summaryrefslogtreecommitdiffstats
path: root/ipapython/ipautil.py
Commit message (Collapse)AuthorAgeFilesLines
* ipapython.ipautil.run: allow skipping stdout/stderr loggingAlexander Bokovoy2019-06-291-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | There are cases when output from a utility run contains sensitive content that is better to avoid logging. For example, klist can be told to show actual encryption keys with -K option. Redacting them out with nolog option to ipapython.ipautil.run() is not possible because replacement routine expects exact matches. Introduce two boolean options that allow to skip printing output from the utility being run: -- nolog_output: skip printing captured stdout -- nolog_error: skip printing captured stderr These options default to False (thus, stdout/stderr content will continue to be printed). In case they were set to True, corresponding line will contain stdout=<REDACTED> or stderr=<REDACTED> Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaserver.install.installutils: move commonly used utils to ipapython.ipautilAlexander Bokovoy2019-06-291-0/+60
| | | | | | | | | | | | When creating ipa-client-samba tool, few common routines from the server installer code became useful for the client code as well. Move them to ipapython.ipautil and update references as well. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Make netifaces optionalChristian Heimes2019-04-091-1/+7
| | | | | | | | | | | | | | | netifaces is a binary Python extension. Outside of the installer, it's only used by CheckedIPAddress.get_matching_interface, which is only called from installer code. Make the import of netifaces optional to reduce the amount of dependencies for PyPI package use case. Binary extensions are especially annoying, because they depend on shared libraries, compiler, and header files to be present. Related: https://pagure.io/freeipa/issue/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Oleg Kozlov <okozlov@redhat.com>
* Add option to remove lines from a fileChristian Heimes2019-04-021-3/+10
| | | | | | | | config_replace_variables() can now also remove lines from a file. Related: https://pagure.io/freeipa/issue/7860 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Py3: Replace six.moves importsChristian Heimes2018-10-051-1/+1
| | | | | | | | | | | | Replace six.moves and six.StringIO/BytesIO imports with cannonical Python 3 packages. Note: six.moves.input behaves differently than builtin input function. Therefore I left six.moves.input for now. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Py3: Replace six.bytes_type with bytesChristian Heimes2018-09-271-2/+2
| | | | | | See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Py3: Replace six.text_type with strChristian Heimes2018-09-271-3/+3
| | | | | | | | On Python 3, six.text_type (singular) is an alias for str. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Py3: Replace six.string_types with strChristian Heimes2018-09-271-3/+3
| | | | | | | | In Python 3, six.string_types is just an alias for str. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* uninstall -v: remove TracebacksFlorence Blanc-Renaud2018-08-231-11/+12
| | | | | | | | | | | | ipa-server-install --uninstall -v -U prints Traceback in its log file. This issue happens because it calls subprocess.Popen with close_fds=True (which closes all file descriptors in the child process) but it is trying to use the file logger in the child process (preexec_fn is called in the child just before the child is executed). The fix is using the logger only in the parent process. Fixes: https://pagure.io/freeipa/issue/7681 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Disable Pylint 2.0 violationsArmando Neto2018-07-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Globally disabling the following violations: - `assignment-from-no-return` (E1111): Assigning to function call which doesn't return. Used when an assignment is done on a function call but the inferred function doesn't return anything. - `keyword-arg-before-vararg` (W1113): Keyword argument before variable positional arguments list in the definition of %s function When defining a keyword argument before variable positional arguments, one can end up in having multiple values passed for the aforementioned parameter in case the method is called with keyword arguments. Locally disabling the following: - `subprocess-popen-preexec-fn` (W1509): Using preexec_fn keyword which may be unsafe in the presence of threads The preexec_fn parameter is not safe to use in the presence of threads in your application. The child process could deadlock before exec is called. If you must use it, keep it trivial! Minimize the number of libraries you call into. https://docs.python.org/3/library/subprocess.html#popen-constructor Fixed violations: - `bad-mcs-classmethod-argument` (C0204): Metaclass class