Commit Graph

8665 Commits

Author SHA1 Message Date
Petr Viktorin
59d87d53b1 Do not compare types that are not comparable in Python 3
In Python 3, different types are generally not comparable (except for equality),
and None can't be compared to None.
Fix cases of these comparisons.

In ipatest.util, give up on sorting lists if the sorting raises a TypeError.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
David Kupka
5ff4170ff9 comment: Add Documentation string to deduplicate function
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 13:59:30 +02:00
Jan Pazdziora
9d7abfaf7a The delegation uris are not set, match message to code.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 13:20:25 +02:00
Martin Basti
5f3784520b CI Test: add setup_kra options into install scripts
https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2015-10-12 17:50:22 +02:00
Jan Cholasta
61bdbd6e47 upgrade: make sure ldap2 is connected in export_kra_agent_pem
https://fedorahosted.org/freeipa/ticket/5360

Reviewed-By: Ales 'alich' Marecek <amarecek@redhat.com>
2015-10-12 15:51:14 +02:00
Jan Cholasta
275e1482de schema: do not derive ipaVaultPublicKey from ipaPublicKey
This is a workaround for DS bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1267782

https://fedorahosted.org/freeipa/ticket/5359

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2015-10-12 15:48:42 +02:00
Martin Basti
573d3323af CI TEST: Vault
Simple CI test for vault feature, including testing with replica

Covers https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2015-10-12 15:15:23 +02:00
Tomas Babej
12840e0bfa tests: Amend result assertions in realmdomains tests
* Nonexistent domains have to be added/deleted with force
* Warning messages are emitted
* Some error messages have been altered

https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
dae9c6cbc1 realmdomains: Do not fail due the ValidationError when adding _kerberos TXT record
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
1e1d6d15c6 realmdomains: Issue a warning when automated management of realmdomains failed
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
6a2f47acbe realmdomains: Add validation that realmdomain being added is indeed from our realm
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
fc6e1f0bb5 realmdomains: Minor style and wording improvements
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Tomas Babej
4ceae037f5 util: Add detect_dns_zone_realm_type helper
https://fedorahosted.org/freeipa/ticket/5278

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-12 13:34:20 +02:00
Oleg Fayans
2b4354f37e Fixed a timing issue with drill returning non-zero exitcode
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-09 14:07:45 +02:00
Alexander Bokovoy
766438aba0 client referral support for trusted domain principals
https://fedorahosted.org/freeipa/ticket/3559

Reviewed-By: Sumit Bose <sbose@redhat.com>
2015-10-08 13:52:16 +02:00
Jan Cholasta
4b381b1503 vault: select a server with KRA for vault operations
This uses the same mechanism which is used for the CA.

https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-08 13:42:58 +02:00
Jan Cholasta
b035a2a114 install: always export KRA agent PEM file
Export the file even when KRA is not installed locally so that vault commands
work on all IPA replicas.

https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-08 13:42:58 +02:00
Jan Cholasta
110e85cc74 install: fix KRA agent PEM file permissions
This fixes CVE-2015-5284.

https://fedorahosted.org/freeipa/ticket/5347

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-08 13:41:08 +02:00
Petr Spacek
0b797da560 Avoid ipa-dnskeysync-replica & ipa-ods-exporter crashes caused by exceeding LDAP limits
ldap2 internally does LDAP search to find out what LDAP search limits
should be used (!). The problem is that this internal search has hardcoded
limits and throws LimitExceeded exception when DS is too slow.

DNSSEC daemons do not need any abstractions from ldap2 so we are going
to use ipaldap directly. This will avoid the unnecessary search and
associated risks.

https://fedorahosted.org/freeipa/ticket/5342

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 14:28:50 +02:00
Petr Viktorin
f82d3da1e8 Appease pylint
Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
dd0bfefae8 ipapython.ssh: Port to Python 3
Sort out the accepted types.
Handle Python 3's stricter separation between bytes and unicode.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
e3c05fcb73 Remove uses of the types module
In Python 3, the types module no longer provide alternate names for
built-in types, e.g. `types.StringType` can just be spelled `str`.

NoneType is also removed; it needs to be replaced with type(None)

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
65e3b9edc6 Use six.Stringio instead of StringIO.StringIO
The StringIO class was moved to the io module.
(In Python 2, io.StringIO is available, but is Unicode-only.)

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
026b1b5307 Use six.moves.http_client instead of httplib
The module was renamed in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
187efdfe42 Use six.moves.configparser instead of ConfigParser
The module name was lowercased in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
ad2bc94725 Use six.moves.xmlrpc.client instead of xmlrpclib
The module is renamed to xmlrpc.client in Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
70b37a956c Use six.moves.urllib instead of urllib/urllib2/urlparse
In Python 3, these modules are reorganized.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
7f1204a42c Use sys.maxsize instead of sys.maxint
In Python 3, integers don't have a maximum. The number called
"sys.maxint" is now "sys.maxsize" (defined as larger than the
largest possible list/string index).

The new spelling is also available in Python 2.7.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
60d626845d test_dn: Split bytes and unicode
Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
ed96f8d9ba ipapython.dn: Use rich comparisons
__cmp__ and cmp were removed from Python 3.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
c9ca8de7a2 rpc: Don't use undocumented urllib functions
The "splittype" and "splithost" functions in urllib.parse
are undocumented and reserved for internal use,
see http://bugs.python.org/issue11009

Use urlsplit instead.

