From 12d456a12d0029833059fe28d3bb1cea338fef16 Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Thu, 5 Sep 2019 15:49:05 +0200
Subject: [PATCH] check for single-label domains only during server install

The fix for https://pagure.io/freeipa/issue/7207 and
https://pagure.io/freeipa/issue/7598 added checks against single-label
domains in client, server and replica installs. This prevents client
enrollment to existing topologies with single-label domain.

This commit removes those fixes on ipa-4-6 branch. Server installation
with single-label domain will still be refused, but client enrollment
will succeed.

Fixes: https://pagure.io/freeipa/issue/8058
Reviewed-By: Francois Cami <fcami@redhat.com>
---
 ipalib/util.py                      |  5 +++--
 ipaserver/install/server/install.py | 16 ++++++++--------
 ipaserver/plugins/config.py         |  2 +-
 ipaserver/plugins/realmdomains.py   |  2 +-
 4 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/ipalib/util.py b/ipalib/util.py
index 1aa94d97b440110fe55584048d468b9c014ec67b..8b6ec564aa6299a6dd149e9afa1bdc04ac770bf2 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -406,14 +406,15 @@ def validate_dns_label(dns_label, allow_underscore=False, allow_slash=False):
 
 def validate_domain_name(
     domain_name, allow_underscore=False,
-    allow_slash=False, entity='domain'
+    allow_slash=False, entity='domain',
+    check_sld=False
 ):
     if domain_name.endswith('.'):
         domain_name = domain_name[:-1]
 
     domain_name = domain_name.split(".")
 
-    if len(domain_name) < 2:
+    if check_sld and len(domain_name) < 2:
         raise ValueError(_(
             'single label {}s are not supported'.format(entity)))
 
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
index c1e593e467cdb856a4ab3251ee103f3da3386a82..5ea4f2e1cc80c995997888aaf44f500524beb796 100644
--- a/ipaserver/install/server/install.py
+++ b/ipaserver/install/server/install.py
@@ -471,25 +471,25 @@ def install_check(installer):
         domain_name = read_domain_name(host_name[host_name.find(".")+1:],
                                        not installer.interactive)
         logger.debug("read domain_name: %s\n", domain_name)
-        try:
-            validate_domain_name(domain_name)
-        except ValueError as e:
-            raise ScriptError("Invalid domain name: %s" % unicode(e))
     else:
         domain_name = options.domain_name
 
     domain_name = domain_name.lower()
+    try:
+        validate_domain_name(domain_name, check_sld=True)
+    except ValueError as e:
+        raise ScriptError("Invalid domain name: %s" % unicode(e))
 
     if not options.realm_name:
         realm_name = read_realm_name(domain_name, not installer.interactive)
         logger.debug("read realm_name: %s\n", realm_name)
 
-        try:
-            validate_domain_name(realm_name, entity="realm")
-        except ValueError as e:
-            raise ScriptError("Invalid realm name: {}".format(unicode(e)))
     else:
         realm_name = options.realm_name.upper()
+    try:
+        validate_domain_name(realm_name, entity="realm", check_sld=True)
+    except ValueError as e:
+        raise ScriptError("Invalid realm name: {}".format(unicode(e)))
 
     if not options.subject_base:
         options.subject_base = installutils.default_subject_base(realm_name)
diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py
index 58b48935c2c7471ff2ce0bb3f5ce92a9fb47a503..b6349f03b7347b696c4e38480440a31db6757de8 100644
--- a/ipaserver/plugins/config.py
+++ b/ipaserver/plugins/config.py
@@ -400,7 +400,7 @@ class config(LDAPObject):
             )
 
         try:
-            validate_domain_name(domain)
+            validate_domain_name(domain, check_sld=True)
         except ValueError as e:
             raise errors.ValidationError(
                 name=attr_name,
diff --git a/ipaserver/plugins/realmdomains.py b/ipaserver/plugins/realmdomains.py
index 80c5c298372f1c3f773150622c708f0286cc87a2..414dfae5090c4cd2e694bdfd3839a39783dd95fc 100644
--- a/ipaserver/plugins/realmdomains.py
+++ b/ipaserver/plugins/realmdomains.py
@@ -59,7 +59,7 @@ def _domain_name_normalizer(d):
 
 def _domain_name_validator(ugettext, value):
     try:
-        validate_domain_name(value, allow_slash=False)
+        validate_domain_name(value, allow_slash=False, check_sld=True)
     except ValueError as e:
         return unicode(e)
     return None
-- 
2.20.1