def test_expiration_warning(self): warning = datetime.now(timezone.utc) + timedelta(days=20) replaceme = { 'nickname': '7777', 'cert-file': paths.RA_AGENT_PEM, 'key-file': paths.RA_AGENT_KEY, 'ca-name': 'dogtag-ipa-ca-renew-agent', 'not-valid-after': int(warning.timestamp()), } set_requests(remove=0, add=replaceme) framework = object() registry.initialize(framework) f = IPACertmongerExpirationCheck(registry) f.config = config.Config() f.config.cert_expiration_days = 30 self.results = capture_results(f) assert len(self.results) == 2 result = self.results.results[0] assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPACertmongerExpirationCheck' assert result.kw.get('key') == '5678' result = self.results.results[1] assert result.result == constants.WARNING assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPACertmongerExpirationCheck' assert result.kw.get('key') == '7777' assert 'expires in 19 days' in result.kw.get('msg')
def test_principal_ok(self): agent_dn = DN(('krbprincipalname', 'cifs/%s@%s' % (m_api.env.host, m_api.env.realm)), m_api.env.container_service, m_api.env.basedn) group_dn = DN(('cn', 'adtrust agents'), m_api.env.container_sysaccounts, m_api.env.basedn) attrs = { 'memberof': [group_dn], } fake_conn = LDAPClient('ldap://localhost', no_schema=True) ldapentry = LDAPEntry(fake_conn, agent_dn) for attr, values in attrs.items(): ldapentry[attr] = values framework = object() registry.initialize(framework) registry.trust_controller = True f = IPATrustControllerPrincipalCheck(registry) f.conn = mock_ldap(ldapentry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 1 result = self.results.results[0] assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.trust' assert result.check == 'IPATrustControllerPrincipalCheck' assert result.kw.get('key') == 'cifs/%s@%s' % \ (m_api.env.host, m_api.env.realm)
def test_nss_agent_too_many(self): attrs = dict( description=['2;1;CN=ISSUER;CN=RA AGENT'], usercertificate=[self.cert], ) fake_conn = LDAPClient('ldap://localhost', no_schema=True) ldapentry = LDAPEntry(fake_conn, DN('uid=ipara,ou=people,o=ipaca')) for attr, values in attrs.items(): ldapentry[attr] = values ldapentry2 = LDAPEntry(fake_conn, DN('uid=ipara2,ou=people,o=ipaca')) for attr, values in attrs.items(): ldapentry[attr] = values framework = object() registry.initialize(framework, config.Config()) f = IPARAAgent(registry) f.conn = mock_ldap([ldapentry, ldapentry2]) self.results = capture_results(f) result = self.results.results[0] assert result.result == constants.ERROR assert result.kw.get('found') == 2
def test_one_ruvs(self): fake_conn = LDAPClient('ldap://localhost', no_schema=True) entries = [] entries.append( self.create_entry(fake_conn, DN('dc=example,cn=mapping tree,cn=config'), {'nsds5ReplicaId': ['3']})) entries.append(None) framework = object() registry.initialize(framework) f = RUVCheck(registry) f.conn = mock_ldap(entries) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 1 result = self.results.results[0] assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ds.ruv' assert result.check == 'RUVCheck' assert result.kw.get('key') == str(m_api.env.basedn) assert result.kw.get('ruv') == '3'
def test_revocation_one_bad(self): m_api.Command.cert_show.side_effect = [ { u'result': { u"revoked": False, } }, { u'result': { u"revoked": True, u"revocation_reason": 4, } }, ] set_requests() framework = object() registry.initialize(framework) f = IPACertRevocation(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 2 result = self.results.results[0] assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPACertRevocation' result = self.results.results[1] assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPACertRevocation' assert result.kw.get('revocation_reason') == 'superseded'
def test_member_fail(self): agent_dn = DN(('fqdn', m_api.env.host), m_api.env.container_host, m_api.env.basedn) attrs = { 'memberof': [agent_dn], } fake_conn = LDAPClient('ldap://localhost', no_schema=True) ldapentry = LDAPEntry(fake_conn, agent_dn) for attr, values in attrs.items(): ldapentry[attr] = values framework = object() registry.initialize(framework) registry.trust_controller = True f = IPATrustControllerPrincipalCheck(registry) f.conn = mock_ldap(ldapentry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 1 result = self.results.results[0] assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.trust' assert result.kw.get('key') == 'cifs/%s@%s' % \ (m_api.env.host, m_api.env.realm)
def test_one_expired(self, mock_load): mock_load.return_value = [ FakeIPACertificate( None, subject=self.sub_ca, not_after=datetime.now(timezone.utc) + timedelta(days=-3) ), FakeIPACertificate( None, subject=self.root_ca, not_after=datetime.now(timezone.utc) + timedelta(days=20) ) ] framework = object() registry.initialize(framework) f = IPACAChainExpirationCheck(registry) f.config = config.Config() f.config.cert_expiration_days = 7 self.results = capture_results(f) assert len(self.results) == 2 result = self.results.results[0] assert result.result == constants.CRITICAL assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPACAChainExpirationCheck' assert result.kw.get('key') == self.sub_ca assert 'expired' in result.kw.get('msg') result = self.results.results[1] assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPACAChainExpirationCheck' assert result.kw.get('key') == self.root_ca
def test_dnsrecords_bad_realm(self, mock_query, mock_query_srv): """Unexpected Kerberos TXT record""" mock_query.side_effect = fake_query_one_txt mock_query_srv.side_effect = query_srv([m_api.env.host]) m_api.Command.server_find.side_effect = [{ 'result': [ { 'cn': [m_api.env.host], 'enabled_role_servrole': ['CA server', 'IPA master'], }, ] }] framework = object() registry.initialize(framework) f = IPADNSSystemRecordsCheck(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 9 ok = get_results_by_severity(self.results.results, constants.SUCCESS) warn = get_results_by_severity(self.results.results, constants.WARNING) assert len(ok) == 8 assert len(warn) == 1 result = warn[0] assert result.kw.get('msg') == 'expected realm missing' assert result.kw.get('key') == '\"FAKE_REALM\"'
def test_ca_certs_ok(self, mock_certdb, mock_directive): """Test what should be the standard case""" trust = { 'ocspSigningCert cert-pki-ca': 'u,u,u', 'subsystemCert cert-pki-ca': 'u,u,u', 'auditSigningCert cert-pki-ca': 'u,u,Pu', 'Server-Cert cert-pki-ca': 'u,u,u', 'caSigningCert cert-pki-ca': 'CT,C,C', 'transportCert cert-pki-kra': 'u,u,u', } mock_certdb.return_value = mock_CertDB(trust) mock_directive.side_effect = [name for name, nsstrust in trust.items()] framework = object() registry.initialize(framework) f = DogtagCertsConfigCheck(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 6 for result in self.results.results: assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.dogtag.ca' assert result.check == 'DogtagCertsConfigCheck'
def test_openssl_validation_bad(self, mock_run): def run(args, raiseonerr=True): result = _RunResult('', '', 2) result.raw_output = bytes( 'O = EXAMPLE.TEST, CN = ipa.example.test\n' 'error 20 at 0 depth lookup: unable to get local issuer ' 'certificate\nerror %s: verification failed'.format( args[-1]).encode('utf-8')) result.raw_error_output = b'' result.error_log = '' return result mock_run.side_effect = run framework = object() registry.initialize(framework) f = IPAOpenSSLChainValidation(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 2 for result in self.results.results: assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPAOpenSSLChainValidation' assert 'failed' in result.kw.get('msg')
def test_dnsrecords_one_with_ad(self, mock_query, mock_query_srv): mock_query.side_effect = fake_query_one mock_query_srv.side_effect = query_srv([m_api.env.host], True) m_api.Command.server_find.side_effect = [{ 'result': [ { 'cn': [m_api.env.host], 'enabled_role_servrole': ['CA server', 'IPA master', 'AD trust controller'], }, ] }] framework = object() registry.initialize(framework) f = IPADNSSystemRecordsCheck(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 15 for result in self.results.results: assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.dns' assert result.check == 'IPADNSSystemRecordsCheck'
