freeipa.git/ipapython/dnssec, branch master

Fix minor typos

2016-06-20T11:49:32+00:00

Reviewed-By: Martin Basti

Cosmetic changes to the code

2016-02-24T08:21:30+00:00

Fixes some Coverity issues

ipadiscovery.py:          added assert should universe break
plugins/dns.py:           removed dead code
dnssec/ldapkeydb.py:      attribute assert in the proper object
test_automount_plugin.py: fixed possible close() on None
xmlrpc_test.py:           Coverity does not like accessing None.__class__

https://fedorahosted.org/freeipa/ticket/5661

Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti

ipapython: port p11helper C code to Python

2016-01-21T09:21:32+00:00

This replaces the binary _ipap11helper module with cffi-based Python code.

https://fedorahosted.org/freeipa/ticket/5596

Reviewed-By: Martin Basti

Use print_function future definition wherever print() is used

2016-01-20T10:59:21+00:00

Pylint considers `print` a statement if the __future__ import is
not present, even if it's used like a function with one argument.

Add the __future__ import to files `pylint --py3k` complains about.

https://fedorahosted.org/freeipa/ticket/5623

Reviewed-By: Jan Cholasta 
Reviewed-By: Martin Basti

DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removal

2016-01-07T13:13:23+00:00

Command "ldap-cleanup " is called to remove all key metadata from
LDAP. This command is now called when disabling DNSSEC on a DNS zone. The stale
metadata were causing problems when re-enabling DNSSEC on the same zone.

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti

DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP

2016-01-07T13:13:23+00:00

This filtering is useful in cases where LDAP contains DNS zones which
have old metadata objects and DNSSEC disabled. Such zones must be
ignored to prevent errors while calling dnssec-keyfromlabel or rndc.

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti

DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP

2016-01-07T13:13:23+00:00

Key purging has to be only only after key metadata purging so
ipa-dnskeysyncd on replices does not fail while dereferencing
non-existing keys.

https://fedorahosted.org/freeipa/ticket/5334

Reviewed-By: Martin Basti

DNSSEC: add debug mode to ldapkeydb.py

2016-01-07T13:13:23+00:00

ldapkeydb.py can be executed directly now. In that case it will print
out key metadata as obtained using IPA LDAP API.

Kerberos credential cache has to be filled with principal posessing
appropriate access rights before the script is execured.

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti

DNSSEC: remove obsolete TODO note

2016-01-07T13:13:23+00:00

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti

DNSSEC: Make sure that current key state in LDAP matches key state in BIND

2016-01-07T13:13:23+00:00

We have to explicitly specify "none" value to prevent dnssec-keyfromlabel
utility from using current time for keys without "publish" and "activate"
timestamps.

Previously this lead to situation where key was in (intermediate) state
"generated" in OpenDNSSEC but BIND started to use this key for signing.

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti