summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Enable pylint unpacking-non-sequence checkMartin Basti2016-01-142-7/+6
| | | | | | | Enables check and marks occurences of runtime error in dcerpc.py as false positive. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Always verify we have a valid ldap context.Simo Sorce2016-01-131-0/+29
| | | | | | | | | | | LDAP calls just assert if an invalid (NULL) context is passed in, so we need to be sure we have a valid connection context before calling into LDAP APIs and fail outright if a context can't be obtained. https://fedorahosted.org/freeipa/ticket/5577 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use only AES enctypes by defaultSimo Sorce2016-01-132-13/+3
| | | | | | | | | | | | Remove des3 and arcfour from the defaults for new installs. NOTE: the ipasam/dcerpc code sill uses arcfour Signed-off-by: Simo Sorce <simo@redhat.com> Ticket: https://fedorahosted.org/freeipa/ticket/4740 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipatests: Make the A record for hosts in topology conditionalMilan Kubík2016-01-131-2/+9
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-csreplica-manage: remove extraneous ldap2 connectionMartin Babinsky2016-01-131-2/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5583 Reviewed-By: Martin Basti <mbasti@redhat.com>
* py3: Remove py3 incompatible exception handlingTomas Babej2016-01-133-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/5585 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* fix Py3 incompatible exception instantiation in replica install codeMartin Babinsky2016-01-131-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5585 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Do not decode HTTP reason phrase from DogtagFraser Tweedale2016-01-133-38/+36
| | | | | | | | | | | | | | The HTTP reason phrase sent by Dogtag is assumed to be encoded in UTF-8, but the encoding used by Tomcat is dependent on system locale, causing decode errors in some locales. The reason phrase is optional and will not be sent in a future version of Tomcat[1], so do not bother decoding and returning it. [1] https://github.com/apache/tomcat/commit/707ab1c77f3bc189e1c3f29b641506db4c8bce37 Fixes: https://fedorahosted.org/freeipa/ticket/5578 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipalib: assume version 2.0 when skip_version_check is enabledJan Cholasta2016-01-121-2/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5601 Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests for package version comparisonMartin Babinsky2016-01-121-0/+51
| | | | | | | | | | These tests will ensure that our package version handling code can correctly decide when to upgrade IPA master. https://fedorahosted.org/freeipa/ticket/5572 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Don't error when find_base() fails if a base is not requiredNathaniel McCallum2016-01-121-4/+5
| | | | | | | | | We always have to call find_base() in order to force libldap to open the socket. However, if no base is actually required then there is no reason to error out if find_base() fails. This condition can arise when anonymous binds are disabled. Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC CI: add missing ldns-utils dependencyMartin Basti2016-01-121-0/+2
| | | | Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* DNSSEC test: fix adding zones with --skip-overlap-checkMartin Basti2016-01-121-5/+12
| | | | | | | In DNSSEC tests the root zone has to be created, this requires to use --skip-overlap-check to work properly. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* use FFI call to rpmvercmp function for version comparisonMartin Babinsky2016-01-112-33/+13
| | | | | | | | | | | | | Stop using rpm-python to compare package versions since the implicit NSS initialization upon the module import breaks NSS handling in IPA code. Call rpm-libs C-API function via CFFI instead. Big thanks to Martin Kosek <mkosek@redhat.com> for sharing the code snippet that spurred this patch. https://fedorahosted.org/freeipa/ticket/5572 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix: Use unattended parameter instead of options.unattendedDavid Kupka2016-01-111-1/+1
| | | | | | | | | Attribute 'unattended' is not always present in 'options' so function parameter 'unattended' should be used. https://fedorahosted.org/freeipa/ticket/5563 Reviewed-By: Martin Basti <mbasti@redhat.com>
* installer: Change reverse zones question to better reflect reality.David Kupka2016-01-111-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5563 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-replica-prepare: Add '--auto-reverse' and '--allow-zone-overlap' optionsDavid Kupka2016-01-111-0/+5
