In `ipapwd_get_cur_kvno()`, the `Slapi_ValueSet` obtained via
`slapi_attr_get_valueset()` was never freed. This function returns a
copy of the valueset that must be freed by the caller using
`slapi_valueset_free()`.
Add `slapi_valueset_free(svs)` before returning from the function.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_gen_hashes()`, when an error occurred after allocating output
parameters, `*ntvals` was freed but `*nthash` was not.
Add `slapi_ch_free_string(nthash)` to the error cleanup section.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_post_modadd()`, the `pwvals` array returned by
`ipapwd_setPasswordHistory()` was passed to `slapi_mods_add_mod_values()`
but never freed. The `slapi_mods_add_mod_values()` function makes a copy
of the values, so the original array still needs to be freed.
Add `ipapwd_free_slapi_value_array()` call in the cleanup section to
free the array.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_pre_add()` and `ipapwd_pre_mod()`, the `nt` string returned
by `ipapwd_gen_hashes()` was only freed when `is_smb` was true. When NT
hashes are generated for `is_ipant` entries but `is_smb` is false, the
`nt` string was leaked.
Free `nt`, `ntvals` and `svals` unconditionally.
Fix the error path in `ipapwd_pre_add()` where `nt` and `ntvals` were
leaked when `slapi_entry_attr_replace_sv()` failed for `svals`.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_pre_add()` and `ipapwd_pre_mod()`, `binddn` is obtained via
`slapi_pblock_get()` with SLAPI_CONN_DN which returns an allocated
string. This string was never freed after use.
Add `slapi_ch_free_string(&binddn)` calls after the bind DN is no longer
needed in both functions.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_pre_add()`, when processing password from entry extension,
`userpw` was reassigned without freeing the previous value.
Additionally, `enabled` obtained from `ipapwd_getIpaConfigAttr()` was
never freed, and early returns bypassed the cleanup section causing
memory leaks.
Free `userpw` before reassigning it.
Free `enabled` after use.
Replace early `return 0` statements with `goto done` to ensure proper
cleanup of all allocated resources.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In `ipapwd_chpwop()`, `ipapwd_setkeytab()`, and `ipapwd_getkeytab()`
functions, `bindDN`/`bind_dn` is obtained via `slapi_pblock_get()` with
SLAPI_CONN_DN which returns an allocated string. This string was never
freed in the cleanup sections of these functions.
Add `slapi_ch_free_string()` calls for the bind DN variables in the
`free_and_return` sections of all three functions.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Extend the EDNS test suite by, adding structured tests for DNS-over-TLS under a enforced policy with IPA and external CAs.
Tests:
TestDNSOverTLS_EnforcedPolicy_IPA_CA
TestDNSOverTLS_EnforcedPolicy_External_CA
Related: https://issues.redhat.com/browse/IDM-1524
Signed-off-by: PRANAV THUBE <pthube@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The base class MigrationTest installation sets up two
separate servers, each with their own DNS. The second
one (replica[0]) is the "new" IPA server and will migrate
data from the "old" one (master).
When manually running these tests in my own environment
they fail because the new server can't connect to the old
one because it doesn't have its IP address. This somehow
works in PR-CI. So add the master IP address on the replica
so it has a way to contact it.
Fixes: https://pagure.io/freeipa/issue/9884
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Sudhir Menon <sumenon@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
When dns is handles externaly and `--auto-reverse` is used to install
ipa-server, installation fails as
```
ipa: ERROR: stderr: Checking DNS domain testrelm.test., please wait ...
Checking DNS domain xx.xx.xx.in-addr.arpa., please wait ...
DNS zone xx.xx.xx.in-addr.arpa. already exists in DNS and is handled by server(s): ['xxx.', 'xxx.', 'xxx.', 'xxx.']
The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
```
Allow ipa-server install adding '--allow-zone-overlap' option for these
cases.
Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
The error only happens in developer mode (when mode=developer instead of
mode=production in /etc/ipa/default.conf). Using object.__setattr__ bypasses
normal attribute assignment which fails in developer mode when trying to set
the class attribute allow_empty_update on an instance.
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: PRANAV THUBE <pthube@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: PRANAV THUBE <pthube@redhat.com>
In `ipapwd_set_extradata` free `xdata` after it's not longer needed. It
was leaked because `slapi_value_new_berval()` makes a copy of the data.
In `ipapwd_free_slapi_value_array` free `svals` (caller's pointer)
instead of `sv` (local pointer).
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
In various code paths the `ctx` structure was freed, but not `ctx`
resources (`base_dn`, `nss_ctx`, `extdom_instance_counter`) which may
have been allocated.
Plugin didn't have SLAPI_PLUGIN_CLOSE_FN registered, so context was
never freed on server shutdown.
Related: https://pagure.io/freeipa/issue/9895
Signed-off-by: Viktor Ashirov <vashirov@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
There is a small bug in the server code that processes
the user-locked situation: while kinit reports `kinit:
Client's credentials have been revoked ...`, the code
expects `kinit: Clients credentials have been revoked ...`
(doesn't contain the apostrophe). By correcting the
message and adding the apostrophe the right message
should be displayed.
