internet/ansible-freeipa
4
0
Fork 0
mirror of https://github.com/freeipa/ansible-freeipa.git synced 2026-03-26 21:33:05 +00:00
Code Issues Projects Releases Wiki Activity

dnszone: remove variable serial.

Browse Source 
As of FreeIPA 4.9.7, setting SOA serial is deprecated, so this change
removes support for setting this variable in ipadnszone module.
This commit is contained in:
Rafael Guterres Jeffman
2021-08-20 10:36:59 -03:00
parent a68fe58ff2
commit 9454bcaacb
4 changed files with 3 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README-dnszone.md
View File

@@ -84,7 +84,6 @@ Example playbook to create a DNS zone with all currently supported variables:
- ip_address: 8.8.8.8
- ip_address: 8.8.4.4
port: 52
serial: 1234
refresh: 3600
retry: 900
expire: 1209600
@@ -218,7 +217,6 @@ Variable | Description | Required
`dnssec`| Allow inline DNSSEC signing of records in the zone | no
`allow_transfer`| List of IP addresses or networks which are allowed to transfer the zone | no
`allow_query`| List of IP addresses or networks which are allowed to issue queries | no
`serial`| SOA record serial number | no
`refresh`| SOA record refresh time | no
`retry`| SOA record retry time | no
`expire`| SOA record expire time | no

31
plugins/modules/ipadnszone.py
View File

@@ -103,10 +103,6 @@ options:
description: List of IP addresses or networks which are allowed to issue queries
required: false
type: bool
serial:
description: SOA record serial number
required: false
type: int
refresh:
description: SOA record refresh time
required: false
@@ -171,7 +167,6 @@ EXAMPLES = """
- ip_address: 8.8.8.8
- ip_address: 8.8.4.4
port: 52
serial: 1234
refresh: 3600
retry: 900
expire: 1209600
@@ -228,7 +223,6 @@ class DNSZoneModule(FreeIPABaseModule):
ipa_param_mapping = {
# Direct Mapping
"idnsforwardpolicy": "forward_policy",
"idnssoaserial": "serial",
"idnssoarefresh": "refresh",
"idnssoaretry": "retry",
"idnssoaexpire": "expire",
@@ -451,10 +445,6 @@ class DNSZoneModule(FreeIPABaseModule):
# Look for existing zone in IPA
zone, is_zone_active = self.get_zone(zone_name)
args = self.get_ipa_command_args(zone=zone)
set_serial = self.ipa_params.serial is not None
if set_serial:
del args["idnssoaserial"]
if self.ipa_params.state in ["present", "enabled", "disabled"]:
if not zone:
@@ -479,26 +469,6 @@ class DNSZoneModule(FreeIPABaseModule):
if self.ipa_params.state == "absent" and zone is not None:
self.add_ipa_command("dnszone_del", zone_name)
# Due to a bug in FreeIPA dnszone-add won't set
# SOA Serial in the creation of a zone, or if
# another field is modified along with it.
# As a workaround, we set only the SOA serial,
# with dnszone-mod, after other changes.
# See:
# - https://pagure.io/freeipa/issue/8227
# - https://pagure.io/freeipa/issue/8489
# Only set SOA Serial if it is not set already.
if (set_serial and
(zone is None
or "idnssoaserial" not in zone
or zone["idnssoaserial"] is None
or zone["idnssoaserial"][0] != str(self.ipa_params.serial)
)):
args = {
"idnssoaserial": self.ipa_params.serial,
}
self.add_ipa_command("dnszone_mod", zone_name, args)
def process_command_result(self, name, command, args, result):
# pylint: disable=super-with-arguments
super(DNSZoneModule, self).process_command_result(
@@ -552,7 +522,6 @@ def get_argument_spec():
dnssec=dict(type="bool", required=False, default=None),
allow_transfer=dict(type="list", required=False, default=None),
allow_query=dict(type="list", required=False, default=None),
serial=dict(type="int", required=False, default=None),
refresh=dict(type="int", required=False, default=None),
retry=dict(type="int", required=False, default=None),
expire=dict(type="int", required=False, default=None),

