summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ipalib/errors.py16
-rw-r--r--ipalib/plugins/cert.py2
-rw-r--r--ipalib/plugins/host.py8
-rw-r--r--ipalib/plugins/service.py20
-rw-r--r--ipalib/util.py16
-rw-r--r--tests/test_cmdline/test_ipagetkeytab.py4
-rw-r--r--tests/test_xmlrpc/test_cert.py2
-rw-r--r--tests/test_xmlrpc/test_hbac_plugin.py6
-rw-r--r--tests/test_xmlrpc/test_host_plugin.py40
-rw-r--r--tests/test_xmlrpc/test_hostgroup_plugin.py1
-rw-r--r--tests/test_xmlrpc/test_netgroup_plugin.py2
-rw-r--r--tests/test_xmlrpc/test_service_plugin.py15
12 files changed, 99 insertions, 33 deletions
diff --git a/ipalib/errors.py b/ipalib/errors.py
index d1d39a378..c35d424a7 100644
--- a/ipalib/errors.py
+++ b/ipalib/errors.py
@@ -1054,6 +1054,22 @@ class DefaultGroupError(ExecutionError):
errno = 4018
format = _('The default users group cannot be removed')
+class DNSNotARecordError(ExecutionError):
+ """
+ **4019** Raised when a hostname is not a DNS A record
+
+ For example:
+
+ >>> raise DNSNotARecordError()
+ Traceback (most recent call last):
+ ...
+ DNSNotARecordError: Host does not have corresponding DNS A record
+
+ """
+
+ errno = 4019
+ format = _('Host does not have corresponding DNS A record')
+
class BuiltinError(ExecutionError):
"""
**4100** Base class for builtin execution errors (*4100 - 4199*).
diff --git a/ipalib/plugins/cert.py b/ipalib/plugins/cert.py
index ed1d65ad2..8920cfe4f 100644
--- a/ipalib/plugins/cert.py
+++ b/ipalib/plugins/cert.py
@@ -269,7 +269,7 @@ class cert_request(VirtualCommand):
if not add:
raise errors.NotFound(reason="The service principal for this request doesn't exist.")
try:
- service = api.Command['service_add'](principal, **{})['result']
+ service = api.Command['service_add'](principal, **{'force': True})['result']
dn = service['dn']
except errors.ACIError:
raise errors.ACIError(info='You need to be a member of the serviceadmin role to add services')
diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py
index b42cbbcb7..78d4d5a02 100644
--- a/ipalib/plugins/host.py
+++ b/ipalib/plugins/host.py
@@ -84,7 +84,6 @@ def validate_host(ugettext, fqdn):
return _('Fully-qualified hostname required')
return None
-
class host(LDAPObject):
"""
Host object.
@@ -196,8 +195,15 @@ class host_add(LDAPCreate):
"""
msg_summary = _('Added host "%(value)s"')
+ takes_options = (
+ Flag('force',
+ doc=_('force host name even if not in DNS'),
+ ),
+ )
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
+ if not options.get('force', False):
+ util.validate_host_dns(self.log, keys[-1])
if 'locality' in entry_attrs:
entry_attrs['l'] = entry_attrs['locality']
del entry_attrs['locality']
diff --git a/ipalib/plugins/service.py b/ipalib/plugins/service.py
index 392ae60eb..ac949b788 100644
--- a/ipalib/plugins/service.py
+++ b/ipalib/plugins/service.py
@@ -60,7 +60,7 @@ EXAMPLES:
"""
import base64
-from ipalib import api, errors
+from ipalib import api, errors, util
from ipalib import Str, Flag, Bytes
from ipalib.plugins.baseldap import *
from ipalib import x509
@@ -183,19 +183,11 @@ class service_add(LDAPCreate):
entry_attrs['usercertificate'] = base64.b64decode(cert)
# FIXME: shouldn't we request signing at this point?
- # TODO: once DNS client is done (code below for reference only!)
- # if not kw['force']:
- # fqdn = hostname + '.'
- # rs = dnsclient.query(fqdn, dnsclient.DNS_C_IN, dnsclient.DNS_T_A)
- # if len(rs) == 0:
- # self.log.debug(
- # 'IPA: DNS A record lookup failed for '%s'" % hostname
- # )
- # raise ipaerror.gen_exception(ipaerror.INPUT_NOT_DNS_A_RECORD)
- # else:
- # self.log.debug(
- # 'IPA: found %d records for '%s'" % (len(rs), hostname)
- # )
+ if not options.get('force', False):
+ # We know the host exists if we've gotten this far but we
+ # really want to discourage creating services for hosts that
+ # don't exist in DNS.
+ util.validate_host_dns(self.log, hostname)
return dn
diff --git a/ipalib/util.py b/ipalib/util.py
index 76be9a6d7..570d66e00 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -28,6 +28,7 @@ import time
import krbV
import socket
from ipalib import errors
+from ipapython import dnsclient
def get_current_principal():
@@ -113,3 +114,18 @@ def realm_to_suffix(realm_name):
s = realm_name.split(".")
terms = ["dc=" + x.lower() for x in s]
return ",".join(terms)
+
+def validate_host_dns(log, fqdn):
+ """
+ See if the hostname has a DNS A record.