def test_revocation_ok(self): m_api.Command.cert_show.side_effect = [ { u'result': { u"revoked": False, } }, { u'result': { u"revoked": False, } }, ] set_requests() framework = object() registry.initialize(framework) f = IPACertRevocation(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 2 for result in self.results.results: assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPACertRevocation'
def test_principal_fail(self): service_dn = DN(('cn', 'ADTRUST')) attrs = { 'ipaconfigstring': ['disabledService'], } fake_conn = LDAPClient('ldap://localhost', no_schema=True) ldapentry = LDAPEntry(fake_conn, service_dn) for attr, values in attrs.items(): ldapentry[attr] = values framework = object() registry.initialize(framework) registry.trust_controller = True f = IPATrustControllerServiceCheck(registry) f.conn = mock_ldap(ldapentry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 1 result = self.results.results[0] assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.trust' assert result.kw.get('key') == 'ADTRUST'
def test_sidgen_fail(self): attrs = { 'nsslapd-pluginEnabled': ['off'], } fake_conn = LDAPClient('ldap://localhost', no_schema=True) ldapentry = LDAPEntry(fake_conn, DN('cn=plugin, cn=config')) for attr, values in attrs.items(): ldapentry[attr] = values framework = object() registry.initialize(framework) registry.trust_agent = True f = IPAsidgenpluginCheck(registry) f.conn = mock_ldap(ldapentry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 2 result = self.results.results[0] assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.trust' assert result.check == 'IPAsidgenpluginCheck' assert result.kw.get('key') == 'IPA SIDGEN' result = self.results.results[1] assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.trust' assert result.check == 'IPAsidgenpluginCheck' assert result.kw.get('key') == 'ipa-sidgen-task'
def test_expiration(self): set_requests() framework = object() registry.initialize(framework) f = IPACertmongerExpirationCheck(registry) f.config = config.Config() f.config.cert_expiration_days = 7 self.results = capture_results(f) assert len(self.results) == 2 result = self.results.results[0] assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPACertmongerExpirationCheck' assert result.kw.get('key') == '1234' assert result.kw.get('msg') == 'Request id 1234 expired on ' \ '19700101001704Z' result = self.results.results[1] assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPACertmongerExpirationCheck' assert result.kw.get('key') == '5678'
def test_nss_validation_ok_no_ca(self, mock_run, mock_cainstance): """Test with the CA marked as not configured so there should only be a DS certificate to check. """ def run(args, raiseonerr=True): result = _RunResult('', '', 0) result.raw_output = b'certutil: certificate is valid\n' result.raw_error_output = b'' return result mock_run.side_effect = run mock_cainstance.return_value = CAInstance(False) framework = object() registry.initialize(framework) f = IPANSSChainValidation(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 1 for result in self.results.results: assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPANSSChainValidation' assert 'slapd-' in result.kw.get('key')
def test_nss_validation_bad(self, mock_run, mock_cainstance): def run(args, raiseonerr=True): result = _RunResult('', '', 255) result.raw_output = str.encode( 'certutil: certificate is invalid: Peer\'s certificate issuer ' 'has been marked as not trusted by the user.') result.raw_error_output = b'' result.error_log = '' return result mock_run.side_effect = run mock_cainstance.return_value = CAInstance() framework = object() registry.initialize(framework) f = IPANSSChainValidation(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 2 for result in self.results.results: assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPANSSChainValidation'
def test_trust_get_trust_domains_fail(self, mock_trust, mock_run): # sssctl domain-list run_result = namedtuple('run', ['returncode', 'error_log']) run_result.returncode = 0 run_result.error_log = '' run_result.output = 'implicit_files\nipa.example\nad.example\n' mock_run.return_value = run_result mock_trust.side_effect = errors.NotFound(reason='bad') framework = object() registry.initialize(framework) registry.trust_agent = True f = IPATrustDomainsCheck(registry) f.config = config.Config() self.results = capture_results(f) # There are more than one result I just care about this particular # value. The error is not fatal. result = self.results.results[0] assert result.result == constants.WARNING assert result.source == 'ipahealthcheck.ipa.trust' assert result.check == 'IPATrustDomainsCheck' assert result.kw.get('key') == 'trust-find'
def test_kra_agent_nonmatching_cert(self): cert2 = IPACertificate(2) attrs = dict( description=['2;1;CN=ISSUER;CN=RA AGENT'], usercertificate=[cert2], ) fake_conn = LDAPClient('ldap://localhost', no_schema=True) ldapentry = LDAPEntry(fake_conn, DN('uid=ipakra,ou=people,o=kra,o=ipaca')) for attr, values in attrs.items(): ldapentry[attr] = values framework = object() registry.initialize(framework, config.Config()) f = IPAKRAAgent(registry) f.conn = mock_ldap([ldapentry]) self.results = capture_results(f) result = self.results.results[0] assert result.result == constants.ERROR assert result.kw.get('certfile') == paths.RA_AGENT_PEM assert result.kw.get('dn') == 'uid=ipakra,ou=people,o=kra,o=ipaca'
def test_kra_agent_ok(self): attrs = dict( description=['2;1;CN=ISSUER;CN=RA AGENT'], usercertificate=[self.cert], ) fake_conn = LDAPClient('ldap://localhost', no_schema=True) ldapentry = LDAPEntry(fake_conn, DN('uid=ipakra,ou=people,o=kra,o=ipaca')) for attr, values in attrs.items(): ldapentry[attr] = values framework = object() registry.initialize(framework, config.Config()) f = IPAKRAAgent(registry) f.conn = mock_ldap([ldapentry]) self.results = capture_results(f) assert len(self.results) == 1 result = self.results.results[0] assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPAKRAAgent'
def test_dnsrecords_two(self, mock_query, mock_query_srv): """Test two CA masters, all SRV records""" mock_query_srv.side_effect = query_srv( [m_api.env.host, 'replica.' + m_api.env.domain]) mock_query.side_effect = fake_query_two m_api.Command.server_find.side_effect = [{ 'result': [ { 'cn': [m_api.env.host], 'enabled_role_servrole': ['CA server', 'IPA master'], }, { 'cn': ['replica.' + m_api.env.domain], 'enabled_role_servrole': ['CA server', 'IPA master'], }, ] }] framework = object() registry.initialize(framework) f = IPADNSSystemRecordsCheck(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 17 for result in self.results.results: assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.dns' assert result.check == 'IPADNSSystemRecordsCheck'
def test_principal_fail(self): admins_dn = DN(('cn', 'admins')) attrs = { 'ipantsecurityidentifier': ['S-1-5-21-1234-5678-1976041503-500'], } fake_conn = LDAPClient('ldap://localhost', no_schema=True) ldapentry = LDAPEntry(fake_conn, admins_dn) for attr, values in attrs.items(): ldapentry[attr] = values framework = object() registry.initialize(framework) registry.trust_controller = True f = IPATrustControllerGroupSIDCheck(registry) f.conn = mock_ldap(ldapentry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 1 result = self.results.results[0] assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.trust' assert result.check == 'IPATrustControllerGroupSIDCheck' assert result.kw.get('key') == 'ipantsecurityidentifier' assert result.kw.get('rid') == 'S-1-5-21-1234-5678-1976041503-500'
def test_certs_mismatch(self, mock_certdb): """ Ensure mismatches are detected""" fake_conn = LDAPClient('ldap://localhost', no_schema=True) pkidbentry = LDAPEntry( fake_conn, DN('uid=pkidbuser,ou=people,o=ipaca'), userCertificate=[IPACertificate(serial_number=2)], subjectName=['test']) casignentry = LDAPEntry(fake_conn, DN('cn=%s IPA CA' % m_api.env.realm, 'cn=certificates,cn=ipa,cn=etc', m_api.env.basedn), CACertificate=[IPACertificate()], userCertificate=[IPACertificate()], subjectName=['test']) ldap_entries = [pkidbentry, casignentry] trust = { 'ocspSigningCert cert-pki-ca': 'u,u,u', 'caSigningCert cert-pki-ca': 'u,u,u', 'subsystemCert cert-pki-ca': 'u,u,u', 'auditSigningCert cert-pki-ca': 'u,u,Pu', 'Server-Cert cert-pki-ca': 'u,u,u', 'transportCert cert-pki-kra': 'u,u,u', 'storageCert cert-pki-kra': 'u,u,u', 'auditSigningCert cert-pki-kra': 'u,u,Pu', } dogtag_entries_subjects = ( 'CN=OCSP Subsystem,O=%s' % m_api.env.realm, 'CN=CA Subsystem,O=%s' % m_api.env.realm, 'CN=CA Audit,O=%s' % m_api.env.realm, 