mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-26 16:16:31 -06:00
Remove NSEC3PARAM record
Revert 5b95be802c
Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
This commit is contained in:
Martin Basti
Petr Vobornik
parent
21e1e4ac3b
commit
ff7b44e3b0
4
ACI.txt
4
ACI.txt
@ -39,11 +39,11 @@ aci: (targetattr = "idnsallowsyncptr || idnsforwarders || idnsforwardpolicy || i
|
||||
dn: cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Add DNS Entries";allow (add) groupdn = "ldap:///cn=System: Add DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "a6record || aaaarecord || afsdbrecord || arecord || certrecord || cn || cnamerecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rrsigrecord || sigrecord || srvrecord || sshfprecord || tlsarecord || txtrecord")(target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
aci: (targetattr = "a6record || aaaarecord || afsdbrecord || arecord || certrecord || cn || cnamerecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsrecord || nxtrecord || objectclass || ptrrecord || rrsigrecord || sigrecord || srvrecord || sshfprecord || tlsarecord || txtrecord")(target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Read DNS Entries";allow (compare,read,search) groupdn = "ldap:///cn=System: Read DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Remove DNS Entries";allow (delete) groupdn = "ldap:///cn=System: Remove DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetattr = "a6record || aaaarecord || afsdbrecord || arecord || certrecord || cn || cnamerecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsec3paramrecord || nsecrecord || nsrecord || nxtrecord || ptrrecord || rrsigrecord || sigrecord || srvrecord || sshfprecord || tlsarecord || txtrecord")(target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
aci: (targetattr = "a6record || aaaarecord || afsdbrecord || arecord || certrecord || cn || cnamerecord || dlvrecord || dnamerecord || dnsclass || dnsttl || dsrecord || hinforecord || idnsallowdynupdate || idnsallowquery || idnsallowsyncptr || idnsallowtransfer || idnsforwarders || idnsforwardpolicy || idnsname || idnssecinlinesigning || idnssoaexpire || idnssoaminimum || idnssoamname || idnssoarefresh || idnssoaretry || idnssoarname || idnssoaserial || idnsupdatepolicy || idnszoneactive || keyrecord || kxrecord || locrecord || managedby || mdrecord || minforecord || mxrecord || naptrrecord || nsecrecord || nsrecord || nxtrecord || ptrrecord || rrsigrecord || sigrecord || srvrecord || sshfprecord || tlsarecord || txtrecord")(target = "ldap:///idnsname=*,cn=dns,dc=ipa,dc=example")(version 3.0;acl "permission:System: Update DNS Entries";allow (write) groupdn = "ldap:///cn=System: Update DNS Entries,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Add Groups,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
aci: (targetfilter = "(|(objectclass=ipausergroup)(objectclass=posixgroup))")(version 3.0;acl "permission:System: Add Groups";allow (add) groupdn = "ldap:///cn=System: Add Groups,cn=permissions,cn=pbac,dc=ipa,dc=example";)
|
||||
dn: cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=ipa,dc=example
|
||||
|
||||
12
API.txt
12
API.txt
@ -799,7 +799,7 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: PrimaryKey('value', None, None)
|
||||
