._tcp')],
'srvrecord': [u"0 100 1234 %s" % idnzone1_mname],
},
},
),
dict(
desc='Show raw record %r in zone %r' % (u'_foo._tcp', idnzone1),
command=('dnsrecord_show', [idnzone1, u'_foo._tcp'], {u'raw' : True}),
expected={
'value': DNSName(u'_foo._tcp'),
'summary': None,
'result': {
'dn': DN(('idnsname', u'_foo._tcp'), idnzone1_dn),
'idnsname': [u'_foo._tcp'],
'srvrecord': [u"0 100 1234 %s" % idnzone1_mname_punycoded],
},
},
),
dict(
desc='Show raw record %r in zone %r' % (u'_foo._tcp', idnzone1_punycoded),
command=('dnsrecord_show', [idnzone1, u'_foo._tcp'], {u'raw' : True}),
expected={
'value': DNSName(u'_foo._tcp'),
'summary': None,
'result': {
'dn': DN(('idnsname', u'_foo._tcp'), idnzone1_dn),
'idnsname': [u'_foo._tcp'],
'srvrecord': [u"0 100 1234 %s" % idnzone1_mname_punycoded],
},
},
),
dict(
desc='Add AFSDB record to %r using dnsrecord_add' % (dnsafsdbres1),
command=('dnsrecord_add', [idnzone1, dnsafsdbres1], {
'afsdb_part_subtype': 0,
'afsdb_part_hostname' : idnzone1_mname}),
expected={
'value': dnsafsdbres1_dnsname,
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': dnsafsdbres1_dn,
'idnsname': [dnsafsdbres1_dnsname],
'afsdbrecord': [u'0 ' + idnzone1_mname],
},
},
),
dict(
Tests: remove unused records from tests Ticket: https://fedorahosted.org/freeipa/ticket/4328 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-06 08:43:38 -05:00
desc='Show raw record %r in zone %r' % (dnsafsdbres1, idnzone1),
DNS new tests Added new internationalized DNS tests Part of ticket: IPA should allow internationalized domain names https://fedorahosted.org/freeipa/ticket/3169 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-28 04:14:27 -05:00
command=('dnsrecord_show', [idnzone1, dnsafsdbres1], {u'raw' : True}),
expected={
'value': dnsafsdbres1_dnsname,
'summary': None,
'result': {
'dn': dnsafsdbres1_dn,
'idnsname': [dnsafsdbres1_punycoded],
'afsdbrecord': [u'0 ' + idnzone1_mname_punycoded],
},
},
),
Test DNS: wildcard in RR owner Only test, issue was fixed in https://fedorahosted.org/freeipa/ticket/3169 Ticket: https://fedorahosted.org/freeipa/ticket/3148 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-28 11:56:10 -05:00
DNS tests: tests update to due to change in options Affected options --name-server, --ip-address Part of ticket: https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-09-19 05:38:34 -05:00
dict(
desc='Add A denormalized record in zone %r' % (idnzone1),
command=('dnsrecord_add', [idnzone1, u'gro\xdf'], {'arecord': u'172.16.0.1'}),
expected=errors.ConversionError(name='name',
error=u'domain name \'gro\xdf\' should be normalized to: gross')
),
Test DNS: wildcard in RR owner Only test, issue was fixed in https://fedorahosted.org/freeipa/ticket/3169 Ticket: https://fedorahosted.org/freeipa/ticket/3148 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-28 11:56:10 -05:00
dict(
desc='Add A record to %r in zone %r' % (wildcard_rec1, zone1),
command=('dnsrecord_add', [zone1, wildcard_rec1], {'arecord': wildcard_rec1_addr}),
expected={
'value': wildcard_rec1_dnsname,
'summary': None,
'result': {
'dn': wildcard_rec1_dn,
'idnsname': [wildcard_rec1_dnsname],
'arecord': [wildcard_rec1_addr],
'objectclass': objectclasses.dnsrecord,
},
},
),
dict(
desc='Resolve name %r (wildcard)' % (wildcard_rec1_test1),
command=('dns_resolve', [wildcard_rec1_test1], {}),
expected={
'result': True,
'summary': "Found '%s'" % wildcard_rec1_test1,
'value': wildcard_rec1_test1,
},
),
dict(
desc='Resolve name %r (wildcard)' % (wildcard_rec1_test2),
command=('dns_resolve', [wildcard_rec1_test2], {}),
expected={
'result': True,
'summary': "Found '%s'" % wildcard_rec1_test2,
'value': wildcard_rec1_test2,
},
),
Tests: DNS wildcard records Ticket: https://fedorahosted.org/freeipa/ticket/4488 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-08-20 10:26:34 -05:00
dict(
desc='Try to add NS record to wildcard owner %r in zone %r' % (wildcard_rec1, zone1),
command=('dnsrecord_add', [zone1, wildcard_rec1], {'nsrecord': zone2_ns, 'force': True}),
expected=errors.ValidationError(
name='idnsname',
error=(u'owner of DNAME, DS, NS records '
'should not be a wildcard domain name (RFC 4592 section 4)')
)
),
dict(
desc='Try to add DNAME record to wildcard owner %r in zone %r' % (wildcard_rec1, zone1),
command=('dnsrecord_add', [zone1, wildcard_rec1], {'dnamerecord': u'dname.test.'}),
expected=errors.ValidationError(
name='idnsname',
error=(u'owner of DNAME, DS, NS records '
'should not be a wildcard domain name (RFC 4592 section 4)')
)
),
dict(
desc='Try to add DS record to wildcard owner %r in zone %r' % (wildcard_rec1, zone1),
command=('dnsrecord_add', [zone1, wildcard_rec1], {'dsrecord': u'0 0 0 00'}),
expected=errors.ValidationError(
name='idnsname',
error=(u'owner of DNAME, DS, NS records '
'should not be a wildcard domain name (RFC 4592 section 4)')
)
),
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Disable zone %r' % zone1,
command=('dnszone_disable', [zone1], {}),
expected={
'value': zone1_absolute_dnsname,
'summary': u'Disabled DNS zone "%s"' % zone1_absolute,
'result': True,
},
Tests: DNS wildcard records Ticket: https://fedorahosted.org/freeipa/ticket/4488 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-08-20 10:26:34 -05:00
),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Check if zone %r is really disabled' % zone1,
command=('dnszone_show', [zone1], {}),
expected={
'value': zone1_absolute_dnsname,
'summary': None,
'result': {
'dn': zone1_dn,
'idnsname': [zone1_absolute_dnsname],
'idnszoneactive': [u'FALSE'],
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
'idnssoarname': [zone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'172.16.31.80;'],
'idnsallowquery': [u'!192.0.2.0/24;any;'],
'mxrecord': [u'0 ns1.dnszone.test.'],
'locrecord': [u"49 11 42.400 N 16 36 29.600 E 227.64 10.00 10.00 0.10"],
},
},
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Enable zone %r' % zone1,
command=('dnszone_enable', [zone1], {}),
expected={
'value': zone1_absolute_dnsname,
'summary': u'Enabled DNS zone "%s"' % zone1_absolute,
'result': True,
},
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Check if zone %r is really enabled' % zone1,
command=('dnszone_show', [zone1_absolute], {}),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
expected={
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'value': zone1_absolute_dnsname,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'summary': None,
'result': {
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'dn': zone1_dn,
'idnsname': [zone1_absolute_dnsname],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnszoneactive': [u'TRUE'],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
'idnssoarname': [zone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'172.16.31.80;'],
'idnsallowquery': [u'!192.0.2.0/24;any;'],
'mxrecord': [u'0 ns1.dnszone.test.'],
'locrecord': [u"49 11 42.400 N 16 36 29.600 E 227.64 10.00 10.00 0.10"],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
},
),
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Disable zone %r' % idnzone1,
command=('dnszone_disable', [idnzone1], {}),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
expected={
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'value': idnzone1_dnsname,
'summary': u'Disabled DNS zone "%s"' % idnzone1,
'result': True,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
),
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Check if zone %r is really disabled' % idnzone1,
command=('dnszone_show', [idnzone1], {}),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
expected={
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'value': idnzone1_dnsname,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'summary': None,
'result': {
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'dn': idnzone1_dn,
'idnsname': [idnzone1_dnsname],
'idnszoneactive': [u'FALSE'],
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
'idnssoarname': [idnzone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'mxrecord': [u"0 %s" % idnzone1_mname],
'kxrecord': [u"0 %s" % idnzone1_mname],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
},
),
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Enable zone %r' % idnzone1,
command=('dnszone_enable', [idnzone1], {}),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
expected={
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'value': idnzone1_dnsname,
'summary': u'Enabled DNS zone "%s"' % idnzone1,
'result': True,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
),
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Check if zone %r is really enabled' % idnzone1,
command=('dnszone_show', [idnzone1], {}),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
expected={
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'value': idnzone1_dnsname,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'summary': None,
'result': {
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'dn': idnzone1_dn,
'idnsname': [idnzone1_dnsname],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnszoneactive': [u'TRUE'],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'nsrecord': nameservers,
'idnssoamname': [self_server_ns_dnsname],
'idnssoarname': [idnzone1_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'mxrecord': [u"0 %s" % idnzone1_mname],
'kxrecord': [u"0 %s" % idnzone1_mname],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
},
),
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Delete zone %r' % zone1,
command=('dnszone_del', [zone1], {}),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
expected={
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'value': [zone1_absolute_dnsname],
'summary': u'Deleted DNS zone "%s"' % zone1_absolute,
'result': {'failed': []},
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
),
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
]
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
class test_root_zone(Declarative):
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
@classmethod
def setup_class(cls):
super(test_root_zone, cls).setup_class()
if not api.Backend.rpcclient.isconnected():
api.Backend.rpcclient.connect(fallback=False)
if not have_ldap2:
raise nose.SkipTest('server plugin not available')
if get_nameservers_error is not None:
raise nose.SkipTest('unable to get list of nameservers (%s)' % get_nameservers_error)
try:
api.Command['dnszone_add'](zone1, idnssoarname=zone1_rname,)
api.Command['dnszone_del'](zone1)
except errors.NotFound:
raise nose.SkipTest('DNS is not configured')
except errors.DuplicateEntry:
pass
cleanup_commands = [
('dnszone_del', [zone_root, ],
{'continue': True}),
('permission_del', [zone_root_permission, ], {'force': True}),
]
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
tests = [
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Create zone %r' % zone_root,
command=(
'dnszone_add', [zone_root], {
'idnssoarname': zone_root_rname,
}
),
expected={
'value': zone_root_dnsname,
'summary': None,
'result': {
'dn': zone_root_dn,
'idnsname': [zone_root_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone_root_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict(
desc='Add per-zone permission for zone %r' % zone_root,
command=(
'dnszone_add_permission', [zone_root], {}
),
expected=dict(
result=True,
value=zone_root_permission,
summary=u'Added system permission "%s"' % zone_root_permission,
),
),
]
class test_forward_zones(Declarative):
# https://fedorahosted.org/freeipa/ticket/4750
@classmethod
def setup_class(cls):
super(test_forward_zones, cls).setup_class()
if not api.Backend.rpcclient.isconnected():
api.Backend.rpcclient.connect(fallback=False)
if not have_ldap2:
raise nose.SkipTest('server plugin not available')
try:
api.Command['dnszone_add'](zone1, idnssoarname=zone1_rname,)
api.Command['dnszone_del'](zone1)
except errors.NotFound:
raise nose.SkipTest('DNS is not configured')
except errors.DuplicateEntry:
pass
cleanup_commands = [
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
('dnsforwardzone_del', [zone_fw_wildcard, fwzone1, fwzone2, fwzone3],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
{'continue': True}),
('permission_del', [fwzone1_permission, ], {'force': True}),
]
tests = [
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
dict(
desc='Search for forward zone with --forward-policy=none (no zones)',
command=('dnsforwardzone_find', [], {'idnsforwardpolicy': u'none'}),
expected={
'summary': None,
'count': 0,
'truncated': False,
'result': [],
},
),
dict(
desc='Search for forward zone with --forward-policy=only (no zones)',
command=('dnsforwardzone_find', [], {'idnsforwardpolicy': u'only'}),
expected={
'summary': None,
'count': 0,
'truncated': False,
'result': [],
},
),
dict(
desc='Search for forward zone with --forward-policy=first (no zones)',
command=('dnsforwardzone_find', [], {'idnsforwardpolicy': u'first'}),
expected={
'summary': None,
'count': 0,
'truncated': False,
'result': [],
},
),
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
dict(
desc='Try to create forward zone %r with wildcard domain name' % zone_fw_wildcard,
command=(
'dnsforwardzone_add', [zone_fw_wildcard], {'idnsforwardpolicy': u'none'}
),
expected=errors.ValidationError(name='name',
error=u'should not be a wildcard domain name (RFC 4592 section 4)')
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
dict(
desc='Try to create forward zone with empty name',
command=(
'dnsforwardzone_add', [u''], {}
),
expected=errors.RequirementError(name='name')
),
dict(
desc='Try to create forward zone %r with invalid name' % 'invalid..name.fwzone.test.',
command=(
'dnsforwardzone_add', [u'invalid..name.fwzone.test.', ], {}
),
expected=errors.ConversionError(
name='name',
error=u'empty DNS label')
),
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
dict(
desc='Try to create forward zone %r without forwarders with default "(first)" policy' % fwzone1,
command=(
'dnsforwardzone_add', [fwzone1], {}
),
expected=errors.ValidationError(name='idnsforwarders',
error=u'Please specify forwarders.')
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Try to create forward zone %r without forwarders with "only" policy' % fwzone1,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
command=(
'dnsforwardzone_add', [fwzone1], {'idnsforwardpolicy': u'only'}
),
expected=errors.ValidationError(name='idnsforwarders',
error=u'Please specify forwarders.')
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
dict(
desc='Try to create forward zone %r without forwarders with "first" policy' % fwzone1,
command=(
'dnsforwardzone_add', [fwzone1], {'idnsforwardpolicy': u'first'}
),
expected=errors.ValidationError(
name='idnsforwarders',
error=u'Please specify forwarders.')
),
dict(
desc='Try to create forward zone %r with "only" policy and invalid IP address' % fwzone1,
command=(
'dnsforwardzone_add', [fwzone1], {
'idnsforwardpolicy': u'only',
'idnsforwarders': [u'127.0.0.999', ]
}
),
expected=errors.ValidationError(
name='forwarder',
error=u'invalid IP address format')
),
dict(
desc='Try to create forward zone %r with "first" policy and invalid IP address' % fwzone1,
command=(
'dnsforwardzone_add', [fwzone1], {
'idnsforwardpolicy': u'first',
'idnsforwarders': [u'127.0.0.999', ]
}
),
expected=errors.ValidationError(
name='forwarder',
error=u'invalid IP address format')
),
dict(
desc='Try to create forward zone %r with invalid policy' % fwzone1,
command=(
'dnsforwardzone_add', [fwzone1], {
'idnsforwardpolicy': u'invalid',
}
),
expected=errors.ValidationError(
name='forward_policy',
error=u"must be one of 'only', 'first', 'none'")
),
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
dict(
desc='Create forward zone %r without forwarders with "none" policy' % fwzone1,
command=(
'dnsforwardzone_add', [fwzone1], {'idnsforwardpolicy': u'none'}
),
expected={
'value': fwzone1_dnsname,
'summary': None,
'result': {
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
'objectclass': objectclasses.dnsforwardzone,
},
},
),
dict(
desc='Try to create duplicate forward zone %r' % fwzone1,
command=(
'dnsforwardzone_add', [fwzone1], {'idnsforwardpolicy': u'none'}
),
expected=errors.DuplicateEntry(
message=u'DNS forward zone with name "%s" already exists' % fwzone1),
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Create forward zone %r with forwarders with default ("first") policy' % fwzone2,
command=(
'dnsforwardzone_add', [fwzone2], {'idnsforwarders': [forwarder1]}
),
expected={
'value': fwzone2_dnsname,
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
u'messages': (
{u'message': lambda x: x.startswith(
u"DNS server %s: query '%s SOA':" %
(forwarder1, fwzone2)),
u'code': 13006,
u'type':u'warning',
u'name': u'DNSServerValidationWarning'},
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'result': {
'dn': fwzone2_dn,
'idnsname': [fwzone2_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder1],
'objectclass': objectclasses.dnsforwardzone,
},
},
),
dict(
desc='Delete forward zone %r (cleanup)' % fwzone2,
command=('dnsforwardzone_del', [fwzone2], {}),
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
expected={
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'value': [fwzone2_dnsname],
'summary': u'Deleted DNS forward zone "%s"' % fwzone2,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'result': {'failed': []},
},
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Create forward zone %r with three forwarders with "only" policy' % fwzone2,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_add', [fwzone2], {
'idnsforwarders': [forwarder1, forwarder2, forwarder3],
'idnsforwardpolicy': u'only'
}
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
),
expected={
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'value': fwzone2_dnsname,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'result': {
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dn': fwzone2_dn,
'idnsname': [fwzone2_dnsname],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'idnszoneactive': [u'TRUE'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwardpolicy': [u'only'],
'idnsforwarders': [forwarder1, forwarder2, forwarder3],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'objectclass': objectclasses.dnsforwardzone,
},
},
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Delete forward zone %r (cleanup)' % fwzone2,
command=('dnsforwardzone_del', [fwzone2], {}),
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
expected={
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'value': [fwzone2_dnsname],
'summary': u'Deleted DNS forward zone "%s"' % fwzone2,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'result': {'failed': []},
},
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Create forward zone %r with one forwarder with "only" policy' % fwzone2,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_add', [fwzone2], {
'idnsforwarders': forwarder2, 'idnsforwardpolicy': u'only'
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
}
),
expected={
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'value': fwzone2_dnsname,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'result': {
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dn': fwzone2_dn,
