From 89cb6dccf2dd88cbde955d93605ca9b06615d5e8 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Mar 16 2021 10:29:45 +0000 Subject: import ipa-4.6.8-5.el7_9.4 --- diff --git a/SOURCES/0010-fix-cert-find-errors-in-CA-less-deployment.patch b/SOURCES/0010-fix-cert-find-errors-in-CA-less-deployment.patch new file mode 100644 index 0000000..abfb00d --- /dev/null +++ b/SOURCES/0010-fix-cert-find-errors-in-CA-less-deployment.patch @@ -0,0 +1,41 @@ +From e73e728e10739792d7bf45134507b12407326502 Mon Sep 17 00:00:00 2001 +From: Fraser Tweedale +Date: Mon, 15 Jun 2020 14:55:57 +1000 +Subject: [PATCH] fix cert-find errors in CA-less deployment + +Under some search conditions (in particular, when user is +specified), the CA sub-search of cert-find command throws an error +on CA-less deployments. Do not execute the CA sub-search on CA-less +deployments. + +Fixes: https://pagure.io/freeipa/issue/8369 +Reviewed-By: Christian Heimes +--- + ipaserver/plugins/cert.py | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py +index de47ba95b11e9aca31f1417fa7571bc7e3b48321..57ad1327feb62d5f45266bc9d5c6b8fba75a81aa 100644 +--- a/ipaserver/plugins/cert.py ++++ b/ipaserver/plugins/cert.py +@@ -1826,9 +1826,14 @@ class cert_find(Search, CertMethod): + truncated = False + complete = False + +- for sub_search in (self._cert_search, +- self._ca_search, +- self._ldap_search): ++ # Do not execute the CA sub-search in CA-less deployment. ++ # See https://pagure.io/freeipa/issue/8369. ++ if ca_enabled: ++ searches = [self._cert_search, self._ca_search, self._ldap_search] ++ else: ++ searches = [self._cert_search, self._ldap_search] ++ ++ for sub_search in searches: + sub_result, sub_truncated, sub_complete = sub_search( + all=all, + raw=raw, +-- +2.26.2 + diff --git a/SOURCES/0011-fix-iPAddress-cert-issuance-for-1-host-service.patch b/SOURCES/0011-fix-iPAddress-cert-issuance-for-1-host-service.patch new file mode 100644 index 0000000..4e47d8b --- /dev/null +++ b/SOURCES/0011-fix-iPAddress-cert-issuance-for-1-host-service.patch @@ -0,0 +1,183 @@ +From 87afc31838166409e29d2de750f10622cf1ddc46 Mon Sep 17 00:00:00 2001 +From: Fraser Tweedale +Date: Thu, 11 Jun 2020 22:42:38 +1000 +Subject: [PATCH] fix iPAddress cert issuance for >1 host/service + +The 'cert_request' command accumulates DNS names from the CSR, +before checking that all IP addresses in the CSR are reachable from +those DNS names. Before adding a DNS name to the set, we check that +that it corresponds to the FQDN of a known host/service principal +(including principal aliases). When a DNS name maps to a +"alternative" principal (i.e. not the one given via the 'principal' +argument), this check was not being performed correctly. +Specifically, we were looking for the 'krbprincipalname' field on +the RPC response object directly, instead of its 'result' field. + +To resolve the issue, dereference the RPC response to its 'result' +field before invoking the '_dns_name_matches_principal' subroutine. + +Fixes: https://pagure.io/freeipa/issue/8368 +Reviewed-By: Rob Crittenden +--- + ipaserver/plugins/cert.py | 6 +- + .../test_cert_request_ip_address.py | 64 +++++++++++++++++-- + 2 files changed, 63 insertions(+), 7 deletions(-) + +diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py +index 57ad1327feb62d5f45266bc9d5c6b8fba75a81aa..4af5c97f5722a7799509764df93c2433661dba20 100644 +--- a/ipaserver/plugins/cert.py ++++ b/ipaserver/plugins/cert.py +@@ -814,13 +814,13 @@ class cert_request(Create, BaseCertMethod, VirtualCommand): + try: + if principal_type == HOST: + alt_principal_obj = api.Command['host_show']( +- name, all=True) ++ name, all=True)['result'] + elif principal_type == KRBTGT: + alt_principal = kerberos.Principal( + (u'host', name), principal.realm) + elif principal_type == SERVICE: + alt_principal_obj = api.Command['service_show']( +- alt_principal, all=True) ++ alt_principal, all=True)['result'] + except errors.NotFound: + # We don't want to issue any certificates referencing + # machines we don't know about. Nothing is stored in this +@@ -853,7 +853,7 @@ class cert_request(Create, BaseCertMethod, VirtualCommand): + pass + + # Now check write access and caacl +- altdn = alt_principal_obj['result']['dn'] ++ altdn = alt_principal_obj['dn'] + if not ldap.can_write(altdn, "usercertificate"): + raise errors.ACIError(info=_( + "Insufficient privilege to create a certificate " +diff --git a/ipatests/test_xmlrpc/test_cert_request_ip_address.py b/ipatests/test_xmlrpc/test_cert_request_ip_address.py +index 560a82da318933a9f2b8bf2a498f4eb6659ac2b3..e657df03fd110a39be24e156bf7da69769d4e79a 100644 +--- a/ipatests/test_xmlrpc/test_cert_request_ip_address.py ++++ b/ipatests/test_xmlrpc/test_cert_request_ip_address.py +@@ -29,10 +29,16 @@ from ipatests.test_xmlrpc.tracker.host_plugin import HostTracker + from ipatests.test_xmlrpc.tracker.user_plugin import UserTracker + from ipatests.test_xmlrpc.xmlrpc_test import XMLRPC_test + +-host_fqdn = u'iptest.{}'.format(api.env.domain) ++host_shortname = u'iptest' ++host_fqdn = u'{}.{}'.format(host_shortname, api.env.domain) + host_princ = u'host/{}'.format(host_fqdn) + host_ptr = u'{}.'.format(host_fqdn) + ++host2_shortname = u'iptest2' ++host2_fqdn = u'{}.{}'.format(host2_shortname, api.env.domain) ++host2_princ = u'host/{}'.format(host2_fqdn) ++host2_ptr = u'{}.'.format(host2_fqdn) ++ + other_fqdn = u'other.{}'.format(api.env.domain) + other_ptr = u'{}.'.format(other_fqdn) + +@@ -40,6 +46,10 @@ ipv4_address = u'169.254.0.42' + ipv4_revzone_s = u'0.254.169.in-addr.arpa.' + ipv4_revrec_s = u'42' + ++host2_ipv4_address = u'169.254.0.43' ++host2_ipv4_revzone_s = u'0.254.169.in-addr.arpa.' ++host2_ipv4_revrec_s = u'43' ++ + ipv6_address = u'fe80::8f18:bdab:4299:95fa' + ipv6_revzone_s = u'0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.' + ipv6_revrec_s = u'a.f.5.9.9.9.2.4.b.a.d.b.8.1.f.8' +@@ -47,7 +57,13 @@ ipv6_revrec_s = u'a.f.5.9.9.9.2.4.b.a.d.b.8.1.f.8' + + @pytest.fixture(scope='class') + def host(request): +- tr = HostTracker('iptest') ++ tr = HostTracker(host_shortname) ++ return tr.make_fixture(request) ++ ++ ++@pytest.fixture(scope='class') ++def host2(request): ++ tr = HostTracker(host2_shortname) + return tr.make_fixture(request) + + +@@ -91,6 +107,13 @@ def ipv6_revzone(host): + yield x + + ++@yield_fixture(scope='class') ++def