command: dnsrecord_add
|
||||
args: 2,105,3
|
||||
args: 2,101,3
|
||||
arg: DNSNameParam('dnszoneidnsname', cli_name='dnszone', multivalue=False, only_absolute=True, primary_key=True, query=True, required=True)
|
||||
arg: DNSNameParam('idnsname', attribute=True, cli_name='name', multivalue=False, primary_key=True, required=True)
|
||||
option: Str('a6_part_data', attribute=False, cli_name='a6_data', multivalue=False, option_group=u'A6 Record', required=False)
|
||||
@ -870,10 +870,6 @@ option: Str('naptr_part_replacement', attribute=False, cli_name='naptr_replaceme
|
||||
option: Str('naptr_part_service', attribute=False, cli_name='naptr_service', multivalue=False, option_group=u'NAPTR Record', required=False)
|
||||
option: NAPTRRecord('naptrrecord', attribute=True, cli_name='naptr_rec', csv=True, multivalue=True, option_group=u'NAPTR Record', required=False)
|
||||
option: DNSNameParam('ns_part_hostname', attribute=False, cli_name='ns_hostname', multivalue=False, option_group=u'NS Record', required=False)
|
||||
option: Int('nsec3param_part_algorithm', attribute=False, cli_name='nsec3param_algorithm', maxvalue=255, minvalue=0, multivalue=False, option_group=u'NSEC3PARAM Record', required=False)
|
||||
option: Int('nsec3param_part_flags', attribute=False, cli_name='nsec3param_flags', default=0, maxvalue=255, minvalue=0, multivalue=False, option_group=u'NSEC3PARAM Record', required=False)
|
||||
option: Int('nsec3param_part_iterations', attribute=False, cli_name='nsec3param_iterations', maxvalue=65535, minvalue=0, multivalue=False, option_group=u'NSEC3PARAM Record', required=False)
|
||||
option: Str('nsec3param_part_salt', attribute=False, cli_name='nsec3param_salt', default=u'-', minlength=1, multivalue=False, option_group=u'NSEC3PARAM Record', pattern='^([0-9a-fA-F]+|-)$', required=False)
|
||||
option: NSEC3PARAMRecord('nsec3paramrecord', attribute=True, cli_name='nsec3param_rec', csv=True, multivalue=True, option_group=u'NSEC3PARAM Record', required=False)
|
||||
option: NSEC3Record('nsec3record', attribute=True, cli_name='nsec3_rec', csv=True, multivalue=True, option_group=u'NSEC3 Record', required=False)
|
||||
option: NSECRecord('nsecrecord', attribute=True, cli_name='nsec_rec', csv=True, multivalue=True, option_group=u'NSEC Record', required=False)
|
||||
@ -1020,7 +1016,7 @@ output: ListOfEntries('result', (<type 'list'>, <type 'tuple'>), Gettext('A list
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: Output('truncated', <type 'bool'>, None)
|
||||
command: dnsrecord_mod
|
||||
args: 2,105,3
|
||||
args: 2,101,3
|
||||
arg: DNSNameParam('dnszoneidnsname', cli_name='dnszone', multivalue=False, only_absolute=True, primary_key=True, query=True, required=True)
|
||||
arg: DNSNameParam('idnsname', attribute=True, cli_name='name', multivalue=False, primary_key=True, query=True, required=True)
|
||||
option: Str('a6_part_data', attribute=False, autofill=False, cli_name='a6_data', multivalue=False, option_group=u'A6 Record', required=False)
|
||||
@ -1089,10 +1085,6 @@ option: Str('naptr_part_replacement', attribute=False, autofill=False, cli_name=
|
||||
option: Str('naptr_part_service', attribute=False, autofill=False, cli_name='naptr_service', multivalue=False, option_group=u'NAPTR Record', required=False)
|
||||
