summaryrefslogtreecommitdiffstats
path: root/ipalib
Commit message (Collapse)AuthorAgeFilesLines
* Replace replication_wait_timeout with certmonger_wait_timeoutRob Crittenden2019-09-042-3/+12
| | | | | | | | | | | | The variable is intended to control the timeout for replication events. If someone had significantly reduced it via configuration then it could have caused certmogner requests to fail due to timeouts. Add replication_wait_timeout, certmonger_wait_timeout and http_timeout to the default.conf man page. Related: https://pagure.io/freeipa/issue/7971 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Update comments to explain caSubsystemCert switchChristian Heimes2019-08-081-0/+3
| | | | | | | Related: https://bugzilla.redhat.com/1670239 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Change RA agent certificate profile to caSubsystemCertAlexander Bokovoy2019-08-081-1/+1
| | | | | | | | | | | | | | | | | | | | | Currently, RA agent certificate is issued using caServerCert profile. This has unfortunate side effect of asserting id-pk-serverAuth EKU which is not really needed for RA agent. If IPA CA certificate adds SAN DNS constraints into issued certificates, presence of id-pk-serverAuth EKU forces NSS (and other crypto libraries) to validate CN value with regards to SAN DNS constraints, due to historical use of CN bearing DNS name. Since RA agent certificate has 'CN=IPA RA', it is guaranteed to fail the check. Default IPA CA configuration does *not* add SAN DNS constraints into RA agent certificate. However, it is better to be prepared to such behavior. Related: https://bugzilla.redhat.com/1670239 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* cainstance: add profile to IPA RA tracking requestFraser Tweedale2019-07-221-0/+1
| | | | | | | | | | | | | Profile-based renewal means we should always explicitly specify the profile in tracking requests that use the dogtag-ipa-ca-renew-agent renewal helper. This includes the IPA RA agent certificate. Update CAInstance.configure_agent_renewal() to add the profile to the tracking request. This also covers the upgrade scenario (because the same method gets invoked). Part of: https://pagure.io/freeipa/issue/7991 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* move MSCSTemplate classes to ipalibFraser Tweedale2019-07-171-0/+171
| | | | | | | | | | | | | As we expand the integration tests for external CA functionality, it is helpful (and avoids duplication) to use the MSCSTemplate* classes. These currently live in ipaserver.install.cainstance, but ipatests is no longer permitted to import from ipaserver (see commit 81714976e5e13131654c78eb734746a20237c933). So move these classes to ipalib. Part of: https://pagure.io/freeipa/issue/7548 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Use system-wide crypto policy for TLS ciphersChristian Heimes2019-07-021-3/+3
| | | | | | | | | | IPA now uses the system-wide crypto policy for TLS ciphers on RHEL. It's also now possible to keep the default policy by setting TLS_HIGH_CIPHERS to None. Fixes: https://pagure.io/freeipa/issue/7998 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Use only TLS 1.2 by defaultChristian Heimes2019-07-013-19/+28
| | | | | | | | | | | | | | | | | TLS 1.3 is causing some trouble with client cert authentication. Conditional client cert authentication requires post-handshake authentication extension on TLS 1.3. The new feature is not fully implemented yet. TLS 1.0 and 1.1 are no longer state of the art and now disabled by default. TLS 1.2 works everywhere and supports PFS. Related: https://pagure.io/freeipa/issue/7667 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* dnsrecord-mod: allow to modify ttl without passing the recordFlorence Blanc-Renaud2019-07-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The command ipa dnsrecord-mod <zone> <record> --ttl requires to provide at least one record to modify. When none is specified, it prompts by proposing each of the existing records, for instance: ipa dnsrecord-mod ZZZZZ.org ns11 --ttl=86400 No option to modify specific record provided. Current DNS record contents: A record: xxx.xxx.xxx.xxx AAAA record: xxxx:xx Modify A record 'xxxx.xxxx.xxxx.xxxx'? Yes/No (default No): Modify AAAA record 'xxxx:xx'? Yes/No (default No): ipa: ERROR: No options to modify a specific record provided. The admin should be able to modify the TTL value without re-entering the record information. The issue happens because of an internal check that forgot to consider 'dnsttl' as a valid standalone modification. Fixes: https://pagure.io/freeipa/issue/7982 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Handle missing LWCA certificate or chainFraser Tweedale2019-06-181-0/+9
