4.5.3-1: Update to upstream 4.5.3

Signed-off-by: Tomas Krizek <tkrizek@redhat.com>

.gitignore

@@ -53,3 +53,5 @@
 /freeipa-4.5.1.tar.gz.asc
 /freeipa-4.5.2.tar.gz
 /freeipa-4.5.2.tar.gz.asc
+/freeipa-4.5.3.tar.gz
+/freeipa-4.5.3.tar.gz.asc

0002-Fix-IP-Address-Checks.patch

@@ -1,532 +0,0 @@
-From d010191d170c0ebb5f46bac2fc528f788e8ffc41 Mon Sep 17 00:00:00 2001
-From: Martin Basti <mbasti@redhat.com>
-Date: Tue, 13 Jun 2017 17:03:30 +0200
-Subject: [PATCH 1/7] Fix local IP address validation
-
-Previously bf9886a84393d1d1546db7e49b102e08a16a83e7 match_local has
-undesirable side effect that CheckedIPAddress object has set self._net
-from local interface.
-
-However with the recent changes, match_local is usually set to False,
-thus this side effect stops happening and default mask per address class
-is used. This causes validation error because mask on interface and mask
-used for provided IP addresses differ (reporducible only with classless
-masks).
-
-FreeIPA should compare only IP addresses with local addresses without masks
-
-https://pagure.io/freeipa/issue/4317
-
-Reviewed-By: David Kupka <dkupka@redhat.com>
----
- ipapython/ipautil.py | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py
-index a277ed8..647ee83 100644
---- a/ipapython/ipautil.py
-+++ b/ipapython/ipautil.py
-@@ -216,10 +216,10 @@ class CheckedIPAddress(UnsafeIPAddress):
-                     addr=ifaddr,
-                     netmask=ifdata['netmask']
-                 ))
--                if ifnet == self._net or (
--                                self._net is None and ifnet.ip == self):
--                    self._net = ifnet
-+
-+                if ifnet.ip == self:
-                     iface = interface
-+                    self._net = ifnet
-                     break
- 
-         return iface
--- 
-2.9.4
-
-
-From 4d06f0c52200a4345db36dae3fdbc178f18f2f01 Mon Sep 17 00:00:00 2001
-From: Martin Basti <mbasti@redhat.com>
-Date: Wed, 14 Jun 2017 14:45:03 +0200
-Subject: [PATCH 2/7] ipa-dns-install: remove check for local ip address
-
-This check was forgotten and will be removed now.
-
-https://pagure.io/freeipa/issue/4317
-
-Reviewed-By: David Kupka <dkupka@redhat.com>
----
- install/tools/ipa-dns-install | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/install/tools/ipa-dns-install b/install/tools/ipa-dns-install
-index 5bd0ba6..cb6c5d8 100755
---- a/install/tools/ipa-dns-install
-+++ b/install/tools/ipa-dns-install
-@@ -47,7 +47,9 @@ def parse_options():
-                       default=False, help="print debugging information")
-     parser.add_option("--ip-address", dest="ip_addresses", metavar="IP_ADDRESS",
-                       default=[], action="append",
--                      type="ip", ip_local=True, help="Master Server IP Address. This option can be used multiple times")
-+                      type="ip",
-+                      help="Master Server IP Address. This option can be used "
-+                           "multiple times")
-     parser.add_option("--forwarder", dest="forwarders", action="append",
-                       type="ip", help="Add a DNS forwarder. This option can be used multiple times")
-     parser.add_option("--no-forwarders", dest="no_forwarders", action="store_true",
--- 
-2.9.4
-
-
-From 0aa0041149f359f1954409baf886d4b31fdadc16 Mon Sep 17 00:00:00 2001
-From: Martin Basti <mbasti@redhat.com>
-Date: Wed, 14 Jun 2017 14:47:23 +0200
-Subject: [PATCH 3/7] refactor CheckedIPAddress class
-
-Make methods without side effects (setting mask)
-
-https://pagure.io/freeipa/issue/4317
-
-Reviewed-By: David Kupka <dkupka@redhat.com>
----
- ipapython/ipautil.py | 29 ++++++++++++++++++++++-------
- 1 file changed, 22 insertions(+), 7 deletions(-)
-
-diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py
-index 647ee83..2c020e3 100644
---- a/ipapython/ipautil.py
-+++ b/ipapython/ipautil.py
-@@ -62,6 +62,12 @@ PROTOCOL_NAMES = {
-     socket.SOCK_DGRAM: 'udp'
- }
- 
-+InterfaceDetails = collections.namedtuple(
-+    'InterfaceDetails', [
-+        'name',  # interface name
-+        'ifnet'  # network details of interface
-+    ])
-+
- 
- class UnsafeIPAddress(netaddr.IPAddress):