'idnsname': [fwzone2_dnsname],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'only'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwarders': [forwarder2],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'objectclass': objectclasses.dnsforwardzone,
},
},
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Create forward zone %r with three forwarders with "first" policy' % fwzone3,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_add', [fwzone3], {
'idnsforwarders': [forwarder1, forwarder2, forwarder3],
'idnsforwardpolicy': u'first'
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
}
),
expected={
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'value': fwzone3_dnsname,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'result': {
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dn': fwzone3_dn,
'idnsname': [fwzone3_dnsname],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'idnszoneactive': [u'TRUE'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder1, forwarder2, forwarder3],
'objectclass': objectclasses.dnsforwardzone,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
},
},
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Delete forward zone %r (cleanup)' % fwzone3,
command=('dnsforwardzone_del', [fwzone3], {}),
expected={
'value': [fwzone3_dnsname],
'summary': u'Deleted DNS forward zone "%s"' % fwzone3,
'result': {'failed': []},
},
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Create forward zone %r with one forwarder with "first" policy' % fwzone3,
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_add', [fwzone3], {
'idnsforwarders': forwarder3, 'idnsforwardpolicy': u'first'
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
}
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
expected={
'value': fwzone3_dnsname,
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'result': {
'dn': fwzone3_dn,
'idnsname': [fwzone3_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder3],
'objectclass': objectclasses.dnsforwardzone,
},
},
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r change one forwarder' % fwzone3,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_mod', [fwzone3], {
'idnsforwarders': forwarder1,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
}
),
expected={
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'value': fwzone3_dnsname,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'result': {
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsname': [fwzone3_dnsname],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnszoneactive': [u'TRUE'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder1],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
},
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r add one forwarder' % fwzone3,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_mod', [fwzone3], {
'idnsforwarders': [forwarder1, forwarder2]
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
}
),
expected={
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'value': fwzone3_dnsname,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'result': {
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsname': [fwzone3_dnsname],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnszoneactive': [u'TRUE'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwardpolicy': [u'first'],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnsforwarders': [forwarder1, forwarder2],
},
},
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r change one forwarder if two exists' % fwzone3,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_mod', [fwzone3], {
'idnsforwarders': [forwarder1, forwarder3]
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
}
),
expected={
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'value': fwzone3_dnsname,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'result': {
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsname': [fwzone3_dnsname],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwarders': [forwarder1, forwarder3],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
},
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r change two forwarders if two exists' % fwzone3,
command=(
'dnsforwardzone_mod', [fwzone3], {
'idnsforwarders': [forwarder2, forwarder4]
}
),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
expected={
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'value': fwzone3_dnsname,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'result': {
'idnsname': [fwzone3_dnsname],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwarders': [forwarder2, forwarder4],
},
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r with --policy=none, add forwarders' % fwzone1,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'none',
'idnsforwarders': [forwarder3],
}
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
expected={
'value': fwzone1_dnsname,
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'result': {
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwardpolicy': [u'none'],
'idnsforwarders': [forwarder3],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
},
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r change --policy=none' % fwzone2,
command=(
'dnsforwardzone_mod', [fwzone2], {
'idnsforwardpolicy': u'none',
}
),
expected={
'value': fwzone2_dnsname,
'summary': None,
'result': {
'idnsname': [fwzone2_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
'idnsforwarders': [forwarder2],
},
},
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r change --policy=only (was "none", FW exists)' % fwzone2,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_mod', [fwzone2], {
'idnsforwardpolicy': u'only',
}
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
expected={
'value': fwzone2_dnsname,
'summary': None,
'result': {
'idnsname': [fwzone2_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'only'],
'idnsforwarders': [forwarder2],
},
},
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r with --policy=first (was "none", FW exists)' % fwzone1,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'first',
'idnsforwarders': [forwarder3],
}
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
expected={
'value': fwzone1_dnsname,
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'result': {
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder3],
},
},
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r with --policy=none, forwarder empty' % fwzone1,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'none',
'idnsforwarders': [],
}
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
expected={
'value': fwzone1_dnsname,
'summary': None,
'result': {
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
},
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
},
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
dict(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
desc='Modify forward zone %r --policy=only, add forwarders"' % fwzone1,
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
command=(
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'only',
'idnsforwarders': [forwarder1, forwarder2]
}
),
expected={
'value': fwzone1_dnsname,
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'result': {
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'only'],
'idnsforwarders': [forwarder1, forwarder2],
},
},
),
dict(
desc='Modify forward zone %r --policy=first (was "only")' % fwzone1,
command=(
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'first',
}
),
expected={
'value': fwzone1_dnsname,
'summary': None,
'result': {
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder1, forwarder2],
},
},
),
dict(
desc='Modify forward zone %r --policy=only (was "first")' % fwzone1,
command=(
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'only',
}
),
expected={
'value': fwzone1_dnsname,
'summary': None,
'result': {
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'only'],
'idnsforwarders': [forwarder1, forwarder2],
},
},
),
dict(
desc='Modify forward zone %r with --policy=none, forwarder empty (cleanup)' % fwzone1,
command=(
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'none',
'idnsforwarders': [],
}
),
expected={
'value': fwzone1_dnsname,
'summary': None,
'result': {
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
},
},
),
dict(
desc='Try to modify non-existent forward zone %r' % nonexistent_fwzone,
command=(
'dnsforwardzone_mod', [nonexistent_fwzone], {
'idnsforwardpolicy': u'only'
}
),
expected=errors.NotFound(reason="%s: DNS forward zone not found" %
nonexistent_fwzone)
),
dict(
desc='Try to modify forward zone %r without forwarders with "only" policy' % fwzone1,
command=(
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'only'
}
),
expected=errors.ValidationError(name='idnsforwarders',
error=u'Please specify forwarders.')
),
dict(
desc='Try to modify forward zone %r without forwarders with "first" policy' % fwzone1,
command=(
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'first'
}
),
expected=errors.ValidationError(name='idnsforwarders',
error=u'Please specify forwarders.')
),
dict(
desc='Try to modify forward zone %r with "only" policy change empty forwarders' % fwzone2,
command=(
'dnsforwardzone_mod', [fwzone2], {
'idnsforwarders': [],
}
),
expected=errors.ValidationError(
name='idnsforwarders',
error=u'Please specify forwarders.')
),
dict(
desc='Try to modify forward zone %r with "first" policy change empty forwarders' % fwzone3,
command=(
'dnsforwardzone_mod', [fwzone3], {
'idnsforwarders': [],
}
),
expected=errors.ValidationError(
name='idnsforwarders',
error=u'Please specify forwarders.')