+ """
+ rs = dnsclient.query(fqdn + '.', dnsclient.DNS_C_IN, dnsclient.DNS_T_A)
+ if len(rs) == 0:
+ log.debug(
+ 'IPA: DNS A record lookup failed for %s' % fqdn
+ )
+ raise errors.DNSNotARecordError()
+ else:
+ log.debug(
+ 'IPA: found %d records for %s' % (len(rs), fqdn)
+ )
diff --git a/tests/test_cmdline/test_ipagetkeytab.py b/tests/test_cmdline/test_ipagetkeytab.py
index 5c9d58cd8..2c51102e9 100644
--- a/tests/test_cmdline/test_ipagetkeytab.py
+++ b/tests/test_cmdline/test_ipagetkeytab.py
@@ -70,7 +70,7 @@ class test_ipagetkeytab(cmdline_test):
"""
# Create the service
try:
- api.Command['host_add'](self.host_fqdn)
+ api.Command['host_add'](self.host_fqdn, force=True)
except errors.DuplicateEntry:
# it already exists, no problem
pass
@@ -93,7 +93,7 @@ class test_ipagetkeytab(cmdline_test):
"""
# Create the service
try:
- api.Command['service_add'](self.service_princ)
+ api.Command['service_add'](self.service_princ, force=True)
except errors.DuplicateEntry:
# it already exists, no problem
pass
diff --git a/tests/test_xmlrpc/test_cert.py b/tests/test_xmlrpc/test_cert.py
index 5d594891e..9ea1744a0 100644
--- a/tests/test_xmlrpc/test_cert.py
+++ b/tests/test_xmlrpc/test_cert.py
@@ -101,7 +101,7 @@ class test_cert(XMLRPC_test):
This should fail because the service principal doesn't exist
"""
# First create the host that will use this policy
- res = api.Command['host_add'](self.host_fqdn)['result']
+ res = api.Command['host_add'](self.host_fqdn, force= True)['result']
csr = unicode(self.generateCSR(self.subject))
try:
diff --git a/tests/test_xmlrpc/test_hbac_plugin.py b/tests/test_xmlrpc/test_hbac_plugin.py
index cc6e2f55b..d90837417 100644
--- a/tests/test_xmlrpc/test_hbac_plugin.py
+++ b/tests/test_xmlrpc/test_hbac_plugin.py
@@ -149,19 +149,19 @@ class test_hbac(XMLRPC_test):
self.test_group, description=u'description'
)
self.failsafe_add(api.Object.host,
- self.test_host
+ self.test_host, force=True
)
self.failsafe_add(api.Object.hostgroup,
self.test_hostgroup, description=u'description'
)
self.failsafe_add(api.Object.host,
- self.test_sourcehost
+ self.test_sourcehost, force=True
)
self.failsafe_add(api.Object.hostgroup,
self.test_sourcehostgroup, description=u'desc'
)
self.failsafe_add(api.Object.hbacsvc,
- self.test_service, description=u'desc'
+ self.test_service, description=u'desc', force=True
)
def test_8_hbac_add_user(self):
diff --git a/tests/test_xmlrpc/test_host_plugin.py b/tests/test_xmlrpc/test_host_plugin.py
index 7ae068c36..8c2224b58 100644
--- a/tests/test_xmlrpc/test_host_plugin.py
+++ b/tests/test_xmlrpc/test_host_plugin.py
@@ -32,12 +32,15 @@ short1 = u'testhost1'
dn1 = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn1, api.env.basedn)
service1 = u'dns/%s@%s' % (fqdn1, api.env.realm)
service1dn = u'krbprincipalname=%s,cn=services,cn=accounts,%s' % (service1.lower(), api.env.basedn)
+fqdn2 = u'shouldnotexist.%s' % api.env.domain
+dn2 = u'fqdn=%s,cn=computers,cn=accounts,%s' % (fqdn2, api.env.basedn)
class test_host(Declarative):
cleanup_commands = [
('host_del', [fqdn1], {}),
+ ('host_del', [fqdn2], {}),
('service_del', [service1], {}),
]
@@ -70,6 +73,7 @@ class test_host(Declarative):
dict(
description=u'Test host 1',
l=u'Undisclosed location 1',
+ force=True,
),
),
expected=dict(
@@ -94,6 +98,7 @@ class test_host(Declarative):
dict(
description=u'Test host 1',
localityname=u'Undisclosed location 1',
+ force=True,
),
),
expected=errors.DuplicateEntry(),
@@ -267,6 +272,7 @@ class test_host(Declarative):
dict(
description=u'Test host 1',
l=u'Undisclosed location 1',
+ force=True,
),
),
expected=dict(
@@ -286,7 +292,7 @@ class test_host(Declarative):
dict(
desc='Add a service to host %r' % fqdn1,
- command=('service_add', [service1], {}),
+ command=('service_add', [service1], {'force': True}),
expected=dict(
