.freeipa-pr-ci.yaml

-topologies:
-  build: &build
-    name: build
-    cpu: 2
-    memory: 3800
-  master_1repl: &master_1repl
-    name: master_1repl
-    cpu: 4
-    memory: 5750
-  master_1repl_1client: &master_1repl_1client
-    name: master_1repl_1client
-    cpu: 4
-    memory: 6700
-
-jobs:
-  fedora-28/build:
-    requires: []
-    priority: 100
-    job:
-      class: Build
-      args:
-        git_repo: '{git_repo}'
-        git_refspec: '{git_refspec}'
-        template: &ci-master-f28
-          name: freeipa/ci-master-f28
-          version: 0.1.5
-        timeout: 1800
-        topology: *build
-
-  fedora-28/simple_replication:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_simple_replication.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/caless:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_caless.py::TestServerReplicaCALessToCAFull
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/external_ca_1:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_external_ca.py::TestExternalCA
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl_1client
-
-  fedora-28/external_ca_2:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_external_ca.py::TestSelfExternalSelf test_integration/test_external_ca.py::TestExternalCAInstall
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/test_topologies:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_topologies.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/test_sudo:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_sudo.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl_1client
-
-  fedora-28/test_commands:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_commands.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/test_kerberos_flags:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_kerberos_flags.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl_1client
-
-  fedora-28/test_http_kdc_proxy:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_http_kdc_proxy.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl_1client
-
-  fedora-28/test_forced_client_enrolment:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_forced_client_reenrollment.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl_1client
-
-  fedora-28/test_advise:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_advise.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/test_testconfig:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_testconfig.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/test_service_permissions:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_service_permissions.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/test_netgroup:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_netgroup.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/test_vault:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_vault.py
-        template: *ci-master-f28
-        timeout: 4500
-        topology: *master_1repl
-
-  fedora-28/test_authconfig:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_authselect.py
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl_1client
-
-  fedora-28/replica_promotion:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_replica_promotion.py::TestSubCAkeyReplication
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl
-
-  fedora-28/dnssec:
-    requires: [fedora-28/build]
-    priority: 50
-    job:
-      class: RunPytest
-      args:
-        build_url: '{fedora-28/build_url}'
-        test_suite: test_integration/test_dnssec.py::TestInstallDNSSECFirst
-        template: *ci-master-f28
-        timeout: 3600
-        topology: *master_1repl

.freeipa-pr-ci.yaml

+ipatests/prci_definitions/gating.yaml
\ No newline at end of file

.gitignore

@@ -119,3 +119,56 @@ freeipa2-dev-doc
 /ipapython/.DEFAULT_PLUGINS
 
 /ipatests/.cache/
+
+# Python scripts with auto-generated shebang
+ipa
+makeaci
+makeapi
+client/ipa-certupdate
+client/ipa-client-automount
+client/ipa-client-install
+daemons/dnssec/ipa-dnskeysyncd
+daemons/dnssec/ipa-dnskeysync-replica
+daemons/dnssec/ipa-ods-exporter
+install/certmonger/dogtag-ipa-ca-renew-agent-submit
+install/certmonger/ipa-server-guard
+install/oddjob/com.redhat.idm.trust-fetch-domains
+install/restart_scripts/renew_ca_cert
+install/restart_scripts/renew_kdc_cert
+install/restart_scripts/renew_ra_cert
+install/restart_scripts/renew_ra_cert_pre
+install/restart_scripts/restart_dirsrv
+install/restart_scripts/restart_httpd
+install/restart_scripts/stop_pkicad
+install/tools/ipa-adtrust-install
+install/tools/ipa-advise
+install/tools/ipa-backup
+install/tools/ipa-cacert-manage
+install/tools/ipa-ca-install
+install/tools/ipa-compat-manage
+install/tools/ipa-csreplica-manage
+install/tools/ipactl
+install/tools/ipa-custodia
+install/tools/ipa-custodia-check
+install/tools/ipa-dns-install
+install/tools/ipa-httpd-kdcproxy
+install/tools/ipa-kra-install
+install/tools/ipa-ldap-updater
+install/tools/ipa-managed-entries
+install/tools/ipa-nis-manage
+install/tools/ipa-otptoken-import
+install/tools/ipa-pkinit-manage
+install/tools/ipa-pki-retrieve-key
+install/tools/ipa-replica-conncheck
+install/tools/ipa-replica-install
+install/tools/ipa-replica-manage
+install/tools/ipa-replica-prepare
+install/tools/ipa-restore
+install/tools/ipa-server-certinstall
+install/tools/ipa-server-install
+install/tools/ipa-server-upgrade
+install/tools/ipa-winsync-migrate
+ipatests/i18n.py
+ipatests/ipa-run-tests
+ipatests/ipa-test-config
+ipatests/ipa-test-task