-     """Any valid IP address with or without netmask."""
-@@ -161,9 +167,12 @@ class CheckedIPAddress(UnsafeIPAddress):
-             raise ValueError("cannot use multicast IP address {}".format(addr))
- 
-         if match_local:
--            if not self.get_matching_interface():
-+            intf_details = self.get_matching_interface()
-+            if not intf_details:
-                 raise ValueError('no network interface matches the IP address '
-                                  'and netmask {}'.format(addr))
-+            else:
-+                self.set_ip_net(intf_details.ifnet)
- 
-         if self._net is None:
-             if self.version == 4:
-@@ -193,7 +202,8 @@ class CheckedIPAddress(UnsafeIPAddress):
- 
-     def get_matching_interface(self):
-         """Find matching local interface for address
--        :return: Interface name or None if no interface has this address
-+        :return: InterfaceDetails named tuple or None if no interface has
-+        this address
-         """
-         if self.version == 4:
-             family = netifaces.AF_INET
-@@ -204,7 +214,6 @@ class CheckedIPAddress(UnsafeIPAddress):
-                 "Unsupported address family ({})".format(self.version)
-             )
- 
--        iface = None
-         for interface in netifaces.interfaces():
-             for ifdata in netifaces.ifaddresses(interface).get(family, []):
- 
-@@ -218,11 +227,17 @@ class CheckedIPAddress(UnsafeIPAddress):
-                 ))
- 
-                 if ifnet.ip == self:
--                    iface = interface
--                    self._net = ifnet
--                    break
-+                    return InterfaceDetails(interface, ifnet)
- 
--        return iface
-+    def set_ip_net(self, ifnet):
-+        """Set IP Network details for this address. IPNetwork is valid only
-+        locally, so this should be set only for local IP addresses
-+
-+        :param ifnet: netaddr.IPNetwork object with information about IP
-+        network where particula address belongs locally
-+        """
-+        assert isinstance(ifnet, netaddr.IPNetwork)
-+        self._net = ifnet
- 
- 
- def valid_ip(addr):
--- 
-2.9.4
-
-
-From 9a924dd8cc27507a70f4ec5020d97417e149e350 Mon Sep 17 00:00:00 2001
-From: Martin Basti <mbasti@redhat.com>
-Date: Wed, 14 Jun 2017 14:54:43 +0200
-Subject: [PATCH 4/7] CheckedIPAddress: remove match_local param
-
-This parameter is unused in code. We are no longer testing if IP address
-matches an interface in constructor.
-
-https://pagure.io/freeipa/issue/4317
-
-Reviewed-By: David Kupka <dkupka@redhat.com>
----
- ipapython/config.py                     |  5 ++---
- ipapython/ipautil.py                    | 10 +---------
- ipaserver/install/installutils.py       |  2 +-
- ipaserver/plugins/dns.py                |  4 ++--
- ipaserver/plugins/host.py               |  2 +-
- ipatests/test_ipapython/test_ipautil.py |  3 +--
- 6 files changed, 8 insertions(+), 18 deletions(-)
-
-diff --git a/ipapython/config.py b/ipapython/config.py
-index 9db2dcd..6349892 100644
---- a/ipapython/config.py
-+++ b/ipapython/config.py
-@@ -68,10 +68,9 @@ class IPAFormatter(IndentedHelpFormatter):
- def check_ip_option(option, opt, value):
-     from ipapython.ipautil import CheckedIPAddress
- 
--    ip_local = option.ip_local is True
-     ip_netmask = option.ip_netmask is True
-     try:
--        return CheckedIPAddress(value, parse_netmask=ip_netmask, match_local=ip_local)
-+        return CheckedIPAddress(value, parse_netmask=ip_netmask)
-     except Exception as e:
-         raise OptionValueError("option %s: invalid IP address %s: %s" % (opt, value, e))
- 
-@@ -86,7 +85,7 @@ class IPAOption(Option):
-     optparse.Option subclass with support of options labeled as
-     security-sensitive such as passwords.
-     """
--    ATTRS = Option.ATTRS + ["sensitive", "ip_local", "ip_netmask"]
-+    ATTRS = Option.ATTRS + ["sensitive", "ip_netmask"]
-     TYPES = Option.TYPES + ("ip", "dn")
-     TYPE_CHECKER = copy(Option.TYPE_CHECKER)
-     TYPE_CHECKER["ip"] = check_ip_option
-diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py
-index 2c020e3..5a6bf5a 100644
---- a/ipapython/ipautil.py
