summaryrefslogtreecommitdiffstats
path: root/ipapython
Commit message (Collapse)AuthorAgeFilesLines
* ipapython/ipachangeconf.py: change "is not 0" for "!= 0"François Cami2019-09-021-1/+1
| | | | | | | | | | | Python 3.8 introduced a warning to check for usage of "is not" when comparing literals. Any such usage will output: SyntaxWarning: "is not" with a literal. Did you mean "!="? See: https://bugs.python.org/issue34850 Fixes: https://pagure.io/freeipa/issue/8057 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Move ipachangeconf from ipaclient.install to ipapythonRob Critenden2019-08-281-0/+590
| | | | | | | | | This will let us call it from ipaplatform. Mark the original location as deprecated. Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Allow insecure binds for migrationChristian Heimes2019-08-131-3/+5
| | | | | | | | | | | | | | Commit 5be9341fbabaf7bcb396a2ce40f17e1ccfa54b77 disallowed simple bind over an insecure connection. Password logins were only allowed over LDAPS or LDAP+STARTTLS. The restriction broke 'ipa migrate-ds' in some cases. This commit lifts the restriction and permits insecure binds over plain LDAP. It also makes the migrate-ds plugin use STARTTLS when a CA certificate is configured with a plain LDAP connection. Fixes: https://pagure.io/freeipa/issue/8040 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* ipapython/admintool.py: use SERVER_NOT_CONFIGUREDFrançois Cami2019-07-301-3/+1
| | | | | | | | | | | | Commit 9182917280a5c2590fa677729db54b38a9ac4d1f introduced SUCCESS, SERVER_INSTALL_ERROR and SERVER_NOT_CONFIGURED to deal with cases when server is not configured. Actually use SERVER_NOT_CONFIGURED in log_failure instead of 2. Related-to: https://pagure.io/freeipa/issue/6843 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* upgrade: remove ipaCert and key from /etc/httpd/aliasFlorence Blanc-Renaud2019-07-151-0/+26
| | | | | | | | | | | | | With ipa 4.5+, the RA cert is stored in files in /var/lib/ipa/ra-agent.{key|pem}. The upgrade code handles the move from /etc/httpd/alias to the files but does not remove the private key from /etc/httpd/alias. The fix calls certutil -F -n ipaCert to remove cert and key, instead of -D -n ipaCert which removes only the cert. Fixes: https://pagure.io/freeipa/issue/7329 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* ipapython.ipautil.run: allow skipping stdout/stderr loggingAlexander Bokovoy2019-06-291-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | There are cases when output from a utility run contains sensitive content that is better to avoid logging. For example, klist can be told to show actual encryption keys with -K option. Redacting them out with nolog option to ipapython.ipautil.run() is not possible because replacement routine expects exact matches. Introduce two boolean options that allow to skip printing output from the utility being run: -- nolog_output: skip printing captured stdout -- nolog_error: skip printing captured stderr These options default to False (thus, stdout/stderr content will continue to be printed). In case they were set to True, corresponding line will contain stdout=<REDACTED> or stderr=<REDACTED> Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaserver.install.installutils: move commonly used utils to ipapython.ipautilAlexander Bokovoy2019-06-291-0/+60
| | | | | | | | | | | | When creating ipa-client-samba tool, few common routines from the server installer code became useful for the client code as well. Move them to ipapython.ipautil and update references as well. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* admintool: don't display log file on errors unless logging is setupRob Crittenden2019-06-111-1/+5
| | | | | | | | | | | | | | | | The admintool will display the message when something goes wrong: See %s for more information" % self.log_file_name This is handy except when finally logging setup is not done yet so the log file doesn't actually get written to. This can happen if validation catches and raises an exception. Fixes: https://pagure.io/freeipa/issue/7952 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* dn: sort AVAs when converting from x509.NameFraser Tweedale2019-06-111-0/+2
| | | | | | | | | | | | | | | Equal DNs with multi-valued RDNs can compare inequal if one (or both) is constructed from a cryptography.x509.Name, because the AVAs in the multi-valued RDNs are not being sorted. Sort the AVAs when constructing from Name and add test cases for equality checks on multi-valued RDNs constructed from inputs with permuted AVA order. Part of: https://pagure.io/freeipa/issue/7963 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Return 0 on uninstall when on_master for case of not installedRob Crittenden2019-06-071-1/+6
