140 lines
4.9 KiB
Diff
140 lines
4.9 KiB
Diff
From 48846e98e5e988d600ddf81c937f353fcecdea1a Mon Sep 17 00:00:00 2001
|
|
From: Rob Crittenden <rcritten@redhat.com>
|
|
Date: Mon, 27 Nov 2023 16:11:08 -0500
|
|
Subject: [PATCH 1/2] hbactest was not collecting or returning messages
|
|
|
|
hbactest does a number of internal searches, one of which
|
|
can exceed the configured sizelimit: hbacrule-find
|
|
|
|
Collect any messages returned from thsi call and display them
|
|
to the user on the cli.
|
|
|
|
Fixes: https://pagure.io/freeipa/issue/9486
|
|
|
|
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
|
|
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
|
|
---
|
|
ipaclient/plugins/hbactest.py | 2 ++
|
|
ipaserver/plugins/hbactest.py | 14 +++++++++++---
|
|
2 files changed, 13 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/ipaclient/plugins/hbactest.py b/ipaclient/plugins/hbactest.py
|
|
index 1b54530b2..e0f93b9c2 100644
|
|
--- a/ipaclient/plugins/hbactest.py
|
|
+++ b/ipaclient/plugins/hbactest.py
|
|
@@ -38,6 +38,8 @@ class hbactest(CommandOverride):
|
|
# Note that we don't actually use --detail below to see if details need
|
|
# to be printed as our execute() method will return None for corresponding
|
|
# entries and None entries will be skipped.
|
|
+ self.log_messages(output)
|
|
+
|
|
for o in self.output:
|
|
if o == 'value':
|
|
continue
|
|
diff --git a/ipaserver/plugins/hbactest.py b/ipaserver/plugins/hbactest.py
|
|
index 887a35b7e..568c13174 100644
|
|
--- a/ipaserver/plugins/hbactest.py
|
|
+++ b/ipaserver/plugins/hbactest.py
|
|
@@ -24,6 +24,8 @@ from ipalib import Command, Str, Flag, Int
|
|
from ipalib import _
|
|
from ipapython.dn import DN
|
|
from ipalib.plugable import Registry
|
|
+from ipalib.messages import VersionMissing
|
|
+
|
|
if api.env.in_server:
|
|
try:
|
|
import ipaserver.dcerpc
|
|
@@ -323,6 +325,9 @@ class hbactest(Command):
|
|
# 2. Required options are (user, target host, service)
|
|
# 3. Options: rules to test (--rules, --enabled, --disabled), request for detail output
|
|
rules = []
|
|
+ result = {
|
|
+ 'warning':None, 'matched':None, 'notmatched':None, 'error':None
|
|
+ }
|
|
|
|
# Use all enabled IPA rules by default
|
|
all_enabled = True
|
|
@@ -351,8 +356,12 @@ class hbactest(Command):
|
|
|
|
hbacset = []
|
|
if len(testrules) == 0:
|
|
- hbacset = self.api.Command.hbacrule_find(
|
|
- sizelimit=sizelimit, no_members=False)['result']
|
|
+ hbacrules = self.api.Command.hbacrule_find(
|
|
+ sizelimit=sizelimit, no_members=False)
|
|
+ hbacset = hbacrules['result']
|
|
+ for message in hbacrules['messages']:
|
|
+ if message['code'] != VersionMissing.errno:
|
|
+ result.setdefault('messages', []).append(message)
|
|
else:
|
|
for rule in testrules:
|
|
try:
|
|
@@ -469,7 +478,6 @@ class hbactest(Command):
|
|
error_rules = []
|
|
warning_rules = []
|
|
|
|
- result = {'warning':None, 'matched':None, 'notmatched':None, 'error':None}
|
|
if not options['nodetail']:
|
|
# Validate runs rules one-by-one and reports failed ones
|
|
for ipa_rule in rules:
|
|
--
|
|
2.43.0
|
|
|
|
|
|
From d1e09c68af8ac77f656dd639af5d9a7f07c41f9d Mon Sep 17 00:00:00 2001
|
|
From: Rob Crittenden <rcritten@redhat.com>
|
|
Date: Tue, 28 Nov 2023 13:35:13 -0500
|
|
Subject: [PATCH 2/2] ipatests: Verify that hbactest will return messages
|
|
|
|
Limit the sizelimit of the hbactest request to confirm that
|
|
the output includes a SearchResultTruncated message.
|
|
|
|
Fixes: https://pagure.io/freeipa/issue/9486
|
|
|
|
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
|
|
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
|
|
---
|
|
ipatests/test_xmlrpc/test_hbactest_plugin.py | 19 ++++++++++++++++++-
|
|
1 file changed, 18 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/ipatests/test_xmlrpc/test_hbactest_plugin.py b/ipatests/test_xmlrpc/test_hbactest_plugin.py
|
|
index 73c4ce232..e2e66c759 100644
|
|
--- a/ipatests/test_xmlrpc/test_hbactest_plugin.py
|
|
+++ b/ipatests/test_xmlrpc/test_hbactest_plugin.py
|
|
@@ -134,6 +134,7 @@ class test_hbactest(XMLRPC_test):
|
|
assert ret['value']
|
|
assert ret['error'] is None
|
|
assert ret['matched'] is None
|
|
+ assert 'messages' not in ret
|
|
assert ret['notmatched'] is None
|
|
|
|
def test_c_hbactest_check_rules_enabled_detail(self):
|
|
@@ -200,7 +201,23 @@ class test_hbactest(XMLRPC_test):
|
|
nodetail=True
|
|
)
|
|
|
|
- def test_g_hbactest_clear_testing_data(self):
|
|
+ def test_g_hbactest_searchlimit_message(self):
|
|
+ """
|
|
+ Test running 'ipa hbactest' with limited --sizelimit
|
|
+
|
|
+ We know there are at least 6 rules, 4 created here + 2 default.
|
|
+ """
|
|
+ ret = api.Command['hbactest'](
|
|
+ user=self.test_user,
|
|
+ targethost=self.test_host,
|
|
+ service=self.test_service,
|
|
+ nodetail=True,
|
|
+ sizelimit=2,
|
|
+ )
|
|
+
|
|
+ assert ret['messages'] is not None
|
|
+
|
|
+ def test_h_hbactest_clear_testing_data(self):
|
|
"""
|
|
Clear data for HBAC test plugin testing.
|
|
"""
|
|
--
|
|
2.43.0
|
|
|