),
dict(
desc='Try to modify forward zone %r with "only" policy change invalid forwarder IP' % fwzone2,
command=(
'dnsforwardzone_mod', [fwzone2], {
'idnsforwarders': [u'127.0.0.999', ],
}
),
expected=errors.ValidationError(
name='forwarder',
error=u'invalid IP address format')
),
dict(
desc='Try to modify forward zone %r with "first" policy change invalid forwarder IP' % fwzone3,
command=(
'dnsforwardzone_mod', [fwzone3], {
'idnsforwarders': [u'127.0.0.999', ],
}
),
expected=errors.ValidationError(
name='forwarder',
error=u'invalid IP address format')
),
dict(
desc='Try to modify forward zone %r with invalid policy' % fwzone1,
command=(
'dnsforwardzone_mod', [fwzone1], {
'idnsforwardpolicy': u'invalid',
}
),
expected=errors.ValidationError(
name='forward_policy',
error=u"must be one of 'only', 'first', 'none'")
),
dict(
desc='Retrieve forward zone %r' % fwzone1,
command=(
'dnsforwardzone_show', [fwzone1], {}
),
expected={
'value': fwzone1_dnsname,
'summary': None,
'result': {
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
},
},
),
dict(
desc='Try to retrieve nonexistent forward zone %r' % nonexistent_fwzone,
command=(
'dnsforwardzone_show', [nonexistent_fwzone], {}
),
expected=errors.NotFound(reason="%s: DNS forward zone not found" %
nonexistent_fwzone)
),
dict(
desc='Search for all forward zones',
command=('dnsforwardzone_find', [], {}),
expected={
'summary': None,
'count': 3,
'truncated': False,
'result': [
{
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
},
{
'dn': fwzone2_dn,
'idnsname': [fwzone2_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'only'],
'idnsforwarders': [forwarder2],
},
{
'dn': fwzone3_dn,
'idnsname': [fwzone3_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder2, forwarder4],
},
],
},
),
dict(
desc='Search for all forward zones with --pkey-only',
command=('dnsforwardzone_find', [], {'pkey_only': True}),
expected={
'summary': None,
'count': 3,
'truncated': False,
'result': [
{
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
},
{
'dn': fwzone2_dn,
'idnsname': [fwzone2_dnsname],
},
{
'dn': fwzone3_dn,
'idnsname': [fwzone3_dnsname],
},
],
},
),
dict(
desc='Search for forward zone %r' % fwzone1,
command=('dnsforwardzone_find', [fwzone1], {}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [{
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
}],
},
),
dict(
desc='Search for 3 forward zones search with criteria "%r"' % fwzone_search_all_name,
command=('dnsforwardzone_find', [fwzone_search_all_name], {}),
expected={
'summary': None,
'count': 3,
'truncated': False,
'result': [
{
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
},
{
'dn': fwzone2_dn,
'idnsname': [fwzone2_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'only'],
'idnsforwarders': [forwarder2],
},
{
'dn': fwzone3_dn,
'idnsname': [fwzone3_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder2, forwarder4],
},
],
},
),
dict(
desc='Search for forward zone with --name %r' % fwzone1,
command=('dnsforwardzone_find', [], {'idnsname': fwzone1}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
}
],
},
),
dict(
desc='Search for forward zone with --forward-policy=none',
command=('dnsforwardzone_find', [], {'idnsforwardpolicy': u'none'}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
}
],
},
),
dict(
desc='Search for forward zone with --forward-policy=only',
command=('dnsforwardzone_find', [], {'idnsforwardpolicy': u'only'}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{
'dn': fwzone2_dn,
'idnsname': [fwzone2_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'only'],
'idnsforwarders': [forwarder2],
}
],
},
),
dict(
desc='Search for forward zone with --forward-policy=first',
command=('dnsforwardzone_find', [], {'idnsforwardpolicy': u'first'}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [
{
'dn': fwzone3_dn,
'idnsname': [fwzone3_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder2, forwarder4],
}
],
},
),
dict(
desc='Try to search for non-existent forward zone',
command=('dnsforwardzone_find', [nonexistent_fwzone], {}),
expected={
'summary': None,
'count': 0,
'truncated': False,
'result': [],
},
),
dict(
desc='Try to search for non-existent forward zone with --name',
command=('dnsforwardzone_find', [], {'idnsname': nonexistent_fwzone}),
expected={
'summary': None,
'count': 0,
'truncated': False,
'result': [],
},
),
dict(
desc='Delete forward zone %r' % fwzone2,
command=('dnsforwardzone_del', [fwzone2], {}),
expected={
'value': [fwzone2_dnsname],
'summary': u'Deleted DNS forward zone "%s"' % fwzone2,
'result': {'failed': []},
},
),
dict(
desc='Delete forward zone %r with --continue' % fwzone3,
command=('dnsforwardzone_del', [fwzone3], {'continue': True}),
expected={
'value': [fwzone3_dnsname],
'summary': u'Deleted DNS forward zone "%s"' % fwzone3,
'result': {'failed': []},
},
),
dict(
desc='Try to delete non-existent forward zone',
command=('dnsforwardzone_del', [nonexistent_fwzone], {}),
expected=errors.NotFound(reason="%s: DNS forward zone not found" %
nonexistent_fwzone)
),
dict(
desc='Try to delete non-existent forward zone with --continue',
command=('dnsforwardzone_del', [nonexistent_fwzone], {'continue': True}),
expected={
'value': [],
'summary': u'Deleted DNS forward zone ""',
'result': {
'failed': [nonexistent_fwzone_dnsname],
}
}
),
dict(
desc='Try to add per-zone permission for unknown forward zone',
command=('dnsforwardzone_add_permission', [absnxname], {}),
expected=errors.NotFound(reason=u'%s: DNS forward zone not found' % absnxname)
),
dict(
desc='Add per-zone permission for forward zone %r' % fwzone1,
command=(
'dnsforwardzone_add_permission', [fwzone1], {}
),
expected=dict(
result=True,
value=fwzone1_permission,
summary=u'Added system permission "%s"' % fwzone1_permission,
),
),
dict(
desc='Try to add duplicate per-zone permission for forward zone %r' % fwzone1,
command=(
'dnsforwardzone_add_permission', [fwzone1], {}
),
expected=errors.DuplicateEntry(message=u'permission with name '
'"%s" already exists' % fwzone1_permission)
),
dict(
desc='Make sure the permission was created %r' % fwzone1,
command=(
'permission_show', [fwzone1_permission], {}
),
expected=dict(
value=fwzone1_permission,
summary=None,
result={
'dn': fwzone1_permission_dn,
'cn': [fwzone1_permission],
'objectclass': objectclasses.system_permission,
'ipapermissiontype': [u'SYSTEM'],
},
),
),
dict(
desc='Retrieve the permission %r with --all --raw' % fwzone1,
command=(
'permission_show', [fwzone1_permission], {}
),
expected=dict(
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
value=fwzone1_permission,
summary=None,
result={
'dn': fwzone1_permission_dn,
'cn': [fwzone1_permission],
'objectclass': objectclasses.system_permission,
'ipapermissiontype': [u'SYSTEM'],
},
),
),
dict(
desc='Try to remove per-zone permission for unknown forward zone',
command=('dnsforwardzone_remove_permission', [absnxname], {}),
expected=errors.NotFound(reason=u'%s: DNS forward zone not found'
% absnxname)
),
dict(
desc='Remove per-zone permission for forward zone %r' % fwzone1,
command=(
'dnsforwardzone_remove_permission', [fwzone1], {}
),
expected=dict(
result=True,
value=fwzone1_permission,
summary=u'Removed system permission "%s"' % fwzone1_permission,
),
),
dict(
desc='Make sure the permission for forward zone %r was deleted' % fwzone1,
command=(
'permission_show', [fwzone1_permission], {}
),
expected=errors.NotFound(reason=u'%s: permission not found'
% fwzone1_permission)
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
dict(
desc='Try to remove per-zone permission for forward zone %r (permission does not exist)' % fwzone1,
command=(
'dnsforwardzone_remove_permission', [fwzone1], {}
),
expected=errors.NotFound(reason=u'%s: permission not found'
% fwzone1_permission)
),
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
dict(
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
desc='Disable forward zone %r' % fwzone1,
command=('dnsforwardzone_disable', [fwzone1], {}),
expected={
'value': fwzone1_dnsname,
'summary': u'Disabled DNS forward zone "%s"' % fwzone1,
'result': True,
},
),
dict(
desc='Check if forward zone %r is really disabled' % fwzone1,
command=('dnsforwardzone_show', [fwzone1], {}),
expected={
'value': fwzone1_dnsname,
'summary': None,
'result': {
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'FALSE'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwardpolicy': [u'none'],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
},
},