method %s should have %s as first argument Used when a metaclass class method has a first argument named differently than the value specified in valid-metaclass-classmethod-first-arg option (default to "mcs"), recommended to easily differentiate them from regular instance methods. - Note: Actually `cls` is the default first arg for `__new__`. - `consider-using-get` (R1715): Consider using dict.get for getting values from a dict if a key is present or a default if not Using the builtin dict.get for getting a value from a dictionary if a key is present or a default if not, is simpler and considered more idiomatic, although sometimes a bit slower Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* pylint3: workaround false positives reported for W1662Alexander Bokovoy2018-05-171-1/+1
| | | | | | | | | | | | | | | | | | | | Pylint3 falsely reports warning W1662: using a variable that was bound inside a comprehension for the cases where the same name is reused for a loop after the comprehension in question. Rename the variable in a loop to avoid it. If the code looks like the following: arr = [f for f in filters if callable(f)] for f in arr: result = result + f() pylint3 would consider 'f' used outside of comprehension. Clearly, this is a false-positive warning as the second 'f' use is completely independent of the comprehension's use of 'f'. Reviewed-By: Aleksei Slaikovskii <aslaikov@redhat.com>
* Fix installer CA port check for port 8080Christian Heimes2018-04-041-0/+49
| | | | | | | | | | | | | | | | The installer now checks that port 8080 is available and not in use by any other application. The port checker has been rewritten to use bind() rather than just checking if a server responds on localhost. It's much more reliable and detects more problems. Original patch by m3gat0nn4ge. Co-authored-by: Mega Tonnage <m3gat0nn4ge@gmail.com> Fixes: https://pagure.io/freeipa/issue/7415 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Add better CalledProcessError and run() loggingChristian Heimes2018-02-201-15/+27
| | | | | | | | | | | | | | | | In case of an error, ipapython.ipautil.run() now raises an exception that contains the error message of the failed command. Before the exception only contained the command and error code. The command is no longer collapsed into one string. The error message and logging output contains the actual command and arguments with intact quoting. Example: CalledProcessError(Command ['/usr/bin/python3', '-c', 'import sys; sys.exit(" ".join(("error", "XXXXXXXX")))'] returned non-zero exit status 1: 'error XXXXXXXX\n') Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Fix pylint warnings inconsistent-return-statementsChristian Heimes2017-12-181-1/+4
| | | | | | | | | | Add consistent return to all functions and methods that are covered by tox -e pylint[23]. I haven't checked if return None is always a good idea or if we should rather raise an error. See: https://pagure.io/freeipa/issue/7326 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Backup ipa-custodia conf and keysChristian Heimes2017-11-131-0/+19
| | | | | | | | https://pagure.io/freeipa/issue/7247 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Warning the user when using a loopback IP as forwarderFelipe Barreto2017-11-091-0/+19
| | | | | | | | | | Changing the --forwarder option to accept a loopback IP. Previously, an error would be raised, now we just show a warning message. Fixes: https://pagure.io/freeipa/issue/5801 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use os.path.isfile() and isdir()Christian Heimes2017-10-201-18/+2
| | | | | | | | | | | Replace custom file_exists() and dir_exists() functions with proper functions from Python's stdlib. The change also gets rid of pylint's invalid bad-python3-import error, https://github.com/PyCQA/pylint/issues/1565 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: port host_port_open() to python 3Stanislav Laznicka2017-08-181-1/+1
| | | | | | | | socket.send() expects `Bytes` instance, not string https://pagure.io/freeipa/issue/4985 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* log progress of wait_for_open_portsPetr Vobornik2017-08-111-1/+6
| | | | | | | | | To know what to focus on when some check fail. E.g. to detect that IPv6 address or its resolution for localhost is misconfigured. https://pagure.io/freeipa/issue/7083 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* control logging of host_port_open from callerPetr Vobornik2017-08-111-10/+4
| | | | | | | | | | | | | host_port_open copied logging behavior of ipa-replica-conncheck utility which doesn't make it much reusable. Now log level can be controlled from caller so other callers might use other logging level without host_port_open guessing what was the intention. https://pagure.io/freeipa/issue/7083 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-141-17/+18