| | | | | | | | | | | | | | | | | | | | | If lightweight CA key replication has not completed, requests for the certificate or chain will return 404**. This can occur in normal operation, and should be a temporary condition. Detect this case and handle it by simply omitting the 'certificate' and/or 'certificate_out' fields in the response, and add a warning message to the response. Also update the client-side plugin that handles the --certificate-out option. Because the CLI will automatically print the warning message, if the expected field is missing from the response, just ignore it and continue processing. ** after the Dogtag NullPointerException gets fixed! Part of: https://pagure.io/freeipa/issue/7964 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* constants: add ca_renewal containerFraser Tweedale2019-05-291-0/+2
| | | | | | Part of: https://pagure.io/freeipa/issue/7885 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Add knob to limit hostname lengthRob Crittenden2019-05-162-5/+29
| | | | | | | | | | | | | | | | | | | | | | On Linux systems the length limit for hostnames is hardcoded at 64 in MAXHOSTNAMELEN Solaris, for example, allows 255 characters, and DNS allows the total length to be up to 255 (with each label < 64). Add a knob to allow configuring the maximum hostname length (FQDN) The same validators are used between hosts and DNS to apply the knob only when dealing with a FQDN as a hostname. The maxlen option is included so installers can limit the length of allowed hostnames when the --hostname option is used. https://pagure.io/freeipa/issue/2018 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use PKCS#8 instead of traditional privkey formatChristian Heimes2019-05-141-1/+1
| | | | | | | | | The modern PKCS#8 private key format supports better encryption standard and is preferable over traditional, weak PKCS#1 key format. Fixes: https://pagure.io/freeipa/issue/7943 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Oleg Kozlov <okozlov@redhat.com>
* Revert "Require a minimum SASL security factor of 56"Alexander Bokovoy2019-05-021-3/+0
| | | | | | | | | | | | | | | | | | This reverts commit 350954589774499d99bf87cb5631c664bb0707c4. We cannot force increase in minimum SASL security factor until our consumers are ready to deal with it. Unfortunately, realmd uses anonymous connection for discovery and validation of IPA LDAP server. The way it is done is fragile (it doesn't take into account an advertised IPA version, only checks that 'IPA' string exists in the info field) but since bumping of minimum SSF prevents reading IPA info field using anonymous connection, client enrollment fails. We should get back to bumping minimum SSF after realmd and other potential consumers are fixed. Reviewed-By: François Cami <fcami@redhat.com>
* Pass token_name to certmongerChristian Heimes2019-04-251-2/+9
| | | | | | | | | | | For HSM support, IPA has to pass the token name for CA and subsystem certificates to certmonger. For now, only the default 'internal' token is supported. Related: https://pagure.io/freeipa/issue/5608 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Reduce startup_timeout to 120sec as documentedChristian Heimes2019-04-241-2/+4
| | | | | | | | | man(5) default.conf says that startup_timeout has a default value of 120 seconds. Even 120 seconds are not effective unless systemd is also reconfigured to have a larger DefaultTimeoutStartSec. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove deprecated object loggerChristian Heimes2019-04-231-3/+0
| | | | | | | | | | | | | The object logger methods been deprecated for about two years since release 4.6.0. The log manager used to moneky-patch additional log methods like info(), warning(), and error() into API plugin objects. The methods have been replaced by calls to module logger objects in 4.6.0. Remove monkey-patch logger methods, log manager, and its root logger from ipapython.ipa_log_manager. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Reuse key type and size in certmonger resubmitChristian Heimes2019-04-161-0/+12
| | | | | | | | | | | | | Certmonger has hard-coded defaults for key size and key type. In case a request does not contain these values, certmonger uses 2048 RSA keys. Since the CA now has 3072, it will also rekey the CA to 2048 instead of resubmitting with the existing 2048 bit key. Use key-size and key-type from the existing request when resubmitting. Related: https://pagure.io/freeipa/issue/6790 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Require a minimum SASL security factor of 56Christian Heimes2019-04-031-0/+3
