From 12d456a12d0029833059fe28d3bb1cea338fef16 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Thu, 5 Sep 2019 15:49:05 +0200 Subject: [PATCH] check for single-label domains only during server install The fix for https://pagure.io/freeipa/issue/7207 and https://pagure.io/freeipa/issue/7598 added checks against single-label domains in client, server and replica installs. This prevents client enrollment to existing topologies with single-label domain. This commit removes those fixes on ipa-4-6 branch. Server installation with single-label domain will still be refused, but client enrollment will succeed. Fixes: https://pagure.io/freeipa/issue/8058 Reviewed-By: Francois Cami --- ipalib/util.py | 5 +++-- ipaserver/install/server/install.py | 16 ++++++++-------- ipaserver/plugins/config.py | 2 +- ipaserver/plugins/realmdomains.py | 2 +- 4 files changed, 13 insertions(+), 12 deletions(-) diff --git a/ipalib/util.py b/ipalib/util.py index 1aa94d97b440110fe55584048d468b9c014ec67b..8b6ec564aa6299a6dd149e9afa1bdc04ac770bf2 100644 --- a/ipalib/util.py +++ b/ipalib/util.py @@ -406,14 +406,15 @@ def validate_dns_label(dns_label, allow_underscore=False, allow_slash=False): def validate_domain_name( domain_name, allow_underscore=False, - allow_slash=False, entity='domain' + allow_slash=False, entity='domain', + check_sld=False ): if domain_name.endswith('.'): domain_name = domain_name[:-1] domain_name = domain_name.split(".") - if len(domain_name) < 2: + if check_sld and len(domain_name) < 2: raise ValueError(_( 'single label {}s are not supported'.format(entity))) diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py index c1e593e467cdb856a4ab3251ee103f3da3386a82..5ea4f2e1cc80c995997888aaf44f500524beb796 100644 --- a/ipaserver/install/server/install.py +++ b/ipaserver/install/server/install.py @@ -471,25 +471,25 @@ def install_check(installer): domain_name = read_domain_name(host_name[host_name.find(".")+1:], not installer.interactive) logger.debug("read domain_name: %s\n", domain_name) - try: - validate_domain_name(domain_name) - except ValueError as e: - raise ScriptError("Invalid domain name: %s" % unicode(e)) else: domain_name = options.domain_name domain_name = domain_name.lower() + try: + validate_domain_name(domain_name, check_sld=True) + except ValueError as e: + raise ScriptError("Invalid domain name: %s" % unicode(e)) if not options.realm_name: realm_name = read_realm_name(domain_name, not installer.interactive) logger.debug("read realm_name: %s\n", realm_name) - try: - validate_domain_name(realm_name, entity="realm") - except ValueError as e: - raise ScriptError("Invalid realm name: {}".format(unicode(e))) else: realm_name = options.realm_name.upper() + try: + validate_domain_name(realm_name, entity="realm", check_sld=True) + except ValueError as e: + raise ScriptError("Invalid realm name: {}".format(unicode(e))) if not options.subject_base: options.subject_base = installutils.default_subject_base(realm_name) diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py index 58b48935c2c7471ff2ce0bb3f5ce92a9fb47a503..b6349f03b7347b696c4e38480440a31db6757de8 100644 --- a/ipaserver/plugins/config.py +++ b/ipaserver/plugins/config.py @@ -400,7 +400,7 @@ class config(LDAPObject): ) try: - validate_domain_name(domain) + validate_domain_name(domain, check_sld=True) except ValueError as e: raise errors.ValidationError( name=attr_name, diff --git a/ipaserver/plugins/realmdomains.py b/ipaserver/plugins/realmdomains.py index 80c5c298372f1c3f773150622c708f0286cc87a2..414dfae5090c4cd2e694bdfd3839a39783dd95fc 100644 --- a/ipaserver/plugins/realmdomains.py +++ b/ipaserver/plugins/realmdomains.py @@ -59,7 +59,7 @@ def _domain_name_normalizer(d): def _domain_name_validator(ugettext, value): try: - validate_domain_name(value, allow_slash=False) + validate_domain_name(value, allow_slash=False, check_sld=True) except ValueError as e: return unicode(e) return None -- 2.20.1