option: NAPTRRecord('naptrrecord', attribute=True, autofill=False, cli_name='naptr_rec', csv=True, multivalue=True, option_group=u'NAPTR Record', required=False)
|
||||
option: DNSNameParam('ns_part_hostname', attribute=False, autofill=False, cli_name='ns_hostname', multivalue=False, option_group=u'NS Record', required=False)
|
||||
option: Int('nsec3param_part_algorithm', attribute=False, autofill=False, cli_name='nsec3param_algorithm', maxvalue=255, minvalue=0, multivalue=False, option_group=u'NSEC3PARAM Record', required=False)
|
||||
option: Int('nsec3param_part_flags', attribute=False, autofill=False, cli_name='nsec3param_flags', default=0, maxvalue=255, minvalue=0, multivalue=False, option_group=u'NSEC3PARAM Record', required=False)
|
||||
option: Int('nsec3param_part_iterations', attribute=False, autofill=False, cli_name='nsec3param_iterations', maxvalue=65535, minvalue=0, multivalue=False, option_group=u'NSEC3PARAM Record', required=False)
|
||||
option: Str('nsec3param_part_salt', attribute=False, autofill=False, cli_name='nsec3param_salt', default=u'-', minlength=1, multivalue=False, option_group=u'NSEC3PARAM Record', pattern='^([0-9a-fA-F]+|-)$', required=False)
|
||||
option: NSEC3PARAMRecord('nsec3paramrecord', attribute=True, autofill=False, cli_name='nsec3param_rec', csv=True, multivalue=True, option_group=u'NSEC3PARAM Record', required=False)
|
||||
option: NSEC3Record('nsec3record', attribute=True, autofill=False, cli_name='nsec3_rec', csv=True, multivalue=True, option_group=u'NSEC3 Record', required=False)
|
||||
option: NSECRecord('nsecrecord', attribute=True, autofill=False, cli_name='nsec_rec', csv=True, multivalue=True, option_group=u'NSEC Record', required=False)
|
||||
|
||||
4
VERSION
4
VERSION
@ -89,5 +89,5 @@ IPA_DATA_VERSION=20100614120000
|
||||
# #
|
||||
########################################################
|
||||
IPA_API_VERSION_MAJOR=2
|
||||
IPA_API_VERSION_MINOR=97
|
||||
# Last change: mbasti - New record type added: TLSA
|
||||
IPA_API_VERSION_MINOR=98
|
||||
# Last change: mbasti - Remove NSEC3PARAM record
|
||||
|
||||
@ -53,7 +53,7 @@ attributeTypes: ( 2.16.840.1.113730.3.8.5.15 NAME 'idnsForwarders' DESC 'list of
|
||||
attributeTypes: ( 2.16.840.1.113730.3.8.5.16 NAME 'idnsZoneRefresh' DESC 'zone refresh interval' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'IPA v2' )
|
||||
attributeTypes: ( 2.16.840.1.113730.3.8.5.17 NAME 'idnsPersistentSearch' DESC 'allow persistent searches' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'IPA v2' )
|
||||
attributeTypes: ( 2.16.840.1.113730.3.8.5.18 NAME 'idnsSecInlineSigning' DESC 'allow inline DNSSEC signing' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'IPA v4.0' )
|
||||
objectClasses: ( 2.16.840.1.113730.3.8.6.0 NAME 'idnsRecord' DESC 'dns Record, usually a host' SUP top STRUCTURAL MUST idnsName MAY ( idnsAllowDynUpdate $ dNSTTL $ dNSClass $ aRecord $ aAAARecord $ a6Record $ nSRecord $ cNAMERecord $ pTRRecord $ sRVRecord $ tXTRecord $ mXRecord $ mDRecord $ hInfoRecord $ mInfoRecord $ aFSDBRecord $ SigRecord $ KeyRecord $ LocRecord $ nXTRecord $ nAPTRRecord $ kXRecord $ certRecord $ dNameRecord $ dSRecord $ sSHFPRecord $ rRSIGRecord $ nSECRecord $ nSEC3PARAMRecord $ DLVRecord $ TLSARecord ) )
|
||||
