Commit Graph

8677 Commits

Author SHA1 Message Date
Jan Cholasta
2f3450249d vault: fix private service vault creation
https://fedorahosted.org/freeipa/ticket/5361

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-10-13 14:34:00 +02:00
Petr Viktorin
88fc27da52 ipaldap: Remove extraneous long (included in six.int_types)
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
f67155486b Alias long to int under Python 3
In py3, the two types are unified under the name "int".

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
5f7c206e74 rpc: Name argument to KerberosError
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
614b490402 ipalib.parameters: Require bytes for Bytes.pattern
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
e0eff8b834 ipalib.parameters: Handle 0-prefixed octal format of ints
In Python 2, numbers prfixed with '0' are parsed as octal,
e.g. '020' -> 16. In Python 3, the prefix is '0o'.

Handle the old syntax for IPA's parameter conversion to keep
backwards compatibility.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
c44dd40b26 test_keyring: Use str(e) instead of e.message for exceptions
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
b71fd2d3c9 Add message property to IPA's errors and warnings under Python 3
Python 3 removes the "message" attribute from exceptions, in favor
of just calling str().
Add it back for IPA's own exception types.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
905d81f500 ipalib.aci: Port to Python 3
- Don't encode under Python 3, where shlex would choke on bytes
- Sort the attrs dictionary in export_to_string, so the tests are
  deterministic. (The iteration order of dicts was always unspecified,
  but was always the same in practice under CPython 2.)

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
be876987f5 test_ipalib.test_frontend: Port unbound method tests to Python 3
Python 3 uses plain function objects instead of unbound methods.
So, what was Class.method.__func__ is now just Class.method.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
88ac1c1616 Rename caught exception for use outside the except: block.
In Python 3, the variable with the currently handled exception is unset
at the end of the except block. (This is done to break reference
cycles, since exception instances now carry tracebacks, which contain
all locals.)

Fix this in baseldap's error handler.

Use a simpler structure for the ipatests.raises utility that only uses the
exception inside the except block.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
929c3d1265 x509: Port to Python 3
In python 3 , `bytes` has the buffer interface, and `buffer` was removed.

Also, invalid padding in base64-encoded data raises a ValueError rather
than TypeError.

In tests, use pytest.assert_raises for more correct exception assertions.
Also, get rid of unused imports in the tests

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Petr Viktorin
59d87d53b1 Do not compare types that are not comparable in Python 3
In Python 3, different types are generally not comparable (except for equality),
and None can't be compared to None.
Fix cases of these comparisons.

In ipatest.util, give up on sorting lists if the sorting raises a TypeError.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
David Kupka
5ff4170ff9 comment: Add Documentation string to deduplicate function
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 13:59:30 +02:00
Jan Pazdziora
9d7abfaf7a The delegation uris are not set, match message to code.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 13:20:25 +02:00
Martin Basti
5f3784520b CI Test: add setup_kra options into install scripts
https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2015-10-12 17:50:22 +02:00
Jan Cholasta
61bdbd6e47 upgrade: make sure ldap2 is connected in export_kra_agent_pem
https://fedorahosted.org/freeipa/ticket/5360

Reviewed-By: Ales 'alich' Marecek <amarecek@redhat.com>
2015-10-12 15:51:14 +02:00
Jan Cholasta
275e1482de schema: do not derive ipaVaultPublicKey from ipaPublicKey
This is a workaround for DS bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1267782

https://fedorahosted.org/freeipa/ticket/5359

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-10-12 15:48:42 +02:00
Martin Basti
573d3323af CI TEST: Vault
Simple CI test for vault feature, including testing with replica

Covers https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2015-10-12 15:15:23 +02:00
Tomas Babej
12840e0bfa tests: Amend result assertions in realmdomains tests
* Nonexistent domains have to be added/deleted with force
* Warning messages are emitted
* Some error messages have been altered

https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
dae9c6cbc1 realmdomains: Do not fail due the ValidationError when adding _kerberos TXT record
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
1e1d6d15c6 realmdomains: Issue a warning when automated management of realmdomains failed
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
6a2f47acbe realmdomains: Add validation that realmdomain being added is indeed from our realm
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
fc6e1f0bb5 realmdomains: Minor style and wording improvements
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
4ceae037f5 util: Add detect_dns_zone_realm_type helper
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Oleg Fayans
2b4354f37e Fixed a timing issue with drill returning non-zero exitcode
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-09 14:07:45 +02:00
Alexander Bokovoy
766438aba0 client referral support for trusted domain principals
https://fedorahosted.org/freeipa/ticket/3559