| | | | | | | | | | | | | | | | This is to suppress the spurious error message: The ipa-client-install command failed. when the client is not configured. This is managed by allowing a ScriptError to return SUCCESS (0) and have this ignored in log_failure(). https://pagure.io/freeipa/issue/7836 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Drop list of return values to be ignored in AdminToolRob Crittenden2019-06-072-11/+3
| | | | | | | | | | | | | | This was an attempt to suppress client uninstallation failure messages in the server uninstallation script. This method inadvertently also suppressed client uninstallation messages and was generally confusing. This reverts part of b96906156be37a7b29ee74423b82f04070c84e22 https://pagure.io/freeipa/issue/7836 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* dn: handle multi-valued RDNs in Name conversionFraser Tweedale2019-05-281-2/+2
| | | | | | | | | | When applying DN to a cryptography.x509.Name, multi-valued RDNs get "flattened" into separate RDNs. Update the constructor to correctly handle Name values with multi-valued RDNs. Fixes: https://pagure.io/freeipa/issue/7963 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* NSSDatabase: fix get_trust_chainFlorence Blanc-Renaud2019-05-241-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the get_trust_chain method, use certutil -O with the option --simple-self-signed to make sure that self-signed certs properly get processed. Note: this option has been introduced in nss 3.38 and our spec file already requires nss >= 3.41. Scenario: when IPA CA is switched from self-signed to externally-signed, then back to self-signed, the same nickname can be used in /etc/pki/pki-tomcat/alias for the initial cert and the renewed certs. If the original and renewed certs are present in the NSS db, running $ certutil -O -n <IPA CA alias> produces a complex output like the following (this command is used to find the trust chain): "CN=Cert Auth,O=ExtAuth" [CN=Cert Auth,O=ExtAuth] "caSigningCert cert-pki-ca" [CN=Certificate Authority,O=DOMAIN.COM] "caSigningCert cert-pki-ca" [CN=Certificate Authority,O=DOMAIN.COM] The renewal code is disturbed by this output. If, on the contrary, certutil -O --simple-self-signed -n <IPA CA alias> is used to extract the trust chain, the output is as expected for a self-signed cert: "caSigningCert cert-pki-ca" [CN=Certificate Authority,O=DOMAIN.COM] As a result, the scenario self-signed > externally signed > self-signed works. Fixes: https://pagure.io/freeipa/issue/7926 Reviewed-By: Oleg Kozlov <okozlov@redhat.com>
* Use AES-128-CBC for PKCS#12 encryption when creating files (FIPS)Rob Crittenden2019-05-141-0/+2
| | | | | | | | | | | | | | | | | A PKCS#12 file is generated from a set of input files in various formats. This file is then used to provide the public and private keys and certificate chain fro importing into an NSS database. In order to work in FIPS mode stronger encryption is required. The default OpenSSL certificate algo is 40-bit RC2 which is not allowed in FIPS mode. The default private key algo is 3DES. Use AES-128 instead for both. Fixes: https://pagure.io/freeipa/issue/7948 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Load libldap_r-*.so.2Christian Heimes2019-05-141-2/+2
| | | | | | | | | libldap_r.so is only available in the OpenLDAP development packages. The openldap package provides libldap_r-*.so.2. Fixes: https://pagure.io/freeipa/issue/7941 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Revert "Require a minimum SASL security factor of 56"Alexander Bokovoy2019-05-021-15/+2
| | | | | | | | | | | | | | | | | | This reverts commit 350954589774499d99bf87cb5631c664bb0707c4. We cannot force increase in minimum SASL security factor until our consumers are ready to deal with it. Unfortunately, realmd uses anonymous connection for discovery and validation of IPA LDAP server. The way it is done is fragile (it doesn't take into account an advertised IPA version, only checks that 'IPA' string exists in the info field) but since bumping of minimum SSF prevents reading IPA info field using anonymous connection, client enrollment fails. We should get back to bumping minimum SSF after realmd and other potential consumers are fixed. Reviewed-By: François Cami <fcami@redhat.com>
* Make python-ldap optional for PyPI packagesChristian Heimes2019-04-263-3/+174
| | | | | | | | | | | | | | | python-ldap is a Python package with heavy C extensions. In order to build python-ldap, not only OpenLDAP development headers are necessary, but also OpenSSL, Cyrus SASL, and MIT KRB5 development headers. A fully functional ipaclient doesn't need an LDAP driver. It talks JSON RPC over HTTPS to a server. python-ldap is only used by ipapython.dn.DN to convert a string to a DN with ldap_str2dn(). The function is simple and can be wrapped with ctypes in a bunch of lines. Related: https://pagure.io/freeipa/issue/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove deprecated object loggerChristian Heimes2019-04-231-86/+1