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* python-netifaces: update to reflect upstream changesMartin Basti2017-06-201-3/+14
| | | | | | | | | | | python-netifaces now provides IPv6 netmask in format mask/prefix. It breaks freeipa as it is unexpected format for python-netaddr. We must split netmask and provide only prefix for netaddr. https://pagure.io/freeipa/issue/7021 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* CheckedIPAddress: remove match_local paramMartin Basti2017-06-201-9/+1
| | | | | | | | | This parameter is unused in code. We are no longer testing if IP address matches an interface in constructor. https://pagure.io/freeipa/issue/4317 Reviewed-By: David Kupka <dkupka@redhat.com>
* refactor CheckedIPAddress classMartin Basti2017-06-201-7/+22
| | | | | | | | Make methods without side effects (setting mask) https://pagure.io/freeipa/issue/4317 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix local IP address validationMartin Basti2017-06-201-3/+3
| | | | | | | | | | | | | | | | | | Previously bf9886a84393d1d1546db7e49b102e08a16a83e7 match_local has undesirable side effect that CheckedIPAddress object has set self._net from local interface. However with the recent changes, match_local is usually set to False, thus this side effect stops happening and default mask per address class is used. This causes validation error because mask on interface and mask used for provided IP addresses differ (reporducible only with classless masks). FreeIPA should compare only IP addresses with local addresses without masks https://pagure.io/freeipa/issue/4317 Reviewed-By: David Kupka <dkupka@redhat.com>
* Only warn when specified server IP addresses don't match intfMartin Basti2017-06-061-28/+34
| | | | | | | | | | In containers local addresses differ from public addresses and we need a way to provide only public address to installers. https://pagure.io/freeipa/issue/2715 https://pagure.io/freeipa/issue/4317 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* ipapython.ipautil.run: Add option to set umask before executing commandDavid Kupka2017-05-191-20/+23
| | | | | | | https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipapython.ipautil.nolog_replace: Do not replace empty valueDavid Kupka2017-03-211-1/+1
| | | | | | | | | | When provided empty value in nolog parameter nolog_replace added 'XXXXXXXX' three (once for plain value, once for http quoted value and last time for shell quoted value) times before every character (including terminating '\0') in the string. https://pagure.io/freeipa/issue/6738 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* py3: ipa_generate_password: do not compare None and IntMartin Basti2017-02-101-0/+2
| | | | | | | | | | | | | The one cannot compare None and Int in Py3 """ unorderable types: NoneType() > int() """ Continue when class is disabled with None value https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* private_ccache: yield ccache nameFraser Tweedale2017-01-311-1/+1
| | | | | | | | | | When using private_ccache, yield 'path' from the context manager. This is cleaner than inspecting 'os.environ['KRB5CCNAME']' within the context. Part of: https://fedorahosted.org/freeipa/ticket/5011 Reviewed-By: Martin Basti <mbasti@redhat.com>
* py3: decode bytes for json.loads()Martin Basti2017-01-241-0/+50
| | | | | | | | | | | | In py 3.5 json.loads requires to have string as input, all bytes must be decoded. Note: python 3.6 supports bytes for json.loads() https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: ipautil: open tempfiles in text modeMartin Basti2017-01-241-2/+2
| | | | | | | | | | Code in ipautlis works with text, so tempfiles should be open in textmode otherwise TypeErrors are raised https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: service.py: replace mkstemp by NamedTemporaryFileMartin Basti2017-01-241-1/+1
| | | | | | | | | | NamedTemporaryfile can be used in more pythonic way and file can be opened in textual mode that is required with PY3 https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix used before assignment bug in host_port_open()Christian Heimes2017-01-061-2/+2
| | | | | | | Detected by most recent pylint under Python 3.5. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa_generate_password algorithm changePetr Spacek2017-01-061-30/+86
| | | | | | | | | | | | | | | | A change to the algorithm that generates random passwords for multiple purposes throught IPA. This spells out the need to assess password strength by the entropy it contains rather than its length. This new password generation should also be compatible with the NSS implementation of password requirements in FIPS environment so that newly created databases won't fail with wrong authentication. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipautil: check for open ports on all resolved IPsTomas Krizek2016-12-071-10/+34
