Commit Graph

7731 Commits

Author SHA1 Message Date
Simo Sorce
b1a30bff04 Use asn1c helpers to encode/decode the getkeytab control
Replaces manual encoding with automatically generated code.

Fixes:
https://fedorahosted.org/freeipa/ticket/4718
https://fedorahosted.org/freeipa/ticket/4728

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-11-20 10:52:13 -05:00
Simo Sorce
c6afc489a1 Add asn1c generated code for keytab controls
Instead of manually encoding controls, use an actual asn1 compiler.
The file asn1/asn1c/ipa.asn1 will contain ipa modules. The generated code
is committed to the tree and built into a static library that is linked
to the code that uses it.

The first module implements the GetKeytabControl control.

Related:
https://fedorahosted.org/freeipa/ticket/4718
https://fedorahosted.org/freeipa/ticket/4728

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-11-20 10:52:13 -05:00
Simo Sorce
b170851058 Fix filtering of enctypes in server code.
The filtering was incorrect and would result in always discarding all values.
Also make sure there are no duplicates in the list.

Partial fix for:
https://fedorahosted.org/freeipa/ticket/4718

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-11-20 10:52:13 -05:00
David Kupka
35dad9684b Fix --{user,group}-ignore-attribute in migration plugin.
Ignore case in attribute names.

https://fedorahosted.org/freeipa/ticket/4620

Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-11-20 16:49:13 +01:00
Martin Basti
58737c7791 Fix pk11helper module compiler warnings
Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-11-20 16:46:30 +01:00
Petr Vobornik
a3c799f2f4 restore: clear httpd ccache after restore
so that httpd ccache won't contain old credentials which would make ipa CLI fail with error:

 Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Decrypt integrity check failed)

https://fedorahosted.org/freeipa/ticket/4726

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-11-20 16:43:26 +01:00
Jan Cholasta
3d1e9813e6 Restore file extended attributes and SELinux context in ipa-restore
https://fedorahosted.org/freeipa/ticket/4712

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-11-20 16:43:26 +01:00
Petr Viktorin
93422a54a3 Add additional backup & restore checks
https://fedorahosted.org/freeipa/ticket/3893

Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-11-20 15:47:38 +01:00
Martin Basti
c80a59eff4 Raise right exception if domain name is not valid
Because of dnspython implementation, in some cases UnicodeError is
raised instead of DNS SyntaxError

Ticket: https://fedorahosted.org/freeipa/ticket/4734
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-20 14:41:36 +00:00
Petr Vobornik
bff97e8b2e webui: fix potential XSS vulnerabilities
Escape user defined text to prevent XSS attacks. Extra precaution was taken
to escape also parts which are unlikely to contain user-defined text.

fixes CVE-2014-7850

https://fedorahosted.org/freeipa/ticket/4742

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-20 15:31:15 +01:00
Martin Basti
43285b1fc3 Show warning instead of error if CA did not start
This is just workaround, checking if CA is working raises false positive
exception during upgrade

Ticket: https://fedorahosted.org/freeipa/ticket/4676
Reviewed-By: Simo Sorce <ssorce@redhat.com>
2014-11-20 10:30:22 +01:00
Petr Viktorin
a14ce85357 Do not restore SELinux settings that were not backed up
https://fedorahosted.org/freeipa/ticket/4678

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-11-19 15:47:45 +01:00
Jan Cholasta
52b141ca6a Fix wrong expiration date on renewed IPA CA certificates
The expiration date was always set to the expiration date of the original
certificate.

https://fedorahosted.org/freeipa/ticket/4717

Reviewed-By: David Kupka <dkupka@redhat.com>
2014-11-19 14:25:26 +00:00
Martin Basti
310e46452c Fix warning message should not contain CLI commands
Message is now universal for both CLI and WebUI

Ticket: https://fedorahosted.org/freeipa/ticket/4647
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-11-19 15:20:55 +01:00
Nathaniel McCallum
3c900ba7a8 Enable QR code display by default in otptoken-add
This is possible because python-qrcode's output now fits in a standard
terminal. Also, update ipa-otp-import and otptoken-add-yubikey to
disable QR code output as it doesn't make sense in these contexts.

https://fedorahosted.org/freeipa/ticket/4703

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-11-19 14:26:00 +01:00
Martin Basti
d2ffd17617 Fix: zonemgr must be unicode value
To support IDNA --zonemgr option must be unicode not ascii

https://fedorahosted.org/freeipa/ticket/4724

Reviewed-By: David Kupka <dkupka@redhat.com>
2014-11-19 13:37:48 +01:00
Simo Sorce
a86d8e8064 Add UTC date to GIT snapshot version generation
This way make rpms will always generate new packages that can be installed on
top fo older ones, regardless of alphabetic ordering of the GIT commit id.
Also make sure version and date variables are immditely resolved, so they can't
change during the build.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-11-18 15:24:31 -05:00
Martin Basti
7c176b708e Fix named working directory permissions
Just adding dir to specfile doesnt work, because is not guarantee the
named is installed, during RPM installation.