| | | | | | | | | | | | | The object logger methods been deprecated for about two years since release 4.6.0. The log manager used to moneky-patch additional log methods like info(), warning(), and error() into API plugin objects. The methods have been replaced by calls to module logger objects in 4.6.0. Remove monkey-patch logger methods, log manager, and its root logger from ipapython.ipa_log_manager. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Make netifaces optionalChristian Heimes2019-04-092-2/+9
| | | | | | | | | | | | | | | netifaces is a binary Python extension. Outside of the installer, it's only used by CheckedIPAddress.get_matching_interface, which is only called from installer code. Make the import of netifaces optional to reduce the amount of dependencies for PyPI package use case. Binary extensions are especially annoying, because they depend on shared libraries, compiler, and header files to be present. Related: https://pagure.io/freeipa/issue/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Oleg Kozlov <okozlov@redhat.com>
* Verify external CA's basic constraint pathlenChristian Heimes2019-04-041-1/+13
| | | | | | | | | | IPA no verifies that intermediate certs of external CAs have a basic constraint path len of at least 1 and increasing. Fixes: https://pagure.io/freeipa/issue/7877 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Require a minimum SASL security factor of 56Christian Heimes2019-04-031-2/+15
| | | | | | | | | | | | | | SSF_MINX 56 level ensures data integrity and confidentiality for SASL GSSAPI and SASL GSS SPNEGO connections. Although at least AES128 is enforced pretty much everywhere, 56 is required for backwards compatibility with systems that announce wrong SSF. Related: https://pagure.io/freeipa/issue/7140 Related: https://pagure.io/freeipa/issue/4580 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Add option to remove lines from a fileChristian Heimes2019-04-021-3/+10
| | | | | | | | config_replace_variables() can now also remove lines from a file. Related: https://pagure.io/freeipa/issue/7860 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Send only the path and not the full URI to httplib.requestRob Crittenden2019-03-191-1/+1
| | | | | | | | | | | | | | | | Sending the full uri was causing httplib to send requests as: POST http://ipa.example.com/ca/admin/ca/getStatus HTTP/1.1 From what I can tell tomcat changed its URL handling due to a CVE (BZ 1552375). This has been wrong in freeipa since the CA status checking was added, d6fbbd5 , but tomcat handled it fine so we didn't notice. https://pagure.io/freeipa/issue/7883 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add constructors to ldap clientChristian Heimes2019-02-051-12/+59
| | | | | | | | | | | | | | | Add LDAPClient.from_realm(), LDAPClient.from_hostname_secure(), and LDAPClient.from_hostname_plain() constructors. The simple_bind() method now also refuses to transmit a password over a plain, unencrypted line. LDAPClient.from_hostname_secure() uses start_tls and FreeIPA's CA cert by default. The constructor also automatically disables start_tls for ldaps and ldapi connections. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move realm_to_serverid/ldap_uri to ipaldapChristian Heimes2019-02-051-0/+14
| | | | | | | | | The helper function realm_to_serverid() and realm_to_ldap_uri() are useful outside the server installation framework. They are now in ipapython.ipaldap along other helpers for LDAP handling in FreeIPA. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Don't configure KEYRING ccache in containersChristian Heimes2019-01-181-3/+8
| | | | | | | | | | | | | | Kernel keyrings are not namespaced yet. Keyrings can leak into other containers. Therefore keyrings should not be used in containerized environment. Don't configure Kerberos to use KEYRING ccache backen when a container environment is detected by systemd-detect-virt --container. Fixes: https://pagure.io/freeipa/issue/7807 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* ipaldap.py: fix method creating a ldap filter for IPACertificateFlorence Blanc-Renaud2018-11-271-0/+3
| | | | | | | | | | | | | | | | ipa user-find --certificate and ipa host-find --certificate fail to return matching entries, because the method transforming the attribute into a LDAP filter does not properly handle IPACertificate objects. Directory Server logs show a filter with (usercertificate=ipalib.x509.IPACertificate object at 0x7fc0a5575b90>) When the attribute contains a cryptography.x509.Certificate, the method needs to extract the public bytes instead of calling str(value). Fixes https://pagure.io/freeipa/issue/7770 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* pylint 2.2: Fix unnecessary pass statementChristian Heimes2018-11-262-4/+0
