|
 |
937546 |
From 12d456a12d0029833059fe28d3bb1cea338fef16 Mon Sep 17 00:00:00 2001
|
|
|
937546 |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
937546 |
Date: Thu, 5 Sep 2019 15:49:05 +0200
|
|
|
937546 |
Subject: [PATCH] check for single-label domains only during server install
|
|
|
937546 |
|
|
|
937546 |
The fix for https://pagure.io/freeipa/issue/7207 and
|
|
|
937546 |
https://pagure.io/freeipa/issue/7598 added checks against single-label
|
|
|
937546 |
domains in client, server and replica installs. This prevents client
|
|
|
937546 |
enrollment to existing topologies with single-label domain.
|
|
|
937546 |
|
|
|
937546 |
This commit removes those fixes on ipa-4-6 branch. Server installation
|
|
|
937546 |
with single-label domain will still be refused, but client enrollment
|
|
|
937546 |
will succeed.
|
|
|
937546 |
|
|
|
937546 |
Fixes: https://pagure.io/freeipa/issue/8058
|
|
|
937546 |
Reviewed-By: Francois Cami <fcami@redhat.com>
|
|
|
937546 |
---
|
|
|
937546 |
ipalib/util.py | 5 +++--
|
|
|
937546 |
ipaserver/install/server/install.py | 16 ++++++++--------
|
|
|
937546 |
ipaserver/plugins/config.py | 2 +-
|
|
|
937546 |
ipaserver/plugins/realmdomains.py | 2 +-
|
|
|
937546 |
4 files changed, 13 insertions(+), 12 deletions(-)
|
|
|
937546 |
|
|
|
937546 |
diff --git a/ipalib/util.py b/ipalib/util.py
|
|
|
937546 |
index 1aa94d97b440110fe55584048d468b9c014ec67b..8b6ec564aa6299a6dd149e9afa1bdc04ac770bf2 100644
|
|
|
937546 |
--- a/ipalib/util.py
|
|
|
937546 |
+++ b/ipalib/util.py
|
|
|
937546 |
@@ -406,14 +406,15 @@ def validate_dns_label(dns_label, allow_underscore=False, allow_slash=False):
|
|
|
937546 |
|
|
|
937546 |
def validate_domain_name(
|
|
|
937546 |
domain_name, allow_underscore=False,
|
|
|
937546 |
- allow_slash=False, entity='domain'
|
|
|
937546 |
+ allow_slash=False, entity='domain',
|
|
|
937546 |
+ check_sld=False
|
|
|
937546 |
):
|
|
|
937546 |
if domain_name.endswith('.'):
|
|
|
937546 |
domain_name = domain_name[:-1]
|
|
|
937546 |
|
|
|
937546 |
domain_name = domain_name.split(".")
|
|
|
937546 |
|
|
|
937546 |
- if len(domain_name) < 2:
|
|
|
937546 |
+ if check_sld and len(domain_name) < 2:
|
|
|
937546 |
raise ValueError(_(
|
|
|
937546 |
'single label {}s are not supported'.format(entity)))
|
|
|
937546 |
|
|
|
937546 |
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
|
|
|
937546 |
index c1e593e467cdb856a4ab3251ee103f3da3386a82..5ea4f2e1cc80c995997888aaf44f500524beb796 100644
|
|
|
937546 |
--- a/ipaserver/install/server/install.py
|
|
|
937546 |
+++ b/ipaserver/install/server/install.py
|
|
|
937546 |
@@ -471,25 +471,25 @@ def install_check(installer):
|
|
|
937546 |
domain_name = read_domain_name(host_name[host_name.find(".")+1:],
|
|
|
937546 |
not installer.interactive)
|
|
|
937546 |
logger.debug("read domain_name: %s\n", domain_name)
|
|
|
937546 |
- try:
|
|
|
937546 |
- validate_domain_name(domain_name)
|
|
|
937546 |
- except ValueError as e:
|
|
|
937546 |
- raise ScriptError("Invalid domain name: %s" % unicode(e))
|
|
|
937546 |
else:
|
|
|
937546 |
domain_name = options.domain_name
|
|
|
937546 |
|
|
|
937546 |
domain_name = domain_name.lower()
|
|
|
937546 |
+ try:
|
|
|
937546 |
+ validate_domain_name(domain_name, check_sld=True)
|
|
|
937546 |
+ except ValueError as e:
|
|
|
937546 |
+ raise ScriptError("Invalid domain name: %s" % unicode(e))
|
|
|
937546 |
|
|
|
937546 |
if not options.realm_name:
|
|
|
937546 |
realm_name = read_realm_name(domain_name, not installer.interactive)
|
|
|
937546 |
logger.debug("read realm_name: %s\n", realm_name)
|
|
|
937546 |
|
|
|
937546 |
- try:
|
|
|
937546 |
- validate_domain_name(realm_name, entity="realm")
|
|
|
937546 |
- except ValueError as e:
|
|
|
937546 |
- raise ScriptError("Invalid realm name: {}".format(unicode(e)))
|
|
|
937546 |
else:
|
|
|
937546 |
realm_name = options.realm_name.upper()
|
|
|
937546 |
+ try:
|
|
|
937546 |
+ validate_domain_name(realm_name, entity="realm", check_sld=True)
|
|
|
937546 |
+ except ValueError as e:
|
|
|
937546 |
+ raise ScriptError("Invalid realm name: {}".format(unicode(e)))
|
|
|
937546 |
|
|
|
937546 |
if not options.subject_base:
|
|
|
937546 |
options.subject_base = installutils.default_subject_base(realm_name)
|
|
|
937546 |
diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py
|
|
|
937546 |
index 58b48935c2c7471ff2ce0bb3f5ce92a9fb47a503..b6349f03b7347b696c4e38480440a31db6757de8 100644
|
|
|
937546 |
--- a/ipaserver/plugins/config.py
|
|
|
937546 |
+++ b/ipaserver/plugins/config.py
|
|
|
937546 |
@@ -400,7 +400,7 @@ class config(LDAPObject):
|
|
|
937546 |
)
|
|
|
937546 |
|
|
|
937546 |
try:
|
|
|
937546 |
- validate_domain_name(domain)
|
|
|
937546 |
+ validate_domain_name(domain, check_sld=True)
|
|
|
937546 |
except ValueError as e:
|
|
|
937546 |
raise errors.ValidationError(
|
|
|
937546 |
name=attr_name,
|
|
|
937546 |
diff --git a/ipaserver/plugins/realmdomains.py b/ipaserver/plugins/realmdomains.py
|
|
|
937546 |
index 80c5c298372f1c3f773150622c708f0286cc87a2..414dfae5090c4cd2e694bdfd3839a39783dd95fc 100644
|
|
|
937546 |
--- a/ipaserver/plugins/realmdomains.py
|
|
|
937546 |
+++ b/ipaserver/plugins/realmdomains.py
|
|
|
937546 |
@@ -59,7 +59,7 @@ def _domain_name_normalizer(d):
|
|
|
937546 |
|
|
|
937546 |
def _domain_name_validator(ugettext, value):
|
|
|
937546 |
try:
|
|
|
937546 |
- validate_domain_name(value, allow_slash=False)
|
|
|
937546 |
+ validate_domain_name(value, allow_slash=False, check_sld=True)
|
|
|
937546 |
except ValueError as e:
|
|
|
937546 |
return unicode(e)
|
|
|
937546 |
return None
|
|
|
937546 |
--
|
|
|
937546 |
2.20.1
|
|
|
937546 |
|