'CN=%s,O=%s' % (m_api.env.host, m_api.env.realm), 'CN=KRA Transport Certificate,O=%s' % m_api.env.realm, 'CN=KRA Storage Certificate,O=%s' % m_api.env.realm, 'CN=KRA Audit,O=%s' % m_api.env.realm, ) for i, subject in enumerate(dogtag_entries_subjects): entry = LDAPEntry(fake_conn, DN('cn=%i,ou=certificateRepository' % i, 'ou=ca,o=ipaca'), userCertificate=[IPACertificate()], subjectName=[subject]) ldap_entries.append(entry) mock_certdb.return_value = mock_CertDB(trust) framework = object() registry.initialize(framework, config.Config()) f = IPADogtagCertsMatchCheck(registry) f.conn = mock_ldap(ldap_entries) self.results = capture_results(f) assert len(self.results) == 3 result = self.results.results[0] assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.certs' assert result.check == 'IPADogtagCertsMatchCheck'
def test_trust_get_trust_domains_mismatch(self, mock_run): # sssctl domain-list dlresult = namedtuple('run', ['returncode', 'error_log']) dlresult.returncode = 0 dlresult.error_log = '' dlresult.output = 'implicit_files\nipa.example\n' \ 'child.example\n' olresult = namedtuple('run', ['returncode', 'error_log']) olresult.returncode = 0 olresult.error_log = '' olresult.output = 'Online status: Online\n\n' mock_run.side_effect = [dlresult, olresult, olresult] # get_trust_domains() m_api.Command.trust_find.side_effect = [{ 'result': [ { 'cn': ['ad.example'], 'ipantflatname': ['ADROOT'], 'ipanttrusteddomainsid': ['S-1-5-21-abc'], 'trusttype': ['Active Directory domain'], }, { 'cn': ['child.example'], 'ipantflatname': ['ADROOT'], 'ipanttrusteddomainsid': ['S-1-5-21-def'], 'trusttype': ['Active Directory domain'], }, ] }] framework = object() registry.initialize(framework) registry.trust_agent = True f = IPATrustDomainsCheck(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 2 result = self.results.results[0] assert result.result == constants.ERROR assert result.source == 'ipahealthcheck.ipa.trust' assert result.check == 'IPATrustDomainsCheck' assert result.kw.get('key') == 'domain-list' assert result.kw.get('trust_domains') == 'ad.example, child.example' assert result.kw.get('sssd_domains') == 'child.example' result = self.results.results[1] assert result.result == constants.SUCCESS assert result.source == 'ipahealthcheck.ipa.trust' assert result.check == 'IPATrustDomainsCheck' assert result.kw.get('key') == 'domain-status' assert result.kw.get('domain') == 'child.example'
def test_no_ruvs(self): framework = object() registry.initialize(framework) f = RUVCheck(registry) f.conn = mock_ldap(None) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 0
def test_no_trust_agent(self): framework = object() registry.initialize(framework) registry.trust_agent = False f = IPAsidgenpluginCheck(registry) f.config = config.Config() self.results = capture_results(f) # Zero because the call was skipped altogether assert len(self.results) == 0
def test_not_trust_controller(self): framework = object() registry.initialize(framework) registry.trust_controller = False f = IPATrustControllerConfCheck(registry) f.config = config.Config() self.results = capture_results(f) # Zero because the call was skipped altogether assert len(self.results) == 0
def test_nss_agent_no_entry_found(self): framework = object() registry.initialize(framework, config.Config()) f = IPARAAgent(registry) f.conn = mock_ldap(None) # None == NotFound self.results = capture_results(f) result = self.results.results[0] assert result.result == constants.ERROR assert result.kw.get('msg') == 'RA agent not found in LDAP'
def test_nss_agent_load_failure(self, mock_load_cert): mock_load_cert.side_effect = IOError('test') framework = object() registry.initialize(framework, config.Config()) f = IPARAAgent(registry) self.results = capture_results(f) result = self.results.results[0] assert result.result == constants.ERROR assert result.kw.get('error') == 'test'
def test_cacert_caless(self, mock_cainstance): """Nothing to check if the master is CALess""" mock_cainstance.return_value = CAInstance(False) framework = object() registry.initialize(framework) f = DogtagCertsConfigCheck(registry) f.config = config.Config() self.results = capture_results(f) assert len(self.results) == 0