| | | | | | | | | | pylint 2.2.0 has a new checker for unnecessary pass statements. There is no need to have a pass statement in functions or classes with a doc string. Fixes: https://pagure.io/freeipa/issue/7772 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* certdb: validate server cert signatureChristian Heimes2018-11-141-2/+9
| | | | | | | | | | | PR https://github.com/freeipa/freeipa/pull/2554 added the '-e' option for CA cert validation. Let's also verify signature, key size, and signing algorithm of server certs. With the '-e' option, the installer and other tools will catch weak certs early. Fixes: pagure.io/freeipa/issue/7761 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* certdb: validate certificate signaturesFraser Tweedale2018-11-131-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | When verifying a CA certificate, validate its signature. This causes FreeIPA to reject certificate chains with bad signatures, signatures using unacceptable algorithms, or certificates with unacceptable key sizes. The '-e' option to 'certutil -V' was the missing ingredient. An an example of a problem prevented by this change, a certifiate signed by a 1024-bit intermediate CA, would previously have been imported by ipa-cacert-manage, but would cause Dogtag startup failure due to failing self-test. With this change, ipa-cacert-manage will reject the certificate: # ipa-cacert-manage renew --external-cert-file /tmp/ipa.p7 Importing the renewed CA certificate, please wait CA certificate CN=Certificate Authority,O=IPA.LOCAL 201809261455 in /tmp/ipa.p7 is not valid: certutil: certificate is invalid: The certificate was signed using a signature algorithm that is disabled because it is not secure. Fixes: https://pagure.io/freeipa/issue/7761 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certdb: ensure non-empty Subject Key IdentifierFraser Tweedale2018-11-121-1/+4
| | | | | | | | | | | | | | Installation or IPA CA renewal with externally-signed CA accepts an IPA CA certificate with empty Subject Key Identifier. This is technically legal in X.509, but is an operational issue. Furthermore, due to an extant bug in Dogtag (https://pagure.io/dogtagpki/issue/3079) it will cause Dogtag startup failure. Reject CA certificates with empty Subject Key Identifier. Fixes: https://pagure.io/freeipa/issue/7762 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaldap: avoid invalid modlist when attribute encoding differsFraser Tweedale2018-11-061-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ipaldap does not take into account the possibility of the attribute encoding returned by python-ldap differing from the attribute encoding produced by FreeIPA. In particular this can occur with DNs with special characters that require escaping. For example, python-ldap (or the underlying LDAP library) escapes special characters using hex encoding: CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\2C Inc.,L=Brisbane,C=AU Whereas FreeIPA, when encoding the DN, escapes the character directly: CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\, Inc.,L=Brisbane,C=AU Therefore it is possible to generate an invalid modlist. For example, during external CA certificate renewal, if the issuer DN includes a comma in one of the attribute values (as above), an invalid modlist will be generated: [ (ldap.MOD_ADD, 'ipacaissuerdn', [b'CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\, Inc.,L=Brisbane,C=AU']) , (ldap.MOD_DELETE, 'ipacaissuerdn', [b'CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\2C Inc.,L=Brisbane,C=AU']) ] Although encoded differently, these are the same value. If this modification is applied to the object, attributeOrValueExists (error 20) occurs. To avoid the issue, put deletes before adds in the modlist. If a value is present (with different encodings) as both an addition and a deletion, it must be because the original object contained the value with a different encoding. Therefore it is safe to delete it, then add it back. Note that the modlist is not optimal. In the simplest case (like above example), there should be no modification to perform. It is considerably more complex (and more computation) to implement this because the raw attribute values must be decoded before comparison. Fixes: https://pagure.io/freeipa/issue/7750 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certdb: provide meaningful err msg for wrong PINFlorence Blanc-Renaud2018-10-091-7/+34
| | | | | | | | | | | | ipa-server-install or ipa-replica-install do not provide a meaningful error message in CA-less mode when the install fails because of a wrong PIN. Update the err msg so that it provides a hint to the user. Fixes https://pagure.io/freeipa/issue/5378 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Py3: Replace six.moves importsChristian Heimes2018-10-055-15/+6
