summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ipa-uuid: emit a message when unexpected mod type is encounteredMartin Babinsky2015-01-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is related to the following defect reported by covscan of FreeIPA master code: """ Error: DEADCODE (CWE-561): /daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c:796: cond_const: Condition "modtype != 1", taking false branch. Now the value of "modtype" is equal to 1. /daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c:796: cond_const: Condition "modtype != 4", taking false branch. Now the value of "modtype" is equal to 4. /daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c:941: equality_cond: Jumping to case "1". /daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c:957: equality_cond: Jumping to case "4". /daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c:940: intervals: When switching on "modtype", the value of "modtype" must be in one of the following intervals: {[1,1], [4,4]}. /daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c:940: dead_error_condition: The switch value "modtype" cannot reach the default case. /daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c:1031: dead_error_begin: Execution cannot reach this statement: "default:". """ The patch is a part of series related to https://fedorahosted.org/freeipa/ticket/4795 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-pwd-extop: added an informational comment about intentional fallthroughMartin Babinsky2015-01-301-0/+2
| | | | | | | | | | | | | | | | | | | | This patch is related to this defect reported by covscan in FreeIPA code: """ Error: MISSING_BREAK (CWE-484): /daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c:631: unterminated_case: The case for value "2" is not terminated by a 'break' statement. /daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c:638: fallthrough: The above case falls through to this one. """ Added a comment informing about intentional falltrough in this place, so that future generations reading the code don't get confused. The patch is the part of a series related to https://fedorahosted.org/freeipa/ticket/4795 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* OTP: failed search for the user of last token emits an error messageMartin Babinsky2015-01-301-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the following defect reported by covscan: """ Error: CHECKED_RETURN (CWE-252): /daemons/ipa-slapi-plugins/ipa-otp-lasttoken/ipa_otp_lasttoken.c:119: check_return: Calling "slapi_search_internal_get_entry" without checking return value (as is done elsewhere 14 out of 16 times). /daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c:402: example_checked: Example 1: "slapi_search_internal_get_entry(sdn, NULL, &config_entry, ipaenrollment_plugin_id)" has its value checked in "(rc = slapi_search_internal_get_entry(sdn, NULL, &config_entry, ipaenrollment_plugin_id)) != 0". /daemons/ipa-slapi-plugins/ipa-lockout/ipa_lockout.c:207: example_assign: Example 2: Assigning: "ret" = return value from "slapi_search_internal_get_entry(sdn, NULL, &config_entry, getPluginID())". /daemons/ipa-slapi-plugins/ipa-lockout/ipa_lockout.c:212: example_checked: Example 2 (cont.): "ret" has its value checked in "ret". /daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c:651: example_assign: Example 3: Assigning: "search_result" = return value from "slapi_search_internal_get_entry(sdn, attrlist, e2, ipapwd_plugin_id)". /daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c:653: example_checked: Example 3 (cont.): "search_result" has its value checked in "search_result != 0". /daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c:1035: example_assign: Example 4: Assigning: "ret" = return value from "slapi_search_internal_get_entry(tmp_dn, NULL, &pwdop->pwdata.target, ipapwd_plugin_id)". /daemons/ipa-slapi-plugins/ipa-pwd-extop/prepost.c:1039: example_checked: Example 4 (cont.): "ret" has its value checked in "ret != 0". /daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c:817: example_assign: Example 5: Assigning: "ret" = return value from "slapi_search_internal_get_entry(tmp_dn, NULL, &e, getPluginID())". /daemons/ipa-slapi-plugins/ipa-uuid/ipa_uuid.c:820: example_checked: Example 5 (cont.): "ret" has its value checked in "ret == 10". """ this patch is a part of a series related to https://fedorahosted.org/freeipa/ticket/4795 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: more robust handling of principal addition/editingMartin Babinsky2015-01-301-23/+47
| | | | | | | | | | | | | | | | | | | | | | | | The patch addresses the following defect reported by covscan in FreeIPA master: """ Error: FORWARD_NULL (CWE-476): /daemons/ipa-kdb/ipa_kdb_principals.c:1886: assign_zero: Assigning: "principal" = "NULL". /daemons/ipa-kdb/ipa_kdb_principals.c:1929: var_deref_model: Passing null pointer "principal" to "ipadb_entry_to_mods", which dereferences it. /daemons/ipa-kdb/ipa_kdb_principals.c:1491:9: deref_parm_in_call: Function "ipadb_get_ldap_mod_str" dereferences "principal". /daemons/ipa-kdb/ipa_kdb_principals.c:1174:5: deref_parm_in_call: Function "strdup" dereferences "value" """ This is a part of series of patches related to https://fedorahosted.org/freeipa/ticket/4795 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* always get PAC for client principal if AS_REQ is trueMartin Babinsky2015-01-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | This patch proposes a fix for the following defect reported by covscan in FreeIPA master code: """ Error: DEADCODE (CWE-561): /daemons/ipa-kdb/ipa_kdb_mspac.c:2013: assignment: Assigning: "client_entry" = "NULL". /daemons/ipa-kdb/ipa_kdb_mspac.c:2077: null: At condition "client_entry", the value of "client_entry" must be "NULL". /daemons/ipa-kdb/ipa_kdb_mspac.c:2077: dead_error_condition: The condition "client_entry" cannot be true. /daemons/ipa-kdb/ipa_kdb_mspac.c:2077: dead_error_line: Execution cannot reach the expression "client_entry" inside this statement: "kerr = ipadb_get_pac(contex...". """ This is a part of a series of patches related to https://fedorahosted.org/freeipa/ticket/4795 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-kdb: unexpected error code in 'ipa_kdb_audit_as_req' triggers a messageMartin Babinsky2015-01-303-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is related this defect reported by covscan on FreeIPA master: """ Error: DEADCODE (CWE-561): /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != -1765328353L", taking false branch. Now the value of "error_code" is equal to -1765328353. /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != -1765328360L", taking false branch. Now the value of "error_code" is equal to -1765328360. /daemons/ipa-kdb/ipa_kdb_audit_as.c:42: cond_const: Condition "error_code != 0", taking false branch. Now the value of "error_code" is equal to 0. /daemons/ipa-kdb/ipa_kdb_audit_as.c:71: intervals: When switching on "error_code", the value of "error_code" must be in one of the following intervals: {[-1765328360,-1765328360], [-1765328353,-1765328353], [0,0]}. /daemons/ipa-kdb/ipa_kdb_audit_as.c:71: dead_error_condition: The switch value "error_code" cannot reach the default case. /daemons/ipa-kdb/ipa_kdb_audit_as.c:123: dead_error_begin: Execution cannot reach this statement: "default:". """ This patch is a part of series related to https://fedorahosted.org/freeipa/ticket/4795. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Use dyndns_update instead of deprecated sssd optionMartin Basti2015-01-281-1/+1
| | | | | | | | | ipa_dyndns_update is deprecated in SSSD, dyndns_update should be used instead. https://fedorahosted.org/freeipa/ticket/4849 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Moved dbus-python dependence to freeipa-python packageMartin Babinsky2015-01-281-0/+1
| | | | | | | | Added dbus-python dependency to freeipa-python. This should fix https://fedorahosted.org/freeipa/ticket/4863 and also cover dbus-python dependencies in other freeipa-* packages. Reviewed-By: Martin Kosek <mkosek@redhat.com>
* idviews: Allow setting ssh public key on ipauseroverride-addDavid Kupka2015-01-271-0/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4868 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Do not crash when replica is unreachable in ipa-restoreJan Cholasta2015-01-271-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4857 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Use 'remove-ds.pl' to remove DS instanceMartin Babinsky2015-01-274-33/+47
| | | | | | | | | | | The patch adds a function which calls 'remove-ds.pl' during DS instance removal. This should allow for a more thorough removal of DS related data during server uninstallation (such as closing custom ports, cleaning up slapd-* entries etc.) This patch is related to https://fedorahosted.org/freeipa/ticket/4487. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Create correct log directories during full restore in ipa-restoreJan Cholasta2015-01-271-15/+14
| | | | | | https://fedorahosted.org/freeipa/ticket/4865 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* ipapython: Fix incorrect python shebangsTomas Babej2015-01-2613-13/+6
| | | | | | Make sure shebangs explicitly reference python2. Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipatests: Fix incorrect assumptions in idviews testsTomas Babej2015-01-261-12/+8
| | | | | | https://fedorahosted.org/freeipa/ticket/4839 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipatests: Fix old command references in the ID views testsTomas Babej2015-01-261-18/+17
| | | | | | | | Make sure only new API command versions are referenced. https://fedorahosted.org/freeipa/ticket/4839 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipatests: Add coverage for referential integrity plugin applied on ↵Tomas Babej2015-01-261-1/+86
| | | | | | | | | | | | ipaAssignedIDView This adds a test case which makes sure that referential integrity plugin does not leave any trailing references for ipaAssignedIDView attribute on hosts, if the ID view being referenced has been deleted. https://fedorahosted.org/freeipa/ticket/4839 Reviewed-By: David Kupka <dkupka@redhat.com>
* Always return absolute idnsname in dnszone commandsMartin Basti2015-01-261-2/+34
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4722 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSSEC: fix root zone dns name conversionMartin Basti2015-01-231-0/+3
| | | | | | | | Root zone was represented as '@', which was incorrect. ksmutil did not accept it. Now root zone is represented as '.' Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNSSEC catch ldap exceptions in ipa-dnskeysyncdMartin Basti2015-01-231-2/+6
| | | | | | Server down exception causes lot of false positive abrt reports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Print PublicError traceback when in debug modeMartin Kosek2015-01-221-0/+3
| | | | | | | | | | | | | The framework only shows traceback for the internal/unknown errors, recognized PublicErrors are simply passed back to the FreeIPA clients. However, sometimes it would help to see a traceback of the PublicError to for example see exactly which line returns it. https://fedorahosted.org/freeipa/ticket/4847 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Revert "Make all ipatokenTOTP attributes mandatory"Jan Cholasta2015-01-211-1/+1
| | | | | | | | | | | | This prevents schema replication conflicts which cause replication failures with older versions of IPA. Details in https://bugzilla.redhat.com/show_bug.cgi?id=1176995#c7 This reverts commit adcd373931c50d91550f6b74b191d08ecce5b137. https://fedorahosted.org/freeipa/ticket/4833 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Add anonymous read ACI for DUA profileMartin Kosek2015-01-212-0/+22
| | | | | | | | DUA profile(s) are consumed by Solaris clients. https://fedorahosted.org/freeipa/ticket/4850 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add debug messages into client autodetectionMartin Basti2015-01-211-0/+5
| | | | | | Is hard to debug what the problem with REALM is without debug messages. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Put LDIF files to their original location in ipa-restoreJan Cholasta2015-01-211-1/+8
| | | | | | | | This prevents SELinux failures during online data restore. https://fedorahosted.org/freeipa/ticket/4822 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Replication Administrators cannot remove replication agreementsMartin Kosek2015-01-201-0/+11
| | | | | | | | | | | | Replication agreement deletion requires read access to DNA range setting. The read access was accidently removed during PermissionV2 refactoring. Add the read ACI back as a special SYSTEM permission. https://fedorahosted.org/freeipa/ticket/4848 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Do not assume certmonger is running in httpinstanceJan Cholasta2015-01-201-19/+29
| | | | | | https://fedorahosted.org/freeipa/ticket/4835 Reviewed-By: David Kupka <dkupka@redhat.com>
* Allow Replication Administrators manipulate Winsync AgreementsMartin Kosek2015-01-192-1/+24
| | | | | | | | | | | | | Replication Administrators members were not able to set up changelog5 entry in cn=config or list winsync agreements. To allow reading winsync replicas, the original deny ACI cn=replica had to be removed as it prevented admins from reading the entries, but just anonymous/authenticated users. https://fedorahosted.org/freeipa/ticket/4836 Reviewed-By: David Kupka <dkupka@redhat.com>
* Allow PassSync user to locate and update NT usersMartin Kosek2015-01-195-25/+151
| | | | | | | | | | | | | | | Add new PassSync Service privilege that have sufficient access to let AD PassSync service search for NT users and update the password. To make sure existing PassSync user keeps working, it is added as a member of the new privilege. New update plugin is added to add link to the new privilege to the potentially existing PassSync user to avoid breaking the PassSync service. https://fedorahosted.org/freeipa/ticket/4837 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipa-cldap: support NETLOGON_NT_VERSION_5EX_WITH_IP properlyAlexander Bokovoy2015-01-191-7/+12
| | | | | | | | | | | | | | | | | | | | | | According to MS-ADTS 6.3.3.2, "Domain Controller Response to an LDAP Ping", if NETLOGON_NT_VERSION_5EX_WITH_IP is requested in NtVer, we should fill the socket address of the server and set the NtVer of the response accordingly. The behavior is a bit unclear from 6.3.3.2 but Samba expects LDAP ping to behave the same way as a mailslot ping, described in 6.3.5, where socket address of the server is included only if _WITH_IP variant was requested in NtVer. If NtVer only contains NETLOGON_NT_VERSION_5EX (without _WITH_IP bit), socket address should not be filled in. Additionally, this means we should use special variant of ndr_push_NETLOGON_SAM_LOGON_RESPONSE_EX helper named ndr_push_NETLOGON_SAM_LOGON_RESPONSE_EX_with_flags to properly handle optional existence of the socket address in the response. https://fedorahosted.org/freeipa/ticket/4827 Reviewed-By: Sumit Bose <sbose@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Support Samba PASSDB 0.2.0 aka interface version 24Alexander Bokovoy2015-01-193-5/+39
| | | | | | | | | | | | | | | 1. Samba project renamed libpdb to libsamba-passdb https://bugzilla.samba.org/show_bug.cgi?id=10355 2. With interface version 24, Samba removed uid_to_sid()/gid_to_sid() from the PASSDB interface and united them as id_to_sid(). Make sure FreeIPA ipa_sam code supports new and old versions of the PASSDB API. https://fedorahosted.org/freeipa/ticket/4778 Reviewed-By: Sumit Bose <sbose@redhat.com>
* DNS tests: warning if forward zone is inactiveMartin Basti2015-01-151-0/+468
| | | | | Ticket: https://fedorahosted.org/freeipa/ticket/4721 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Detect and warn about invalid DNS forward zone configurationMartin Basti2015-01-152-11/+332
| | | | | | | | | Shows warning if forward and parent authoritative zone do not have proper NS record delegation, which can cause the forward zone will be ineffective and forwarding will not work. Ticket: https://fedorahosted.org/freeipa/ticket/4721 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix IPA_BACKUP_DIR path nameMartin Kosek2015-01-141-2/+2
| | | | | | Path name was not updated during patch rebase. https://fedorahosted.org/freeipa/ticket/4797
* ipatests: Make descriptions sorted according to the order of the testsTomas Babej2015-01-141-3/+3
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* spec: Add BuildRequires for python-pytest pluginsTomas Babej2015-01-141-1/+3
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_host_plugin: Use HostTracker fixturesPetr Viktorin2015-01-143-1222/+803
| | | | | | | | | | | | The racker object "remembers" expected state across several tests, so only changes (rather than all expected state) need to be specified in each test. Also, the tracker fixture will make it easy to use hosts in other test modules. This change makes the tests independent; any permutation of any subset of these tests should now pass. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_host_plugin: Split tests into independent classesPetr Viktorin2015-01-141-158/+220