| | | | | | | | | Opiton should be added to ipa-replica-prepare when it was added to ipa-{server,replica,dns}-install but was forgotten. https://fedorahosted.org/freeipa/ticket/5563 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipatests: Fix configuration problems in dns testsMilan Kubík2016-01-111-2/+3
| | | | | | | revzone2 changed to unresolvable reverse zone test for root zone now supresses the overlap check Reviewed-By: Martin Basti <mbasti@redhat.com>
* Upgrade: Fix upgrade of NIS Server configurationMartin Basti2016-01-115-55/+129
| | | | | | | | | | | | | Former upgrade file always created the NIS Server container, that caused the ipa-nis-manage did not set all required NIS maps. Default creation of container has been removed. Updating of NIS Server configuration and NIS maps is done only if the NIS Server container exists. https://fedorahosted.org/freeipa/ticket/5507 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* prevent crash of CA-less server upgrade due to absent certmongerMartin Babinsky2016-01-111-2/+28
| | | | | | | | | | | | | ipa-server-upgrade tests whether certmonger service is running before attempting to upgrade IPA master. This causes the upgrader to always fail when there is no CA installer and certmonger is not needed, effectively preventing CA-less IPA master to upgrade succefuly. This test is now skipped if CA is not enabled. https://fedorahosted.org/freeipa/ticket/5519 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Allow to used mixed case for sysrestoreMartin Basti2016-01-082-3/+7
| | | | | | | | | | | | | This commit allows to use mixed case of keys for sysrestore, before this commit all keys were saved in lowercase what prevents to accesing them. Original usage of mixed case for sysretore key in opendssecinstance had to be changed to lowercase to prevent issues on already installed systems. https://fedorahosted.org/freeipa/ticket/5574 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix DNS zone overlap check to allow ipa-replica-install to workPetr Spacek2016-01-081-15/+19
| | | | | | https://fedorahosted.org/freeipa/ticket/5564 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix dns_is_enabled() API command to throw exceptions as appropriatePetr Spacek2016-01-081-6/+4
| | | | | | | | | | Previously the command returned False whenever an exception occured which caused installed to continue even when there was a problem with LDAP connection. https://fedorahosted.org/freeipa/ticket/5564 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix --auto-reverse option in --unattended mode.Petr Spacek2016-01-081-1/+2
| | | | | | | | | | | | | Now the option correctly adds missing reverse zones even in unattended mode. Still, this is not sufficient in all cases because 'automatic empty zones' created by BIND (as specified in RFC 6303) can shadow the reverse zones hosted on other servers. This needs to be solved in a separate patch. https://fedorahosted.org/freeipa/ticket/5559 Reviewed-By: David Kupka <dkupka@redhat.com>
* webui: pwpolicy cospriority field was marked as requiredPetr Vobornik2016-01-081-1/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5553 Reviewed-By: Martin Basti <mbasti@redhat.com>
* webui: add examples to network address validator error messagePetr Vobornik2016-01-082-2/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/5532 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* Fixed install_ca and install_kra under domain level 0Oleg Fayans2016-01-071-4/+24
| | | | | | Also added ipa_backup, ipa_restore and replica_uninstall functions Reviewed-By: Martin Basti <mbasti@redhat.com>
* update_uniqueness plugin: fix referenced before assigment errorMartin Basti2016-01-071-2/+2
| | | | | | | This error may potentially happen when plugin migration is skipped due an error. In that case variable 'update' was undefined. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* DNSSEC: Log debug messages at log level DEBUGPetr Spacek2016-01-071-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: ipa-dnskeysyncd: call ods-signer ldap-cleanup on zone removalPetr Spacek2016-01-071-0/+6
| | | | | | | | | | Command "ldap-cleanup <zone name>" is called to remove all key metadata from LDAP. This command is now called when disabling DNSSEC on a DNS zone. The stale metadata were causing problems when re-enabling DNSSEC on the same zone. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: ipa-ods-exporter: add ldap-cleanup commandPetr Spacek2016-01-071-12/+48
| | | | | | | | | | | | | | | Command "ldap-cleanup <zone name>" will remove all key metadata from LDAP. This can be used manually in sequence like: ldap-cleanup <zone name> update <zone name> to delete all key metadata from LDAP and re-export them from OpenDNSSEC. ldap-cleanup command should be called when disabling DNSSEC on a DNS zone to remove stale key metadata from LDAP. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAPPetr Spacek2016-01-072-9/+31
| | | | | | | | | | This filtering is useful in cases where LDAP contains DNS zones which have old metadata objects and DNSSEC disabled. Such zones must be ignored to prevent errors while calling dnssec-keyfromlabel or rndc. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAPPetr Spacek2016-01-072-18/+99
| | | | | | | | | | Key purging has to be only only after key metadata purging so ipa-dnskeysyncd on replices does not fail while dereferencing non-existing keys. https://fedorahosted.org/freeipa/ticket/5334 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: logging improvements in ipa-ods-exporterPetr Spacek2016-01-071-6/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: add debug mode to ldapkeydb.pyPetr Spacek2016-01-071-2/+52
| | | | | | | | | | | | ldapkeydb.py can be executed directly now. In that case it will print out key metadata as obtained using IPA LDAP API. Kerberos credential cache has to be filled with principal posessing appropriate access rights before the script is execured. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: remove obsolete TODO notePetr Spacek2016-01-071-1/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Make sure that current key state in LDAP matches key state in BINDPetr Spacek2016-01-071-1/+5
| | | | | | | | | | | | | We have to explicitly specify "none" value to prevent dnssec-keyfromlabel utility from using current time for keys without "publish" and "activate" timestamps. Previously this lead to situation where key was in (intermediate) state "generated" in OpenDNSSEC but BIND started to use this key for signing. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Make sure that current state in OpenDNSSEC matches key state in LDAPPetr Spacek2016-01-071-10/+95
| | | | | | | | | | | | | | | | | | | | | | | | Previously we published timestamps of planned state changes in LDAP. This led to situations where state transition in OpenDNSSEC was blocked by an additional condition (or unavailability of OpenDNSSEC) but BIND actually did the transition as planned. Additionally key state mapping was incorrect for KSK so sometimes KSK was not used for signing when it should. Example (for code without this fix): - Add a zone and let OpenDNSSEC to generate keys. - Wait until keys are in state "published" and next state is "inactive". - Shutdown OpenDNSSEC or break replication from DNSSEC key master. - See that keys on DNS replicas will transition to state "inactive" even though it should not happen because OpenDNSSEC is not available (i.e. new keys may not be available). - End result is that affected zone will not be signed anymore, even though it should stay signed with the old keys. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNSSEC: Improve error reporting from ipa-ods-exporterPetr Spacek2016-01-071-1/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Require Dogtag 10.2.6-13 to fix KRA uninstallChristian Heimes2016-01-061-2/+2
| | | | | | | | | | | | The combination of a bug in Dogtag's sslget command and a new feature in mod_nss causes an incomplete uninstallation of KRA. The bug has been fixed in Dogtag 10.2.6-13. https://fedorahosted.org/freeipa/ticket/5469 https://fedorahosted.org/pki/ticket/1704 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipalib/x509.py: revert deletion of ipalib api importMartin Babinsky2016-01-041-0/+1
| | | | | | | | | | | This import statement has been removed in commit e4075b1fe26a608cd1f3778ee1f655a5f5700c65. This caused requests for service certs to fail, since the validation functions from x509 module crashed with NameError. https://fedorahosted.org/freeipa/ticket/5561 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Enable pylint unnecessary-pass checkMartin Basti2015-12-2314-19/+2
| | | | | | Enables check and removes extra pass statement from code. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint empty-docstring checkMartin Basti2015-12-233-9/+0