| | | | | | | | | | | | Replace six.moves and six.StringIO/BytesIO imports with cannonical Python 3 packages. Note: six.moves.input behaves differently than builtin input function. Therefore I left six.moves.input for now. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Py3: Replace six.bytes_type with bytesChristian Heimes2018-09-272-3/+3
| | | | | | See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Py3: Replace six.text_type with strChristian Heimes2018-09-274-12/+10
| | | | | | | | On Python 3, six.text_type (singular) is an alias for str. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Py3: Replace six.integer_types with intChristian Heimes2018-09-273-7/+5
| | | | | | | | | | In Python 3, six.integer_types is (int,). In most places, the alias can be simply replaced with int. In other places, it was possible to simplify the code by unpacking the tuple. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Py3: Replace six.string_types with strChristian Heimes2018-09-278-30/+27
| | | | | | | | In Python 3, six.string_types is just an alias for str. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Py3: Remove subclassing from objectChristian Heimes2018-09-2712-17/+19
| | | | | | | | | Python 2 had old style and new style classes. Python 3 has only new style classes. There is no point to subclass from object any more. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Sprinkle raw strings across the code baseChristian Heimes2018-09-271-1/+1
| | | | | | | | | | | | | | | tox / pytest is complaining about lots and lots of invalid escape sequences in our code base. Sprinkle raw strings or backslash escapes across the code base to fix most occurences of: DeprecationWarning: invalid escape sequence There is still one warning that keeps repeating, though: source:264: DeprecationWarning: invalid escape sequence \d Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Remove Python 2 support and packagesChristian Heimes2018-09-061-1/+0
| | | | | | | | | | | | | | Remove Python 2 related code and configuration from spec file, autoconf and CI infrastructure. From now on, FreeIPA 4.8 requires at least Python 3.6. Python 2 packages like python2-ipaserver or python2-ipaclient are no longer available. PR-CI, lint, and tox aren't testing Python 2 compatibility either. See: https://fedoraproject.org/wiki/Changes/FreeIPA_Python_2_Removal Fixes: https://pagure.io/freeipa/issue/7568 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* uninstall -v: remove TracebacksFlorence Blanc-Renaud2018-08-231-11/+12
| | | | | | | | | | | | ipa-server-install --uninstall -v -U prints Traceback in its log file. This issue happens because it calls subprocess.Popen with close_fds=True (which closes all file descriptors in the child process) but it is trying to use the file logger in the child process (preexec_fn is called in the child just before the child is executed). The fix is using the logger only in the parent process. Fixes: https://pagure.io/freeipa/issue/7681 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Add missing docstrings to kernel_keyring.pyAlexander Scheel2018-08-201-0/+9
| | | | | Signed-off-by: Alexander Scheel <ascheel@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add docstring to verify_kdc_cert_validityAlexander Scheel2018-08-201-0/+5
| | | | | Signed-off-by: Alexander Scheel <ascheel@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* ipatests: add installer framework testingStanislav Laznicka2018-07-191-2/+9
| | | | | | Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Disable Pylint 2.0 violationsArmando Neto2018-07-162-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Globally disabling the following violations: - `assignment-from-no-return` (E1111): Assigning to function call which doesn't return. Used when an assignment is done on a function call but the inferred function doesn't return anything. - `keyword-arg-before-vararg` (W1113): Keyword argument before variable positional arguments list in the definition of %s function When defining a keyword argument before variable positional arguments, one can end up in having multiple values passed for the aforementioned parameter in case the method is called with keyword arguments. Locally disabling the following: - `subprocess-popen-preexec-fn` (W1509): Using preexec_fn keyword which may be unsafe in the presence of threads The preexec_fn parameter is not safe to use in the presence of threads in your application. The child process could deadlock before exec is called. If you must use it, keep it trivial! Minimize the number of libraries you call into. https://docs.python.org/3/library/subprocess.html#popen-constructor Fixed violations: - `bad-mcs-classmethod-argument` (C0204): Metaclass class method %s should have %s as first argument Used when a metaclass class method has a first argument named differently than the value specified in valid-metaclass-classmethod-first-arg option (default