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
dict(
desc='Disable already disabled forward zone %r' % fwzone1,
command=('dnsforwardzone_disable', [fwzone1], {}),
expected={
'value': fwzone1_dnsname,
'summary': u'Disabled DNS forward zone "%s"' % fwzone1,
'result': True,
},
),
dict(
desc='Try to disable non-existent forward zone',
command=('dnsforwardzone_disable', [nonexistent_fwzone], {}),
expected=errors.NotFound(reason="no such entry")
),
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
dict(
desc='Enable forward zone %r' % fwzone1,
command=('dnsforwardzone_enable', [fwzone1], {}),
expected={
'value': fwzone1_dnsname,
'summary': u'Enabled DNS forward zone "%s"' % fwzone1,
'result': True,
},
),
dict(
desc='Check if forward zone %r is really enabled' % fwzone1,
command=('dnsforwardzone_show', [fwzone1], {}),
expected={
'value': fwzone1_dnsname,
'summary': None,
'result': {
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
'idnsforwardpolicy': [u'none'],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
},
},
),
New test cases for Forward_zones https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-15 11:51:30 -06:00
dict(
desc='Enable already enabled forward zone %r' % fwzone1,
command=('dnsforwardzone_enable', [fwzone1], {}),
expected={
'value': fwzone1_dnsname,
'summary': u'Enabled DNS forward zone "%s"' % fwzone1,
'result': True,
},
),
dict(
desc='Try to enable non-existent forward zone',
command=('dnsforwardzone_enable', [nonexistent_fwzone], {}),
expected=errors.NotFound(reason="no such entry")
),
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
]
class test_forward_master_zones_mutual_exlusion(Declarative):
# https://fedorahosted.org/freeipa/ticket/4750
@classmethod
def setup_class(cls):
super(test_forward_master_zones_mutual_exlusion, cls).setup_class()
if not api.Backend.rpcclient.isconnected():
api.Backend.rpcclient.connect(fallback=False)
if not have_ldap2:
raise nose.SkipTest('server plugin not available')
try:
api.Command['dnszone_add'](zone1, idnssoarname=zone1_rname,)
api.Command['dnszone_del'](zone1)
except errors.NotFound:
raise nose.SkipTest('DNS is not configured')
except errors.DuplicateEntry:
pass
cleanup_commands = [
('dnszone_del', [zone1, zone_findtest_master], {'continue': True}),
('dnsforwardzone_del', [fwzone1, zone_findtest_forward],
{'continue': True}),
('permission_del', [fwzone1_permission, ], {'force': True}),
]
tests = [
dict(
desc='Create zone %r' % zone1,
command=(
'dnszone_add', [zone1], {
'idnssoarname': zone1_rname,
}
),
expected={
'value': zone1_absolute_dnsname,
'summary': None,
'result': {
'dn': zone1_dn,
'idnsname': [zone1_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': lambda x: True, # don't care in this test
'nsrecord': lambda x: True, # don't care in this test
'idnssoarname': lambda x: True, # don't care in this test
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': lambda x: True, # don't care in this test
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict(
desc='Create forward zone %r without forwarders with "none" policy' % fwzone1,
command=(
'dnsforwardzone_add', [fwzone1], {'idnsforwardpolicy': u'none'}
),
expected={
'value': fwzone1_dnsname,
'summary': None,
'result': {
'dn': fwzone1_dn,
'idnsname': [fwzone1_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
'objectclass': objectclasses.dnsforwardzone,
},
},
),
dict(
desc='Try to create duplicate zone which is already forward zone %r' % fwzone1,
command=(
'dnszone_add', [fwzone1], {
'idnssoarname': zone1_rname,
}
),
expected=errors.DuplicateEntry(
message=u'Only one zone type is allowed per zone name'),
),
dict(
desc='Try to create duplicate forward zone which is already master zone %r' % zone1,
command=(
'dnsforwardzone_add', [zone1], {
'idnsforwardpolicy': u'none',
}
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
),
expected=errors.DuplicateEntry(
message=u'Only one zone type is allowed per zone name'),
),
dict(
desc='Try to modify forward zone %r using dnszone-mod' % fwzone1,
command=(
'dnszone_mod', [fwzone1], {
'idnssoarname': zone1_rname,
}
),
expected=errors.NotFound(
reason=u'%s: DNS zone not found' % fwzone1),
),
dict(
desc='Try to modify master zone %r using dnsforwardzone-mod' % zone1,
command=(
'dnsforwardzone_mod', [zone1], {
'idnsforwardpolicy': u'none',
}
),
expected=errors.NotFound(
reason=u'%s: DNS forward zone not found' % zone1_absolute),
),
dict(
desc='Try to delete forward zone %r using dnszone-del' % fwzone1,
command=('dnszone_del', [fwzone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS zone not found' % fwzone1),
),
dict(
desc='Try to delete master zone %r using dnsforwardzone-del' % zone1,
command=('dnsforwardzone_del', [zone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS forward zone not found' % zone1_absolute),
),
dict(
desc='Try to retrieve forward zone %r using dnszone-show' % fwzone1,
command=('dnszone_show', [fwzone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS zone not found' % fwzone1),
),
dict(
desc='Try to retrieve master zone %r using dnsforwardzone-show' % zone1,
command=('dnsforwardzone_show', [zone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS forward zone not found' % zone1_absolute),
),
dict(
desc='Try to add per-zone permission for forward zone %r using dnszone-add-permission' % fwzone1,
command=('dnszone_add_permission', [fwzone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS zone not found' % fwzone1),
),
dict(
desc='Try to add per-zone permission for master zone %r using dnsforwardzone-add-permission' % zone1,
command=('dnsforwardzone_add_permission', [zone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS forward zone not found' % zone1_absolute),
),
dict(
desc='Try to remove per-zone permission for forward zone %r using dnszone-remove-permission' % fwzone1,
command=('dnszone_remove_permission', [fwzone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS zone not found' % fwzone1),
),
dict(
desc='Try to remove per-zone permission for master zone %r using dnsforwardzone-remove-permission' % zone1,
command=('dnsforwardzone_remove_permission', [zone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS forward zone not found' % zone1_absolute),
),
dict(
desc='Try to disable forward zone %r using dnszone-disable' % fwzone1,
command=('dnszone_disable', [fwzone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS zone not found' % fwzone1),
),
dict(
desc='Try to disable zone %r using dnsforwardzone-disable' % zone1,
command=('dnsforwardzone_disable', [zone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS forward zone not found' % zone1_absolute),
),
dict(
desc='Try to enable forward zone %r using dnszone-disable' % fwzone1,
command=('dnszone_enable', [fwzone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS zone not found' % fwzone1),
),
dict(
desc='Try to enable zone %r using dnsforwardzone-disable' % zone1,
command=('dnsforwardzone_enable', [zone1], {}),
expected=errors.NotFound(
reason=u'%s: DNS forward zone not found' % zone1_absolute),
),
dict(
desc='Create zone %r' % zone_findtest_master,
command=(
'dnszone_add', [zone_findtest_master], {
'idnssoarname': zone_findtest_master_rname,
}
),
expected={
'value': zone_findtest_master_dnsname,
'summary': None,
'result': {
'dn': zone_findtest_master_dn,
'idnsname': [zone_findtest_master_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'idnssoamname': lambda x: True, # don't care in this test
'nsrecord': lambda x: True, # don't care in this test
'idnssoarname': lambda x: True, # don't care in this test
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'idnsupdatepolicy': lambda x: True, # don't care in this test
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict(
desc='Create forward zone %r' % zone_findtest_forward,
command=(
'dnsforwardzone_add', [zone_findtest_forward],
{'idnsforwarders': [forwarder1]}
),
expected={
'value': zone_findtest_forward_dnsname,
'summary': None,
DNSSEC: validate forward zone forwarders Show warning messages if DNSSEC validation is failing for particular FW zone or if the specified forwarders do not work https://fedorahosted.org/freeipa/ticket/4657 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-04-24 06:37:07 -05:00
'messages': lambda x: True, # fake forwarders - ignore message
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'result': {
'dn': zone_findtest_forward_dn,
'idnsname': [zone_findtest_forward_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder1],
