freeipa.git/ipapython, branch coverity

Use copy when replacing files to keep SELinux context

2016-07-22T14:46:55+00:00

When installer replaces any file with newer, it must use 'copy' instead of
'mv' to keep SELinux context valid.

https://fedorahosted.org/freeipa/ticket/6111

Reviewed-By: Petr Spacek

Fix session cookies

2016-07-22T14:30:32+00:00

The CLI was not using session cookies for communication with IPA API.
The kernel_keyring code was expecting the keyname to be a string, but
in python 2 a unicode was supplied (the key is built using
ipa_session_cookie:%principal and principal is a unicode).

The patch fixes the assertions, allowing to store and retrieve the cookie.
It also adds a test with unicode key name.

https://fedorahosted.org/freeipa/ticket/5984

Reviewed-By: Petr Spacek

Create server and host certs with DNS altname

2016-07-19T12:18:04+00:00

Currently server (HTTP / LDAP) certs are created without a Subject
Alternative Name extension during server install, replica prepare
and host enrolment, a potentially problematic violation of RFC 2818.

Add the hostname as a SAN dNSName when these certs are created.

(Certmonger adds an appropriate request extension when renewing the
certificate, so nothing needs to be done for renewal).

Fixes: https://fedorahosted.org/freeipa/ticket/4970
Reviewed-By: Petr Spacek

Fix internal errors in host-add and other commands caused by DNS resolution

2016-07-01T08:35:39+00:00

Previously resolver was returning CheckedIPAddress objects. This
internal server error in cases where DNS actually returned reserved IP
addresses.

Now the resolver is returning UnsafeIPAddress objects which do syntactic
checks but do not filter IP addresses.

From now on we can decide if some IP address should be accepted as-is or
if it needs to be contrained to some subset of IP addresses using
CheckedIPAddress class.

This regression was caused by changes for
https://fedorahosted.org/freeipa/ticket/5710

Reviewed-By: Martin Basti

Remove unused is_local(), interface, and defaultnet from CheckedIPAddress

2016-07-01T08:35:39+00:00

All these were unused so I'm removing them to keep the code clean and
easier to read. At this point it is clear that only difference between
netaddr.IPAddress and CheckedIPAddress is prefixlen attribute.

Reviewed-By: Martin Basti

ipalib: introduce Principal parameter

2016-07-01T07:37:25+00:00

This patch introduces a separate Principal parameter that allows the framework
to syntactically validate incoming/outcoming principals by using a single
shared codebase.

https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka 
Reviewed-By: Jan Cholasta

ipapython module for Kerberos principal manipulation and parsing

2016-07-01T07:37:25+00:00

This module implements a shared codebase to handle various types of Kerberos
principal names encountered during management of users, hosts nad services.
Common codebase aims to replace various ad-hoc functions and routines
scattered along the management framework.

https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka 
Reviewed-By: Jan Cholasta

Do not allow installation in FIPS mode

2016-06-29T14:17:27+00:00

https://fedorahosted.org/freeipa/ticket/5761

Reviewed-By: Martin Basti 
Reviewed-By: Rob Crittenden

Use NSS for name->resolution in IPA installer

2016-06-29T12:19:59+00:00

This fixes scenarios where IPA server is not able to resolve own name
and option --ip-address was not specified by the user.

This partially reverts changes from commit
dc405005f537cf278fd6ddfe6b87060bd13d9a67

https://fedorahosted.org/freeipa/ticket/5962

Reviewed-By: Martin Basti

ipaldap: turn LDAP filter utility functions into class methods

2016-06-29T06:52:29+00:00

The LDAP filter utilities do not use any instance attributes, so
collectively turn them into class methods to promote reuse.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta