From 12d456a12d0029833059fe28d3bb1cea338fef16 Mon Sep 17 00:00:00 2001

From: Florence Blanc-Renaud <flo@redhat.com>

Date: Thu, 5 Sep 2019 15:49:05 +0200

Subject: [PATCH] check for single-label domains only during server install

The fix for https://pagure.io/freeipa/issue/7207 and

https://pagure.io/freeipa/issue/7598 added checks against single-label

domains in client, server and replica installs. This prevents client

enrollment to existing topologies with single-label domain.

This commit removes those fixes on ipa-4-6 branch. Server installation

with single-label domain will still be refused, but client enrollment

will succeed.

Fixes: https://pagure.io/freeipa/issue/8058

Reviewed-By: Francois Cami <fcami@redhat.com>

---

 ipalib/util.py                      |  5 +++--

 ipaserver/install/server/install.py | 16 ++++++++--------

 ipaserver/plugins/config.py         |  2 +-

 ipaserver/plugins/realmdomains.py   |  2 +-

 4 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/ipalib/util.py b/ipalib/util.py

index 1aa94d97b440110fe55584048d468b9c014ec67b..8b6ec564aa6299a6dd149e9afa1bdc04ac770bf2 100644

--- a/ipalib/util.py

+++ b/ipalib/util.py

@@ -406,14 +406,15 @@ def validate_dns_label(dns_label, allow_underscore=False, allow_slash=False):

 def validate_domain_name(

     domain_name, allow_underscore=False,

-    allow_slash=False, entity='domain'

+    allow_slash=False, entity='domain',

+    check_sld=False

 ):

     if domain_name.endswith('.'):

         domain_name = domain_name[:-1]

     domain_name = domain_name.split(".")

-    if len(domain_name) < 2:

+    if check_sld and len(domain_name) < 2:

         raise ValueError(_(

             'single label {}s are not supported'.format(entity)))

diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py

index c1e593e467cdb856a4ab3251ee103f3da3386a82..5ea4f2e1cc80c995997888aaf44f500524beb796 100644

--- a/ipaserver/install/server/install.py

+++ b/ipaserver/install/server/install.py

@@ -471,25 +471,25 @@ def install_check(installer):

         domain_name = read_domain_name(host_name[host_name.find(".")+1:],

                                        not installer.interactive)

         logger.debug("read domain_name: %s\n", domain_name)

-        try:

-            validate_domain_name(domain_name)

-        except ValueError as e:

-            raise ScriptError("Invalid domain name: %s" % unicode(e))

     else:

         domain_name = options.domain_name

     domain_name = domain_name.lower()

+    try:

+        validate_domain_name(domain_name, check_sld=True)

+    except ValueError as e:

+        raise ScriptError("Invalid domain name: %s" % unicode(e))

     if not options.realm_name:

         realm_name = read_realm_name(domain_name, not installer.interactive)

         logger.debug("read realm_name: %s\n", realm_name)

-        try:

-            validate_domain_name(realm_name, entity="realm")

-        except ValueError as e:

-            raise ScriptError("Invalid realm name: {}".format(unicode(e)))

     else:

         realm_name = options.realm_name.upper()

+    try:

+        validate_domain_name(realm_name, entity="realm", check_sld=True)

+    except ValueError as e:

+        raise ScriptError("Invalid realm name: {}".format(unicode(e)))

     if not options.subject_base:

         options.subject_base = installutils.default_subject_base(realm_name)

diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py

index 58b48935c2c7471ff2ce0bb3f5ce92a9fb47a503..b6349f03b7347b696c4e38480440a31db6757de8 100644

--- a/ipaserver/plugins/config.py

+++ b/ipaserver/plugins/config.py

@@ -400,7 +400,7 @@ class config(LDAPObject):

             )

         try:

-            validate_domain_name(domain)

+            validate_domain_name(domain, check_sld=True)

         except ValueError as e:

             raise errors.ValidationError(

                 name=attr_name,

diff --git a/ipaserver/plugins/realmdomains.py b/ipaserver/plugins/realmdomains.py

index 80c5c298372f1c3f773150622c708f0286cc87a2..414dfae5090c4cd2e694bdfd3839a39783dd95fc 100644

--- a/ipaserver/plugins/realmdomains.py

+++ b/ipaserver/plugins/realmdomains.py

@@ -59,7 +59,7 @@ def _domain_name_normalizer(d):

 def _domain_name_validator(ugettext, value):

     try:

-        validate_domain_name(value, allow_slash=False)

+        validate_domain_name(value, allow_slash=False, check_sld=True)

     except ValueError as e:

         return unicode(e)

     return None

-- 

2.20.1