From 48846e98e5e988d600ddf81c937f353fcecdea1a Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Mon, 27 Nov 2023 16:11:08 -0500 Subject: [PATCH 1/2] hbactest was not collecting or returning messages hbactest does a number of internal searches, one of which can exceed the configured sizelimit: hbacrule-find Collect any messages returned from thsi call and display them to the user on the cli. Fixes: https://pagure.io/freeipa/issue/9486 Signed-off-by: Rob Crittenden Reviewed-By: Florence Blanc-Renaud --- ipaclient/plugins/hbactest.py | 2 ++ ipaserver/plugins/hbactest.py | 14 +++++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/ipaclient/plugins/hbactest.py b/ipaclient/plugins/hbactest.py index 1b54530b2..e0f93b9c2 100644 --- a/ipaclient/plugins/hbactest.py +++ b/ipaclient/plugins/hbactest.py @@ -38,6 +38,8 @@ class hbactest(CommandOverride): # Note that we don't actually use --detail below to see if details need # to be printed as our execute() method will return None for corresponding # entries and None entries will be skipped. + self.log_messages(output) + for o in self.output: if o == 'value': continue diff --git a/ipaserver/plugins/hbactest.py b/ipaserver/plugins/hbactest.py index 887a35b7e..568c13174 100644 --- a/ipaserver/plugins/hbactest.py +++ b/ipaserver/plugins/hbactest.py @@ -24,6 +24,8 @@ from ipalib import Command, Str, Flag, Int from ipalib import _ from ipapython.dn import DN from ipalib.plugable import Registry +from ipalib.messages import VersionMissing + if api.env.in_server: try: import ipaserver.dcerpc @@ -323,6 +325,9 @@ class hbactest(Command): # 2. Required options are (user, target host, service) # 3. Options: rules to test (--rules, --enabled, --disabled), request for detail output rules = [] + result = { + 'warning':None, 'matched':None, 'notmatched':None, 'error':None + } # Use all enabled IPA rules by default all_enabled = True @@ -351,8 +356,12 @@ class hbactest(Command): hbacset = [] if len(testrules) == 0: - hbacset = self.api.Command.hbacrule_find( - sizelimit=sizelimit, no_members=False)['result'] + hbacrules = self.api.Command.hbacrule_find( + sizelimit=sizelimit, no_members=False) + hbacset = hbacrules['result'] + for message in hbacrules['messages']: + if message['code'] != VersionMissing.errno: + result.setdefault('messages', []).append(message) else: for rule in testrules: try: @@ -469,7 +478,6 @@ class hbactest(Command): error_rules = [] warning_rules = [] - result = {'warning':None, 'matched':None, 'notmatched':None, 'error':None} if not options['nodetail']: # Validate runs rules one-by-one and reports failed ones for ipa_rule in rules: -- 2.43.0 From d1e09c68af8ac77f656dd639af5d9a7f07c41f9d Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 28 Nov 2023 13:35:13 -0500 Subject: [PATCH 2/2] ipatests: Verify that hbactest will return messages Limit the sizelimit of the hbactest request to confirm that the output includes a SearchResultTruncated message. Fixes: https://pagure.io/freeipa/issue/9486 Signed-off-by: Rob Crittenden Reviewed-By: Florence Blanc-Renaud --- ipatests/test_xmlrpc/test_hbactest_plugin.py | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/ipatests/test_xmlrpc/test_hbactest_plugin.py b/ipatests/test_xmlrpc/test_hbactest_plugin.py index 73c4ce232..e2e66c759 100644 --- a/ipatests/test_xmlrpc/test_hbactest_plugin.py +++ b/ipatests/test_xmlrpc/test_hbactest_plugin.py @@ -134,6 +134,7 @@ class test_hbactest(XMLRPC_test): assert ret['value'] assert ret['error'] is None assert ret['matched'] is None + assert 'messages' not in ret assert ret['notmatched'] is None def test_c_hbactest_check_rules_enabled_detail(self): @@ -200,7 +201,23 @@ class test_hbactest(XMLRPC_test): nodetail=True ) - def test_g_hbactest_clear_testing_data(self): + def test_g_hbactest_searchlimit_message(self): + """ + Test running 'ipa hbactest' with limited --sizelimit + + We know there are at least 6 rules, 4 created here + 2 default. + """ + ret = api.Command['hbactest']( + user=self.test_user, + targethost=self.test_host, + service=self.test_service, + nodetail=True, + sizelimit=2, + ) + + assert ret['messages'] is not None + + def test_h_hbactest_clear_testing_data(self): """ Clear data for HBAC test plugin testing. """ -- 2.43.0