host2_ipv4_ptr(host2, ipv4_revzone): ++ for x in _record_setup( ++ host2, ipv4_revzone, host2_ipv4_revrec_s, ptrrecord=host2_ptr): ++ yield x ++ ++ + @yield_fixture(scope='class') + def ipv4_ptr(host, ipv4_revzone): + for x in _record_setup( +@@ -105,17 +128,24 @@ def ipv6_ptr(host, ipv6_revzone): + yield x + + ++@yield_fixture(scope='class') ++def host2_ipv4_a(host2): ++ for x in _record_setup( ++ host2, api.env.domain, host2_shortname, arecord=host2_ipv4_address): ++ yield x ++ ++ + @yield_fixture(scope='class') + def ipv4_a(host): + for x in _record_setup( +- host, api.env.domain, u'iptest', arecord=ipv4_address): ++ host, api.env.domain, host_shortname, arecord=ipv4_address): + yield x + + + @yield_fixture(scope='class') + def ipv6_aaaa(host): + for x in _record_setup( +- host, api.env.domain, u'iptest', aaaarecord=ipv6_address): ++ host, api.env.domain, host_shortname, aaaarecord=ipv6_address): + yield x + + +@@ -221,6 +251,12 @@ csr_cname2 = csr([ + x509.DNSName(u'cname2.{}'.format(api.env.domain)), + x509.IPAddress(ipaddress.ip_address(ipv4_address)), + ]) ++csr_two_dnsname_two_ip = csr([ ++ x509.DNSName(host_fqdn), ++ x509.IPAddress(ipaddress.ip_address(ipv4_address)), ++ x509.DNSName(host2_fqdn), ++ x509.IPAddress(ipaddress.ip_address(host2_ipv4_address)), ++]) + + + @pytest.fixture +@@ -463,3 +499,23 @@ class TestIPAddressCNAME(XMLRPC_test): + def test_two_levels(self, host, csr_cname2): + with pytest.raises(errors.ValidationError, match=PAT_FWD): + host.run_command('cert_request', csr_cname2, principal=host_princ) ++ ++ ++@pytest.mark.tier1 ++class TestTwoHostsTwoIPAddresses(XMLRPC_test): ++ """ ++ Test certificate issuance with CSR containing two hosts ++ and two IP addresses (one for each host). ++ ++ """ ++ def test_host_exists( ++ self, host, host2, ipv4_a, ipv4_ptr, host2_ipv4_a, host2_ipv4_ptr, ++ ): ++ # for convenience, this test also establishes the DNS ++ # record fixtures, which have class scope ++ host.ensure_exists() ++ host2.ensure_exists() ++ ++ def test_issuance(self, host, csr_two_dnsname_two_ip): ++ host.run_command( ++ 'cert_request', csr_two_dnsname_two_ip, principal=host_princ) +-- +2.26.2 + diff --git a/SOURCES/0012-CAless-installation-set-the-perms-on-KDC-cert-file.patch b/SOURCES/0012-CAless-installation-set-the-perms-on-KDC-cert-file.patch new file mode 100644 index 0000000..6d5710e --- /dev/null +++ b/SOURCES/0012-CAless-installation-set-the-perms-on-KDC-cert-file.patch @@ -0,0 +1,33 @@ +From 52855f472ea918534d50743af4a2b512661fdd95 Mon Sep 17 00:00:00 2001 +From: Florence Blanc-Renaud +Date: Mon, 3 Aug 2020 18:52:07 +0200 +Subject: [PATCH] CAless installation: set the perms on KDC cert file + +In CA less installation, the KDC certificate file does not have +the expected 644 permissions. As a consequence, WebUI login +fails. + +The fix makes sure that the KDC cert file is saved with 644 perms. + +Fixes: https://pagure.io/freeipa/issue/8440 +Reviewed-By: Rob Crittenden +--- + ipaserver/install/krbinstance.py | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py +index a666c0918afad81e35f49387ffc32cde60484c5d..3aede9016eb6de38d43a84cb6997cb69987c4eb2 100644 +--- a/ipaserver/install/krbinstance.py ++++ b/ipaserver/install/krbinstance.py +@@ -527,6 +527,8 @@ class KrbInstance(service.Service): + certs.install_pem_from_p12(self.pkcs12_info[0], + self.pkcs12_info[1], + paths.KDC_CERT) ++ # The KDC cert needs to be readable by everyone ++ os.chmod(paths.KDC_CERT, 0o644) + certs.install_key_from_p12(self.pkcs12_info[0], + self.pkcs12_info[1], + paths.KDC_KEY) +-- +2.26.2 + diff --git a/SOURCES/0013-ipatests-check-KDC-cert-permissions-in-CA-less-insta.patch b/SOURCES/0013-ipatests-check-KDC-cert-permissions-in-CA-less-insta.patch new file mode 100644 index 0000000..8e05071 --- /dev/null +++ b/SOURCES/0013-ipatests-check-KDC-cert-permissions-in-CA-less-insta.patch @@ -0,0 +1,51 @@ +From e6627a5d7818684bad09ad952aa0415a929b231a Mon Sep 17 00:00:00 2001 +From: Florence Blanc-Renaud +Date: Mon, 3 Aug 2020 18:53:47 +0200 +Subject: [PATCH] ipatests: check KDC cert permissions in CA less install + +The KDC certificate file must be stored with 644 permissions. +Add a test checking the file permissions on server + replica. + +Related: https://pagure.io/freeipa/issue/8440 +Reviewed-By: Rob Crittenden +--- + ipatests/test_integration/test_caless.py | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/ipatests/test_integration/test_caless.py b/ipatests/test_integration/test_caless.py +index 529611b183e14f7b23910987bb15ee21492d6f27..fc38b807d357c995b2d6fc04c5612109d38b5f1e 100644 +--- a/ipatests/test_integration/test_caless.py ++++ b/ipatests/test_integration/test_caless.py +@@ -1564,6 +1564,13 @@ class TestCertInstall(CALessBase): + assert result.returncode == 0 + + ++def verify_kdc_cert_perms(host): ++ """Verify that the KDC cert pem file has 0644 perms""" ++ cmd = host.run_command(['stat', '-c', ++ '"%a %G:%U"', paths.KDC_CERT]) ++ assert "644 root:root" in cmd.stdout_text ++ ++ + class TestPKINIT(CALessBase): + """Install master and replica with PKINIT""" + num_replicas = 1 +@@ -1577,6 +1584,7 @@ class TestPKINIT(CALessBase): + result = cls.install_server(pkinit_pkcs12_exists=True, + pkinit_pin=_DEFAULT) + assert result.returncode == 0 ++ verify_kdc_cert_perms(cls.master) + + @replica_install_teardown + def test_server_replica_install_pkinit(self): +@@ -1586,6 +1594,7 @@ class TestPKINIT(CALessBase): + pkinit_pin=_DEFAULT) + assert result.returncode == 0 + self.verify_installation() ++ verify_kdc_cert_perms(self.replicas[0]) + + + class TestServerReplicaCALessToCAFull(CALessBase): +-- +2.26.2 + diff --git a/SOURCES/0014-WebUI-Fix-jQuery-DOM-manipulation-issues.patch b/SOURCES/0014-WebUI-Fix-jQuery-DOM-manipulation-issues.patch new file mode 100644 index 0000000..1660674 --- /dev/null +++ b/SOURCES/0014-WebUI-Fix-jQuery-DOM-manipulation-issues.patch @@ -0,0 +1,204 @@ +From 38194853324aec8f28547911e2945ed1878bafed Mon Sep 17 00:00:00 2001 +From: Serhii Tsymbaliuk +Date: Mon, 21 Sep 2020 15:46:05 +0200 +Subject: [PATCH] WebUI: Fix jQuery DOM manipulation issues + +The commit includes the following jQuery patches: +- Manipulation: Make jQuery.htmlPrefilter an identity function + (https://github.com/jquery/jquery/pull/4642) +- Manipulation: Skip the select wrapper for