'objectclass': objectclasses.dnsforwardzone,
},
},
),
dict(
desc='dnsforwardzone-find should return only forward zones',
command=('dnsforwardzone_find', [zone_findtest], {}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [{
'dn': zone_findtest_forward_dn,
'idnsname': [zone_findtest_forward_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'first'],
'idnsforwarders': [forwarder1],
}],
},
),
dict(
desc='dnszone-find should return only master zones',
command=('dnszone_find', [zone_findtest], {}),
expected={
'summary': None,
'count': 1,
'truncated': False,
'result': [{
'dn': zone_findtest_master_dn,
'idnsname': [zone_findtest_master_dnsname],
'idnszoneactive': [u'TRUE'],
DNS tests: separate current forward zone tests Ticket: https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-12-05 09:12:54 -06:00
'nsrecord': lambda x: True, # don't care in this test
'idnssoamname': lambda x: True, # don't care in this test
'idnssoarname': lambda x: True, # don't care in this test
Tests DNS: forward zones design: http://www.freeipa.org/page/V4/Forward_zones Ticket: https://fedorahosted.org/freeipa/ticket/3210 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-23 09:48:55 -05:00
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
}],
},
),
dict(
desc='Try to add A record to forward zone %r in zone %r' % (name1, fwzone1),
command=('dnsrecord_add', [fwzone1, name1], {'arecord': arec3}),
expected=errors.ValidationError(
name='dnszoneidnsname',
error=(u'only master zones can contain records')
),
),
dict(
desc='Try to retrieve record %r in forward zone %r' % (name1, fwzone1),
command=('dnsrecord_show', [fwzone1, name1], {}),
expected=errors.ValidationError(
name='dnszoneidnsname',
error=(u'only master zones can contain records')
),
),
dict(
desc='Try to delete record %r in forward zone %r' % (name1, fwzone1),
command=('dnsrecord_del', [fwzone1, name1], {'del_all': True}),
expected=errors.ValidationError(
name='dnszoneidnsname',
error=(u'only master zones can contain records')
),
),
dict(
desc='Try to modify record in forward zone %r' % fwzone1,
command=('dnsrecord_mod',
[fwzone1, name1],
{'aaaarecord': u'f001:baad::1'}),
expected=errors.ValidationError(
name='dnszoneidnsname',
error=(u'only master zones can contain records')
),
),
dict(
desc='Try to search for all records in forward zone %r' % fwzone1,
command=('dnsrecord_find', [fwzone1], {}),
expected=errors.ValidationError(
name='dnszoneidnsname',
error=(u'only master zones can contain records')
),
),
DNS test: allow '.' as zone name https://fedorahosted.org/freeipa/ticket/4149 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-08-25 05:48:32 -05:00
]
DNS tests: warning if forward zone is inactive Ticket: https://fedorahosted.org/freeipa/ticket/4721 Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-01-14 10:06:56 -06:00
class test_forwardzone_delegation_warnings(Declarative):
@classmethod
def setup_class(cls):
super(test_forwardzone_delegation_warnings, cls).setup_class()
if not api.Backend.rpcclient.isconnected():
api.Backend.rpcclient.connect(fallback=False)
if not have_ldap2:
raise nose.SkipTest('server plugin not available')
try:
api.Command['dnszone_add'](zone1, idnssoarname=zone1_rname,)
api.Command['dnszone_del'](zone1)
except errors.NotFound:
raise nose.SkipTest('DNS is not configured')
except errors.DuplicateEntry:
pass
cleanup_commands = [
('dnsforwardzone_del', [zone1_sub_fw, zone1_sub2_fw],
{'continue': True}),
('dnszone_del', [zone1, zone1_sub],
{'continue': True}),
]
tests = [
dict(
desc='Create forward zone %r without forwarders with "none" '
'policy' % zone1_sub_fw,
command=(
'dnsforwardzone_add', [zone1_sub_fw],
{'idnsforwardpolicy': u'none'}
),
expected={
'value': zone1_sub_fw_dnsname,
'summary': None,
'result': {
'dn': zone1_sub_fw_dn,
'idnsname': [zone1_sub_fw_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
'objectclass': objectclasses.dnsforwardzone,
},
},
),
dict(
desc='Create zone %r (expected warning for %r)' % (zone1,
zone1_sub_fw),
command=(
'dnszone_add', [zone1_absolute], {}
),
expected={
'value': zone1_absolute_dnsname,
'summary': None,
'result': {
'dn': zone1_dn,
'idnsname': [zone1_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': lambda x: True, # don't care in this test
'nsrecord': lambda x: True, # don't care in this test
'idnssoarname': lambda x: True, # don't care in this test
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': lambda x: True, # don't care in this test
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
'messages': (
{'message': u'forward zone "fw.sub.dnszone.test." is not '
u'effective because of missing proper NS '
u'delegation in authoritative zone '
u'"dnszone.test.". Please add NS record '
u'"fw.sub" to parent zone "dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
),
},
),
dict(
desc='Create zone %r (expected warning for %r)' % (zone1_sub,
zone1_sub_fw),
command=(
'dnszone_add', [zone1_sub], {}
),
expected={
'value': zone1_sub_dnsname,
'summary': None,
'result': {
'dn': zone1_sub_dn,
'idnsname': [zone1_sub_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': lambda x: True, # don't care in this test
'nsrecord': lambda x: True, # don't care in this test
'idnssoarname': lambda x: True, # don't care in this test
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': lambda x: True, # don't care in this test
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
'messages': (
{'message': u'forward zone "fw.sub.dnszone.test." is not '
u'effective because of missing proper NS '
u'delegation in authoritative zone '
u'"sub.dnszone.test.". Please add NS record '
u'"fw" to parent zone "sub.dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
),
},
),
dict(
desc='Disable zone %r (expected warning for %r)' % (zone1_sub,
zone1_sub_fw),
command=(
'dnszone_disable', [zone1_sub], {}
),
expected={
'value': zone1_sub_dnsname,
'summary': u'Disabled DNS zone "%s"' % zone1_sub,
'result': True,
'messages': (
{'message': u'forward zone "fw.sub.dnszone.test." is not '
u'effective because of missing proper NS '
u'delegation in authoritative zone '
u'"dnszone.test.". Please add NS record '
u'"fw.sub" to parent zone "dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
),
},
),
dict(
desc='Enable zone %r (expected warning for %r)' % (zone1_sub,
zone1_sub_fw),
command=(
'dnszone_enable', [zone1_sub], {}
),
expected={
'value': zone1_sub_dnsname,
'summary': u'Enabled DNS zone "%s"' % zone1_sub,
'result': True,
'messages': (
{'message': u'forward zone "fw.sub.dnszone.test." is not '
u'effective because of missing proper NS '
u'delegation in authoritative zone '
u'"sub.dnszone.test.". Please add NS record '
u'"fw" to parent zone "sub.dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
),
},
),
dict(
desc='Disable forward zone %r' % (zone1_sub_fw),
command=(
'dnsforwardzone_disable', [zone1_sub_fw], {}
),
expected={
'value': zone1_sub_fw_dnsname,
'summary': u'Disabled DNS forward zone "%s"' % zone1_sub_fw,
'result': True,
},
),
dict(
desc='Enable forward zone %r (expected warning for %r)' % (
zone1_sub_fw, zone1_sub_fw),
command=(
'dnsforwardzone_enable', [zone1_sub_fw], {}
),
expected={
'value': zone1_sub_fw_dnsname,
'summary': u'Enabled DNS forward zone "%s"' % zone1_sub_fw,
'result': True,
'messages': (
{'message': u'forward zone "fw.sub.dnszone.test." is not '
u'effective because of missing proper NS '
u'delegation in authoritative zone '
u'"sub.dnszone.test.". Please add NS record '
u'"fw" to parent zone "sub.dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
),
},
),
dict(
desc='Delegate zone %r from zone %r using NS record' % (
zone1_sub_fw, zone1_sub),
command=('dnsrecord_add', [zone1_sub, u'fw'],
{'nsrecord': self_server_ns}),
expected={
'value': DNSName(u'fw'),
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': DN(('idnsname', u'fw'), zone1_sub_dn),
'idnsname': [DNSName(u'fw')],
'nsrecord': [self_server_ns],
},
},
),
dict(
desc='Disable zone %r (expected warning for %r)' % (zone1_sub,
zone1_sub_fw),
command=(
'dnszone_disable', [zone1_sub], {}
),
expected={
'value': zone1_sub_dnsname,
'summary': u'Disabled DNS zone "%s"' % zone1_sub,
'result': True,
'messages': (
{'message': u'forward zone "fw.sub.dnszone.test." is not '
u'effective because of missing proper NS '
u'delegation in authoritative zone '
u'"dnszone.test.". Please add NS record '
u'"fw.sub" to parent zone "dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
),
},
),
dict(
desc='Enable zone %r' % (zone1_sub),
