Remove root autobind search restriction, fix upgrade logging & error handling.

There was no point in limiting autobind root to just search cn=config since
it could always just modify its way out of the box, so remove the
restriction.

The upgrade log wasn't being created. Clearing all other loggers before
we calling logging.basicConfig() fixes this.

Add a global exception when performing updates so we can gracefully catch
and log problems without leaving the server in a bad state.

https://fedorahosted.org/freeipa/ticket/1243
https://fedorahosted.org/freeipa/ticket/1254

2 files changed, 21 insertions, 25 deletions

diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py
index d203f4f93..8d93a60b3 100644
--- a/ipaserver/install/installutils.py
+++ b/ipaserver/install/installutils.py
@@ -330,6 +330,8 @@ def update_file(filename, orig, subst):
 def set_directive(filename, directive, value, quotes=True, separator=' '):
     """Set a name/value pair directive in a configuration file.
 
+       A value of None means to drop the directive.
+
        This has only been tested with nss.conf
     """
     valueset = False
@@ -339,18 +341,20 @@ def set_directive(filename, directive, value, quotes=True, separator=' '):
     for line in fd:
         if directive in line:
             valueset = True
-            if quotes:
-                newfile.append('%s%s"%s"\n' % (directive, separator, value))
-            else:
-                newfile.append('%s%s%s\n' % (directive, separator, value))
+            if value is not None:
+                if quotes:
+                    newfile.append('%s%s"%s"\n' % (directive, separator, value))
+                else:
+                    newfile.append('%s%s%s\n' % (directive, separator, value))
         else:
             newfile.append(line)
     fd.close()
     if not valueset:
-        if quotes:
-            newfile.append('%s%s"%s"\n' % (directive, separator, value))
-        else:
-            newfile.append('%s%s%s\n' % (directive, separator, value))
+        if value is not None:
+            if quotes:
+                newfile.append('%s%s"%s"\n' % (directive, separator, value))
+            else:
+                newfile.append('%s%s%s\n' % (directive, separator, value))
 
     fd = open(filename, "w")
     fd.write("".join(newfile))
@@ -401,7 +405,7 @@ def wait_for_open_ports(host, ports, timeout=0):
 
     op_timeout = time.time() + timeout
     ipv6_failover = False
-    
+
     for port in ports:
         while True:
             try:
diff --git a/ipaserver/install/upgradeinstance.py b/ipaserver/install/upgradeinstance.py
index ad977b745..2f42358b7 100644
--- a/ipaserver/install/upgradeinstance.py
+++ b/ipaserver/install/upgradeinstance.py
@@ -21,6 +21,7 @@ import os
 import sys
 import shutil
 import random
+import logging
 
 from ipaserver.install import installutils
 from ipaserver.install import dsinstance
@@ -56,6 +57,7 @@ class IPAUpgrade(service.Service):
         self.files = files
         self.modified = False
         self.badsyntax = False
+        self.upgradefailed = False
 
     def create_instance(self):
         self.step("stopping directory server", self.stop)
@@ -75,41 +77,26 @@ class IPAUpgrade(service.Service):
                separator=':')
         security = installutils.get_directive(self.filename, 'nsslapd-security',
                    separator=':')
-        autobind = installutils.get_directive(self.filename,
-                   'nsslapd-ldapiautobind', separator=':')
-        searchbase = installutils.get_directive(self.filename,
-                   'nsslapd-ldapientrysearchbase', separator=':')
 
         self.backup_state('nsslapd-port', port)
         self.backup_state('nsslapd-security', security)
-        self.backup_state('nsslapd-ldapiautobind', autobind)
-        self.backup_state('nsslapd-ldapientrysearchbase', searchbase)
 
     def __restore_config(self):
         port = self.restore_state('nsslapd-port')
         security = self.restore_state('nsslapd-security')
-        autobind = self.restore_state('nsslapd-ldapiautobind')
-        searchbase = self.restore_state('nsslapd-ldapientrysearchbase')
 
         installutils.set_directive(self.filename, 'nsslapd-port',
             port, quotes=False, separator=':')
         installutils.set_directive(self.filename, 'nsslapd-security',
             security, quotes=False, separator=':')
-        installutils.set_directive(self.filename, 'nsslapd-ldapiautobind',
-            autobind, quotes=False, separator=':')
-        installutils.set_directive(self.filename,
-            'nsslapd-ldapientrysearchbase',
-            searchbase, quotes=False, separator=':')
 
     def __disable_listeners(self):
         installutils.set_directive(self.filename, 'nsslapd-port',
             0, quotes=False, separator=':')
         installutils.set_directive(self.filename, 'nsslapd-security',
             'off', quotes=False, separator=':')
-        installutils.set_directive(self.filename, 'nsslapd-ldapiautobind',
-            'on', quotes=False, separator=':')
         installutils.set_directive(self.filename, 'nsslapd-ldapientrysearchbase',
-            '', quotes=False, separator=':')
+            None, quotes=False, separator=':')
 
     def __upgrade(self):
         try:
@@ -120,6 +107,11 @@ class IPAUpgrade(service.Service):
         except ldapupdate.BadSyntax:
             self.modified = False
             self.badsyntax = True
+        except Exception, e:
+            # Bad things happened, return gracefully
+            self.modified = False
+            self.upgradefailed = True
+            logging.error('Upgrade failed with %s' % str(e))
 
 def main():
     if os.getegid() != 0: