summaryrefslogtreecommitdiffstats
path: root/ipalib/util.py
Commit message (Collapse)AuthorAgeFilesLines
* Fill new DNS zone update policy by defaultMartin Kosek2012-06-051-4/+25
| | | | | | | | | | | | For security reasons, dynamic updates are not enabled for new DNS zones. In order to enable the dynamic zone securely, user needs to allow dynamic updates and create a zone update policy. The policy is not easy to construct for regular users, we should rather fill it by default and let users just switch the policy on or off. https://fedorahosted.org/freeipa/ticket/2441
* Replace DNS client based on acutil with python-dnsMartin Kosek2012-05-241-7/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | IPA client and server tool set used authconfig acutil module to for client DNS operations. This is not optimal DNS interface for several reasons: - does not provide native Python object oriented interface but but rather C-like interface based on functions and structures which is not easy to use and extend - acutil is not meant to be used by third parties besides authconfig and thus can break without notice Replace the acutil with python-dns package which has a feature rich interface for dealing with all different aspects of DNS including DNSSEC. The main target of this patch is to replace all uses of acutil DNS library with a use python-dns. In most cases, even though the larger parts of the code are changed, the actual functionality is changed only in the following cases: - redundant DNS checks were removed from verify_fqdn function in installutils to make the whole DNS check simpler and less error-prone. Logging was improves for the remaining checks - improved logging for ipa-client-install DNS discovery https://fedorahosted.org/freeipa/ticket/2730 https://fedorahosted.org/freeipa/ticket/1837
* Remove duplicate and unused utility codePetr Viktorin2012-05-091-47/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | IPA has some unused code from abandoned features (Radius, ipa 1.x user input, commant-line tab completion), as well as some duplicate utilities. This patch cleans up the utility modules. Duplicate code consolidated into ipapython.ipautil: {ipalib.util,ipaserver.ipautil,ipapython.ipautil}.realm_to_suffix {ipaserver,ipapython}.ipautil.CIDict (with style improvements from the ipaserver version) {ipapython.entity,ipaserver.ipautil}.utf8_encode_value {ipapython.entity,ipaserver.ipautil}.utf8_encode_values ipalib.util.get_fqdn was removed in favor of the same function in ipaserver.install.installutils Removed unused code: ipalib.util: load_plugins_in_dir import_plugins_subpackage make_repr (was imported but unused; also removed from tests) ipapython.ipautil: format_list parse_key_value_pairs read_pairs_file read_items_file user_input_plain AttributeValueCompleter ItemCompleter ipaserver.ipautil: get_gsserror (a different version exists in ipapython.ipautil) ipaserver.ipautil ended up empty and is removed entirely. https://fedorahosted.org/freeipa/ticket/2650
* Improve error message in zonemgr validatorMartin Kosek2012-04-291-18/+22
| | | | | | | | | This patch consolidates zonemgr function to move the most of the checks to common functions in order to provide consistent output. The error messages produced by the validator should now be more helpful when identifying the source of error. https://fedorahosted.org/freeipa/ticket/1966
* Validate DN & RDN parameters for migrate commandJohn Dennis2012-04-161-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ticket #2555 We were generating a traceback (server error) if a malformed RDN was passed as a parameter to the migrate command. * add parameter validation functions validate_dn_param() and validate_rdn_param() to ipalib.util. Those functions simply invoke the DN or RDN constructor from our dn module passing it the string representation. If the constructor does not throw an error it's valid. * Add the parameter validation function pointers to the Param objects in the migrate command. * Make the usercontainer and groupcontainer parameters required. passing --usercontainer= on the command line will produce ipa: ERROR: 'user_container' is required * Fix _get_search_bases() so if a container dn is empty it it just uses the base dn alone instead of faulting (currently bullet-proofing because now the containers are required). * Update the doc for usercontainer and groupcontainer to reflect the fact they are DN's not RDN's. A RDN can only be one level and it should be possible to have a container more than one RDN removed from the base.
* Netgroup nisdomain and hosts validationOndrej Hamada2012-03-281-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | nisdomain validation: Added pattern to the 'nisdomain' parameter to validate the specified nisdomain name. According to most common use cases the same pattern as for netgroup should fit. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2448 'add_external_pre_callback' function was created to allow validation of all external members. Validation is based on usage of objects primary key parameter. The 'add_external_pre_callback' fucntion has to be called directly from in the 'pre_callback' function. This change affects netgroup, hbacrule and sudorule commands. For hostname, the validator allows non-fqdn and underscore characters. validate_hostname function in ipalib.util was modified and contains additional option that allows hostname to contain underscore characters. This option is disabled by default. Unit-tests added. https://fedorahosted.org/freeipa/ticket/2447
* Improve hostname and domain name validationMartin Kosek2012-02-291-10/+37
| | | | | | | | | | | | | | | DNS plugin did not check DNS zone and DNS record validity and user was thus able to create domains like "foo bar" or other invalid DNS labels which would really confuse both user and bind-dyndb-ldap plugin. This patch at first consolidates hostname/domain name validators so that they use common functions and we don't have regular expressions and other checks defined in several places. These new cleaned validators are then used for zone/record name validation. https://fedorahosted.org/freeipa/ticket/2384
* Add SSHFP update policy for existing zonesMartin Kosek2012-02-271-0/+18
| | | | | | | | | | | | | SSH public key support includes a feature to automatically add/update client SSH fingerprints in SSHFP records. However, the update won't work for zones created before this support was added as they don't allow clients to update SSHFP records in their update policies. This patch lets dns upgrade module extend the original policy to allow the SSHFP dynamic updates. It updates only original policy, we don't want it to overwrite custom user policies. https://fedorahosted.org/freeipa/ticket/2394
* Ease zonemgr restrictionsMartin Kosek2012-02-201-6/+3
| | | | | | | | | | | | Admin e-mail validator currently requires an email to be in a second-level domain (hostmaster@example.com). This is too restrictive. Top level domain e-mails (hostmaster@testrelm) should also be allowed. This patch also fixes default zonemgr value in help texts and man pages. https://fedorahosted.org/freeipa/ticket/2272
* Add support for SSH public keys to user and host objects.Jan Cholasta2012-02-131-0/+32
| | | | | | | | | | | This patch adds a new multivalue param "sshpubkey" for specifying SSH public keys to both user and host objects. The accepted value is base64-encoded public key blob as specified in RFC4253, section 6.6. Additionaly, host commands automatically update DNS SSHFP records when requested by user. https://fedorahosted.org/freeipa/ticket/754
* add session manager and cache krb authJohn Dennis2012-02-091-0/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a session manager and support for caching authentication in the session. Major elements of the patch are: * Add a session manager to support cookie based sessions which stores session data in a memcached entry. * Add ipalib/krb_utils.py which contains functions to parse ccache names, format principals, format KRB timestamps, and a KRB_CCache class which reads ccache entry and allows one to extract information such as the principal, credentials, credential timestamps, etc. * Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so that all kerberos items are co-located. * Modify javascript in ipa.js so that the IPA.command() RPC call checks for authentication needed error response and if it receives it sends a GET request to /ipa/login URL to refresh credentials. * Add session_auth_duration config item to constants.py, used to configure how long a session remains valid. * Add parse_time_duration utility to ipalib/util.py. Used to parse the session_auth_duration config item. * Update the default.conf.5 man page to document session_auth_duration config item (also added documentation for log_manager config items which had been inadvertantly omitted from a previous commit). * Add SessionError object to ipalib/errors.py * Move Kerberos protection in Apache config from /ipa to /ipa/xml and /ipa/login * Add SessionCCache class to session.py to manage temporary Kerberos ccache file in effect for the duration of an RPC command. * Adds a krblogin plugin used to implement the /ipa/login handler. login handler sets the session expiration time, currently 60 minutes or the expiration of the TGT, whichever is shorter. It also copies the ccache provied by mod_auth_kerb into the session data. The json handler will later extract and validate the ccache belonging to the session. * Refactored the WSGI handlers so that json and xlmrpc could have independent behavior, this also moves where create and destroy context occurs, now done in the individual handler rather than the parent class. * The json handler now looks up the session data, validates the ccache bound to the session, if it's expired replies with authenicated needed error. * Add documentation to session.py. Fully documents the entire process, got questions, read the doc. * Add exclusions to make-lint as needed.