Contributors.txt

@@ -100,6 +100,7 @@ Developers:
 	Jan Pazdziora
 	W. Michael Petullo
 	Pavel Picka
+	Orion Poplawski
 	Gowrishankar Rajaiyan
 	realsobek
 	Michal Reznik
@@ -108,6 +109,7 @@ Developers:
 	Lynn Root
 	Pete Rowley
 	Lenka Ryznarova
+	Alexander Scheel
 	Thorsten Scherf
 	shanyin
 	Kaleemullah Siddiqui
@@ -121,12 +123,14 @@ Developers:
 	David Spångberg
 	Justin Stephenson
 	Diane Trout
+	Serhii Tsymbaliuk
 	Fraser Tweedale
 	Petr Viktorin
 	Petr Voborník
 	Felipe Volpone
 	Pavel Vomáčka
 	Andrew Wnuk
+	Thomas Woerner
 	Jason Woods
 	Adam Young
 	Mohammad Rizwan Yusuf
@@ -157,15 +161,26 @@ Testing:
 	Yi Zhang
 
 Translators:
-	Héctor Daniel Cabrera
-	Yuri Chornoivan
-	Teguh DC
-	Piotr Drąg
-	Jérôme Fenal
+	Abhijeet Kasurde
+	Andi Chandler
+	Andrew Martynov
+	A S Alam
+	Emilio Herrera
 	Gundachandru
+	Héctor Daniel Cabrera
 	Jake Li
-	Andrew Martynov
+	Jérôme Fenal
+	Marco Aurélio Krause
+	Martin Bašti
+	Olesya Gerasimenko
+	Paul Ritter
+	Pavel Vomacka
+	Piotr Drąg
+	Robert Antoni Buj Gelonch
 	Sankarshan Mukhopadhyay
+	Teguh DC
+	Yuri Chornoivan
+	Zdenek
 
 Wiki, Solution and Idea Contributors:
 	James Hogarth

Makefile.am

+NULL =
+
 ACLOCAL_AMFLAGS = -I m4
 
 if ENABLE_SERVER
@@ -16,20 +18,35 @@ SUBDIRS = asn1 util client contrib po pypi $(PYTHON_SUBDIRS) $(SERVER_SUBDIRS)
 
 GENERATED_PYTHON_FILES = \
 	$(top_builddir)/ipaplatform/override.py \
-	$(top_builddir)/ipapython/version.py
+	$(top_builddir)/ipapython/version.py \
+	$(top_builddir)/makeaci \
+	$(top_builddir)/makeapi \
+	$(NULL)
 
 MOSTLYCLEANFILES = ipasetup.pyc ipasetup.pyo \
 		   pylint_plugins.pyc pylint_plugins.pyo
 
 # user-facing scripts
-dist_bin_SCRIPTS = ipa
+nodist_bin_SCRIPTS = ipa
 
 # files required for build but not installed
-dist_noinst_SCRIPTS = makeapi \
-		      makeaci \
-		      make-doc \
-		      make-test \
-		      pylint_plugins.py
+nodist_noinst_SCRIPTS = \
+	makeapi \
+	makeaci \
+	$(NULL)
+
+dist_noinst_SCRIPTS = \
+	make-doc \
+	make-test \
+	pylint_plugins.py \
+	$(NULL)
+
+# templates
+dist_noinst_DATA = \
+	ipa.in		\
+	makeaci.in	\
+	makeapi.in	\
+	$(NULL)
 
 ipasetup.py: ipasetup.py.in $(CONFIG_STATUS)
 	$(AM_V_GEN)sed						\
@@ -63,7 +80,6 @@ clean-local:
 	rm -rf "$(top_srcdir)/__pycache__"
 	rm -f "$(top_builddir)"/$(PACKAGE)-*.tar.gz
 
-
 # convenience targets for RPM build
 .PHONY: rpmroot rpmdistdir version-update _dist-version-bakein _rpms-prep \
 	rpms _rpms-body srpms _srpms-body
@@ -178,7 +194,7 @@ if WITH_PYTHON3
 	@ # just tests, aci, api and pylint on Python 3
 	PYTHONPATH=$(abspath $(top_srcdir)) $(PYTHON3) ipatests/ipa-run-tests \
 	    --ipaclient-unittests
-	$(MAKE) $(AM_MAKEFLAGS) PYTHON=$(PYTHON3) acilint apilint polint pylint
+	$(MAKE) $(AM_MAKEFLAGS) PYTHON=$(PYTHON3) acilint apilint polint pylint jslint check
 else
 	@echo "WARNING: python3 not available"
 endif
@@ -368,3 +384,13 @@ python_install:
 .PHONY:
 strip-po:
 	$(MAKE) -C po strip-po
+
+PYTHON_SHEBANG = 					\
+	ipa	\
+	makeaci	\
+	makeapi	\
+	$(NULL)
+
+CLEANFILES = $(PYTHON_SHEBANG)
+
+include $(top_srcdir)/Makefile.pythonscripts.am

Makefile.pythonscripts.am

+# special handling of Python scripts with auto-generated shebang line
+$(PYTHON_SHEBANG):%: %.in Makefile
+	$(AM_V_GEN)sed -e 's|@PYTHONSHEBANG[@]|#!$(PYTHON) -E|g' $< > $@
+	$(AM_V_GEN)chmod +x $@

VERSION.m4

@@ -21,7 +21,7 @@
 ########################################################
 define(IPA_VERSION_MAJOR, 4)
 define(IPA_VERSION_MINOR, 7)
-define(IPA_VERSION_RELEASE, 0)
+define(IPA_VERSION_RELEASE, 1)
 
 ########################################################
 # For 'pre' releases the version will be               #

client/Makefile.am

@@ -40,9 +40,9 @@ sbin_PROGRAMS =			\
 	$(NULL)
 
 sbin_SCRIPTS =			\
-	ipa-client-install	\
-	ipa-client-automount	\
 	ipa-certupdate		\
+	ipa-client-automount	\
+	ipa-client-install	\
 	$(NULL)
 
 ipa_getkeytab_SOURCES =		\
@@ -98,10 +98,17 @@ noinst_HEADERS =		\
 	ipa-client-common.h
 
 EXTRA_DIST =			\
-	$(sbin_SCRIPTS)		\
+	ipa-certupdate.in	\
+	ipa-client-automount.in	\
+	ipa-client-install.in	\
 	$(NULL)
 
 install-data-hook:
 	$(INSTALL) -d -m 755 $(DESTDIR)$(IPA_SYSCONF_DIR)/nssdb
 	$(INSTALL) -d -m 755 $(DESTDIR)$(localstatedir)/lib/ipa-client/pki
 	$(INSTALL) -d -m 755 $(DESTDIR)$(localstatedir)/lib/ipa-client/sysrestore
+
+
+PYTHON_SHEBANG = $(sbin_SCRIPTS)
+
+include $(top_srcdir)/Makefile.pythonscripts.am

client/ipa-certupdate → client/ipa-certupdate.in

-#!/usr/bin/python3 -E
+@PYTHONSHEBANG@
 # Authors: Jan Cholasta <jcholast@redhat.com>
 #
 # Copyright (C) 2014  Red Hat

client/ipa-client-automount → client/ipa-client-automount.in

-#!/usr/bin/python3 -E
+@PYTHONSHEBANG@
 #
 # Authors:
 #   Rob Crittenden <rcritten@redhat.com>

client/ipa-client-install → client/ipa-client-install.in

-#!/usr/bin/python3 -E
+@PYTHONSHEBANG@
 # Authors: Simo Sorce <ssorce@redhat.com>
 #          Karl MacMillan <kmacmillan@mentalrootkit.com>
 #

client/ipa-join.c

@@ -371,62 +371,6 @@ done:
     return rval;
 }
 
-/*
- * Get the certificate subject base from the IPA configuration.
- *
- * Not considered a show-stopper if this fails for some reason.
- *
- * The caller is responsible for binding/unbinding to LDAP.
- */
-static int
-get_subject(LDAP *ld, char *ldap_base, const char **subject, int quiet)
-{
-    char *attrs[] = {"ipaCertificateSubjectBase", NULL};
-    char *base = NULL;
-    LDAPMessage *entry, *res = NULL;
-    struct berval **ncvals;
-    int ret, rval = 0;
-
-    ret = asprintf(&base, "cn=ipaconfig,cn=etc,%s", ldap_base);
-    if (ret == -1)
-    {
-        if (!quiet)
-            fprintf(stderr, _("Out of memory!\n"));
-        rval = 3;
-        goto done;
-    }
-
-    ret = ldap_search_ext_s(ld, base, LDAP_SCOPE_BASE,
-                            "objectclass=*", attrs, 0,
-                            NULL, NULL, NULL, 0, &res);
-
-    if (ret != LDAP_SUCCESS) {
-        fprintf(stderr,
-                _("Search for ipaCertificateSubjectBase failed with error %d"),
-                ret);
-        rval = 14;
-        goto done;
-    }
-
-    entry = ldap_first_entry(ld, res);
-    ncvals = ldap_get_values_len(ld, entry, attrs[0]);
-    if (!ncvals) {
-        fprintf(stderr, _("No values for %s"), attrs[0]);
-        rval = 14;
-        goto done;
-    }
-
-    *subject = strdup(ncvals[0]->bv_val);
-
-    ldap_value_free_len(ncvals);
-
-done:
-    free(base);
-    if (res) ldap_msgfree(res);
-
-    return rval;
-}
-
 /* Join a host to the current IPA realm.
  *
  * There are several scenarios for this:
@@ -446,7 +390,7 @@ done:
  * the state of the entry.
  */
 static int
-join_ldap(const char *ipaserver, char *hostname, char ** binddn, const char *bindpw, const char *basedn, const char **princ, const char **subject, int quiet)
+join_ldap(const char *ipaserver, char *hostname, char ** binddn, const char *bindpw, const char *basedn, const char **princ, int quiet)
 {
     LDAP *ld;
     int rval = 0;
@@ -458,7 +402,6 @@ join_ldap(const char *ipaserver, char *hostname, char ** binddn, const char *bin
 
     *binddn = NULL;
     *princ = NULL;
-    *subject = NULL;
 
     if (NULL != basedn) {
         ldap_base = strdup(basedn);
@@ -494,14 +437,6 @@ join_ldap(const char *ipaserver, char *hostname, char ** binddn, const char *bin
         goto done;
     }
 
-    if (get_subject(ld, ldap_base, subject, quiet) != 0) {
-        if (!quiet)
-            fprintf(stderr,
-                    _("Unable to determine certificate subject of %s\n"),
-                    ipaserver);
-        /* Not a critical failure */
-    }
-
     valrequest.bv_val = (char *)hostname;
     valrequest.bv_len = strlen(hostname);
 
@@ -538,7 +473,7 @@ done:
 }
 
 static int
-join_krb5(const char *ipaserver, char *hostname, char **hostdn, const char **princ, const char **subject, int force, int quiet) {
+join_krb5(const char *ipaserver, char *hostname, char **hostdn, const char **princ, int force, int quiet) {
     xmlrpc_env env;
     xmlrpc_value * argArrayP = NULL;
     xmlrpc_value * paramArrayP = NULL;
@@ -550,7 +485,6 @@ join_krb5(const char *ipaserver, char *hostname, char **hostdn, const char **pri
     struct utsname uinfo;
     xmlrpc_value *princP = NULL;
     xmlrpc_value *krblastpwdchangeP = NULL;
-    xmlrpc_value *subjectP = NULL;
     xmlrpc_value *hostdnP = NULL;
     const char *krblastpwdchange = NULL;
     char * url = NULL;
@@ -559,7 +493,6 @@ join_krb5(const char *ipaserver, char *hostname, char **hostdn, const char **pri
     int ret;
 
     *hostdn = NULL;
-    *subject = NULL;
     *princ = NULL;
 
     /* Start up our XML-RPC client library. */
@@ -658,18 +591,6 @@ join_krb5(const char *ipaserver, char *hostname, char **hostdn, const char **pri
         goto cleanup;
     }
 
-    xmlrpc_struct_find_value(&env, structP, "ipacertificatesubjectbase", &subjectP);
-    if (subjectP) {
-        xmlrpc_value * singleprincP = NULL;
-
-        /* FIXME: all values are returned as lists currently. Once this is
-         * fixed we can read the string directly.
-         */
-        xmlrpc_array_read_item(&env, subjectP, 0, &singleprincP);
-        xmlrpc_read_string(&env, singleprincP, *&subject);
-        xmlrpc_DECREF(subjectP);
-    }
-
 cleanup:
     if (argArrayP) xmlrpc_DECREF(argArrayP);
     if (paramArrayP) xmlrpc_DECREF(paramArrayP);
@@ -922,7 +843,6 @@ join(const char *server, const char *hostname, const char *bindpw, const char *b
     char *iparealm = NULL;
     char * host = NULL;
     const char * princ = NULL;
-    const char * subject = NULL;
     char * hostdn = NULL;
     struct utsname uinfo;
 
@@ -963,7 +883,7 @@ join(const char *server, const char *hostname, const char *bindpw, const char *b
     }
 
     if (bindpw)
-        rval = join_ldap(ipaserver, host, &hostdn, bindpw, basedn, &princ, &subject, quiet);
+        rval = join_ldap(ipaserver, host, &hostdn, bindpw, basedn, &princ, quiet);
     else {
         krberr = krb5_init_context(&krbctx);
         if (krberr) {
@@ -987,7 +907,7 @@ join(const char *server, const char *hostname, const char *bindpw, const char *b
             rval = 6;
             goto cleanup;
         }
-        rval = join_krb5(ipaserver, host, &hostdn, &princ, &subject, force,
+        rval = join_krb5(ipaserver, host, &hostdn, &princ, force,
                          quiet);
     }
 
@@ -1049,11 +969,7 @@ join(const char *server, const char *hostname, const char *bindpw, const char *b
     }
 
 cleanup:
-    if (NULL != subject && !quiet && rval == 0)
-        fprintf(stderr, _("Certificate subject base is: %s\n"), subject);
-
     free((char *)princ);
-    free((char *)subject);
     free(host);
 
     if (bindpw)

configure.ac

@@ -100,11 +100,27 @@ PKG_CHECK_MODULES([CRYPTO], [libcrypto])
 
 dnl ---------------------------------------------------------------------------
 dnl - Check for Python
+dnl - Check for platform Python interpreter
 dnl - Check for Python 2/3 for devcheck
 dnl ---------------------------------------------------------------------------
 