-+++ b/ipapython/ipautil.py
-@@ -135,7 +135,7 @@ class CheckedIPAddress(UnsafeIPAddress):
- 
-     Reserved or link-local addresses are never accepted.
-     """
--    def __init__(self, addr, match_local=False, parse_netmask=True,
-+    def __init__(self, addr, parse_netmask=True,
-                  allow_loopback=False, allow_multicast=False):
-         try:
-             super(CheckedIPAddress, self).__init__(addr)
-@@ -166,14 +166,6 @@ class CheckedIPAddress(UnsafeIPAddress):
-         if not allow_multicast and self.is_multicast():
-             raise ValueError("cannot use multicast IP address {}".format(addr))
- 
--        if match_local:
--            intf_details = self.get_matching_interface()
--            if not intf_details:
--                raise ValueError('no network interface matches the IP address '
--                                 'and netmask {}'.format(addr))
--            else:
--                self.set_ip_net(intf_details.ifnet)
--
-         if self._net is None:
-             if self.version == 4:
-                 self._net = netaddr.IPNetwork(
-diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py
-index 3521d55..01930c4 100644
---- a/ipaserver/install/installutils.py
-+++ b/ipaserver/install/installutils.py
-@@ -585,7 +585,7 @@ def get_server_ip_address(host_name, unattended, setup_dns, ip_addresses):
-     if len(hostaddr):
-         for ha in hostaddr:
-             try:
--                ips.append(ipautil.CheckedIPAddress(ha, match_local=False))
-+                ips.append(ipautil.CheckedIPAddress(ha))
-             except ValueError as e:
-                 root_logger.warning("Invalid IP address %s for %s: %s", ha, host_name, unicode(e))
- 
-diff --git a/ipaserver/plugins/dns.py b/ipaserver/plugins/dns.py
-index f0e6c48..f01baf5 100644
---- a/ipaserver/plugins/dns.py
-+++ b/ipaserver/plugins/dns.py
-@@ -567,7 +567,7 @@ def add_records_for_host_validation(option_name, host, domain, ip_addresses, che
-     for ip_address in ip_addresses:
-         try:
-             ip = CheckedIPAddress(
--                ip_address, match_local=False, allow_multicast=True)
-+                ip_address, allow_multicast=True)
-         except Exception as e:
-             raise errors.ValidationError(name=option_name, error=unicode(e))
- 
-@@ -599,7 +599,7 @@ def add_records_for_host(host, domain, ip_addresses, add_forward=True, add_rever
- 
-     for ip_address in ip_addresses:
-         ip = CheckedIPAddress(
--            ip_address, match_local=False, allow_multicast=True)
-+            ip_address, allow_multicast=True)
- 
-         if add_forward:
-             add_forward_record(domain, host, unicode(ip))
-diff --git a/ipaserver/plugins/host.py b/ipaserver/plugins/host.py
-index 1e1f9d8..364e5be 100644
---- a/ipaserver/plugins/host.py
-+++ b/ipaserver/plugins/host.py
-@@ -245,7 +245,7 @@ def validate_ipaddr(ugettext, ipaddr):
-     Verify that we have either an IPv4 or IPv6 address.
-     """
-     try:
--        CheckedIPAddress(ipaddr, match_local=False)
-+        CheckedIPAddress(ipaddr)
-     except Exception as e:
-         return unicode(e)
-     return None
-diff --git a/ipatests/test_ipapython/test_ipautil.py b/ipatests/test_ipapython/test_ipautil.py
-index 6427935..9c351bd 100644
---- a/ipatests/test_ipapython/test_ipautil.py
-+++ b/ipatests/test_ipapython/test_ipautil.py
-@@ -30,11 +30,10 @@ from ipapython import ipautil
- 
- pytestmark = pytest.mark.tier0
- 
--
- def make_ipaddress_checker(addr, words=None, prefixlen=None):
-     def check_ipaddress():
-         try:
--            ip = ipautil.CheckedIPAddress(addr, match_local=False)
-+            ip = ipautil.CheckedIPAddress(addr)
-             assert ip.words == words and ip.prefixlen == prefixlen
-         except Exception:
-             assert words is None and prefixlen is None
--- 
-2.9.4
-
-
-From 217905a20071b55b50568e8fbb36a8ecde974432 Mon Sep 17 00:00:00 2001
-From: Martin Basti <mbasti@redhat.com>
-Date: Wed, 14 Jun 2017 15:02:21 +0200
-Subject: [PATCH 5/7] Remove ip_netmask from option parser
-
-ipa-dns-install uses ip_netmask=False --> parse_netmask=False, other installers uses default (parse_netmask=True).
-Use this consistent accross all installers.
-
-Also this option is unused (and shouldn't be used).
-
-https://pagure.io/freeipa/issue/4317
-
-Reviewed-By: David Kupka <dkupka@redhat.com>
----
- ipapython/config.py | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/ipapython/config.py b/ipapython/config.py
-index 6349892..19abfc5 100644
---- a/ipapython/config.py
-+++ b/ipapython/config.py
-@@ -68,9 +68,8 @@ class IPAFormatter(IndentedHelpFormatter):
- def check_ip_option(option, opt, value):
-     from ipapython.ipautil import CheckedIPAddress
- 
--    ip_netmask = option.ip_netmask is True
-     try:
--        return CheckedIPAddress(value, parse_netmask=ip_netmask)
-+        return CheckedIPAddress(value)
-     except Exception as e:
-         raise OptionValueError("option %s: invalid IP address %s: %s" % (opt, value, e))
- 
-@@ -85,7 +84,7 @@ class IPAOption(Option):
-     optparse.Option subclass with support of options labeled as
-     security-sensitive such as passwords.
-     """
--    ATTRS = Option.ATTRS + ["sensitive", "ip_netmask"]
-+    ATTRS = Option.ATTRS + ["sensitive"]
-     TYPES = Option.TYPES + ("ip", "dn")
-     TYPE_CHECKER = copy(Option.TYPE_CHECKER)
-     TYPE_CHECKER["ip"] = check_ip_option
--- 
-2.9.4
-
-
-From 93ef10292ca674842c79da0dab6de6fb63261881 Mon Sep 17 00:00:00 2001
-From: Martin Basti <mbasti@redhat.com>
-Date: Thu, 15 Jun 2017 10:26:03 +0200
-Subject: [PATCH 6/7] replica install: add missing check for non-local IP
- address
-
-Add missing warning for used non-local IP address.
-
-https://pagure.io/freeipa/issue/4317
-
-Reviewed-By: David Kupka <dkupka@redhat.com>
----
- ipaserver/install/server/replicainstall.py | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
-index 6620f02..9e328bf 100644
---- a/ipaserver/install/server/replicainstall.py
-+++ b/ipaserver/install/server/replicainstall.py
-@@ -854,6 +854,7 @@ def install_check(installer):
-             # check addresses here, dns module is doing own check
-             network_ip_address_warning(config.ips)
-             broadcast_ip_address_warning(config.ips)
-+            no_matching_interface_for_ip_address_warning(config.ips)
- 
-         if options.setup_adtrust:
-             adtrust.install_check(False, options, remote_api)
--- 
-2.9.4
-
-
-From 1c961161873c37cb29a51baeeed0e782cd4a1d4d Mon Sep 17 00:00:00 2001
-From: Martin Basti <mbasti@redhat.com>
-Date: Thu, 15 Jun 2017 10:27:55 +0200
-Subject: [PATCH 7/7] Remove network and broadcast address warnings
-
-We cannot reliably determine when an IP Address is network or broadcast.
-We allowed to use non-local IP addresses due container use cases, we
-don't know subnets of used IP addresses.
-
-https://pagure.io/freeipa/issue/4317
-
-Reviewed-By: David Kupka <dkupka@redhat.com>
----
- ipaclient/install/client.py                |  4 ----
- ipalib/util.py                             | 20 --------------------
- ipaserver/install/dns.py                   |  2 --
- ipaserver/install/server/install.py        |  4 ----
- ipaserver/install/server/replicainstall.py | 10 +---------
- 5 files changed, 1 insertion(+), 39 deletions(-)
-
-diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py
-index b0de596..c880613 100644
---- a/ipaclient/install/client.py
-+++ b/ipaclient/install/client.py
-@@ -38,8 +38,6 @@ from ipalib.install.kinit import kinit_keytab, kinit_password
- from ipalib.install.service import enroll_only, prepare_only
- from ipalib.rpc import delete_persistent_client_session_data
- from ipalib.util import (
--    broadcast_ip_address_warning,
--    network_ip_address_warning,
-     normalize_hostname,
-     no_matching_interface_for_ip_address_warning,
-     verify_host_resolvable,
-@@ -1299,8 +1297,6 @@ def update_dns(server, hostname, options):
-         root_logger.info("Failed to determine this machine's ip address(es).")
-         return
- 
--    network_ip_address_warning(update_ips)
--    broadcast_ip_address_warning(update_ips)
-     no_matching_interface_for_ip_address_warning(update_ips)
- 
-     update_txt = "debug\n"
-diff --git a/ipalib/util.py b/ipalib/util.py
-index 1bd8495..31e7323 100644
---- a/ipalib/util.py