| | | | | | | | | | | | | | Enables check and fixes: ************* Module ipalib.session ipalib/session.py:671: [C0112(empty-docstring), SessionAuthManager] Empty class docstring) ipalib/session.py:705: [C0112(empty-docstring), SessionAuthManager.logout] Empty method docstring) ************* Module ipalib.cli ipalib/cli.py:364: [C0112(empty-docstring), textui.print_entry] Empty method docstring) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint expression-not-assigned checkMartin Basti2015-12-236-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enables check and fixes: ************* Module ipa-replica-conncheck install/tools/ipa-replica-conncheck:150: [W0106(expression-not-assigned), parse_options] Expression "(replica_group.add_option('-w', '--password', dest='password', sensitive=True, help='Password for the principal'), )" is assigned to nothing) ************* Module ipatests.test_xmlrpc.test_automount_plugin ipatests/test_xmlrpc/test_automount_plugin.py:437: [W0106(expression-not-assigned), test_automount_indirect.test_1a_automountmap_add_indirect] Expression "api.Command['automountmap_add_indirect'](self.locname, self.mapname, **self.map_kw)['result']" is assigned to nothing) ************* Module ipatests.test_ipaserver.test_otptoken_import ipatests/test_ipaserver/test_otptoken_import.py:128: [W0106(expression-not-assigned), test_otptoken_import.test_mini] Expression "[(t.id, t.options) for t in doc.getKeyPackages()]" is assigned to nothing) ************* Module ipatests.test_ipaserver.test_ldap ipatests/test_ipaserver/test_ldap.py:221: [W0106(expression-not-assigned), test_LDAPEntry.test_popitem] Expression "list(e) == []" is assigned to nothing) ************* Module ipa-client-install ipa-client/ipa-install/ipa-client-install:114: [W0106(expression-not-assigned), parse_options] Expression "(basic_group.add_option('-p', '--principal', dest='principal', help='principal to use to join the IPA realm'), )" is assigned to nothing) ipa-client/ipa-install/ipa-client-install:116: [W0106(expression-not-assigned), parse_options] Expression "(basic_group.add_option('-w', '--password', dest='password', sensitive=True, help='password to join the IPA realm (assumes bulk password unless principal is also set)'), )" is assigned to nothing) ipa-client/ipa-install/ipa-client-install:118: [W0106(expression-not-assigned), parse_options] Expression "(basic_group.add_option('-k', '--keytab', dest='keytab', help='path to backed up keytab from previous enrollment'), )" is assigned to nothing) ipa-client/ipa-install/ipa-client-install:120: [W0106(expression-not-assigned), parse_options] Expression "(basic_group.add_option('-W', dest='prompt_password', action='store_true', default=False, help='Prompt for a password to join the IPA realm'), )" is assigned to nothing) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint unused-format-string-key checkMartin Basti2015-12-232-5/+2
| | | | | | | | | | | | Enables check and fixes: ipatests/test_xmlrpc/test_permission_plugin.py:534: [W1301(unused-format-string-key), test_permission] Unused key 'tdn' in format string dictionary) ipatests/test_xmlrpc/test_permission_plugin.py:652: [W1301(unused-format-string-key), test_permission] Unused key 'tdn' in format string dictionary) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint missing-final-newline checkMartin Basti2015-12-232-2/+1
| | | | | | | | Enables check and fixes: ipaserver/install/otpdinstance.py:25: [C0304(missing-final-newline), ] Final newline missing) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint trailing-whitespace checkMartin Basti2015-12-234-6/+5
| | | | | | | | | | | | | | | | | | | Enables check and fixes: ************* Module ipapython.log_manager ipapython/log_manager.py:808: [C0303(trailing-whitespace), ] Trailing whitespace) ************* Module ipachangeconf contrib/RHEL4/ipachangeconf.py:28: [C0303(trailing-whitespace), ] Trailing whitespace) contrib/RHEL4/ipachangeconf.py:116: [C0303(trailing-whitespace), ] Trailing whitespace) ************* Module ipalib.plugins.pwpolicy ipalib/plugins/pwpolicy.py:174: [C0303(trailing-whitespace), ] Trailing whitespace) ipalib/plugins/pwpolicy.py:180: [C0303(trailing-whitespace), ] Trailing whitespace) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint duplicated-key checkMartin Basti2015-12-232-2/+0
| | | | | | | | Enables check and fixes: ipatests/test_xmlrpc/test_permission_plugin.py:65: [W0109(duplicate-key), ] Duplicate key 'ipapermlocation' in dictionary) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable pylint lost exception checkMartin Basti2015-12-232-3/+2
| | | | | | | | | Commit enables check and also fixes: ipaserver/dcerpc.py:718: [W0150(lost-exception), DomainValidator.__search_in_dc] return statement in finally block may swallow exception) Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Enable multiple warnings checks in PylintMartin Basti2015-12-231-3/+67
| | | | | | | Enable more checks in pylint. Currently disabled checks are check that we do not want, or issues are already in code. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2026-04-28 02:05:02 +0000