* Refactor dnsrecord processingMartin Kosek2012-01-121-6/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current DNS record processing architecture has many flaws, including custom execute() methods which does not take advantage of base LDAP commands or nonstandard and confusing DNS record option processing. This patch refactors DNS record processing with the following improvements: * Every DNS record has now own Parameter type. Each DNS record consists from one or more "parts" which are also Parameters. This architecture will enable much easier implementation of future per-DNS-type API. * Validation is now not written as a separate function for every parameter but is delegated to DNS record parts. * Normalization is also delegated to DNS record parts. * Since standard LDAP base commands execute method is now used, dnsrecord-add and dnsrecord-mod correctly supports --setattr and --addattr options. * In order to prevent confusion unsupported DNS record types are now hidden. They are still present in the plugin so that old clients receive proper validation error. The patch also contains several fixes: * Fix domain-name validation and normalization- allow domain names that are not fully qualified. For example --cname-rec=bar is a valid domain-name for bind which will translate it then as bar.<owning-domain>. This change implies, that fully qualified domain names must end with '.'. * Do not let user accidentally remove entire zone with command "ipa dnsrecord-del @ --del-all". * Fix --ttl and --class option processing in dnsrecord-add and dnsrecord-mod. All API changes are compatible with clients without this patch. https://fedorahosted.org/freeipa/ticket/2082
* Fix attempted write to attribute of read-only object.Jan Cholasta2012-01-021-0/+34
| | | | | | | | | Add new class "cachedproperty" for creating property-like attributes that cache the return value of a method call. Also fix few issues in the unit tests to enable them to succeed. ticket 1959
* Improve zonemgr validator and normalizerMartin Kosek2011-11-291-10/+40
| | | | | | | | | | The validator has been improved to support better both SOA format (e-mail address in a domain name format, without '@') and standard e-mail format. Allow '\.' character in a SOA format encoding the standard '.' in the local-part of an e-mail. Normalization code has been moved to one common function. https://fedorahosted.org/freeipa/ticket/2053
* ticket 2022 - modify codebase to utilize IPALogManager, obsoletes loggingJohn Dennis2011-11-231-8/+0
| | | | | | | | | | | | change default_logger_level to debug in configure_standard_logging add new ipa_log_manager module, move log_mgr there, also export root_logger from log_mgr. change all log_manager imports to ipa_log_manager and change log_manager.root_logger to root_logger. add missing import for parse_log_level()
* Improve DNS record data validationMartin Kosek2011-11-101-0/+17
| | | | | | | | | | | | | Implement missing validators for DNS RR types so that we can capture at least basic user errors. Additionally, a normalizer creating a fully-qualified domain name has been implemented for several RRs where name server may mis-interpret the domain name otherwise. Unit tests exercising these new validators for the most common RR types have been added. This patch also consolidates hard-coded values in DNS test to one place. https://fedorahosted.org/freeipa/ticket/1106
* Add --zonemgr/--admin-mail validatorMartin Kosek2011-10-261-0/+30
| | | | | | | | | | | Do at least a basic validation of DNS zone manager mail address. Do not require '@' to be in the mail address as the SOA record stores this value without it and people may be used to configure it that way. '@' is always removed by the installer/dns plugin before the DNS zone is created. https://fedorahosted.org/freeipa/ticket/1966
* Make data type of certificates more obvious/predictable internally.Rob Crittenden2011-06-211-0/+18
| | | | | | | | | | | | | | | | | | | For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
* Change FreeIPA license to GPLv3+Jakub Hrozek2010-12-201-5/+5
| | | | | | | | | | The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
* Add ability to add/remove DNS records when adding/removing a host entry.Rob Crittenden2010-11-231-0/+15
| | | | | | | | | | | | | | | | | | A host in DNS must have an IP address so a valid IP address is required when adding a host. The --force flag will be needed too since you are adding a host that isn't in DNS. For IPv4 it will create an A and a PTR DNS record. IPv6 isn't quite supported yet. Some basic work in the DNS installer is needed to get this working. Once the get_reverse_zone() returns the right value then this should start working and create an AAAA record and the appropriate reverse entry. When deleting a host with the --updatedns flag it will try to remove all records it can find in the zone for this host. ticket 238
* Accept an incoming certificate as either DER or base64 in the service plugin.Rob Crittenden2010-10-081-0/+22
| | | | | | | | | | | | | The plugin required a base64-encoded certificate and always decoded it before processing. This doesn't work with the UI because the json module decodes binary values already. Try to detect if the incoming value is base64-encoded and decode if necessary. Finally, try to pull the cert apart to validate it. This will tell us for sure that the data is a certificate, regardless of the format it came in as. ticket 348
* Remove some additional instances of krbV from ipa-clientRob Crittenden2010-09-101-1/+4
| | | | | | | | | | | Make two krbV imports conditional. These aren't used during a client install so should cause no problems. Also fix the client installer to use the new env option in ipautil.run. We weren't getting the krb5 configuration set in the environment because we were overriding the environment to set the PATH. ticket 136
* Improve serialization to JSON.Pavel Zuna2010-08-121-1/+11
| | | | | | - Make it recursive. - Make Param classes serializable. - Take python native data types into account.
* Make LDAPObject classes JSON serializable.Pavel Zuna2010-08-121-0/+6
|
* Require that hosts be resolvable in DNS. Use --force to ignore warnings.Rob Crittenden2010-08-061-0/+16
| | | | | | | | | | | | | This also requires a resolvable hostname on services as well. I want people to think long and hard about adding things that aren't resolvable. The cert plugin can automatically create services on the user's behalf when issuing a cert. It will always set the force flag to True. We use a lot of made-up host names in the test system, all of which require the force flag now. ticket #25
* Removed util.add_global_options() and frontend.ApplicationJason Gerard DeRose2009-10-141-23/+0
|
* Rename errors2.py to errors.py. Modify all affected files.Pavel Zuna2009-04-231-2/+2
|
* Finish work replacing the errors module with errors2Rob Crittenden2009-04-201-12/+9
| | | | | | Once this is committed we can start the process of renaming errors2 as errors. I thought that combinig this into one commit would be more difficult to review.
* Utility function to get the local hostnameRob Crittenden2009-02-191-0/+11
|
* Implemented more elegant way for entire plugin module to be conditionally ↵Jason Gerard DeRose2009-02-171-3/+3
| | | | skipped; updated cert.py and ra.py modules to use this
* Removed depreciated xmlrpc_marshal() and xmlrpc_unmarshal() functionsJason Gerard DeRose2009-02-171-27/+0
|
* Remove some duplicated code that was moved to ipaserver and use it Remove ↵Rob Crittenden2009-02-061-0/+5
| | | | some unused files
* Started reworking CLI class into cli pluginJason Gerard DeRose2009-02-031-0/+1
|
* Removed depreciated rpc code from ipalib.util; removed corresponding unit ↵Jason Gerard DeRose2008-12-081-61/+0
| | | | tests in test_util
* Added test_util.test_round_trip() test that tests use of xmlrpc_wrap() and ↵Jason Gerard DeRose2008-11-201-1/+1
| | | | xmlrpc_unwrap() with dumps(), loads(); fixed a bug in xmlrpc_unwrap()
* Added util.xmlrpc_wrap(), util.xmlrpc_unwrap() functions an corresponding ↵Jason Gerard DeRose2008-11-191-0/+64
| | | | unit tests
* Added util.make_repr() function; added corresponding unit testsJason Gerard DeRose2008-11-131-0/+9
|
* Command.get_default() will now fill-in None for all missing non-required paramsJason Gerard DeRose2008-11-121-0/+6
|
* Added custom log formatter util.LogFormatter that makes the human-readable ↵Jason Gerard DeRose2008-10-311-0/+9
| | | | time stamp in UTC
* Logging formats are now env variables; added log_format_stderr_debug format ↵Jason Gerard DeRose2008-10-311-1/+0
| | | | used when env.debug is True
* Reoganized global option functionality to it is easy for any script to use ↵Jason Gerard DeRose2008-10-311-0/+22
| | | | the environment-related global options; lite-xmlrpc.py now uses same global options
* Logging is now configured in API.bootstrap(); removed depreciated ↵Jason Gerard DeRose2008-10-311-33/+0
| | | | util.configure_logging() function
* lite-xmlrpc.py now uses api.bootstrap() property, logs to api.loggerJason Gerard DeRose2008-10-281-2/+1
|
* util.configure_logging() now only configures file logging if it can create ↵Jason Gerard DeRose2008-10-281-5/+7
| | | | the log_dir
* Added util.configure_logging() function; API.bootstrap() now calls ↵Jason Gerard DeRose2008-10-281-1/+35
| | | | util.configure_logging()
* Copied plugin loading function from load_plugins.py to util.py; ↵Jason Gerard DeRose2008-10-271-0/+51
| | | | API.load_plugins() method now calls functions in util
* Implement the host commandsRob Crittenden2008-10-221-0/+9
| | | | | In order for this to work against a v1 database the update host.update needs to be applied
* Added ipalib/util.py with xmlrpc_marshal() and xmlrpc_unmarshal() functions; ↵Jason Gerard DeRose2008-10-021-0/+41
| | | | added corresponding unit tests
* 132: Removed test util.py fileJason Gerard DeRose2008-08-131-57/+0
|
* 125: Added some generic auto-import stuffJason Gerard DeRose2008-08-131-0/+57
generated by cgit (git 2.34.1) at 2024-05-26 06:21:02 +0000