-+++ b/ipalib/util.py
-@@ -1110,26 +1110,6 @@ def check_principal_realm_in_trust_namespace(api_instance, *keys):
-                         'namespace'))
- 
- 
--def network_ip_address_warning(addr_list):
--    for ip in addr_list:
--        if ip.is_network_addr():
--            root_logger.warning("IP address %s might be network address", ip)
--            # fixme: once when loggers will be fixed, we can remove this
--            # print
--            print("WARNING: IP address {} might be network address".format(ip),
--                  file=sys.stderr)
--
--
--def broadcast_ip_address_warning(addr_list):
--    for ip in addr_list:
--        if ip.is_broadcast_addr():
--            root_logger.warning("IP address %s might be broadcast address", ip)
--            # fixme: once when loggers will be fixed, we can remove this
--            # print
--            print("WARNING: IP address {} might be broadcast address".format(
--                ip), file=sys.stderr)
--
--
- def no_matching_interface_for_ip_address_warning(addr_list):
-     for ip in addr_list:
-         if not ip.get_matching_interface():
-diff --git a/ipaserver/install/dns.py b/ipaserver/install/dns.py
-index 090b794..1c1aac0 100644
---- a/ipaserver/install/dns.py
-+++ b/ipaserver/install/dns.py
-@@ -264,8 +264,6 @@ def install_check(standalone, api, replica, options, hostname):
-     ip_addresses = get_server_ip_address(hostname, options.unattended,
-                                          True, options.ip_addresses)
- 
--    util.network_ip_address_warning(ip_addresses)
--    util.broadcast_ip_address_warning(ip_addresses)
-     util.no_matching_interface_for_ip_address_warning(ip_addresses)
- 
-     if not options.forward_policy:
-diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
-index 7eb291e..dced253 100644
---- a/ipaserver/install/server/install.py
-+++ b/ipaserver/install/server/install.py
-@@ -27,8 +27,6 @@ from ipalib import api, errors, x509
- from ipalib.constants import DOMAIN_LEVEL_0
- from ipalib.util import (
-     validate_domain_name,
--    network_ip_address_warning,
--    broadcast_ip_address_warning,
-     no_matching_interface_for_ip_address_warning,
- )
- import ipaclient.install.ntpconf
-@@ -616,8 +614,6 @@ def install_check(installer):
-                                              options.ip_addresses)
- 
-         # check addresses here, dns module is doing own check
--        network_ip_address_warning(ip_addresses)
--        broadcast_ip_address_warning(ip_addresses)
-         no_matching_interface_for_ip_address_warning(ip_addresses)
- 
-     if options.setup_adtrust:
-diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
-index 9e328bf..4f28de2 100644
---- a/ipaserver/install/server/replicainstall.py
-+++ b/ipaserver/install/server/replicainstall.py
-@@ -32,11 +32,7 @@ from ipaplatform.tasks import tasks
- from ipaplatform.paths import paths
- from ipalib import api, constants, create_api, errors, rpc, x509
- from ipalib.config import Env
--from ipalib.util import (
--    network_ip_address_warning,
--    broadcast_ip_address_warning,
--    no_matching_interface_for_ip_address_warning,
--)
-+from ipalib.util import no_matching_interface_for_ip_address_warning
- from ipaclient.install.client import configure_krb5_conf, purge_host_keytab
- from ipaserver.install import (
-     adtrust, bindinstance, ca, certs, dns, dsinstance, httpinstance,
-@@ -852,8 +848,6 @@ def install_check(installer):
-                 options.ip_addresses)
- 
-             # check addresses here, dns module is doing own check
--            network_ip_address_warning(config.ips)
--            broadcast_ip_address_warning(config.ips)
-             no_matching_interface_for_ip_address_warning(config.ips)
- 
-         if options.setup_adtrust:
-@@ -1285,8 +1279,6 @@ def promote_check(installer):
-                 False, options.ip_addresses)
- 
-             # check addresses here, dns module is doing own check
--            network_ip_address_warning(config.ips)
--            broadcast_ip_address_warning(config.ips)
-             no_matching_interface_for_ip_address_warning(config.ips)
- 
-         if options.setup_adtrust:
--- 
-2.9.4
-