command=(
'dnszone_enable', [zone1_sub], {}
),
expected={
'value': zone1_sub_dnsname,
'summary': u'Enabled DNS zone "%s"' % zone1_sub,
'result': True,
},
),
dict(
desc='Delete NS record which delegates zone %r from zone %r '
'(expected warning for %r)' % (zone1_sub_fw,
zone1_sub, zone1_sub_fw),
command=('dnsrecord_del', [zone1_sub, u'fw'],
{'del_all': True}),
expected={
'value': [DNSName(u'fw')],
'summary': u'Deleted record "fw"',
'result': {
'failed': [],
},
'messages': (
{'message': u'forward zone "fw.sub.dnszone.test." is not '
u'effective because of missing proper NS '
u'delegation in authoritative zone '
u'"sub.dnszone.test.". Please add NS record '
u'"fw" to parent zone "sub.dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
),
},
),
dict(
desc='Create forward zone %r without forwarders with "none" '
'policy (expected warning)' % zone1_sub2_fw,
command=(
'dnsforwardzone_add', [zone1_sub2_fw],
{'idnsforwardpolicy': u'none'}
),
expected={
'value': zone1_sub2_fw_dnsname,
'summary': None,
'result': {
'dn': zone1_sub2_fw_dn,
'idnsname': [zone1_sub2_fw_dnsname],
'idnszoneactive': [u'TRUE'],
'idnsforwardpolicy': [u'none'],
'objectclass': objectclasses.dnsforwardzone,
},
'messages': (
{'message': u'forward zone "fw.sub2.sub.dnszone.test." '
u'is not effective because of missing proper '
u'NS delegation in authoritative zone '
u'"sub.dnszone.test.". Please add NS record '
u'"fw.sub2" to parent zone '
u'"sub.dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
),
},
),
dict(
desc='Delegate zone %r from zone %r using NS record' % (
zone1_sub2_fw, zone1_sub),
command=('dnsrecord_add', [zone1_sub, u'fw.sub2'],
{'nsrecord': self_server_ns}),
expected={
'value': DNSName(u'fw.sub2'),
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': DN(('idnsname', u'fw.sub2'), zone1_sub_dn),
'idnsname': [DNSName(u'fw.sub2')],
'nsrecord': [self_server_ns],
},
},
),
dict(
desc='Disable forward zone %r' % (zone1_sub2_fw),
command=(
'dnsforwardzone_disable', [zone1_sub2_fw], {}
),
expected={
'value': zone1_sub2_fw_dnsname,
'summary': u'Disabled DNS forward zone "%s"' % zone1_sub2_fw,
'result': True,
},
),
dict(
desc='Enable forward zone %r' % (zone1_sub2_fw),
command=(
'dnsforwardzone_enable', [zone1_sub2_fw], {}
),
expected={
'value': zone1_sub2_fw_dnsname,
'summary': u'Enabled DNS forward zone "%s"' % zone1_sub2_fw,
'result': True,
},
),
dict(
desc='Delete zone %r (expected warning for %r, %r)' % (
zone1_sub, zone1_sub_fw, zone1_sub2_fw),
command=('dnszone_del', [zone1_sub], {}),
expected={
'value': [zone1_sub_dnsname],
'summary': u'Deleted DNS zone "%s"' % zone1_sub,
'result': {'failed': []},
'messages': (
{'message': u'forward zone "fw.sub.dnszone.test." is not '
u'effective because of missing proper NS '
u'delegation in authoritative zone '
u'"dnszone.test.". Please add NS record '
u'"fw.sub" to parent zone "dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
{'message': u'forward zone "fw.sub2.sub.dnszone.test." '
u'is not effective because of missing proper '
u'NS delegation in authoritative zone '
u'"dnszone.test.". Please add NS record '
u'"fw.sub2.sub" to parent zone '
u'"dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'}
),
},
),
dict(
desc='Delegate zone %r from zone %r using NS record' % (
zone1_sub2_fw, zone1),
command=('dnsrecord_add', [zone1, u'fw.sub2.sub'],
{'nsrecord': self_server_ns}),
expected={
'value': DNSName(u'fw.sub2.sub'),
'summary': None,
'result': {
'objectclass': objectclasses.dnsrecord,
'dn': DN(('idnsname', u'fw.sub2.sub'), zone1_dn),
'idnsname': [DNSName(u'fw.sub2.sub')],
'nsrecord': [self_server_ns],
},
},
),
dict(
desc='Delete (using dnsrecord-mod) NS record which delegates '
'zone %r from zone %r (expected warning for %r)' % (
zone1_sub2_fw, zone1, zone1_sub2_fw),
command=('dnsrecord_mod', [zone1, u'fw.sub2.sub'],
{'nsrecord': None}),
expected={
'value': DNSName(u'fw.sub2.sub'),
'summary': u'Deleted record "fw.sub2.sub"',
'result': {
'failed': [],
},
'messages': (
{'message': u'forward zone "fw.sub2.sub.dnszone.test." is '
u'not effective because of missing proper NS '
u'delegation in authoritative zone '
u'"dnszone.test.". Please add NS record '
u'"fw.sub2.sub" to parent zone '
u'"dnszone.test.".',
'code': 13008,
'type': u'warning',
'name': u'ForwardzoneIsNotEffectiveWarning'},
),
},
),
]
Ipatests DNS SOA Record Maintenance https://fedorahosted.org/freeipa/ticket/4746 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-03-27 10:17:10 -05:00
# https://fedorahosted.org/freeipa/ticket/4746
# http://www.freeipa.org/page/V4/DNS:_Automatic_Zone_NS/SOA_Record_Maintenance
class test_dns_soa(Declarative):
@classmethod
def setup_class(cls):
super(test_dns_soa, cls).setup_class()
if not api.Backend.rpcclient.isconnected():
api.Backend.rpcclient.connect(fallback=False)
if not have_ldap2:
raise nose.SkipTest('server plugin not available')
if get_nameservers_error is not None:
raise nose.SkipTest('unable to get list of nameservers (%s)' %
get_nameservers_error)
try:
api.Command['dnszone_add'](zone1,
idnssoarname=zone1_rname,)
api.Command['dnszone_del'](zone1)
except errors.NotFound:
raise nose.SkipTest('DNS is not configured')
except errors.DuplicateEntry:
pass
cleanup_commands = [
('dnszone_del', [zone6, zone6b], {'continue': True}),
]
tests = [
dict(
desc='Try to retrieve non-existent zone %r' % zone6,
command=('dnszone_show', [zone6], {}),
expected=errors.NotFound(
reason=u'%s: DNS zone not found' % zone6_absolute),
),
dict(
desc='Create zone %r' % zone6b,
command=(
'dnszone_add', [zone6b], {
'idnssoarname': zone6b_rname,
}
),
expected={
'value': zone6b_absolute_dnsname,
'summary': None,
'result': {
'dn': zone6b_absolute_dn,
'idnsname': [zone6b_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6b_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict(
desc='Add A record to %r in zone %r' % (zone6b_ns_arec, zone6b),
command=('dnsrecord_add',
[zone6b, zone6b_ns],
{'arecord': zone6b_ip}),
expected={
'value': zone6b_ns_dnsname,
'summary': None,
'result': {
'dn': zone6b_absolute_arec_dn,
'idnsname': [zone6b_ns_arec_dnsname],
'arecord': [zone6b_ip],
'objectclass': objectclasses.dnsrecord,
},
},
),
dict(
desc='Adding a zone - %r - just with zone name' % zone6,
command=('dnszone_add', [zone6], {}),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'dn': zone6_absolute_dn,
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_default_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict(
desc='Updating a zone - %r - with relative '
'admin\'s e-mail' %
zone6,
command=(
'dnszone_mod', [zone6], {
'idnssoarname': zone6_rname_relative_dnsname,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_relative_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
},
),
dict(
desc='Updating a zone - %r - with absolute '
'admin\'s e-mail' %
zone6,
command=(
'dnszone_mod', [zone6], {
'idnssoarname': zone6_rname_absolute_dnsname,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_absolute_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
},
),
dict(
desc='Updating a zone - %r - with default admin\'s e-mail' % zone6,
command=(
'dnszone_mod', [zone6], {
'idnssoarname': zone6_rname_default_dnsname,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_default_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
},
),
dict(
desc='Updating a zone - %r - with name-server absolute' % zone6,
command=(
'dnszone_mod', [zone6], {
'idnssoamname': zone6b_ns,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [zone6b_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6b_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
'messages': [{
'message': u"Semantic of setting Authoritative nameserver "
u"was changed. "
u"It is used only for setting the SOA MNAME "
u"attribute.\n"
u"NS record(s) can be edited in zone "
u"apex - '@'. ",
'code': 13005,
'type': u'warning',
'name': u'OptionSemanticChangedWarning',
}],
},
),
dict(
desc='Add A record to %r in zone %r' % (zone6_ns, zone6),
command=('dnsrecord_add',
[zone6, zone6_ns],
{'arecord': zone6b_ip}),
expected={
'value': zone6_ns_dnsname,
'summary': None,
'result': {
'dn': zone6_absolute_arec_dn,
'idnsname': [zone6_ns_arec_dnsname],
'arecord': [zone6b_ip],
'objectclass': objectclasses.dnsrecord,
},
},
),
dict(
desc='Updating a zone - %r - with name-server relative' % zone6,
command=(
'dnszone_mod', [zone6], {
'idnssoamname': zone6_ns_relative,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [zone6_ns_arec_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_default_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