| | | | | | | | Any of the classes may be run alone. In classes not marked @ordered, individual tests are independent. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* test_host_plugin: Convert tests to imperative stylePetr Viktorin2015-01-143-1587/+1262
| | | | | | | | | | | This has several advantages: - Tests other than run-command/check-response can be added easily - Tracebacks are meaningful (which means we'll be able to remove a lot of test name/description/location tracking code) - Individual tests can be selected/deselected using normal pytest mechanisms (but for isolated tests, more changes will be needed) Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Run pylint on testsPetr Viktorin2015-01-1416-66/+77
| | | | | | | | | | | | | | | Drop support for pylint < 1.0 Enable ignoring unknown attributes on modules (both nose and pytest use advanced techniques, support for which only made it to pylint recently) Fix some bugs revealed by pylint Do minor refactoring or add pylint:disable directives where the linter complains. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Fix validation of ipa-restore optionsJan Cholasta2015-01-142-76/+107
| | | | | | | | | | | | | | | Fix restore mode checks. Do some of the existing checks earlier to make them effective. Check if --instance and --backend exist both in the filesystem and in the backup. Log backup type and restore mode before performing restore. Update ipa-restore man page. https://fedorahosted.org/freeipa/ticket/4797 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Make certificate renewal process synchronizedJan Cholasta2015-01-1315-8/+294
| | | | | | | | Synchronization is achieved using a global renewal lock. https://fedorahosted.org/freeipa/ticket/4803 Reviewed-By: David Kupka <dkupka@redhat.com>
* Restart dogtag when its server certificate is renewedJan Cholasta2015-01-132-5/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4803 Reviewed-By: David Kupka <dkupka@redhat.com>
* Do not crash on unknown services in installutils.stopped_serviceJan Cholasta2015-01-131-3/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4835 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix CA certificate renewal syslog alertJan Cholasta2015-01-131-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4820 Reviewed-By: David Kupka <dkupka@redhat.com>
* Remove RUV from LDIF files before using them in ipa-restoreJan Cholasta2015-01-131-1/+35
| | | | | | https://fedorahosted.org/freeipa/ticket/4822 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fix ipa-restore on systems without IPA installedJan Cholasta2015-01-131-2/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4824 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* baseldap: Handle missing parent objects properly in *-find commandsTomas Babej2015-01-133-2/+19
| | | | | | | | | | | | | | | | | | | | The find_entries function in ipaldap does not differentiate between a LDAP search that returns error code 32 (No such object) and LDAP search returning error code 0 (Success), but returning no results. In both cases errors.NotFound is raised. In turn, LDAPSearch commands interpret NotFound exception as no results. To differentiate between the cases, a new error EmptyResult was added, which inherits from NotFound to preserve the compatibility with the new code. This error is raised by ipaldap.find_entries in case it is performing a search with and the target dn does not exist. https://fedorahosted.org/freeipa/ticket/4659 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Abort backup restoration on not matching host.David Kupka2015-01-131-4/+2
| | | | | | | | | When restoring backup on master other than it was created there is high risk of unexpected and hard-to-debug behavior. Refuse such restore. https://fedorahosted.org/freeipa/ticket/4823 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove ipanttrustauthincoming/ipanttrustauthoutgoing from ipa trust-add output.David Kupka2015-01-131-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4787 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* New test cases for Forward_zonesMartin Basti2015-01-131-54/+803
| | | | | | https://fedorahosted.org/freeipa/ticket/4750 Reviewed-By: Martin Kosek <mkosek@redhat.com>
generated by cgit (git 2.34.1) at 2026-03-12 06:25:03 +0000