0003-python-netifaces-update-to-reflect-upstream-changes.patch

@@ -1,56 +0,0 @@
-From 56d04b3dccc967630d869006dfbd0003fcfedabe Mon Sep 17 00:00:00 2001
-From: Martin Basti <mbasti@redhat.com>
-Date: Fri, 16 Jun 2017 13:42:53 +0200
-Subject: [PATCH] python-netifaces: update to reflect upstream changes
-
-python-netifaces now provides IPv6 netmask in format mask/prefix. It
-breaks freeipa as it is unexpected format for python-netaddr. We must
-split netmask and provide only prefix for netaddr.
-
-https://pagure.io/freeipa/issue/7021
-
-Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
-Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
----
- ipapython/ipautil.py | 17 ++++++++++++++---
- 1 file changed, 14 insertions(+), 3 deletions(-)
-
-diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py
-index 5a6bf5a..1bb48d4 100644
---- a/ipapython/ipautil.py
-+++ b/ipapython/ipautil.py
-@@ -197,6 +197,7 @@ class CheckedIPAddress(UnsafeIPAddress):
-         :return: InterfaceDetails named tuple or None if no interface has
-         this address
-         """
-+        root_logger.debug("Searching for an interface of IP address: %s", self)
-         if self.version == 4:
-             family = netifaces.AF_INET
-         elif self.version == 6:
-@@ -213,10 +214,20 @@ class CheckedIPAddress(UnsafeIPAddress):
-                 # errors in IPNetwork
-                 ifaddr = ifdata['addr'].split(u'%', 1)[0]
- 
--                ifnet = netaddr.IPNetwork('{addr}/{netmask}'.format(
-+                # newer versions of netifaces provide IPv6 netmask in format
-+                # 'ffff:ffff:ffff:ffff::/64'. We have to split and use prefix
-+                # or the netmask with older versions
-+                ifmask = ifdata['netmask'].split(u'/')[-1]
-+
-+                ifaddrmask = '{addr}/{netmask}'.format(
-                     addr=ifaddr,
--                    netmask=ifdata['netmask']
--                ))
-+                    netmask=ifmask
-+                )
-+                root_logger.debug(
-+                    "Testing local IP address: %s (interface: %s)",
-+                    ifaddrmask, interface)
-+
-+                ifnet = netaddr.IPNetwork(ifaddrmask)
- 
-                 if ifnet.ip == self:
-                     return InterfaceDetails(interface, ifnet)
--- 
-2.9.4
-

