From a04defc43419906675107e483f0f2f3153685c8d Mon Sep 17 00:00:00 2001
From: Martin Basti <mbasti@redhat.com>
Date: Wed, 31 May 2017 15:50:05 +0200
Subject: [PATCH] Only warn when specified server IP addresses don't match intf
In containers local addresses differ from public addresses and we need
a way to provide only public address to installers.
https://pagure.io/freeipa/issue/2715
https://pagure.io/freeipa/issue/4317
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
---
ipaclient/install/client.py | 4 +-
ipalib/install/hostname.py | 2 +-
ipalib/util.py | 14 +++++++
ipapython/ipautil.py | 62 ++++++++++++++++--------------
ipaserver/install/dns.py | 1 +
ipaserver/install/installutils.py | 4 +-
ipaserver/install/server/install.py | 2 +
ipaserver/install/server/replicainstall.py | 2 +
8 files changed, 59 insertions(+), 32 deletions(-)
diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py
index 6f10f5258747881b9af8c6b70b499f9ff7d577ff..41dae3004d1f4836e79c2048ae0a12f722595ca0 100644
--- a/ipaclient/install/client.py
+++ b/ipaclient/install/client.py
@@ -41,6 +41,7 @@ from ipalib.util import (
broadcast_ip_address_warning,
network_ip_address_warning,
normalize_hostname,
+ no_matching_interface_for_ip_address_warning,
verify_host_resolvable,
)
from ipaplatform import services
@@ -1300,6 +1301,7 @@ def update_dns(server, hostname, options):
network_ip_address_warning(update_ips)
broadcast_ip_address_warning(update_ips)
+ no_matching_interface_for_ip_address_warning(update_ips)
update_txt = "debug\n"
update_txt += ipautil.template_str(DELETE_TEMPLATE_A,
@@ -1445,7 +1447,7 @@ def check_ip_addresses(options):
if options.ip_addresses:
for ip in options.ip_addresses:
try:
- ipautil.CheckedIPAddress(ip, match_local=True)
+ ipautil.CheckedIPAddress(ip)
except ValueError as e:
root_logger.error(e)
return False
diff --git a/ipalib/install/hostname.py b/ipalib/install/hostname.py
index 74c569d972df9975d677762b5769b2bf84dfddf0..5422ba6390ce13aa40f34938ed777d8821e8231b 100644
--- a/ipalib/install/hostname.py
+++ b/ipalib/install/hostname.py
@@ -34,7 +34,7 @@ class HostNameInstallInterface(service.ServiceInstallInterface):
def ip_addresses(self, values):
for value in values:
try:
- CheckedIPAddress(value, match_local=True)
+ CheckedIPAddress(value)
except Exception as e:
raise ValueError("invalid IP address {0}: {1}".format(
value, e))
diff --git a/ipalib/util.py b/ipalib/util.py
index 713fc107e9374eefe7805bc4e1abc40b6d150c32..1bd8495a49b010e7a3ac926dad516ab5f8219b39 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -1128,3 +1128,17 @@ def broadcast_ip_address_warning(addr_list):
# print
print("WARNING: IP address {} might be broadcast address".format(
ip), file=sys.stderr)
+
+
+def no_matching_interface_for_ip_address_warning(addr_list):
+ for ip in addr_list:
+ if not ip.get_matching_interface():
+ root_logger.warning(
+ "No network interface matches the IP address %s", ip)
+ # fixme: once when loggers will be fixed, we can remove this
+ # print
+ print(
+ "WARNING: No network interface matches the IP address "
+ "{}".format(ip),
+ file=sys.stderr
+ )
diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py
index 317fc225b722ad3ce2f4b9d92822b4f19d49adb9..a277ed87473f3c591f34fcc00e1159f3bbfe3e9b 100644
--- a/ipapython/ipautil.py
+++ b/ipapython/ipautil.py
@@ -161,34 +161,7 @@ class CheckedIPAddress(UnsafeIPAddress):
raise ValueError("cannot use multicast IP address {}".format(addr))
if match_local:
- if self.version == 4:
- family = netifaces.AF_INET
- elif self.version == 6:
- family = netifaces.AF_INET6
- else:
- raise ValueError(
- "Unsupported address family ({})".format(self.version)
- )
-
- iface = None
- for interface in netifaces.interfaces():
- for ifdata in netifaces.ifaddresses(interface).get(family, []):
-
- # link-local addresses contain '%suffix' that causes parse
- # errors in IPNetwork
- ifaddr = ifdata['addr'].split(u'%', 1)[0]
-
- ifnet = netaddr.IPNetwork('{addr}/{netmask}'.format(
- addr=ifaddr,
- netmask=ifdata['netmask']
- ))
- if ifnet == self._net or (
- self._net is None and ifnet.ip == self):
- self._net = ifnet
- iface = interface
- break
-
- if iface is None:
+ if not self.get_matching_interface():
raise ValueError('no network interface matches the IP address '
'and netmask {}'.format(addr))
@@ -218,6 +191,39 @@ class CheckedIPAddress(UnsafeIPAddress):
def is_broadcast_addr(self):
return self.version == 4 and self == self._net.broadcast
+ def get_matching_interface(self):
+ """Find matching local interface for address
+ :return: Interface name or None if no interface has this address
+ """
+ if self.version == 4:
+ family = netifaces.AF_INET
+ elif self.version == 6:
+ family = netifaces.AF_INET6
+ else:
+ raise ValueError(
+ "Unsupported address family ({})".format(self.version)
+ )
+
+ iface = None
+ for interface in netifaces.interfaces():
+ for ifdata in netifaces.ifaddresses(interface).get(family, []):
+
+ # link-local addresses contain '%suffix' that causes parse
+ # errors in IPNetwork
+ ifaddr = ifdata['addr'].split(u'%', 1)[0]
+
+ ifnet = netaddr.IPNetwork('{addr}/{netmask}'.format(
+ addr=ifaddr,
+ netmask=ifdata['netmask']
+ ))
+ if ifnet == self._net or (
+ self._net is None and ifnet.ip == self):
+ self._net = ifnet
+ iface = interface
+ break
+
+ return iface
+
def valid_ip(addr):
return netaddr.valid_ipv4(addr) or netaddr.valid_ipv6(addr)
diff --git a/ipaserver/install/dns.py b/ipaserver/install/dns.py
index 0dddf2a6427f3f939171d755bfe2b1f05cfafa67..090b79493652566a433da248fa7fd9e33dd2cb72 100644
--- a/ipaserver/install/dns.py
+++ b/ipaserver/install/dns.py
@@ -266,6 +266,7 @@ def install_check(standalone, api, replica, options, hostname):
util.network_ip_address_warning(ip_addresses)
util.broadcast_ip_address_warning(ip_addresses)
+ util.no_matching_interface_for_ip_address_warning(ip_addresses)
if not options.forward_policy:
# user did not specify policy, derive it: default is 'first' but
diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py
index d2283af20485fd5d66bfd3cc49059d08d1802575..3521d555914714351160213df60ed9167ac6e370 100644
--- a/ipaserver/install/installutils.py
+++ b/ipaserver/install/installutils.py
@@ -276,7 +276,7 @@ def read_ip_addresses():
if not ip:
break
try:
- ip_parsed = ipautil.CheckedIPAddress(ip, match_local=True)
+ ip_parsed = ipautil.CheckedIPAddress(ip)
except Exception as e:
print("Error: Invalid IP Address %s: %s" % (ip, e))
continue
@@ -585,7 +585,7 @@ def get_server_ip_address(host_name, unattended, setup_dns, ip_addresses):
if len(hostaddr):
for ha in hostaddr:
try:
- ips.append(ipautil.CheckedIPAddress(ha, match_local=True))
+ ips.append(ipautil.CheckedIPAddress(ha, match_local=False))
except ValueError as e:
root_logger.warning("Invalid IP address %s for %s: %s", ha, host_name, unicode(e))
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
index 9dcf903f4582740f007c049fae3ec247ddf52aef..7eb291e07c00e0407ce534c3d4088e6f6378260f 100644
--- a/ipaserver/install/server/install.py
+++ b/ipaserver/install/server/install.py
@@ -29,6 +29,7 @@ from ipalib.util import (
validate_domain_name,
network_ip_address_warning,
broadcast_ip_address_warning,
+ no_matching_interface_for_ip_address_warning,
)
import ipaclient.install.ntpconf
from ipaserver.install import (
@@ -617,6 +618,7 @@ def install_check(installer):
# check addresses here, dns module is doing own check
network_ip_address_warning(ip_addresses)
broadcast_ip_address_warning(ip_addresses)
+ no_matching_interface_for_ip_address_warning(ip_addresses)
if options.setup_adtrust:
adtrust.install_check(False, options, api)
diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
index 20eaf98397101b49c751c325afc0591e0babcc18..6620f0222f9d38112ce0d0fd72381e5673921cba 100644
--- a/ipaserver/install/server/replicainstall.py
+++ b/ipaserver/install/server/replicainstall.py
@@ -35,6 +35,7 @@ from ipalib.config import Env
from ipalib.util import (
network_ip_address_warning,
broadcast_ip_address_warning,
+ no_matching_interface_for_ip_address_warning,
)
from ipaclient.install.client import configure_krb5_conf, purge_host_keytab
from ipaserver.install import (
@@ -1285,6 +1286,7 @@ def promote_check(installer):
# check addresses here, dns module is doing own check
network_ip_address_warning(config.ips)
broadcast_ip_address_warning(config.ips)
+ no_matching_interface_for_ip_address_warning(config.ips)
if options.setup_adtrust:
adtrust.install_check(False, options, remote_api)
--
2.9.4