URL: https://github.com/freeipa/freeipa/pull/5653
Author: mrizwan93
Title: #5653: ipatests: test to renew certs on replica using ipa-cert-fix
Action: opened
PR body:
"""
This test checks if ipa-cert-fix renews the certs on replica
after cert renewal on master.
related: https://pagure.io/freeipa/issue/7885
Signed-off-by: Mohammad Rizwan <myu...@redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5653/head:pr5653
git checkout pr5653
From 9d541468175d0100143bb260924c9be3eabf60ef Mon Sep 17 00:00:00 2001
From: Mohammad Rizwan <myu...@redhat.com>
Date: Mon, 22 Mar 2021 16:06:32 +0530
Subject: [PATCH 1/3] ipatests: refactor expire_cert_critical fixture
Defined method to move the date and refactor
expire_cert_critical fixture using it
Signed-off-by: Mohammad Rizwan <myu...@redhat.com>
---
ipatests/test_integration/test_ipa_cert_fix.py | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/ipatests/test_integration/test_ipa_cert_fix.py b/ipatests/test_integration/test_ipa_cert_fix.py
index b2e92d4dcac..4116a62f16a 100644
--- a/ipatests/test_integration/test_ipa_cert_fix.py
+++ b/ipatests/test_integration/test_ipa_cert_fix.py
@@ -48,6 +48,16 @@ def check_status(host, cert_count, state, timeout=600):
return count
+def move_date(host, chrony_state, date_str):
+ """Helper method to move the date on given host
+ :param host: The host on which date is to be moved
+ :param chrony_state: State to which chrony service to be moved
+ :param date_str: date string to move the date i.e 2years1month1days
+ """
+ host.run_command(['systemctl', chrony_state, 'chronyd'])
+ host.run_command(['date', '-s', date_str])
+
+
@pytest.fixture
def expire_cert_critical():
"""
@@ -64,15 +74,15 @@ def _expire_cert_critical(host, setup_kra=False):
extra_args=['--no-ntp'])
if setup_kra:
tasks.install_kra(host)
- host.run_command(['systemctl', 'stop', 'chronyd'])
- host.run_command(['date', '-s', '+3Years+1day'])
+
+ # move date to expire certs
+ move_date(host, 'stop', '+3Years+1day')
yield _expire_cert_critical
host = hosts.pop('host')
tasks.uninstall_master(host)
- host.run_command(['date', '-s', '-3Years-1day'])
- host.run_command(['systemctl', 'start', 'chronyd'])
+ move_date(host, 'start', '-3Years-1day')
class TestIpaCertFix(IntegrationTest):
From 648c9fec9934302ef1fa2c74f5a88a884e1159a0 Mon Sep 17 00:00:00 2001
From: Mohammad Rizwan <myu...@redhat.com>
Date: Mon, 22 Mar 2021 16:45:14 +0530
Subject: [PATCH 2/3] ipatests: test to renew certs on replica using
ipa-cert-fix
This test checks if ipa-cert-fix renews the certs on replica
after cert renewal on master.
related: https://pagure.io/freeipa/issue/7885
Signed-off-by: Mohammad Rizwan <myu...@redhat.com>
---
.../test_integration/test_ipa_cert_fix.py | 62 +++++++++++++++++++
1 file changed, 62 insertions(+)
diff --git a/ipatests/test_integration/test_ipa_cert_fix.py b/ipatests/test_integration/test_ipa_cert_fix.py
index 4116a62f16a..5cf3cb43f67 100644
--- a/ipatests/test_integration/test_ipa_cert_fix.py
+++ b/ipatests/test_integration/test_ipa_cert_fix.py
@@ -6,6 +6,7 @@
Module provides tests for ipa-cert-fix CLI.