objectClasses: ( 2.16.840.1.113730.3.8.6.0 NAME 'idnsRecord' DESC 'dns Record, usually a host' SUP top STRUCTURAL MUST idnsName MAY ( idnsAllowDynUpdate $ dNSTTL $ dNSClass $ aRecord $ aAAARecord $ a6Record $ nSRecord $ cNAMERecord $ pTRRecord $ sRVRecord $ tXTRecord $ mXRecord $ mDRecord $ hInfoRecord $ mInfoRecord $ aFSDBRecord $ SigRecord $ KeyRecord $ LocRecord $ nXTRecord $ nAPTRRecord $ kXRecord $ certRecord $ dNameRecord $ dSRecord $ sSHFPRecord $ rRSIGRecord $ nSECRecord $ DLVRecord $ TLSARecord ) )
|
||||
objectClasses: ( 2.16.840.1.113730.3.8.6.1 NAME 'idnsZone' DESC 'Zone class' SUP idnsRecord STRUCTURAL MUST ( idnsZoneActive $ idnsSOAmName $ idnsSOArName $ idnsSOAserial $ idnsSOArefresh $ idnsSOAretry $ idnsSOAexpire $ idnsSOAminimum ) MAY ( idnsUpdatePolicy $ idnsAllowQuery $ idnsAllowTransfer $ idnsAllowSyncPTR $ idnsForwardPolicy $ idnsForwarders $ idnsSecInlineSigning ) )
|
||||
objectClasses: ( 2.16.840.1.113730.3.8.6.2 NAME 'idnsConfigObject' DESC 'DNS global config options' STRUCTURAL MAY ( idnsForwardPolicy $ idnsForwarders $ idnsAllowSyncPTR $ idnsZoneRefresh $ idnsPersistentSearch ) )
|
||||
objectClasses: ( 2.16.840.1.113730.3.8.12.18 NAME 'ipaDNSZone' SUP top AUXILIARY MUST idnsName MAY managedBy X-ORIGIN 'IPA v3' )
|
||||
|
||||
@ -1075,20 +1075,6 @@ IPA.dns.get_record_metadata = function() {
|
||||
adder_attributes: [],
|
||||
columns: ['ns_part_hostname']
|
||||
},
|
||||
{
|
||||
name: 'nsec3paramrecord',
|
||||
attributes: [
|
||||
'nsec3param_part_algorithm',
|
||||
'nsec3param_part_flags',
|
||||
'nsec3param_part_iterations',
|
||||
'nsec3param_part_salt'
|
||||
],
|
||||
adder_attributes: [],
|
||||
columns: [
|
||||
'nsec3param_part_algorithm', 'nsec3param_part_flags',
|
||||
'nsec3param_part_iterations', 'nsec3param_part_salt'
|
||||
]
|
||||
},
|
||||
{
|
||||
name: 'ptrrecord',
|
||||
attributes: [
|
||||
@ -1524,7 +1510,7 @@ IPA.dns_record_types = function() {
|
||||
//only supported
|
||||
var attrs = ['A', 'AAAA', 'A6', 'AFSDB', 'CERT', 'CNAME', 'DNAME',
|
||||
'DS', 'DLV', 'KX', 'LOC', 'MX', 'NAPTR', 'NS',
|
||||
'NSEC3PARAM', 'PTR', 'SRV', 'SSHFP', 'TLSA', 'TXT'];
|
||||
'PTR', 'SRV', 'SSHFP', 'TLSA', 'TXT'];
|
||||
var record_types = [];
|
||||
for (var i=0; i<attrs.length; i++) {
|
||||
var attr = attrs[i];
|
||||
|
||||
@ -10,7 +10,7 @@ addifexist: aci:'(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl |
|
||||
dn: cn=dns, $SUFFIX
|
||||
replace:aci:'(targetattr = "*")(version 3.0; acl "No access to DNS tree without a permission"; deny (read,search,compare) (groupdn != "ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX") and (groupdn != "ldap:///cn=Read DNS Entries,cn=permissions,cn=pbac,$SUFFIX");)::(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)'
|
||||
replace:aci:'(targetattr = "*")(version 3.0; acl "Allow read access"; allow (read,search,compare) groupdn = "ldap:///cn=Read DNS Entries,cn=permissions,cn=pbac,$SUFFIX" or userattr = "parent[0,1].managedby#GROUPDN";)::(targetattr = "*")(version 3.0; acl "Read DNS entries from a zone"; allow (read,search,compare) userattr = "parent[0,1].managedby#GROUPDN";)'
|
||||
replace:aci:'(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders")(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)::(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders || nsec3paramrecord || dlvrecord || idnssecinlinesigning ")(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)'