| | | | | | | | | | When a hostname is provided to host_port_open, it should check if ports are open for ALL IPs that are resolved from the hostname, instead of checking whether the port is reachable on at least one of the IPs. https://fedorahosted.org/freeipa/ticket/6522 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipa-replica-conncheck: do not close listening ports until requiredTomas Krizek2016-12-011-71/+0
| | | | | | | | | | | | | | | | | | | Previously, a separate thread would be created for each socket used for conncheck. It would also time out after one second, after which it would be closed and reopened again. This caused random failures of conncheck. Now all sockets are handled in a single thread and once the server starts to listen on a port, it does not close that connection until the script finishes. Only IPv6 socket is used for simplicity, since it can handle both IPv6 and IPv4 connections. This requires IPv6 kernel support, which is required by other parts of IPA anyway. https://fedorahosted.org/freeipa/ticket/6487 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipapython: remove hard dependency on ipaplatformJan Cholasta2016-11-291-1/+1
| | | | | | | | | | | | | | Use hard-coded paths to certutil, pk12util and openssl in certdb if ipaplatform is not available. Hard-coded the path to setpasswd in ipautil.run() doc string. Remove ipaplatform dependency from ipapython's setup.py and add ipapython dependency to ipaplatform's setup.py. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move file encryption functions to installutilsJan Cholasta2016-11-291-57/+0
| | | | | | | | | | | The encrypt_file() and decrypt_file() functions depend on ipaplatform. Move them to ipaserver.install.installutils, as they are only used for the server installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-291-85/+0
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move is_fips_enabled() to ipaplatform.tasksJan Cholasta2016-11-291-19/+0
| | | | | | | | The FIPS setting is platform-specific. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove the timeout argument of run()Jan Cholasta2016-11-291-11/+1
| | | | | | | | | | | | The argument depends on the platform-specific timeout binary and is used only in ipaclient.ntpconf. Call the timeout binary explicitly in ipaclient.ntpconf and remove the argument. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove get_domain_name()Jan Cholasta2016-11-291-11/+0
| | | | | | | | | | | get_domain_name() and related code depends on ipaplatform. Replace all uses of get_domain_name() with api.env.domain and remove get_domain_name() and all of the related code. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIRJan Cholasta2016-11-291-3/+0
| | | | | | | | | | | SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform. Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove both SHARE_DIR and PLUGIN_SHARE_DIR. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* paths: remove DEV_NULLJan Cholasta2016-11-291-1/+1
| | | | | | | | | | | The platform-specific path to /dev/null is provided by the Python standard library in os.devnull. Replace all uses of paths.DEV_NULL with os.devnull and remove DEV_NULL. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-251-0/+2
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Replace LooseVersionChristian Heimes2016-11-241-0/+32
| | | | | | | | | | | | | | | | | | | | pylint is having a hard time with distutils.version in tox's virtual envs. virtualenv uses some tricks to provide a virtual distutils package, pylint can't cope with. https://github.com/PyCQA/pylint/issues/73 suggests to use pkg_resources instead. pkg_resources' version parser has some more benefits, e.g. PEP 440 conformity. But pkg_resources.parse_version() is a heavy weight solution with reduced functionality, e.g. no access to major version. For API_VERSION and plugin version we can use a much simpler and faster approach. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* UnsafeIPAddress: Implement __(g|s)etstate__ and to ensure proper (un)picklingDavid Kupka2016-10-121-0/+22
| | | | | | | | | | Missing attributes in instance created by pickle.load cause AttributeError in second part of ipa-server-install --external-ca. https://fedorahosted.org/freeipa/ticket/6385 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Pylint: fix the rest of unused local variablesMartin Basti2016-10-111-8/+6
| | | | Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Move character escaping function to ipautilMartin Babinsky2016-10-031-0/+27
| | | | | | | | | | Functions `escape_seq` and `unescape_seq` have a generic use-case so it makes sense to move them from `kerberos` to ipautil module so that other modules can reuse them more readily. https://fedorahosted.org/freeipa/ticket/5809 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-29 12:27:58 +0000