+AS_IF([test "x${PYTHON}" != "x"], [
+    AC_MSG_NOTICE([Python user override detected, ${PYTHON}])
+])
+
+AC_MSG_NOTICE([Checking for platform Python])
+AC_PATH_PROG(PLATFORM_PYTHON, platform-python, [], [/usr/libexec$PATH_SEPARATOR$PATH])
 AC_MSG_NOTICE([Checking for Python 3])
-AC_PATH_PROG(PYTHON3, python3)
+AC_PATH_PROGS(PYTHON3, python3)
+
+dnl Only use platform-python when there is no override
+if test \( "x${PLATFORM_PYTHON}" != "x" -a "x${PYTHON}" = "x" \); then
+    dnl platform-python executable detected (it's always Python 3)
+    AC_MSG_NOTICE([Using platform Python as default Python 3 interpreter])
+    PYTHON3=${PLATFORM_PYTHON}
+    PYTHON=${PLATFORM_PYTHON}
+fi
+
 AC_SUBST([PYTHON3])
 AM_CONDITIONAL([WITH_PYTHON3], [test "x${PYTHON3}" != "x"])
 
@@ -123,6 +139,7 @@ elif test "x${PYTHON3}" != "x"; then
     AM_PATH_PYTHON(3.6)
 fi
 
+
 dnl ---------------------------------------------------------------------------
 dnl - Check for cmocka unit test framework http://cmocka.cryptomilk.org/
 dnl ---------------------------------------------------------------------------

daemons/dnssec/Makefile.am

@@ -3,7 +3,7 @@
 AUTOMAKE_OPTIONS = 1.7
 
 appdir = $(libexecdir)/ipa/
-dist_app_SCRIPTS = 		\
+nodist_app_SCRIPTS = 		\
 	ipa-dnskeysyncd		\
 	ipa-dnskeysync-replica	\
 	ipa-ods-exporter
@@ -11,14 +11,18 @@ dist_app_SCRIPTS = 		\
 dist_noinst_DATA = 				\
 	ipa-dnskeysyncd.service.in		\
 	ipa-ods-exporter.service.in		\
-	ipa-ods-exporter.socket.in
+	ipa-ods-exporter.socket.in		\
+	ipa-dnskeysyncd.in		\
+	ipa-dnskeysync-replica.in	\
+	ipa-ods-exporter.in
+
 
 systemdsystemunit_DATA = 		\
 	ipa-dnskeysyncd.service		\
 	ipa-ods-exporter.service	\
 	ipa-ods-exporter.socket
 
-CLEANFILES = $(systemdsystemunit_DATA)
+CLEANFILES = $(systemdsystemunit_DATA) $(nodist_app_SCRIPTS)
 
 %: %.in Makefile
 	sed \
@@ -32,3 +36,9 @@ CLEANFILES = $(systemdsystemunit_DATA)
 dnssecconfdir = $(IPA_SYSCONF_DIR)/dnssec
 install-data-hook:
 	$(INSTALL) -d -m 755 $(DESTDIR)$(dnssecconfdir)
+
+PYTHON_SHEBANG = 					\
+	$(nodist_app_SCRIPTS)	\
+	$(NULL)
+
+include $(top_srcdir)/Makefile.pythonscripts.am

daemons/dnssec/ipa-dnskeysync-replica → daemons/dnssec/ipa-dnskeysync-replica.in

-#!/usr/bin/python3
+@PYTHONSHEBANG@
 #
 # Copyright (C) 2014  FreeIPA Contributors see COPYING for license
 #

daemons/dnssec/ipa-dnskeysyncd → daemons/dnssec/ipa-dnskeysyncd.in

-#!/usr/bin/python3
+@PYTHONSHEBANG@
 #
 # Copyright (C) 2014  FreeIPA Contributors see COPYING for license
 #

daemons/dnssec/ipa-ods-exporter → daemons/dnssec/ipa-ods-exporter.in

-#!/usr/bin/python3
+@PYTHONSHEBANG@
 #
 # Copyright (C) 2014  FreeIPA Contributors see COPYING for license
 #

daemons/ipa-otpd/Makefile.am

@@ -21,3 +21,15 @@ ipa_otpd_SOURCES = bind.c forward.c main.c parse.c query.c queue.c stdio.c
 	     $< > $@
 