value=service1,
summary=u'Added service "%s"' % service1,
@@ -321,4 +327,36 @@ class test_host(Declarative):
),
),
+
+ dict(
+ desc='Try to add host not in DNS %r without force' % fqdn2,
+ command=('host_add', [fqdn2], {}),
+ expected=errors.DNSNotARecordError(reason='Host does not have corresponding DNS A record'),
+ ),
+
+
+ dict(
+ desc='Try to add host not in DNS %r with force' % fqdn2,
+ command=('host_add', [fqdn2],
+ dict(
+ description=u'Test host 2',
+ l=u'Undisclosed location 2',
+ force=True,
+ ),
+ ),
+ expected=dict(
+ value=fqdn2,
+ summary=u'Added host "%s"' % fqdn2,
+ result=dict(
+ dn=dn2,
+ fqdn=[fqdn2],
+ description=[u'Test host 2'],
+ l=[u'Undisclosed location 2'],
+ krbprincipalname=[u'host/%s@%s' % (fqdn2, api.env.realm)],
+ objectclass=objectclasses.host,
+ ipauniqueid=[fuzzy_uuid],
+ ),
+ ),
+ ),
+
]
diff --git a/tests/test_xmlrpc/test_hostgroup_plugin.py b/tests/test_xmlrpc/test_hostgroup_plugin.py
index 407d9ba14..70cbe3d45 100644
--- a/tests/test_xmlrpc/test_hostgroup_plugin.py
+++ b/tests/test_xmlrpc/test_hostgroup_plugin.py
@@ -99,6 +99,7 @@ class test_hostgroup(Declarative):
dict(
description=u'Test host 1',
l=u'Undisclosed location 1',
+ force=True,
),
),
expected=dict(
diff --git a/tests/test_xmlrpc/test_netgroup_plugin.py b/tests/test_xmlrpc/test_netgroup_plugin.py
index 3363883ae..3c1fc34dc 100644
--- a/tests/test_xmlrpc/test_netgroup_plugin.py
+++ b/tests/test_xmlrpc/test_netgroup_plugin.py
@@ -46,7 +46,7 @@ class test_netgroup(XMLRPC_test):
host_fqdn = u'ipatesthost.%s' % api.env.domain
host_description = u'Test host'
host_localityname = u'Undisclosed location'
- host_kw = {'fqdn': host_fqdn, 'description': host_description, 'localityname': host_localityname, 'raw': True}
+ host_kw = {'fqdn': host_fqdn, 'description': host_description, 'localityname': host_localityname, 'raw': True, 'force': True}
hg_cn = u'hg1'
hg_description = u'Netgroup'
diff --git a/tests/test_xmlrpc/test_service_plugin.py b/tests/test_xmlrpc/test_service_plugin.py
index 299c64fc1..96827e4c5 100644
--- a/tests/test_xmlrpc/test_service_plugin.py
+++ b/tests/test_xmlrpc/test_service_plugin.py
@@ -40,8 +40,8 @@ class test_service(XMLRPC_test):
"""
Test adding a HTTP principal using the `xmlrpc.service_add` method.
"""
- self.failsafe_add(api.Object.host, self.host)
- entry = self.failsafe_add(api.Object.service, self.principal)['result']
+ self.failsafe_add(api.Object.host, self.host, force=True)
+ entry = self.failsafe_add(api.Object.service, self.principal, force=True)['result']
assert_attr_equal(entry, 'krbprincipalname', self.principal)
assert_attr_equal(entry, 'objectclass', 'ipaobject')
@@ -50,11 +50,6 @@ class test_service(XMLRPC_test):
Test adding a host principal using `xmlrpc.service_add`. Host
services are not allowed.
"""
- # FIXME: Are host principals not allowed still? Running this test gives
- # this error:
- #
- # NotFound: The host 'ipatest.example.com' does not exist to add a service to.
-
kw = {'krbprincipalname': self.hostprincipal}
try:
api.Command['service_add'](**kw)
@@ -67,7 +62,7 @@ class test_service(XMLRPC_test):
"""
Test adding a malformed principal ('foo').
"""
- kw = {'krbprincipalname': u'foo'}
+ kw = {'krbprincipalname': u'foo', 'force': True}
try:
api.Command['service_add'](**kw)
except errors.MalformedServicePrincipal:
@@ -79,7 +74,7 @@ class test_service(XMLRPC_test):
"""
Test adding a malformed principal ('HTTP/foo@FOO.NET').
"""
- kw = {'krbprincipalname': u'HTTP/foo@FOO.NET'}
+ kw = {'krbprincipalname': u'HTTP/foo@FOO.NET', 'force': True}
try:
api.Command['service_add'](**kw)
except errors.RealmMismatch:
@@ -115,3 +110,5 @@ class test_service(XMLRPC_test):
pass
else:
assert False
+
+ api.Command['host_del'](self.host)
generated by cgit (git 2.34.1) at 2024-04-27 21:00:55 +0000