154 lines
6.1 KiB
Diff
154 lines
6.1 KiB
Diff
From 02c0da3ef74948579106aab4b669f6e64dd60b24 Mon Sep 17 00:00:00 2001
|
|
From: Mohammad Rizwan <myusuf@redhat.com>
|
|
Date: Thu, 24 Jun 2021 13:10:00 +0530
|
|
Subject: [PATCH] ipatests: Test ipa-cert-fix warns when startup directive is
|
|
missing from CS.cfg
|
|
|
|
Earlier it used to fail when startup directive missing from CS.cfg.
|
|
With https://github.com/dogtagpki/pki/pull/3466, it changed to display
|
|
a warning than failing.
|
|
|
|
related: https://pagure.io/freeipa/issue/8890
|
|
|
|
Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
|
|
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
|
|
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
|
|
---
|
|
.../test_integration/test_ipa_cert_fix.py | 92 ++++++++++++++++++-
|
|
1 file changed, 90 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/ipatests/test_integration/test_ipa_cert_fix.py b/ipatests/test_integration/test_ipa_cert_fix.py
|
|
index b2e92d4dc..394e85603 100644
|
|
--- a/ipatests/test_integration/test_ipa_cert_fix.py
|
|
+++ b/ipatests/test_integration/test_ipa_cert_fix.py
|
|
@@ -48,6 +48,16 @@ def check_status(host, cert_count, state, timeout=600):
|
|
return count
|
|
|
|
|
|
+def move_date(host, chrony_state, date_str):
|
|
+ """Helper method to move the date on given host
|
|
+ :param host: The host on which date is to be moved
|
|
+ :param chrony_state: State to which chrony service to be moved
|
|
+ :param date_str: date string to move the date i.e 2years1month1days
|
|
+ """
|
|
+ host.run_command(['systemctl', chrony_state, 'chronyd'])
|
|
+ host.run_command(['date', '-s', date_str])
|
|
+
|
|
+
|
|
@pytest.fixture
|
|
def expire_cert_critical():
|
|
"""
|
|
@@ -82,6 +92,17 @@ class TestIpaCertFix(IntegrationTest):
|
|
# the fixture
|
|
pass
|
|
|
|
+ @pytest.fixture
|
|
+ def expire_ca_cert(self):
|
|
+ tasks.install_master(self.master, setup_dns=False,
|
|
+ extra_args=['--no-ntp'])
|
|
+ move_date(self.master, 'stop', '+20Years+1day')
|
|
+
|
|
+ yield
|
|
+
|
|
+ tasks.uninstall_master(self.master)
|
|
+ move_date(self.master, 'start', '-20Years-1day')
|
|
+
|
|
def test_missing_csr(self, expire_cert_critical):
|
|
"""
|
|
Test that ipa-cert-fix succeeds when CSR is missing from CS.cfg
|
|
@@ -122,7 +143,8 @@ class TestIpaCertFix(IntegrationTest):
|
|
|
|
# Because of BZ 1897120, pki-cert-fix fails on pki-core 10.10.0
|
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1897120
|
|
- if tasks.get_pki_version(self.master) != tasks.parse_version('10.10.0'):
|
|
+ if (tasks.get_pki_version(self.master)
|
|
+ != tasks.parse_version('10.10.0')):
|
|
assert result.returncode == 0
|
|
|
|
# get the number of certs track by certmonger
|
|
@@ -180,6 +202,72 @@ class TestIpaCertFix(IntegrationTest):
|
|
raiseonerr=False)
|
|
assert result.returncode == 2
|
|
|
|
+ def test_missing_startup(self, expire_cert_critical):
|
|
+ """
|
|
+ Test ipa-cert-fix fails/warns when startup directive is missing
|
|
+
|
|
+ This test checks that if 'selftests.container.order.startup' directive
|
|
+ is missing from CS.cfg, ipa-cert-fix fails and throw proper error
|
|
+ message. It also checks that underlying command 'pki-server cert-fix'
|
|
+ should fail to renew the cert.
|
|
+
|
|
+ related: https://pagure.io/freeipa/issue/8721
|
|
+
|
|
+ With https://github.com/dogtagpki/pki/pull/3466, it changed to display
|
|
+ a warning than failing.
|
|
+
|
|
+ This test also checks that if 'selftests.container.order.startup'
|
|
+ directive is missing from CS.cfg, ipa-cert-fix dsplay proper warning
|
|
+ (depending on pki version)
|
|
+
|
|
+ related: https://pagure.io/freeipa/issue/8890
|
|
+ """
|
|
+ expire_cert_critical(self.master)
|
|
+ # pki must be stopped in order to edit CS.cfg
|
|
+ self.master.run_command(['ipactl', 'stop'])
|
|
+ self.master.run_command([
|
|
+ 'sed', '-i', r'/selftests\.container\.order\.startup/d',
|
|
+ paths.CA_CS_CFG_PATH
|
|
+ ])
|
|
+ # dirsrv needs to be up in order to run ipa-cert-fix
|
|
+ self.master.run_command(['ipactl', 'start',
|
|
+ '--ignore-service-failures'])
|
|
+
|
|
+ result = self.master.run_command(['ipa-cert-fix', '-v'],
|
|
+ stdin_text='yes\n',
|
|
+ raiseonerr=False)
|
|
+
|
|
+ err_msg1 = "ERROR: 'selftests.container.order.startup'"
|
|
+ # check that pki-server cert-fix command fails
|
|
+ err_msg2 = ("ERROR: CalledProcessError(Command "
|
|
+ "['pki-server', 'cert-fix'")
|
|
+ warn_msg = ("WARNING: No selftests configured in "
|
|
+ f"{paths.CA_CS_CFG_PATH} "
|
|
+ "(selftests.container.order.startup)")
|
|
+
|
|
+ if (tasks.get_pki_version(self.master)
|
|
+ < tasks.parse_version('10.11.0')):
|
|
+ assert (err_msg1 in result.stderr_text
|
|
+ and err_msg2 in result.stderr_text)
|
|
+ else:
|
|
+ assert warn_msg in result.stdout_text
|
|
+
|
|
+ def test_expired_CA_cert(self, expire_ca_cert):
|
|
+ """Test to check ipa-cert-fix when CA certificate is expired
|
|
+
|
|
+ In order to fix expired certs using ipa-cert-fix, CA cert should be
|
|
+ valid. If CA cert expired, ipa-cert-fix won't work.
|
|
+
|
|
+ related: https://pagure.io/freeipa/issue/8721
|
|
+ """
|
|
+ result = self.master.run_command(['ipa-cert-fix', '-v'],
|
|
+ stdin_text='yes\n',
|
|
+ raiseonerr=False)
|
|
+ # check that pki-server cert-fix command fails
|
|
+ err_msg = ("ERROR: CalledProcessError(Command "
|
|
+ "['pki-server', 'cert-fix'")
|
|
+ assert err_msg in result.stderr_text
|
|
+
|
|
|
|
class TestIpaCertFixThirdParty(CALessBase):
|
|
"""
|
|
@@ -219,7 +307,7 @@ class TestIpaCertFixThirdParty(CALessBase):
|
|
'--pin', self.master.config.admin_password,
|
|
'-d', 'server.p12']
|
|
self.master.run_command(args)
|
|
- self.master.run_command(['ipactl', 'restart',])
|
|
+ self.master.run_command(['ipactl', 'restart'])
|
|
|
|
# Run ipa-cert-fix. This is basically a no-op but tests that
|
|
# the DS nickname is used and not a hardcoded value.
|
|
--
|
|
2.31.1
|
|
|