to "mcs"), recommended to easily differentiate them from regular instance methods. - Note: Actually `cls` is the default first arg for `__new__`. - `consider-using-get` (R1715): Consider using dict.get for getting values from a dict if a key is present or a default if not Using the builtin dict.get for getting a value from a dictionary if a key is present or a default if not, is simpler and considered more idiomatic, although sometimes a bit slower Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix Pylint 2.0 violationsArmando Neto2018-07-142-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following violations aiming to support Pylint 2.0 - `unneeded-not` (C0113): Consider changing "not item in items" to "item not in items" used when a boolean expression contains an unneeded negation. - `useless-import-alias` (C0414): Import alias does not rename original package Used when an import alias is same as original package.e.g using import numpy as numpy instead of import numpy as np - `raising-format-tuple` (W0715): Exception arguments suggest string formatting might be intended Used when passing multiple arguments to an exception constructor, the first of them a string literal containing what appears to be placeholders intended for formatting - `bad-continuation` (C0330): This was already included on the disable list, although with current version of pylint (2.0.0.dev2) violations at the end of the files are not being ignored. See: https://github.com/PyCQA/pylint/issues/2278 - `try-except-raise` (E0705): The except handler raises immediately Used when an except handler uses raise as its first or only operator. This is useless because it raises back the exception immediately. Remove the raise operator or the entire try-except-raise block! - `consider-using-set-comprehension` (R1718): Consider using a set comprehension Although there is nothing syntactically wrong with this code, it is hard to read and can be simplified to a set comprehension.Also it is faster since you don't need to create another transient list - `dict-keys-not-iterating` (W1655): dict.keys referenced when not iterating Used when dict.keys is referenced in a non-iterating context (returns an iterator in Python 3) - `comprehension-escape` (W1662): Using a variable that was bound inside a comprehension Emitted when using a variable, that was bound in a comprehension handler, outside of the comprehension itself. On Python 3 these variables will be deleted outside of the comprehension. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Handle races in replica configChristian Heimes2018-07-121-0/+5
| | | | | | | | | | | | | | | When multiple replicas are installed in parallel, two replicas may try to create the cn=replica entry at the same time. This leads to a conflict on one of the replicas. replica_config() and ensure_replication_managers() now handle conflicts. ipaldap now maps TYPE_OR_VALUE_EXISTS to DuplicateEntry(). The type or value exists exception is raised, when an attribute value or type is already set. Fixes: https://pagure.io/freeipa/issue/7566 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* Fix pylint 2.0 conditional-related violationsArmando Neto2018-07-121-1/+1
| | | | | | | | | | | | | | | | | | | | | In order to support pylint 2.0 the following violations must be fixed: - `chained-comparison` (R1716): Simplify chained comparison between the operands This message is emitted when pylint encounters boolean operation like "a < b and b < c", suggesting instead to refactor it to "a < b < c". - `consider-using-in` (R1714): Consider merging these comparisons with "in" to %r To check if a variable is equal to one of many values,combine the values into a tuple and check if the variable is contained "in" it instead of checking for equality against each of the values.This is faster and less verbose. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix pylint 2.0 return-related violationsArmando Neto2018-07-111-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | Aiming to support pylint 2.0 some functions and methods must have their return statements updated in order to fix two new violations: - `useless-return` (R1711): Useless return at end of function or method Emitted when a single "return" or "return None" statement is found at the end of function or method definition. This statement can safely be removed because Python will implicitly return None - `inconsistent-return-statements` (R1710): Either all return statements in a function should return an expression, or none of them should. According to PEP8, if any return statement returns an expression, any return statements where no value is returned should explicitly state this as return None, and an explicit return statement should be present at the end of the function (if reachable) Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 01:21:02 +0000