 CLEANFILES = $(systemdsystemunit_DATA)
+
+TESTS =
+check_PROGRAMS =
+
+if HAVE_CMOCKA
+TESTS += queue_tests
+check_PROGRAMS += queue_tests
+endif
+
+queue_tests_SOURCES = ipa_otpd_queue_cmocka_tests.c queue.c
+queue_tests_CFLAGS = $(CMOCKA_CFLAGS)
+queue_tests_LDADD = $(CMOCKA_LIBS)

daemons/ipa-otpd/ipa_otpd_queue_cmocka_tests.c

+/*
+ * FreeIPA 2FA companion daemon - internal queue tests
+ *
+ * Author: Robbie Harwood <rharwood@redhat.com>
+ *
+ * Copyright (C) 2018  Robbie Harwood, Red Hat
+ * see file 'COPYING' for use and warranty information
+ *
+ * This program is free software you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <setjmp.h>
+#include <stdarg.h>
+#include <stddef.h>
+
+#include <cmocka.h>
+
+#include "internal.h"
+
+/* Bypass otpd queue allocation/freeing to avoid calling into LDAP and
+ * krad.  No effort is made to make the types match. */
+static struct otpd_queue_item *new_elt(int id)
+{
+    krb5_error_code ret;
+    struct otpd_queue_item *e = NULL;
+
+    ret = otpd_queue_item_new(NULL, &e);
+    assert_int_equal(ret, 0);
+    assert_ptr_not_equal(e, NULL);
+
+    e->msgid = id;
+    return e;
+}
+static void free_elt(struct otpd_queue_item **e)
+{
+    assert_ptr_not_equal(e, NULL);
+    free(*e);
+    *e = NULL;
+}
+static void free_elts(struct otpd_queue *q)
+{
+    assert_ptr_not_equal(q, NULL);
+    for (struct otpd_queue_item *e = otpd_queue_pop(q); e != NULL;
+         e = otpd_queue_pop(q))
+        free_elt(&e);
+}
+#define otpd_queue_item_new new_elt
+#define otpd_queue_item_free free_elt
+#define otpd_queue_free_items free_elts
+
+static void assert_elt_equal(struct otpd_queue_item *e1,
+                             struct otpd_queue_item *e2)
+{
+    if (e1 == NULL && e2 == NULL)
+        return;
+    assert_ptr_not_equal(e1, NULL);
+    assert_ptr_not_equal(e2, NULL);
+    assert_int_equal(e1->msgid, e2->msgid);
+}
+
+static void test_single_insert()
+{
+    struct otpd_queue q = { NULL };
+    struct otpd_queue_item *ein, *eout;
+
+    ein = new_elt(0);
+    otpd_queue_push(&q, ein);
+
+    eout = otpd_queue_peek(&q);
+    assert_elt_equal(ein, eout);
+
+    eout = otpd_queue_pop(&q);
+    assert_elt_equal(ein, eout);
+    free_elt(&eout);
+
+    eout = otpd_queue_pop(&q);
+    assert_ptr_equal(eout, NULL);
+
+    free_elts(&q);
+}
+
+static void test_jump_insert()
+{
+    struct otpd_queue q = { NULL };
+    struct otpd_queue_item *echeck;
+
+    for (int i = 0; i < 3; i++) {
+        struct otpd_queue_item *e = new_elt(i);
+        otpd_queue_push_head(&q, e);
+
+        echeck = otpd_queue_peek(&q);
+        assert_elt_equal(e, echeck);
+    }
+
+    free_elts(&q);
+}
+
+static void test_garbage_insert()
+{
+    struct otpd_queue q = { NULL };
+    struct otpd_queue_item *e, *g;
+
+    g = new_elt(0);
+    g->next = g;
+    otpd_queue_push(&q, g);
+
+    e = otpd_queue_peek(&q);
+    assert_ptr_equal(e->next, NULL);
+
+    free_elts(&q);
+}
+
+static void test_removal()
+{
+    struct otpd_queue q = { NULL };
+
+    for (int i = 0; i < 3; i++) {
+        struct otpd_queue_item *e = new_elt(i);
+        otpd_queue_push(&q, e);
+    }