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Petr Viktorin
f4e62be667 ipap11helper: Port to Python 3
- Use PyLong instead of PyInt on Python 3
- Use PyBytes instead of PyString for binary strings
- Use Py_TYPE(o) instead of o->py_type, and PyVarObject_HEAD_INIT
  instead of PyObject_HEAD_INIT
- Use a helper function instead of Py_BuildValue("s#"), so that
  bytes are returned on Python 3
- Use new style module initialization on Python 3
- Use PyModule_AddIntConstant and PyModule_AddIntMacro for adding constants

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-07 10:27:20 +02:00
Gabe
a6d9c40f14 Update FreeIPA package description
https://fedorahosted.org/freeipa/ticket/5284

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-10-06 18:05:37 +02:00
Timo Aaltonen
7c32ecaa0e httpinstance: Replace a hardcoded path to password.conf with HTTPD_PASSWORD_CONF
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-05 19:28:43 +02:00
Timo Aaltonen
7059117ec3 paths: Add GENERATE_RNDC_KEY.
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-05 17:45:51 +02:00
Milan Kubík
dbfdc1d39b Include ipatests/test_xmlrpc/data directory into distribution.
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-05 16:44:52 +02:00
Milan Kubík
c22c60b87c ipatests: configure Network Manager not to manage resolv.conf
For the duration of the test, makes resolv.conf unmanaged.
If NetworkManager is not running, nothing is changed.

https://fedorahosted.org/freeipa/ticket/5331

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-02 14:01:50 +02:00
Martin Babinsky
14977b5d84 do not overwrite files with local users/groups when restoring authconfig
the patch fixes regression in ipa-restore caused by overwriting /etc/passwd,
/etc/shadow and fiends during restore of authconfig configuration files. These
files are now excluded from authconfig backup dir.

https://fedorahosted.org/freeipa/ticket/5328

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-10-02 12:45:26 +02:00
Martin Babinsky
7ab52384be re-kinit after ipa-restore in backup/restore CI tests
In FreeIPA CI-tests the install_master task automatically performs kinit after
successfull installation. This may break some backup/restore tests which
perform backup into previously installed IPA master. In this case it is
neccessary to re-kinit after restore.

https://fedorahosted.org/freeipa/ticket/5326

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-02 12:42:20 +02:00
Martin Babinsky
e3cb6305cc ipa-server-install: mark master_password Knob as deprecated
fixes a regression introduced during fixing
https://fedorahosted.org/freeipa/ticket/5184

https://fedorahosted.org/freeipa/ticket/5335

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-10-01 16:09:03 +02:00
Jan Cholasta
6067824be4 install: fix ipa-server-install fail on missing --forwarder
https://fedorahosted.org/freeipa/ticket/4517

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-01 14:59:41 +02:00
Oleg Fayans
03d696f224 Added a proper workaround for dnssec test failures in Beaker environment
In beaker lab the situation when master and replica have ip addresses from
different subnets is quite frequent. When a replica has ip from different
subnet than master's, ipa-replica-prepare looks up a proper reverse zone to
add a pointer record, and if it does not find it, it asks a user for permission
to create it automatically. It breaks the tests adding the unexpected input.
The workaround is to always create a reverse zone for a new replica.

Corresponding ticket is https://fedorahosted.org/freeipa/ticket/5306

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-10-01 14:46:43 +02:00
Jan Cholasta
c388dbd4de install: fix invocation of KRAInstance.create_instance()
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-10-01 07:42:33 +02:00
Robert Kuska
01da4a8de3 Replace StandardError with Exception
StandardError was removed in Python3 and instead
Exception should be used.

Signed-off-by: Robert Kuska <rkuska@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-30 10:51:36 +02:00
Petr Vobornik
34e6c3ea05 webui: improve performance of search in association dialog
By adding no_members option to commands which supports it.

It then skips memberof procession on the server side.

https://fedorahosted.org/freeipa/ticket/5271

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-09-30 10:42:37 +02:00
Nathaniel McCallum
9e3eeadeb3 Fix an integer underflow bug in libotp
Temporarily storing the offset time in an unsigned integer causes the
value of the offset to underflow when a (valid) negative offset value
is generated. Using a signed variable avoids this problem.

https://fedorahosted.org/freeipa/ticket/5333

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-09-29 15:16:09 +02:00
Martin Basti
74da4f5870 Replica inst. fix: do not require -r, -a, -p options in unattended mode
Previous patches for this ticket introduced error, that replica install
requires to specify -r, -p and -a option in unattended mode.
This options are not needed on replica side.

https://fedorahosted.org/freeipa/ticket/4517

Reviewed-By: Milan Kubík <mkubik@redhat.com>
2015-09-29 15:12:43 +02:00
Gabe
e2b77f6283 dnssec option missing in ipa-dns-install man page
- Add DNSSEC option ipa-replica-install and ipa-server-install man page as well

https://fedorahosted.org/freeipa/ticket/5300

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-09-25 13:46:35 +02:00
Martin Basti
28c25241fe CI: backup and restore with KRA
Reviewed-By: Milan Kubík <mkubik@redhat.com>
2015-09-25 13:22:19 +02:00
Tomas Babej
75cba4e8bf winsync-migrate: Properly handle collisions in the names of external groups
Since the names of the external groups containing the migrated users
must be stripped of characters which are not valid for use in group names,
two different groups might be mapped to one during this process.

Properly handle collisions in the names by adding an incremental
numeric suffix.

https://fedorahosted.org/freeipa/ticket/5319

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-09-23 17:05:47 +02:00