|
||||
replace:aci:'(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders")(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)::(targetattr = "idnsname || cn || idnsallowdynupdate || dnsttl || dnsclass || arecord || aaaarecord || a6record || nsrecord || cnamerecord || ptrrecord || srvrecord || txtrecord || mxrecord || mdrecord || hinforecord || minforecord || afsdbrecord || sigrecord || keyrecord || locrecord || nxtrecord || naptrrecord || kxrecord || certrecord || dnamerecord || dsrecord || sshfprecord || rrsigrecord || nsecrecord || idnsname || idnszoneactive || idnssoamname || idnssoarname || idnssoaserial || idnssoarefresh || idnssoaretry || idnssoaexpire || idnssoaminimum || idnsupdatepolicy || idnsallowquery || idnsallowtransfer || idnsallowsyncptr || idnsforwardpolicy || idnsforwarders || dlvrecord || idnssecinlinesigning ")(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Update DNS entries in a zone";allow (write) userattr = "parent[0,1].managedby#GROUPDN";)'
|
||||
|
||||
# add DNS plugin
|
||||
dn: cn=IPA DNS,cn=plugins,cn=config
|
||||
|
||||
@ -1229,34 +1229,7 @@ class NSEC3Record(DNSRecord):
|
||||
class NSEC3PARAMRecord(DNSRecord):
|
||||
rrtype = 'NSEC3PARAM'
|
||||
rfc = 5155
|
||||
parts = (
|
||||
Int('algorithm',
|
||||
label=_('Algorithm'),
|
||||
minvalue=0,
|
||||
maxvalue=255,
|
||||
),
|
||||
Int('flags',
|
||||
label=_('Flags'),
|
||||
minvalue=0,
|
||||
maxvalue=255,
|
||||
default=0,
|
||||
),
|
||||
Int('iterations',
|
||||
label=_('Iterations'),
|
||||
minvalue=0,
|
||||
maxvalue=65535,
|
||||
),
|
||||
Str('salt',
|
||||
label=_('Salt'),
|
||||
doc=_('A hexadecimal salt value. Requires hexadecimal digits '
|
||||
'or hyphen ("-") if no salt is required'),
|
||||
minlength=1,
|
||||
default=u'-', # no salt
|
||||
pattern=r'^([0-9a-fA-F]+|-)$',
|
||||
pattern_errmsg=u'only hexadecimal digits or single hyphen ("-") '
|
||||
u'are allowed'
|
||||
),
|
||||
)
|
||||
supported = False
|
||||
|
||||
def _validate_naptr_flags(ugettext, flags):
|
||||
allowed_flags = u'SAUP'
|
||||
@ -2150,7 +2123,7 @@ class dnszone(DNSZoneBase):
|
||||
'idnssoaretry', 'idnssoarname', 'idnssoaserial',
|
||||
'idnsupdatepolicy', 'idnszoneactive', 'keyrecord', 'kxrecord',
|
||||
'locrecord', 'managedby', 'mdrecord', 'minforecord',
|
||||
'mxrecord', 'naptrrecord', 'nsecrecord', 'nsec3paramrecord',
|
||||
'mxrecord', 'naptrrecord', 'nsecrecord',
|
||||
'nsrecord', 'nxtrecord', 'ptrrecord', 'rrsigrecord',
|
||||
'sigrecord', 'srvrecord', 'sshfprecord', 'tlsarecord',
|
||||
'txtrecord',
|
||||
@ -2184,7 +2157,7 @@ class dnszone(DNSZoneBase):
|
||||
'idnssoaretry', 'idnssoarname', 'idnssoaserial',
|
||||
'idnsupdatepolicy', 'idnszoneactive', 'keyrecord', 'kxrecord',
|
||||
'locrecord', 'managedby', 'mdrecord', 'minforecord',
|
||||
'mxrecord', 'naptrrecord', 'nsecrecord', 'nsec3paramrecord',
|
||||
'mxrecord', 'naptrrecord', 'nsecrecord',
|
||||
'nsrecord', 'nxtrecord', 'ptrrecord', 'rrsigrecord',
|
||||
'sigrecord', 'srvrecord', 'sshfprecord', 'tlsarecord',
|
||||
'txtrecord',
|
||||
@ -2496,13 +2469,6 @@ class dnsrecord(LDAPObject):
|
||||
for nsrecord in nsrecords:
|
||||
check_ns_rec_resolvable(keys[0], DNSName(nsrecord))