100
tests/dnszone/test_dnszone_mod.yml
View File

@@ -10,81 +10,6 @@
- name: Setup testing environment
include_tasks: env_setup.yml
# Tests
- name: Verify if zone can be created with a specific SOA serial.
block:
- name: Create zone with serial, refresh, retry and expire.
ipadnszone:
ipaadmin_password: SomeADMINpassword
name: testzone.local
serial: 4567
refresh: 70
retry: 89
expire: 200
- name: Verify zone was created with correct values.
shell: |
echo SomeADMINpassword | kinit -c {{ KRB5CCNAME }} admin
KRB5CCNAME={{ KRB5CCNAME }} ipa dnszone-show testzone.local
kdestroy -A -q -c {{ KRB5CCNAME }}
register: result
failed_when: |
result.failed or not (
"serial: 4567" in result.stdout
and "refresh: 70" in result.stdout
and "retry: 89" in result.stdout
and "expire: 200" in result.stdout
)
- name: Remove test zone.
ipadnszone:
ipaadmin_password: SomeADMINpassword
name: testzone.local
state: absent
vars:
KRB5CCNAME: verify_bz_1876896
- name: Verify if a zone can have the the SOA serial modified to a specific value.
block:
- name: Create zone.
ipadnszone:
ipaadmin_password: SomeADMINpassword
name: testzone.local
state: present
- name: Modify zone with serial, refresh, retry and expire.
ipadnszone:
ipaadmin_password: SomeADMINpassword
name: testzone.local
serial: 4567
refresh: 70
retry: 89
expire: 200
- name: Verify zone was modified to the correct values
shell: |
echo SomeADMINpassword | kinit -c {{ KRB5CCNAME }} admin
KRB5CCNAME={{ KRB5CCNAME }} ipa dnszone-show testzone.local
kdestroy -A -q -c {{ KRB5CCNAME }}
register: result
failed_when: |
result.failed or not (
"serial: 4567" in result.stdout
and "refresh: 70" in result.stdout
and "retry: 89" in result.stdout
and "expire: 200" in result.stdout
)
- name: Remove test zone.
ipadnszone:
ipaadmin_password: SomeADMINpassword
name: testzone.local
state: absent
vars:
KRB5CCNAME: verify_bz_1876896
- name: Ensure zone is present.
ipadnszone:
ipaadmin_password: SomeADMINpassword
@@ -98,7 +23,6 @@
allow_query:
- 1.1.1.1
- 2.2.2.2
serial: 1234
refresh: 3600
retry: 900
expire: 1209600
@@ -113,14 +37,6 @@
register: result
failed_when: not result.changed or result.failed
- name: Set serial to 1234, again.
ipadnszone:
ipaadmin_password: SomeADMINpassword
name: testzone.local
serial: 1234
register: result
failed_when: result.changed or result.failed
- name: Set different nsec3param_rec.
ipadnszone:
ipaadmin_password: SomeADMINpassword
@@ -233,22 +149,6 @@
register: result
failed_when: result.changed or result.failed
- name: Set serial to 12345.
ipadnszone:
ipaadmin_password: SomeADMINpassword
name: testzone.local
serial: 12345
register: result
failed_when: not result.changed or result.failed
- name: Set serial to 12345, again.
ipadnszone:
ipaadmin_password: SomeADMINpassword
name: testzone.local
serial: 12345
register: result
failed_when: result.changed or result.failed
- name: Set dnssec to false.
ipadnszone:
ipaadmin_password: SomeADMINpassword

23
tests/pytests/dnszone/test_dnszone.py
View File

@@ -78,7 +78,7 @@ class TestDNSZone(AnsibleFreeIPATestCase):
self.check_details(["Active zone: TRUE"], "dnszone-find", [zone26])
def test_dnszone_name_from_ip(self):
"""TC-35: Add dns zone with reverse zone IP. Bug#1845056"""
"""TC-35: Add dns zone with reverse zone IP. Bug#1845056."""
zone = "8.192.in-addr.arpa."
expected_msg = "Zone name: {0}".format(zone)
self.check_notexists([expected_msg], "dnszone-find", [zone])
@@ -92,7 +92,7 @@ class TestDNSZone(AnsibleFreeIPATestCase):
self.check_details([expected_msg], "dnszone-find", [zone])
def test_dnszone_del_multiple(self):
"""TC-33: Delete multiple DNS zones Bug#1845058"""
"""TC-33: Delete multiple DNS zones Bug#1845058."""
zone = ["delzone1.com", "delzone2.com", "delzone3.com"]
for add_zone in zone:
kinit_admin(self.master)
@@ -112,7 +112,7 @@ class TestDNSZone(AnsibleFreeIPATestCase):
self.check_notexists([error], "dnszone-show", [add_zone])
def test_dnszone_invalid_ip(self):
"""TC-07: Update with invalid IP’s in allow_transfer. Bug#1845051"""
"""TC-07: Update with invalid IP’s in allow_transfer. Bug#1845051."""
invalid_zone_name = "invalidzone.test"
invalid_zone_ip = "in.va.li.d"
expected_error = "Invalid IP for DNS forwarder"
@@ -128,20 +128,3 @@ class TestDNSZone(AnsibleFreeIPATestCase):
self.check_notexists(
[invalid_zone_ip], "dnszone-show", [invalid_zone_name],
)
def test_invalid_serial(self):
"""TC-13: Update invalid Serial."""
invalid_zone_name = "invalidserialzone.test"
invalid_serial = "429496729599"
expected_error = "invalid 'serial': can be at most 4294967295"
self.mark_xfail_using_ansible_freeipa_version(
version="ansible-freeipa-0.1.12-5.el8.noarch",
reason="Fix is not available for BZ-1845058",
)
self.run_playbook_with_exp_msg(
BASE_PATH + "dnszone_invalid_serial.yaml", expected_error
)
cmd = "dnszone-show"
self.check_notexists([invalid_serial], cmd, [invalid_zone_name])