1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
#
# Copyright (C) 2019 FreeIPA Contributors see COPYING for license
#
"""Smoke tests for FreeIPA installation in (fake) userspace FIPS mode
"""
import pytest
from ipapython.dn import DN
from ipapython.ipautil import ipa_generate_password, realm_to_suffix
from ipatests.pytest_ipa.integration import tasks
from ipatests.pytest_ipa.integration import fips
from ipatests.test_integration.base import IntegrationTest
from .test_dnssec import (
test_zone,
dnssec_install_master,
dnszone_add_dnssec,
wait_until_record_is_signed,
)
def check_version(host):
if tasks.get_pki_version(host) < tasks.parse_version('11.6.0'):
raise pytest.skip("PKI replica FIPS support is not available, "
"https://github.com/dogtagpki/pki/issues/4847")
class TestInstallFIPS(IntegrationTest):
num_replicas = 1
num_clients = 1
fips_mode = True
@classmethod
def install(cls, mh):
check_version(cls.replicas[0])
super(TestInstallFIPS, cls).install(mh)
# sanity check
for host in cls.get_all_hosts():
assert host.is_fips_mode
assert fips.is_fips_enabled(host)
# master with CA, KRA, DNS+DNSSEC
tasks.install_master(cls.master, setup_dns=True, setup_kra=True)
# replica with CA, KRA, DNS
tasks.install_replica(
cls.master,
cls.replicas[0],
setup_dns=True,
setup_ca=True,
setup_kra=True,
)
tasks.install_clients([cls.master] + cls.replicas, cls.clients)
@classmethod
def uninstall(cls, mh):
check_version(cls.replicas[0])
super(TestInstallFIPS, cls).uninstall(mh)
def test_basic(self):
client = self.clients[0]
tasks.kinit_admin(client)
client.run_command(["ipa", "ping"])
@pytest.mark.xfail(reason='freeipa ticket 9785', strict=True)
def test_dnssec(self):
dnssec_install_master(self.master)
# DNSSEC zone
dnszone_add_dnssec(self.master, test_zone)
assert wait_until_record_is_signed(
self.master.ip, test_zone, timeout=100
), ("Zone %s is not signed (master)" % test_zone)
# test replica
assert wait_until_record_is_signed(
self.replicas[0].ip, test_zone, timeout=200
), ("DNS zone %s is not signed (replica)" % test_zone)
def test_vault_basic(self):
vault_name = "testvault"
vault_password = ipa_generate_password()
vault_data = "SSBsb3ZlIENJIHRlc3RzCg=="
# create vault
self.master.run_command(
[
"ipa",
"vault-add",
vault_name,
"--password",
vault_password,
"--type",
"symmetric",
]
)
# archive secret
self.master.run_command(
[
"ipa",
"vault-archive",
vault_name,
"--password",
vault_password,
"--data",
vault_data,
]
)
self.master.run_command(
[
"ipa",
"vault-retrieve",
vault_name,
"--password",
vault_password,
]
)
def test_krb_enctypes(self):
realm = self.master.domain.realm
suffix = realm_to_suffix(realm)
dn = DN(("cn", realm), ("cn", "kerberos")) + suffix
args = ["krbSupportedEncSaltTypes", "krbDefaultEncSaltTypes"]
for host in [self.master] + self.replicas:
result = tasks.ldapsearch_dm(host, str(dn), args, scope="base")
assert "camellia" not in result.stdout_text
assert "aes256-cts" in result.stdout_text
assert "aes128-cts" in result.stdout_text
# test that update does not add camellia
self.master.run_command(["ipa-server-upgrade"])
result = tasks.ldapsearch_dm(self.master, str(dn), args, scope="base")
assert "camellia" not in result.stdout_text
|