|
||||
|
||||
def _nsec3paramrecord_pre_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
||||
assert isinstance(dn, DN)
|
||||
nsec3paramrecord = entry_attrs.get('nsec3paramrecord')
|
||||
if nsec3paramrecord and not self.is_pkey_zone_record(*keys):
|
||||
raise errors.ValidationError(name='nsec3paramrecord',
|
||||
error=unicode(_('must be in zone record')))
|
||||
|
||||
def _idnsname_pre_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
||||
assert isinstance(dn, DN)
|
||||
if keys[-1].is_absolute():
|
||||
@ -2789,14 +2755,6 @@ class dnsrecord(LDAPObject):
|
||||
'NS record except when located in a zone root '
|
||||
'record (RFC 6672, section 2.3)'))
|
||||
|
||||
# NSEC3PARAM record validation
|
||||
nsec3params = rrattrs.get('nsec3paramrecord')
|
||||
if nsec3params is not None:
|
||||
if len(nsec3params) > 1:
|
||||
raise errors.ValidationError(name='nsec3paramrecord',
|
||||
error=_('Only one NSEC3PARAM record is '
|
||||
'allowed per zone'))
|
||||
|
||||
def _entry2rrsets(self, entry_attrs, dns_name, dns_domain):
|
||||
'''Convert entry_attrs to a dictionary {rdtype: rrset}.
|
||||
|
||||
|
||||
@ -1593,68 +1593,6 @@ class test_dns(Declarative):
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to add NSEC3PARAM record out of zone record %r' % (zone1),
|
||||
command=('dnsrecord_add', [zone1, u'test'],
|
||||
{'nsec3paramrecord': u'1 0 2 ad50f1'}),
|
||||
expected=errors.ValidationError(name='nsec3paramrecord',
|
||||
error=u'must be in zone record'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to add invalid NSEC3PARAM record to zone %r' % (zone1),
|
||||
command=('dnsrecord_add', [zone1, u'@'],
|
||||
{'nsec3paramrecord': u'1 0 2 -ad50f1'}),
|
||||
expected=errors.ValidationError(name='salt',
|
||||
error=u'only hexadecimal digits or single hyphen ("-") are allowed'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Add NSEC3PARAM record to zone %r' % (zone1),
|
||||
command=('dnsrecord_add', [zone1, u'@'],
|
||||
{'nsec3paramrecord': u'1 0 2 ad50f1'}),
|
||||
expected={
|
||||
'value': _dns_zone_record,
|
||||
'summary': None,
|
||||
'result': {
|
||||
'dn': zone1_dn,
|
||||
'arecord': [u'172.16.29.111'],
|
||||
'idnsname': [_dns_zone_record],
|
||||
'nsrecord': [zone1_absolute],
|
||||
'nsec3paramrecord': [u'1 0 2 ad50f1'],
|
||||
'objectclass': objectclasses.dnszone,
|
||||
},
|
||||
},
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Try to add another NSEC3PARAM record to zone %r' % (zone1),
|
||||
command=('dnsrecord_add', [zone1, u'@'],
|
||||
{'nsec3paramrecord': u'1 0 2 -'}),
|
||||
expected=errors.ValidationError(name='nsec3paramrecord',
|
||||
error=u'Only one NSEC3PARAM record is allowed per zone'),
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Remove NSEC3PARAM record from zone %r' % (zone1),
|
||||
command=('dnsrecord_del', [zone1, u'@'],
|
||||
{'nsec3paramrecord': u'1 0 2 ad50f1'}),
|
||||
expected={
|
||||
'value': [_dns_zone_record],
|
||||
'summary': None,
|
||||
'result': {
|
||||
'arecord': [u'172.16.29.111'],
|
||||
'idnsname': [_dns_zone_record],
|
||||
'nsrecord': [zone1_absolute],
|
||||
},
|
||||
},
|
||||
),
|
||||
|
||||
|
||||
dict(
|
||||
desc='Create zone %r' % zone3,
|
||||
command=(
|
||||
|
||||
Loading…
Reference in New Issue
Block a user