"""
import pytest
+import re
import time
import logging
@@ -260,3 +261,64 @@ def test_renew_expired_cert_with_kra(self, expire_cert_critical):
self.master.run_command(['ipa-cert-fix', '-v'], stdin_text='yes\n')
check_status(self.master, 12, "MONITORING")
+
+
+class TestCertFixReplica(IntegrationTest):
+
+ num_replicas = 1
+
+ @classmethod
+ def install(cls, mh):
+ tasks.install_master(
+ mh.master, setup_dns=False, extra_args=['--no-ntp']
+ )
+ tasks.install_replica(
+ mh.master, mh.replicas[0],
+ setup_dns=False, extra_args=['--no-ntp']
+ )
+
+ def test_renew_expired_cert_replica(self):
+ """Test renewal of certificates on replica with ipa-cert-fix
+
+ This is to check that ipa-cert-fix renews the certificates
+ on replica
+
+ related: https://pagure.io/freeipa/issue/7885
+ """
+ move_date(self.master, 'stop', '+3years+1days')
+
+ # wait for cert expiry
+ check_status(self.master, 8, "CA_UNREACHABLE")
+
+ self.master.run_command(['ipa-cert-fix', '-v'], stdin_text='yes\n')
+
+ check_status(self.master, 9, "MONITORING")
+
+ # move system date to expire cert on replica
+ move_date(self.replicas[0], 'stop', '+3years+1days')
+
+ # RA agent cert will be expired and in CA_UNREACHABLE state
+ check_status(self.replicas[0], 1, "CA_UNREACHABLE")
+
+ # renew RA agent cert
+ self.replicas[0].run_command(
+ ['ipa-cert-fix', '-v'], stdin_text='yes\n'
+ )
+
+ # LDAP/HTTP/PKINIT certs will be renewed automaticaly
+ # after moving date on replica. This 3, 1 CA cert,
+ # 1 RA agent cert. Check for total 5 valid certs.
+ check_status(self.replicas[0], 5, "MONITORING")
+
+ # get the req ids of all certs to renew remaining
+ # certs by re-submitting it
+ result = self.replicas[0].run_command(['getcert', 'list'])
+ req_ids = re.findall(r'\d+', result.stdout_text)
+
+ # resubmit the certs to renew them
+ for req_id in req_ids:
+ self.replicas[0].run_command(
+ ['getcert', 'resubmit', '-i', req_id]
+ )
+
+ check_status(self.master, 9, "MONITORING")
From 753d7d5e22d9c22093f119d47fd9c40d9b4af856 Mon Sep 17 00:00:00 2001
From: Mohammad Rizwan <myu...@redhat.com>
Date: Mon, 22 Mar 2021 17:05:25 +0530
Subject: [PATCH 3/3] ipatests: PEP8 fixes
---
ipatests/test_integration/test_ipa_cert_fix.py | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/ipatests/test_integration/test_ipa_cert_fix.py b/ipatests/test_integration/test_ipa_cert_fix.py
index 5cf3cb43f67..a590b520cc3 100644
--- a/ipatests/test_integration/test_ipa_cert_fix.py
+++ b/ipatests/test_integration/test_ipa_cert_fix.py
@@ -133,7 +133,8 @@ def test_missing_csr(self, expire_cert_critical):
# Because of BZ 1897120, pki-cert-fix fails on pki-core 10.10.0
# https://bugzilla.redhat.com/show_bug.cgi?id=1897120
- if tasks.get_pki_version(self.master) != tasks.parse_version('10.10.0'):
+ if (tasks.get_pki_version(self.master) !=
+ tasks.parse_version('10.10.0')):
assert result.returncode == 0
# get the number of certs track by certmonger
@@ -230,7 +231,7 @@ def test_third_party_certs(self):
'--pin', self.master.config.admin_password,
'-d', 'server.p12']
self.master.run_command(args)
- self.master.run_command(['ipactl', 'restart',])
+ self.master.run_command(['ipactl', 'restart'])
# Run ipa-cert-fix. This is basically a no-op but tests that
# the DS nickname is used and not a hardcoded value.
_______________________________________________
FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org
To unsubscribe send an email to freeipa-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahosted.org
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