0005-ipa-sam-use-smbldap_set_bind_callback-for-Samba-4.7-.patch

@@ -1,54 +0,0 @@
-From dc7dac0196d684b05cef047670ce95278036c5fb Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Mon, 3 Jul 2017 14:38:05 +0300
-Subject: [PATCH 7/7] ipa-sam: use smbldap_set_bind_callback for Samba 4.7 or
- later
-
-Samba 4.7 tightens up smbldap API by making 'struct smbldap_state' an
-opaque. This means ipa-sam module cannot anymore directly set its
-LDAP bind callback.
-
-Use new smbldap API to set the LDAP bind callback.
-
-Fixes https://pagure.io/freeipa/issue/6877
----
- daemons/ipa-sam/ipa_sam.c | 4 ++++
- server.m4                 | 5 +++++
- 2 files changed, 9 insertions(+)
-
-diff --git a/daemons/ipa-sam/ipa_sam.c b/daemons/ipa-sam/ipa_sam.c
-index fe9913d61..0cd48d845 100644
---- a/daemons/ipa-sam/ipa_sam.c
-+++ b/daemons/ipa-sam/ipa_sam.c
-@@ -4532,8 +4532,12 @@ static NTSTATUS pdb_init_ipasam(struct pdb_methods **pdb_method,
- 				      uri, false, NULL, NULL,
- 				      &ipasam_state->ldap_state);
- 		if (NT_STATUS_IS_OK(status)) {
-+#ifdef HAVE_SMBLDAP_SET_BIND_CALLBACK
-+			smbldap_set_bind_callback(ipasam_state->ldap_state, bind_callback, ipasam_state);
-+#else
- 			ipasam_state->ldap_state->bind_callback = bind_callback;
- 			ipasam_state->ldap_state->bind_callback_data = ipasam_state;
-+#endif
- 		}
- 	}
- 
-diff --git a/server.m4 b/server.m4
-index 365abb60e..a9670c873 100644
---- a/server.m4
-+++ b/server.m4
-@@ -111,6 +111,11 @@ AC_CHECK_LIB([smbldap],[smbldap_get_ldap],
-              [AC_MSG_WARN([libsmbldap is not opaque, not using smbldap_get_ldap])],
-              [$SAMBA40EXTRA_LIBPATH])
- 
-+AC_CHECK_LIB([smbldap],[smbldap_set_bind_callback],
-+             [AC_DEFINE([HAVE_SMBLDAP_SET_BIND_CALLBACK], [1], [struct smbldap_state is opaque])],
-+             [AC_MSG_WARN([libsmbldap is not opaque, not using smbldap_set_bind_callback])],
-+             [$SAMBA40EXTRA_LIBPATH])
-+
- dnl ---------------------------------------------------------------------------
- dnl Check for libunistring
- dnl ---------------------------------------------------------------------------
--- 
-2.13.0
-

0006-replica-install-drop-in-ipa-specific-config.patch

@@ -1,34 +0,0 @@
-From 76cc115c53c3a9c5f594083ff4c4452479070021 Mon Sep 17 00:00:00 2001
-From: Martin Babinsky <mbabinsk@redhat.com>
-Date: Tue, 11 Jul 2017 12:41:38 +0200
-Subject: [PATCH] replica install: drop-in IPA specific config to tmpfiles.d
-
-While server installation and upgrade code configures the IPA specific
-tmpfiles location and creates relevant directories, the replica
-installer code path is covered incompletely and one step is missing.
-
-https://pagure.io/freeipa/issue/7053
-
-Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
-Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
----
- ipaserver/install/server/replicainstall.py | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
-index 4f28de25b..814925de1 100644
---- a/ipaserver/install/server/replicainstall.py
-+++ b/ipaserver/install/server/replicainstall.py
-@@ -1515,6 +1515,9 @@ def install(installer):
-         # remove the extracted replica file
-         remove_replica_info_dir(installer)
- 
-+    # Make sure the files we crated in /var/run are recreated at startup
-+    tasks.configure_tmpfiles()
-+
-     # Everything installed properly, activate ipa service.
-     services.knownservices.ipa.enable()
- 
--- 
-2.13.0
-

freeipa.spec

@@ -63,13 +63,13 @@
 %global etc_systemd_dir %{_sysconfdir}/systemd/system
 %global gettext_domain ipa
 