Reviewed-By: Sumit Bose <sbose@redhat.com>
2015-10-08 13:52:16 +02:00
Jan Cholasta
4b381b1503 vault: select a server with KRA for vault operations
This uses the same mechanism which is used for the CA.

https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-08 13:42:58 +02:00
Jan Cholasta
b035a2a114 install: always export KRA agent PEM file
Export the file even when KRA is not installed locally so that vault commands
work on all IPA replicas.

https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-08 13:42:58 +02:00
Jan Cholasta
110e85cc74 install: fix KRA agent PEM file permissions
This fixes CVE-2015-5284.

https://fedorahosted.org/freeipa/ticket/5347

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-08 13:41:08 +02:00
Petr Spacek
0b797da560 Avoid ipa-dnskeysync-replica & ipa-ods-exporter crashes caused by exceeding LDAP limits
ldap2 internally does LDAP search to find out what LDAP search limits
should be used (!). The problem is that this internal search has hardcoded
limits and throws LimitExceeded exception when DS is too slow.

DNSSEC daemons do not need any abstractions from ldap2 so we are going
to use ipaldap directly. This will avoid the unnecessary search and
associated risks.

https://fedorahosted.org/freeipa/ticket/5342

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 14:28:50 +02:00
Petr Viktorin
f82d3da1e8 Appease pylint
Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
dd0bfefae8 ipapython.ssh: Port to Python 3
Sort out the accepted types.
Handle Python 3's stricter separation between bytes and unicode.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
e3c05fcb73 Remove uses of the types module
In Python 3, the types module no longer provide alternate names for
built-in types, e.g. `types.StringType` can just be spelled `str`.

NoneType is also removed; it needs to be replaced with type(None)

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
65e3b9edc6 Use six.Stringio instead of StringIO.StringIO
The StringIO class was moved to the io module.
(In Python 2, io.StringIO is available, but is Unicode-only.)

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
026b1b5307 Use six.moves.http_client instead of httplib
The module was renamed in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
187efdfe42 Use six.moves.configparser instead of ConfigParser
The module name was lowercased in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
ad2bc94725 Use six.moves.xmlrpc.client instead of xmlrpclib
The module is renamed to xmlrpc.client in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
70b37a956c Use six.moves.urllib instead of urllib/urllib2/urlparse
In Python 3, these modules are reorganized.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
7f1204a42c Use sys.maxsize instead of sys.maxint
In Python 3, integers don't have a maximum. The number called
"sys.maxint" is now "sys.maxsize" (defined as larger than the
largest possible list/string index).

The new spelling is also available in Python 2.7.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
60d626845d test_dn: Split bytes and unicode
Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
ed96f8d9ba ipapython.dn: Use rich comparisons
__cmp__ and cmp were removed from Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
c9ca8de7a2 rpc: Don't use undocumented urllib functions
The "splittype" and "splithost" functions in urllib.parse
are undocumented and reserved for internal use,
see http://bugs.python.org/issue11009

Use urlsplit instead.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
f4e62be667 ipap11helper: Port to Python 3
- Use PyLong instead of PyInt on Python 3
- Use PyBytes instead of PyString for binary strings
- Use Py_TYPE(o) instead of o->py_type, and PyVarObject_HEAD_INIT
  instead of PyObject_HEAD_INIT
- Use a helper function instead of Py_BuildValue("s#"), so that
  bytes are returned on Python 3
- Use new style module initialization on Python 3
- Use PyModule_AddIntConstant and PyModule_AddIntMacro for adding constants

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Gabe
a6d9c40f14 Update FreeIPA package description
https://fedorahosted.org/freeipa/ticket/5284

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-10-06 18:05:37 +02:00
Timo Aaltonen
7c32ecaa0e httpinstance: Replace a hardcoded path to password.conf with HTTPD_PASSWORD_CONF
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-05 19:28:43 +02:00
Timo Aaltonen
7059117ec3 paths: Add GENERATE_RNDC_KEY.
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-05 17:45:51 +02:00
Milan Kubík
dbfdc1d39b Include ipatests/test_xmlrpc/data directory into distribution.
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-05 16:44:52 +02:00
Milan Kubík
c22c60b87c ipatests: configure Network Manager not to manage resolv.conf
For the duration of the test, makes resolv.conf unmanaged.
If NetworkManager is not running, nothing is changed.

https://fedorahosted.org/freeipa/ticket/5331

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-02 14:01:50 +02:00
Martin Babinsky
14977b5d84 do not overwrite files with local users/groups when restoring authconfig
the patch fixes regression in ipa-restore caused by overwriting /etc/passwd,
/etc/shadow and fiends during restore of authconfig configuration files. These
files are now excluded from authconfig backup dir.

https://fedorahosted.org/freeipa/ticket/5328

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-10-02 12:45:26 +02:00