'messages': [{
'message': u"Semantic of setting Authoritative nameserver "
u"was changed. "
u"It is used only for setting the SOA MNAME "
u"attribute.\n"
u"NS record(s) can be edited in zone "
u"apex - '@'. ",
'code': 13005,
'type': u'warning',
'name': u'OptionSemanticChangedWarning',
}],
},
),
dict(
desc='Updating a zone - %r - with unresolvable name-server '
'absolute with --force' %
zone6,
command=(
'dnszone_mod', [zone6], {
'idnssoamname': zone6_unresolvable_ns,
'force': True,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [zone6_unresolvable_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_default_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
'messages': [{
'message': u"Semantic of setting Authoritative nameserver "
u"was changed. "
u"It is used only for setting the SOA MNAME "
u"attribute.\n"
u"NS record(s) can be edited in zone "
u"apex - '@'. ",
'code': 13005,
'type': u'warning',
'name': u'OptionSemanticChangedWarning',
}],
},
),
dict(
desc='Updating a zone - %r - with unresolvable name-server '
'relative with --force' %
zone6,
command=(
'dnszone_mod', [zone6], {
'idnssoamname': zone6_unresolvable_ns_relative,
'force': True,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [zone6_unresolvable_ns_relative_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_default_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
},
'messages': [{
'message': u"Semantic of setting Authoritative nameserver "
u"was changed. "
u"It is used only for setting the SOA MNAME "
u"attribute.\n"
u"NS record(s) can be edited in zone "
u"apex - '@'. ",
'code': 13005,
'type': u'warning',
'name': u'OptionSemanticChangedWarning',
}],
},
),
dict(
desc='Updating a zone - %r - with invalid s e-mail - %r' %
(zone6, zone6_rname_invalid_dnsname),
command=(
'dnszone_mod', [zone6], {
'idnssoarname': zone6_rname_invalid_dnsname,
}),
expected=errors.ConversionError(
name='admin_email',
error=u'empty DNS label'),
),
dict(
desc='Updating a zone - %r - with invalid name-server - %r' %
(zone6, zone6_ns_invalid_dnsname),
command=(
'dnszone_mod', [zone6], {
'idnssoamname': zone6_ns_invalid_dnsname,
}),
expected=errors.ConversionError(
name='name_server',
error=u'empty DNS label'),
),
dict(
desc='Updating a zone - %r - with unresolvable name-server - %r' %
(zone6, zone6_unresolvable_ns),
command=(
'dnszone_mod', [zone6], {
'idnssoamname': zone6_unresolvable_ns,
}),
expected=errors.NotFound(
reason=u"Nameserver '%s' does not have a corresponding "
u"A/AAAA record" %
zone6_unresolvable_ns_dnsname,),
),
dict(
desc='Updating a zone - %r - with unresolvable relative '
'name-server - %r' %
(zone6, zone6_unresolvable_ns_relative),
command=(
'dnszone_mod', [zone6], {
'idnssoamname': zone6_unresolvable_ns_relative,
}),
expected=errors.NotFound(
reason=u"Nameserver '%s' does not have a corresponding "
u"A/AAAA record" %
zone6_unresolvable_ns_dnsname,),
),
dict(
desc='Updating a zone - %r - with empty name-server - %r' %
(zone6, zone6_unresolvable_ns_relative),
command=(
'dnszone_mod', [zone6], {
'idnssoamname': "",
}),
expected=errors.ValidationError(name='name_server',
error=u'is required'),
),
dict(
desc='Deleting a zone - %r' % zone6,
command=('dnszone_del', [zone6], {}),
expected={
'value': [zone6_absolute_dnsname],
'summary': u'Deleted DNS zone "%s"' % zone6_absolute,
'result': {'failed': []},
},
),
dict(
desc='Adding a zone - %r - with relative admin\'s e-mail' % zone6,
command=(
'dnszone_add', [zone6], {
'idnssoarname': zone6_rname_relative_dnsname,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'dn': zone6_absolute_dn,
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_relative_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict(
desc='Deleting a zone - %r' % zone6,
command=('dnszone_del', [zone6], {}),
expected={
'value': [zone6_absolute_dnsname],
'summary': u'Deleted DNS zone "%s"' % zone6_absolute,
'result': {'failed': []},
},
),
dict(
desc='Adding a zone - %r - with absolute admin\'s e-mail' % zone6,
command=(
'dnszone_add', [zone6], {
'idnssoarname': zone6_rname_absolute_dnsname,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'dn': zone6_absolute_dn,
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [self_server_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_absolute_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
},
),
dict(
desc='Deleting a zone - %r' % zone6,
command=('dnszone_del', [zone6], {}),
expected={
'value': [zone6_absolute_dnsname],
'summary': u'Deleted DNS zone "%s"' % zone6_absolute,
'result': {'failed': []},
},
),
dict(
desc='Adding a zone - %r - with name-server %r' %
(zone6, zone6_ns_dnsname),
command=(
'dnszone_add', [zone6], {
'idnssoamname': zone6b_ns,
}),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'dn': zone6_absolute_dn,
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [zone6b_ns_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6b_rname_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
'messages': [{
'message': u"Semantic of setting Authoritative nameserver "
u"was changed. "
u"It is used only for setting the SOA MNAME "
u"attribute.\n"
u"NS record(s) can be edited in zone "
u"apex - '@'. ",
'code': 13005,
'type': u'warning',
'name': u'OptionSemanticChangedWarning',
}], },
),
dict(
desc='Deleting a zone - %r' % zone6,
command=('dnszone_del', [zone6], {}),
expected={
'value': [zone6_absolute_dnsname],
'summary': u'Deleted DNS zone "%s"' % zone6_absolute,
'result': {'failed': []},
},
),
dict(
desc='Adding a zone - %r - with unresolvable name-server '
'relative with --force' %
zone6,
command=(
'dnszone_add', [zone6], {
'idnssoamname': zone6_unresolvable_ns_relative,
'force': True,
}
),
expected={
'value': zone6_absolute_dnsname,
'summary': None,
'result': {
'dn': zone6_absolute_dn,
'idnsname': [zone6_absolute_dnsname],
'idnszoneactive': [u'TRUE'],
'idnssoamname': [zone6_unresolvable_ns_relative_dnsname],
'nsrecord': nameservers,
'idnssoarname': [zone6_rname_default_dnsname],
'idnssoaserial': [fuzzy_digits],
'idnssoarefresh': [fuzzy_digits],
'idnssoaretry': [fuzzy_digits],
'idnssoaexpire': [fuzzy_digits],
'idnssoaminimum': [fuzzy_digits],
'idnsallowdynupdate': [u'FALSE'],
'idnsupdatepolicy': [u'grant %(realm)s krb5-self * A; '
u'grant %(realm)s krb5-self * AAAA; '
u'grant %(realm)s krb5-self * SSHFP;'
% dict(realm=api.env.realm)],
'idnsallowtransfer': [u'none;'],
'idnsallowquery': [u'any;'],
'objectclass': objectclasses.dnszone,
},
'messages': [{
'message': u"Semantic of setting Authoritative nameserver "
u"was changed. "
u"It is used only for setting the SOA MNAME "
u"attribute.\n"
u"NS record(s) can be edited in zone "
u"apex - '@'. ",
'code': 13005,
'type': u'warning',
'name': u'OptionSemanticChangedWarning',
}],
},
),
dict(
desc='Deleting a zone - %r' % zone6,
command=('dnszone_del', [zone6], {}),
expected={
'value': [zone6_absolute_dnsname],
'summary': u'Deleted DNS zone "%s"' % zone6_absolute,
'result': {'failed': []},
},
),
dict(
desc='Adding zone with invalid zone name - %r' % zone6_invalid,
command=('dnszone_add', [zone6_invalid], {}),
expected=errors.ConversionError(
name='name',
error=u'empty DNS label'
),
),
dict(
desc='Adding a zone - %r - with invalid s e-mail - %r' %
(zone6, zone6_rname_invalid_dnsname),
command=(
'dnszone_add', [zone6], {
'idnssoarname': zone6_rname_invalid_dnsname,
}),
expected=errors.ConversionError(
name='admin_email',
error=u'empty DNS label'),
),
dict(
desc='Adding a zone - %r - with invalid name-server - %r' %
(zone6, zone6_ns_invalid_dnsname),
command=(
'dnszone_add', [zone6], {
'idnssoamname': zone6_ns_invalid_dnsname,
}),
expected=errors.ConversionError(
name='name_server',
error=u'empty DNS label'),
),
dict(
desc='Adding a zone - %r - with unresolvable name-server - %r' %
(zone6, zone6_unresolvable_ns),
command=(
'dnszone_add', [zone6], {
'idnssoamname': zone6_unresolvable_ns,
}),
expected=errors.NotFound(
reason=u"Nameserver '%s' does not have a corresponding "
u"A/AAAA record" %
zone6_unresolvable_ns_dnsname,),
),
dict(
desc='Adding a zone - %r - with unresolvable '
'relative name-server - %r' %
(zone6,
zone6_unresolvable_ns_relative),
command=(
'dnszone_add', [zone6], {
'idnssoamname': zone6_unresolvable_ns_relative,
}),
expected=errors.NotFound(
reason=u"Nameserver '%s' does not have a corresponding "
u"A/AAAA record" %
zone6_unresolvable_ns_dnsname,),
),
]
Reference in New Issue Copy Permalink