Ticket: https://fedorahosted.org/freeipa/ticket/4716
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-18 18:49:42 +00:00
Thorsten Scherf
4c670919a5 Add help string on how to configure multiple DNS forwards for various cli tools
The man pages for various FreeIPA setup tools are more descriptive on how to
configure multiple DNS forwarders than the corresponding cli help. This patch
makes the cli help more verbose now for the following tools:

* ipa-dns-install
* ipa-replica-install
* ipa-server-install

https://fedorahosted.org/freeipa/ticket/4465

Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-11-14 15:38:52 +01:00
Nathaniel McCallum
c38e2d7394 Ensure users exist when assigning tokens to them
https://fedorahosted.org/freeipa/ticket/4642

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-13 16:18:41 +01:00
Nathaniel McCallum
93ff9ec087 Improve otptoken help messages
https://fedorahosted.org/freeipa/ticket/4689

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-11-13 15:32:52 +01:00
David Kupka
b032debd23 Produce better error in group-add command.
https://fedorahosted.org/freeipa/ticket/4611

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-13 13:07:22 +00:00
David Kupka
e28eb13907 Remove service file even if it isn't link.
(Link to) service file from /etc/systemd/system/ must be removed before masking
systemd service.

https://fedorahosted.org/freeipa/ticket/4658

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-13 13:53:23 +01:00
Martin Basti
2712b609cb Upgrade: fix trusts objectclass violationi
Execute updates in proper ordering.
Curently ldap-updater implementation doesnt allow better fix.

Ticket: https://fedorahosted.org/freeipa/ticket/4680
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-11-13 13:31:17 +01:00
Martin Basti
f62c7843ff Fix upgrade referint plugin
Mixing 'Old' and 'New' attr style for referential integrity plugin causes errors.
Now old setting are migrated to new style setting before upgrade

Ticket: https://fedorahosted.org/freeipa/ticket/4622
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-11-13 13:26:34 +01:00
Rob Crittenden
c32ecbff8c Search using proper scope when connecting CA instances
The wrong search scope was being used when trying to determine if
a given master had a CA installed when trying to create a new
connection.

https://fedorahosted.org/freeipa/ticket/4704

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-11-13 13:16:12 +01:00
Martin Basti
40ea328a78 Fix: DNS policy upgrade raises asertion error
Ticket: https://fedorahosted.org/freeipa/ticket/4708
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-13 12:12:28 +00:00
Petr Viktorin
e60ef1fe02 ipaplatform: Use the dirsrv service, not target
IPA only uses one instance of the directory server. When an instance
is not specified to a call to service.start/stop/restart/...,
use IPA's instance.

Stopping a systemd service is synchronous (bby default), but stopping
a target is not. This will change ensures that the directory server
is actually down when stop() finishes.

https://fedorahosted.org/freeipa/ticket/4709

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-13 10:49:17 +00:00
Martin Basti
a7162e7766 Fix: DNS installer adds invalid zonemgr email
Installer adds zonemgr as relative (and invalid) address.
This fix force installer to use absolute email.

Ticket: https://fedorahosted.org/freeipa/ticket/4707
Reviewed-By: David Kupka <dkupka@redhat.com>
2014-11-13 10:36:28 +00:00
Jan Cholasta
2639997dfe Fix CA certificate backup and restore
Backup and restore /etc/pki/ca-trust/source/ipa.p11-kit.

Create /etc/ipa/nssdb after restore if necessary.

https://fedorahosted.org/freeipa/ticket/4711

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-11-11 16:13:52 +01:00
Petr Vobornik
8248f69627 webui: prohibit setting rid base with ipa-trust-ad-posix type
Base RID is no longer editable for ipa-trust-ad-posix range type

Adder dialog:
- Range type selector was moved up because it affects a field above it

Details page:
- Only fields relevant to range's type are visible

https://fedorahosted.org/freeipa/ticket/4221

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-11 10:56:16 +01:00
Petr Vobornik
3d11de4849 idrange: include raw range type in output
iparangetype output is a localized human-readable value which is not suitable for machine-based API consumers

Solved by new iparangetyperaw output attribute which contains iparangetype's raw value

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-11 10:56:16 +01:00
Petr Vobornik
61d98bdc59 ldapupdater: set baserid to 0 for ipa-ad-trust-posix ranges
New updater plugin which sets baserid to 0 for ranges with type ipa-ad-trust-posix

https://fedorahosted.org/freeipa/ticket/4221

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-11 10:56:16 +01:00
Petr Vobornik
feea9047be unittests: baserid for ipa-ad-trust-posix idranges
https://fedorahosted.org/freeipa/ticket/4221

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-11 10:56:16 +01:00
Petr Vobornik
95a492caec ranges: prohibit setting --rid-base with ipa-trust-ad-posix type
We should not allow setting --rid-base for ranges of ipa-trust-ad-posix since we do not perform any RID -> UID/GID mappings for these ranges (objects have UID/GID set in AD). Thus, setting RID base makes no sense.