+    for (int i = 0; i < 3; i++) {
+        struct otpd_queue_item *e = otpd_queue_pop(&q);
+        assert_ptr_not_equal(e, NULL);
+        assert_ptr_equal(e->next, NULL);
+        assert_int_equal(e->msgid, i);
+        free_elt(&e);
+    }
+}
+
+static void pick_id(struct otpd_queue *q, int msgid)
+{
+    struct otpd_queue_item *e;
+
+    e = otpd_queue_pop_msgid(q, msgid);
+    assert_int_equal(e->msgid, msgid);
+    assert_ptr_equal(e->next, NULL);
+    free_elt(&e);
+    e = otpd_queue_pop_msgid(q, msgid);
+    assert_ptr_equal(e, NULL);
+}
+static void test_pick_removal()
+{
+    struct otpd_queue q = { NULL };
+
+    for (int i = 0; i < 4; i++) {
+        struct otpd_queue_item *e = new_elt(i);
+        otpd_queue_push(&q, e);
+    }
+
+    pick_id(&q, 0); /* first */
+    pick_id(&q, 2); /* middle */
+    pick_id(&q, 3); /* last */
+    pick_id(&q, 1); /* singleton */
+
+    free_elts(&q);
+}
+
+static void test_iter()
+{
+    krb5_error_code ret;
+    struct otpd_queue q = { NULL };
+    const struct otpd_queue *queues[3];
+    struct otpd_queue_iter *iter = NULL;
+    const krad_packet *p = NULL;
+
+    for (ptrdiff_t i = 1; i <= 3; i++) {
+        struct otpd_queue_item *e = new_elt(i);
+        e->req = (void *)i;
+        otpd_queue_push(&q, e);
+    }
+
+    queues[0] = &q;
+    queues[1] = &q;
+    queues[2] = NULL;
+    ret = otpd_queue_iter_new(queues, &iter);
+    assert_int_equal(ret, 0);
+    assert_ptr_not_equal(iter, NULL);
+
+    for (ptrdiff_t i = 0; i < 6; i++) {
+        p = otpd_queue_iter_func(iter, FALSE);
+        assert_ptr_equal(p, (void *) (i % 3 + 1));
+    }
+    p = otpd_queue_iter_func(iter, FALSE);
+    assert_ptr_equal(p, NULL);
+
+    free_elts(&q);
+}
+
+int main(int argc, char *argv[])
+{
+    const struct CMUnitTest tests[] = {
+        cmocka_unit_test(test_single_insert),
+        cmocka_unit_test(test_jump_insert),
+        cmocka_unit_test(test_garbage_insert),
+        cmocka_unit_test(test_removal),
+        cmocka_unit_test(test_pick_removal),
+        cmocka_unit_test(test_iter),
+    };
+
+    return cmocka_run_group_tests(tests, NULL, NULL);
+}

daemons/ipa-otpd/queue.c

@@ -111,6 +111,8 @@ void otpd_queue_push(struct otpd_queue *q, struct otpd_queue_item *item)
         q->head = q->tail = item;
     else
         q->tail = q->tail->next = item;
+
+    item->next = NULL;
 }
 
 void otpd_queue_push_head(struct otpd_queue *q, struct otpd_queue_item *item)
@@ -118,6 +120,8 @@ void otpd_queue_push_head(struct otpd_queue *q, struct otpd_queue_item *item)
     if (item == NULL)
         return;
 
+    item->next = NULL;
+
     if (q->head == NULL)
         q->tail = q->head = item;
     else {
@@ -145,6 +149,8 @@ struct otpd_queue_item *otpd_queue_pop(struct otpd_queue *q)
     if (q->head == NULL)
         q->tail = NULL;
 
+    if (item != NULL)
+        item->next = NULL;
     return item;
 }
 
@@ -160,6 +166,7 @@ struct otpd_queue_item *otpd_queue_pop_msgid(struct otpd_queue *q, int msgid)
             *prev = item->next;
             if (q->head == NULL)
                 q->tail = NULL;
+            item->next = NULL;
             return item;
         }
     }