-%global VERSION 4.5.2
+%global VERSION 4.5.3
 
 %define _hardened_build 1
 
 Name:           freeipa
 Version:        %{VERSION}
-Release:        4%{?dist}
+Release:        1%{?dist}
 Summary:        The Identity, Policy and Audit system
 
 Group:          System Environment/Base
@@ -80,12 +80,6 @@ Source1:        https://releases.pagure.org/freeipa/freeipa-%{VERSION}.tar.gz.as
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 Patch0001:      0001-Workarounds-for-SELinux-execmem-violations-in-crypto.patch
-# remove Patch000[2-3] in 4.5.3
-Patch0002:      0002-Fix-IP-Address-Checks.patch
-Patch0003:      0003-python-netifaces-update-to-reflect-upstream-changes.patch
-Patch0004:      0004-ipa-sam-use-own-private-structure-not-ldapsam_privat.patch
-Patch0005:      0005-ipa-sam-use-smbldap_set_bind_callback-for-Samba-4.7-.patch
-Patch0006:	0006-replica-install-drop-in-ipa-specific-config.patch
 
 BuildRequires:  openldap-devel
 # For KDB DAL version, make explicit dependency so that increase of version
@@ -296,8 +290,8 @@ Requires(post): systemd-units
 Requires: selinux-policy >= %{selinux_policy_version}
 Requires(post): selinux-policy-base >= %{selinux_policy_version}
 Requires: slapi-nis >= %{slapi_nis_version}
-Requires: pki-ca >= 10.3.5-11
+Requires: pki-ca >= 10.4.0-1
-Requires: pki-kra >= 10.3.5-11
+Requires: pki-kra >= 10.4.0-1
 Requires(preun): python systemd-units
 Requires(postun): python systemd-units
 Requires: policycoreutils >= 2.1.12-5
@@ -1042,6 +1036,10 @@ fi
 python2 -c "import sys; from ipaserver.install import installutils; sys.exit(0 if installutils.is_ipa_configured() else 1);" > /dev/null 2>&1
 
 if [  $? -eq 0 ]; then
+    # This is necessary for Fedora system upgrades which by default
+    # work with the network being offline
+    /bin/systemctl start network-online.target
+
     # This must be run in posttrans so that updates from previous
     # execution that may no longer be shipped are not applied.
     /usr/sbin/ipa-server-upgrade --quiet >/dev/null || :
@@ -1616,6 +1614,9 @@ fi
 %endif # with_ipatests
 
 %changelog
+* Fri Jul 21 2017 Tomas Krizek <tkrizek@redhat.com> - 4.5.3-1
+- Update to upstream 4.5.3 - see https://www.freeipa.org/page/Releases/4.5.3
+
 * Thu Jul 13 2017 Alexander Bokovoy <abokovoy@redhat.com> - 4.5.2-4
 - Make sure tmpfiles.d snippet for replica is in place after install
 

sources

@@ -1,2 +1,2 @@
-SHA512 (freeipa-4.5.2.tar.gz) = 0525f3b614f3837dd4fc2c459115d4765254caed88345c8f2e6014942ff9ccfe0f865d14bb7444260fca2c8db306fcc9df5ccf87cf0e3565fb0b304a5e5b379d
+SHA512 (freeipa-4.5.3.tar.gz) = 649b42a721b1bde6e8ebd5387bff171e9ea700005e3b2670129a25a6a5d1d81f6c6005375fb136d973706c0337f048c10fdd9913967035fa7f6ba766828dae42
-SHA512 (freeipa-4.5.2.tar.gz.asc) = 38a760516817dded90f46fc9cb4e0a9c548591a544f4b8e6d6ba9c1f7b7abed196d08c66221b0ae8c4b1d72a1ed6ee891ad96f3b5c0ec3bb536f92930d7738d0
+SHA512 (freeipa-4.5.3.tar.gz.asc) = 8eef3c911cc04c2d9fd15c840b71391a556ac6cd32d092af3424db303e2b933fc74db4600a4d491a14f636cd180975fd9157ece0e46f1502f0cdf81d097ef7e2