| | | | | | | | | | | | | | SSF_MINX 56 level ensures data integrity and confidentiality for SASL GSSAPI and SASL GSS SPNEGO connections. Although at least AES128 is enforced pretty much everywhere, 56 is required for backwards compatibility with systems that announce wrong SSF. Related: https://pagure.io/freeipa/issue/7140 Related: https://pagure.io/freeipa/issue/4580 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Use expanduser instead of HOME env varChristian Heimes2019-01-293-10/+5
| | | | | | | | | | The HOME directory may not be available in containers. It's also the wrong variable on some platforms. Use os.path.expanduser() instead of HOME. Fixes: https://pagure.io/freeipa/issue/7837 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* make sure IPA_CONFDIR is used to check that client is configuredAlexander Bokovoy2019-01-102-4/+5
| | | | | | | | | | | | | | Fixes a test ipatests/test_cmdline/test_cli.py:test_cli_fs_encoding() which sets IPA_CONFDIR and attempts to interpret the resulting error message. However, if the test is run on an enrolled machine (a developer's laptop, for example), check_client_configuration() will succeed because it ignores IPA_CONFDIR and, as result, api.finalize() will fail later with a stacktrace. Pass an environment object and test an overridden config file existence in this case to fail with a proper and expected message. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Check pager's executable before subprocess.PopenOleg Kozlov2018-12-072-5/+18
| | | | | | | | Get the value of `PAGER` environment variable in case it's defined, check the executable, if it exists - use a pager, otherwise - print function. Fixes: https://pagure.io/freeipa/issue/7746 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* pylint 2.2: Fix unnecessary pass statementChristian Heimes2018-11-261-1/+0
| | | | | | | | | | pylint 2.2.0 has a new checker for unnecessary pass statements. There is no need to have a pass statement in functions or classes with a doc string. Fixes: https://pagure.io/freeipa/issue/7772 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* rpc: always read responseFraser Tweedale2018-11-071-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the server responds 401 and the response body is empty, the client raises ResponseNotReady. This occurs because: 1. For a non-200 response, the response read only if the Content-Length header occurs. 2. The response must be read before another request (e.g. the follow-up request with WWW-Authenticate header set), and this condition was not met. For details see https://github.com/python/cpython/blob/v3.6.7/Lib/http/client.py#L1305-L1321. This situation should not arise in regular use, because the client either has a session cookie, or, knowing the details of the server it is contacting, it establishes the GSS-API context and includes the WWW-Authenticate header in the initial request. Nevertheless, this problem has been observed in the wild. I do not know its ordinary cause(s), but one can force the issue by removing an authenticated user's session cache from /run/ipa/ccaches, then performing a request. Resolve the issue by always reading the response. It is safe to call response.read() regardless of whether the Content-Length header appears, or whether the body is empty. Fixes: https://pagure.io/freeipa/issue/7752 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix misleading errors during client install rollbackRob Crittenden2018-10-261-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some incorrect errors are possible if a client installation fails and a configuration rollback is required. These include: 1. Unconfigured automount client failed: CalledProcessError(Command ['/usr/sbin/ipa-client-automount', '--uninstall', '--debug'] returned non-zero exit status 1: '') Caused by check_client_configuration() not returning the correct return value (2). 2. WARNING: Unable to revert to the pre-installation state ('authconfig' tool has been deprecated in favor of 'authselect'). The default sssd profile will be used instead. The authconfig arguments would have been: authconfig --disableldap --disablekrb5 --disablesssdauth --disablemkhomedir If installation fails before SSSD is configured there is no state to roll back to. Detect this condition. 3. An error occurred while removing SSSD's cache.Please remove the cache manually by executing sssctl cache-remove -o. Again, if SSSD is not configured yet then there is no cache to remove. Also correct the missing space after the period. https://pagure.io/freeipa/issue/7729 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Py3: Replace six.moves importsChristian Heimes2018-10-054-13/+7
| | | | | | | | | | | | Replace six.moves and six.StringIO/BytesIO imports with cannonical Python 3 packages. Note: six.moves.input behaves differently than builtin input function. Therefore I left six.moves.input for now. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Py3: Replace six.integer_types with intChristian Heimes2018-09-274-17/+15
| | | | | | | | | | In Python 3, six.integer_types is (int,). In most places, the alias can be simply replaced with int. In other places, it was possible to simplify the code by unpacking the tuple. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Py3: Replace six.string_types with strChristian Heimes2018-09-277-20/+18
| | | | | | | | In Python 3, six.string_types is just an alias for str. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Py3: Remove subclassing from objectChristian Heimes2018-09-2712-21/+22
| | | | | | | | | Python 2 had old style and new style classes. Python 3 has only new style classes. There is no point to subclass from object any more. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Sprinkle raw strings across the code baseChristian Heimes2018-09-272-3/+3
| | | | | | | | | | | | | | | tox / pytest is complaining about lots and lots of invalid escape sequences in our code base. Sprinkle raw strings or backslash escapes across the code base to fix most occurences of: DeprecationWarning: invalid escape sequence There is still one warning that keeps repeating, though: source:264: DeprecationWarning: invalid escape sequence \d Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Workaround for pyasn1 0.4Christian Heimes2018-09-271-5/+12
| | | | | | | | | | | | | | | pyasn1 0.4 changed handling of ANY containers in a backwards incompatible way. For 0.3.x, keep explicit wrap and unwrap in octet strings for ANY container members. For >= 0.4, let pyasn1 do the job. This patch also makes sorting of extended_key_usage_bytes() stable and adds tests. Tested with pyasn1 0.3.7 and 0.4.4. Fixes: https://pagure.io/freeipa/issue/7685 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Remove replica_file knob from ipalib/install/service.pyThomas Woerner2018-09-121-7/+0
| | | | | | | | | The replica_file option is not needed anymore. Threfore the option can be removed. See: https://pagure.io/freeipa/issue/7689 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Mark replica_file option as deprecatedThomas Woerner2018-08-131-0/+1
| | | | | | | | | The replica_file option is only supported for DL0. The option will be marked deprecated for now. See: https://pagure.io/freeipa/issue/7669 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Increase MIN_DOMAIN_LEVEL to DOMAIN_LEVEL_1Thomas Woerner2018-08-131-1/+1
| | | | | | | | | With increasing the minimal domain level to 1 ipa-replica-install will refuse to install if the domain has domain level 0. See: https://pagure.io/freeipa/issue/7669 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix Pylint 2.0 violationsArmando Neto2018-07-142-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following violations aiming to support Pylint 2.0 - `unneeded-not` (C0113): Consider changing "not item in items" to "item not in items" used when a boolean expression contains an unneeded negation. - `useless-import-alias` (C0414): Import alias does not rename original package Used when an import alias is same as original package.e.g using import numpy as numpy instead of import numpy as np - `raising-format-tuple` (W0715): Exception arguments suggest string formatting might be intended Used when passing multiple arguments to an exception constructor, the first of them a string literal containing what appears to be placeholders intended for formatting - `bad-continuation` (C0330): This was already included on the disable list, although with current version of pylint (2.0.0.dev2) violations at the end of the files are not being ignored. See: https://github.com/PyCQA/pylint/issues/2278 - `try-except-raise` (E0705): The except handler raises immediately Used when an except handler uses raise as its first or only operator. This is useless because it raises back the exception immediately. Remove the raise operator or the entire try-except-raise block! - `consider-using-set-comprehension` (R1718): Consider using a set comprehension Although there is nothing syntactically wrong with this code, it is hard to read and can be simplified to a set comprehension.Also it is faster since you don't need to create another transient list - `dict-keys-not-iterating` (W1655): dict.keys referenced when not iterating Used when dict.keys is referenced in a non-iterating context (returns an iterator in Python 3) - `comprehension-escape` (W1662): Using a variable that was bound inside a comprehension Emitted when using a variable, that was bound in a comprehension handler, outside of the comprehension itself. On Python 3 these variables will be deleted outside of the comprehension. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Add pylint ignore to magic config.Env attributesChristian Heimes2018-07-131-9/+15
| | | | | | | | | | | | | pylinti 2 is having a hard time to handle name mangled, magic attributes correctly. Double under attributes like __d are internally renamed to _Env__d. After multiple failed attempts, it was easier to just add more pylint disable to the implementation. pylint 2 also thinkgs that Env.server is defined much later or the env doesn't have that member at all. Ignore the false warnings, too. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Armando Neto <abiagion@redhat.com>
* Fix ipa console filenameChristian Heimes2018-07-121-3/+9
| | | | | | | | | | | | THe ipa console command takes an optional filename argument. The filename argument was broken, because the implementation passed a file object to exec() instead of a string or compiled object. ipa console now uses compile() to compile the code with print_function __future__ feature. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add tab completion and history to ipa consoleChristian Heimes2018-07-121-2/+47
| | | | | | | | | ipa console is a useful tool to use FreeIPA's API in an interactive Python console. The patch adds readline tab completion and history support. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix pylint 2.0 conditional-related violationsArmando Neto2018-07-122-3/+3
| | | | | | | | | | | | | | | | | | | | | In order to support pylint 2.0 the following violations must be fixed: - `chained-comparison` (R1716): Simplify chained comparison between the operands This message is emitted when pylint encounters boolean operation like "a < b and b < c", suggesting instead to refactor it to "a < b < c". - `consider-using-in` (R1714): Consider merging these comparisons with "in" to %r To check if a variable is equal to one of many values,combine the values into a tuple and check if the variable is contained "in" it instead of checking for equality against each of the values.This is faster and less verbose. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix pylint 2.0 return-related violationsArmando Neto2018-07-112-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | Aiming to support pylint 2.0 some functions and methods must have their return statements updated in order to fix two new violations: - `useless-return` (R1711): Useless return at end of function or method Emitted when a single "return" or "return None" statement is found at the end of function or method definition. This statement can safely be removed because Python will implicitly return None - `inconsistent-return-statements` (R1710): Either all return statements in a function should return an expression, or none of them should. According to PEP8, if any return statement returns an expression, any return statements where no value is returned should explicitly state this as return None, and an explicit return statement should be present at the end of the function (if reachable) Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Auto-retry failed certmonger requestsChristian Heimes2018-07-091-14/+50
| | | | | | | | | | | | | | | During parallel replica installation, a request sometimes fails with CA_REJECTED or CA_UNREACHABLE. The error occur when the master is either busy or some information haven't been replicated yet. Even a stuck request can be recovered, e.g. when permission and group information have been replicated. A new function request_and_retry_cert() automatically resubmits failing requests until it times out. Fixes: https://pagure.io/freeipa/issue/7623 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Cleanup shebang and executable bitChristian Heimes2018-07-052-1/+0
| | | | | | | | | | | | - Add missing executable bits to all scripts - Remove executable bits from all files that are not scripts, e.g. js, html, and Python libraries. - Remove Python shebang from all Python library files. It's frown upon to have executable library files in site-packages. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Armando Neto <abiagion@redhat.com>
* Import ABCs from collections.abcChristian Heimes2018-07-051-1/+8
| | | | | | | | | | | | | Python 3 has moved all collection abstract base classes to collections.abc. Python 3.7 started to deprecate the old aliases. The whole import block needs to be protected with import-error and no-name-in-module, because Python 2 doesn't have collections.abc module and collections.abc.Mapping, while Python 3 doesn't have collections.Mapping. Fixes: https://pagure.io/freeipa/issue/7609 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Prevent the creation on users and groups with numeric characters onlyArmando Neto2018-06-271-1/+3
| | | | | | | | | Update regular expression validator to prevent user and group creation. Fixes: https://pagure.io/freeipa/issue/7572 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Ensure that public cert and CA bundle are readableChristian Heimes2018-06-271-1/+3
| | | | | | | | | | | | In CIS hardened mode, the process umask is 027. This results in some files not being world readable. Ensure that write_certificate_list() calls in client installer, server installer, and upgrader create cert bundles with permission bits 0644. Fixes: https://pagure.io/freeipa/issue/7594 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use common replication wait timeout of 5minChristian Heimes2018-06-221-0/+2
| | | | | | | | | | | Instead of multiple timeout values all over the code base, all replication waits now use a common timeout value from api.env of 5 minutes. Waiting for HTTP/replica principal takes 90 to 120 seconds, so 5 minutes seem like a sufficient value for slow setups. Fixes: https://pagure.io/freeipa/issue/7595 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Add support for format method to translation objectsStanislav Levin2018-06-211-0/+70
| | | | | | | | For now translation classes have old style % formatting way only. But 'format' is convenience, preferred in Python3 string formatting method. Fixes: https://pagure.io/freeipa/issue/7586 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Handle subyptes in ACIsRob Crittenden2018-06-201-1/+2
| | | | | | | | | | | | | | | | | | While enabling console output in the server installation the "Allow trust agents to retrieve keytab keys for cross realm principals" ACI was throwing an unparseable error because it has a subkey which broke parsing (the extra semi-colon): userattr="ipaAllowedToPerform;read_keys#GROUPDN"; The regular expression pattern needed to be updated to handle this case. Related: https://pagure.io/freeipa/issue/6760 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* server install: drop some print statements, change log levelRob Crittenden2018-06-201-3/+3
| | | | | | | | | | | | | | | | The server installer had no console logger set so print statements were used for communication. Now that a logger is enabled the extra prints need to be dropped. A number of logger.info statements have been upgraded to debug since they do not need to appear on the console by default. https://pagure.io/freeipa/issue/6760 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Sort and shuffle SRV record by priority and weightChristian Heimes2018-06-192-20/+12
| | | | | | | | | | | | | | | On multiple occasions, SRV query answers were not properly sorted by priority. Records with same priority weren't randomized and shuffled. This caused FreeIPA to contact the same remote peer instead of distributing the load across all available servers. Two new helper functions now take care of SRV queries. sort_prio_weight() sorts SRV and URI records. query_srv() combines SRV lookup with sort_prio_weight(). Fixes: https://pagure.io/freeipa/issue/7475 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* pylint3: workaround false positives reported for W1662Alexander Bokovoy2018-05-171-1/+1
| | | | | | | | | | | | | | | | | | | | Pylint3 falsely reports warning W1662: using a variable that was bound inside a comprehension for the cases where the same name is reused for a loop after the comprehension in question. Rename the variable in a loop to avoid it. If the code looks like the following: arr = [f for f in filters if callable(f)] for f in arr: result = result + f() pylint3 would consider 'f' used outside of comprehension. Clearly, this is a false-positive warning as the second 'f' use is completely independent of the comprehension's use of 'f'. Reviewed-By: Aleksei Slaikovskii <aslaikov@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 15:58:00 +0000