Fixes: https://pagure.io/freeipa/issue/9891
Signed-off-by: Carla Martinez <carlmart@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
When a trust was establish pre samba 4.23, the trust domain object
could contain ipanttrustattributes = 40 (LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)
and winbind would fail to restart after an upgrade to samba 4.23.
Add a test simulating the situation and calling ipa-server-upgrade
Related: https://pagure.io/freeipa/issue/9892
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
When a trust was established pre samba 4.23, the trust domain object
could contain ipanttrustattributes: 8 (LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)
This value prevents winbind restart.
The current code replaces 0 with LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
but should also handle the case for LSA_TRUST_ATTRIBUTE_WITHIN_FOREST.
In this case we should drop the bit and replace it by FOREST_TRANSITIVE
one because otherwise Samba will skip the domain. Do not change the LDAP
representation to allow older replicas to continue operations.
Fixes: https://pagure.io/freeipa/issue/9892
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
The test is moving the date in the future to simulate CA certificate
expiration, then uninstalls the server. If certmonger is working,
the uninstaller may fail with a Dbus Exception.
The test can be fixed with the same strategy as other tests changing
the date: stop certmonger and remove the tracking requests before
uninstallation.
Fixes: https://pagure.io/freeipa/issue/9888
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
If dnsconfd is kept enabled after we are done configuring Unbound for the
encrypted DNS setup, it might overwrite the configuration,
resulting in a broken setup. dnsconfd should be disabled prior to
configuring Unbound during the server/client install process.
Fixes: https://pagure.io/freeipa/issue/9859
Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
In some user agents (e.g. Chrome on Windows) after negotiation of
Kerberos auth fails the agent will try negotiating NTML auth. This
will not work but may prompt http basic auth popups before showing the
html login form, confusing the users.
To circumvent this problem mod_auth_gssapi added the option
GssapiNegotiateOnce, sending the negotiate header only once.
References:
[1] Discussion in mod_auth_gssapi:
https://github.com/gssapi/mod_auth_gssapi/discussions/293
Fixes: https://pagure.io/freeipa/issue/5614
Signed-off-by: Finn Krein-Schuch <finn.krein-schuch@sva.de>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
The hostname "localhost" was harcoded in pki_issue_certificate.
This worked for installations, even without a CA, because this
wasn't called for issuing those certificates.
It fails with ipa-pkinit-enable on a server without a CA because
only attempted the local server which lacks a CA.
Instead detect the CA based on the local capabilities and the
server list of available CAs, preferring the local server if it
has a CA.
Fixes: https://pagure.io/freeipa/issue/9879
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
With the changes related to PKI API, a different error message is
returned when PKI is not reachable.
This breaks the test test_ipahealthcheck_dogtag_ca_connectivity_check.
Update the expected error message.
Fixes: https://pagure.io/freeipa/issue/9881
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
In recent kdcproxy commit 1773f28eeea72ec6efcd433d3b66595c44d1253f, the
use of DNS discovery has been restricted to declared realms in order to
mitigate CVE-2025-59088. The present commit update the
TestHttpKdcProxy::test_ad_user_login_on_client_with_kdcproxy test to
take this change into account.
Signed-off-by: Julien Rische <jrische@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The test test_fips.py::TestInstallFIPS::test_dnssec is failing and
the issue is reported upstream at 9785.
Mark the test as xfail for now.
Related: https://pagure.io/freeipa/issue/9785
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
In FIPS mode, ipa server installation fails in a call to
openssl pkcs12 command because the PKCS12 MAC requires PKCS12KDF
which is not an approved FIPS algo.
The fix consists in passing the additional option -nomacver
Fixes: https://pagure.io/freeipa/issue/9878
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This is needed to avoid importing functions and static values
from cainstance.py and krainstance.py. Both import dsinstance.py
which imports lib389 and initializes things that don't work
well within the server API.
They are moved to installutils and ipalib.constants to be more
centralized and reduce imports.
Related: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Since renewal now occurs through IPA and not directly via
the CA, restrict the CA profiles to only those certificates
we know about and expect.
The RA Agent cert and the subsystem cert share the same profile
so there is another hoop to jump through in validating that
the subjects are valid and expected.
Since the code runs as ipaapi it does not have access to check
the run status of DS so skip in that case. If it fails, it fails.
Contributions from Fraser Tweedale <ftweedal@redhat.com>
Fixes: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Two test were failing because the order within the result
keys changed. We shouldn't rely on order so sort the result
and compare that.
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
The updated certmonger supports the --json-api flag used
to signal that all requests go through the IPA API.
The updated PKI packages provide fixes for the python API
so that all CA requests can be directed through that instead
of using the REST API directly.
Related: https://pagure.io/freeipa/issue/9738
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Viktor Ashirov
PRANAV THUBE
Rob Crittenden
Mohammad Rizwan
MOHAMMAD SAMI
Anuja More
Carla Martinez
Florence Blanc-Renaud
Antonio Torres
Finn Krein-Schuch
Rafael Guterres Jeffman
Arif Budiman
Julien Rische
Sumedh Sidhaye