Since ipaBaseRID is a MUST in ipaTrustedADDomainRange object class, value '0' is allowed and used internally for 'ipa-trust-ad-posix' range type.

No schema change is done.

https://fedorahosted.org/freeipa/ticket/4221

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-11 10:56:16 +01:00
Petr Viktorin
a8e2a242be ipa-restore: Don't crash if AD trust is not installed
https://fedorahosted.org/freeipa/ticket/4668

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-11 09:54:29 +00:00
David Kupka
82c3c2b242 Remove unneeded internal methods. Move code to public methods.
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-11 09:18:30 +01:00
Gabe
d95d557ce5 ipa-server-install Directory Manager help incorrect
https://fedorahosted.org/freeipa/ticket/4694

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-11 09:16:16 +01:00
Endi S. Dewata
80a8df3f19 Modififed NSSConnection not to shutdown existing database.
The NSSConnection class has been modified not to shutdown the
existing NSS database if the database is already opened to
establish an SSL connection, or is already opened by another
code that uses an NSS database without establishing an SSL
connection such as vault CLIs.

https://fedorahosted.org/freeipa/ticket/4638

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-11 09:09:19 +01:00
Petr Spacek
74e0a8cebc Fix minimal version of BIND for Fedora 20 and 21
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-11-07 17:13:45 +01:00
Tomas Babej
b168a7f2d1 specfile: Add BuildRequires for pki-base 10.2.1-0
https://fedorahosted.org/freeipa/ticket/4688

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-11-07 12:29:33 +01:00
Alexander Bokovoy
0df3119b66 Update slapi-nis dependency to pull 0.54.1
Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-11-07 10:28:00 +01:00
Nathaniel McCallum
79df668b5d Ensure that a password exists after OTP validation
Before this patch users could log in using only the OTP value. This
arose because ipapwd_authentication() successfully determined that
an empty password was invalid, but 389 itself would see this as an
anonymous bind. An anonymous bind would never even get this far in
this code, so we simply deny requests with empty passwords.

This patch resolves CVE-2014-7828.

https://fedorahosted.org/freeipa/ticket/4690

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-06 10:56:19 +01:00
Martin Basti
730f33680b Fix upgrade: do not use invalid ldap connection
Ticket: https://fedorahosted.org/freeipa/ticket/4670
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-06 10:45:16 +01:00
David Kupka
9335552418 Stop dirsrv last in ipactl stop.
Other services may depend on directory server.

https://fedorahosted.org/freeipa/ticket/4632

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-11-06 10:43:11 +01:00
Thierry bordaz (tbordaz)
85eb17553f Deadlock in schema compat plugin (between automember_update_membership task and dse update)
Defining schema-compat-ignore-subtree values for schema compat plugin config entries removes the
	default value (ignore: cn=tasks,cn=config). This default value prevented deadlocks.
	Schema plugin needs to scope the $SUFFIX and also any updates to its configuration.
	This change restrict the schema compat to those subtrees. It replaces the definition of ignored subtrees
	that would be too long for cn=config (tasks, mapping tree, replication, snmp..)

https://fedorahosted.org/freeipa/ticket/4635

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-06 09:38:45 +01:00
Jan Cholasta
4589ef133c Fix various bugs in ipap11helper
Fixes a memory leak, a library handle leak and a double free.

Also remove some redundant NULL checks before free to prevent false positives
in static code analysis.

https://fedorahosted.org/freeipa/ticket/4651

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-05 15:28:27 +01:00
Jan Cholasta
ade02cdac4 Fix memory leaks in ipa-join
Also remove dead code in ipa-join and add initializer to a variable in
ipa-getkeytab to prevent false positives in static code analysis.

https://fedorahosted.org/freeipa/ticket/4651

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-05 15:28:27 +01:00
Jan Cholasta
4e49f39e1a Fix memory leak in ipa-pwd-extop
Also remove dead code and explicitly mark an ignored return value to prevent
false positives in static code analysis.

https://fedorahosted.org/freeipa/ticket/4651

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-05 15:28:27 +01:00
Jan Cholasta
9062dcada4 Fix various bugs in ipa-opt-counter and ipa-otp-lasttoken
Fixes a wrong sizeof argument and unchecked return values.

https://fedorahosted.org/freeipa/ticket/4651

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-11-05 15:28:27 +01:00