Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 797256

Summary: ipa netgroup-add-member --hosts should not allow invalid characters
Product: Red Hat Enterprise Linux 6 Reporter: Scott Poore <spoore>
Component: ipaAssignee: Rob Crittenden <rcritten>
Status: CLOSED ERRATA QA Contact: IDM QE LIST <seceng-idm-qe-list>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.3CC: dpal, jgalipea, mkosek, syeghiay
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ipa-2.2.0-6.el6 Doc Type: Bug Fix
Doc Text:
No documentation needed.
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-20 13:19:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Scott Poore 2012-02-24 17:15:25 UTC
Description of problem:

ipa netgroup-add-member allows invalid characters like ?, | $, etc.

Version-Release number of selected component (if applicable):
389-ds-base-1.2.10.1-1.el6.x86_64
389-ds-base-libs-1.2.10.1-1.el6.x86_64
ipa-server-2.2.0-102.20120220T2339zgit7fe095c.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1.  <setup ipa server>
2.  kinit admin
3.  ipa netgroup-add testng1 --desc=desc1
4.  ipa netgroup-add-member testng1 --hosts=badhost?
5.  ipa netgroup-add-member testng1 --hosts=badhost\!\@\#\$\%\^\&\*\(\)
  
Actual results:

# ipa netgroup-add testng1 --desc=desc1
------------------------
Added netgroup "testng1"
------------------------
  Netgroup name: testng1
  Description: desc1
  NIS domain name: testrelm.com
  IPA unique ID: 40d66da2-5f0a-11e1-9c9c-5254008638a1

# ipa netgroup-add-member --hosts=badhost?
  Netgroup name: testng1
  Description: desc1
  NIS domain name: testrelm.com
  External host: badhost?
-------------------------
Number of members added 1
-------------------------

# ipa netgroup-add-member testng1 --hosts=badhost\!\@\#\$\%\^\&\*\(\)
  Netgroup name: testng1
  Description: desc1
  NIS domain name: testrelm.com
  External host: badhost?, badhost!@#$%^&*()
-------------------------
Number of members added 1
-------------------------

Expected results:

Should error on invalid characters for external hosts

Additional info:

Also affects netgroup-mod:
# ipa netgroup-mod testng1 --addattr=externalhost=anotherbadhost?
---------------------------
Modified netgroup "testng1"
---------------------------
  Netgroup name: testng1
  Description: desc1
  NIS domain name: testrelm.com
  External host: badhost?, badhost!@#$%^&*(), anotherbadhost?

# ipa netgroup-mod testng1 --addattr=externalhost=anotherbadhost\!\@\#\$\%\^\&\*\(\)
---------------------------
Modified netgroup "testng1"
---------------------------
  Netgroup name: testng1
  Description: desc1
  NIS domain name: testrelm.com
  External host: badhost?, badhost!@#$%^&*(), anotherbadhost?, anotherbadhost!@#$%^&*()

/var/log/httpd/error_log entries:

[Fri Feb 24 11:09:35 2012] [error] ipa: INFO: admin: netgroup_add_member(u'testng1', all=False, raw=False, version=u'2.26', host=(u'badhost?',)): SUCCESS
[Fri Feb 24 11:09:54 2012] [error] ipa: INFO: admin: netgroup_add_member(u'testng1', all=False, raw=False, version=u'2.26', host=(u'badhost!@#$%^&*()',)): SUCCESS
[Fri Feb 24 11:13:17 2012] [error] ipa: INFO: admin: netgroup_mod(u'testng1', addattr=(u'externalhost=anotherbadhost?',), rights=False, all=False, raw=False, version=u'2.26'): SUCCESS
[Fri Feb 24 11:13:24 2012] [error] ipa: INFO: admin: netgroup_mod(u'testng1', addattr=(u'externalhost=anotherbadhost!@#$%^&*()',), rights=False, all=False, raw=False, version=u'2.26'): SUCCESS

Comment 2 Dmitri Pal 2012-02-26 18:03:47 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/2447

Comment 6 Scott Poore 2012-04-02 14:28:32 UTC
From a quick check, I can see that it appears fixed for the --hosts option but, should it be for --setattr/--addattr?  Doesn't appear to be:


# ipa netgroup-add test1 --desc=asdf
----------------------
Added netgroup "test1"
----------------------
  Netgroup name: test1
  Description: asdf
  NIS domain name: testrelm.com
  IPA unique ID: 9a65ec84-7ccf-11e1-9e50-525400a8d770


# ipa netgroup-mod test1 --setattr=externalhost=anotherbadhost?
-------------------------
Modified netgroup "test1"
-------------------------
  Netgroup name: test1
  Description: asdf
  NIS domain name: testrelm.com
  External host: anotherbadhost?


# ipa netgroup-mod test1 --addattr=externalhost=anotherbadhost\!\@\#$\%\^\&\*\(\)
-------------------------
Modified netgroup "test1"
-------------------------
  Netgroup name: test1
  Description: asdf
  NIS domain name: testrelm.com
  External host: anotherbadhost?, anotherbadhost!@#$%^&*()

Comment 7 Jenny Severance 2012-04-02 14:36:51 UTC
setting bug back to assigned

Comment 8 Scott Poore 2012-04-02 14:44:45 UTC
I'm not sure if this is related yet but, I'm also now seeing an internal error if --hosts= is empty or space:

# ipa netgroup-add netgroup1 --desc=netgroup1
--------------------------
Added netgroup "netgroup1"
--------------------------
  Netgroup name: netgroup1
  Description: netgroup1
  NIS domain name: testrelm.com
  IPA unique ID: c295bb74-7cd1-11e1-9dc4-525400a8d770

# ipa netgroup-add-member netgroup1 --hosts=
ipa: ERROR: an internal error has occurred

# ipa netgroup-add-member netgroup1 --hosts=""
ipa: ERROR: an internal error has occurred

# ipa netgroup-add-member netgroup1 --hosts=" "
ipa: ERROR: an internal error has occurred


Entry from /var/log/httpd/error_log:
[Mon Apr 02 09:40:32 2012] [error] ipa: ERROR: non-public: TypeError: 'NoneType' object is not iterable
[Mon Apr 02 09:40:32 2012] [error] Traceback (most recent call last):
[Mon Apr 02 09:40:32 2012] [error]   File "/usr/lib/python2.6/site-packages/ipaserver/rpcserver.py", line 315, in wsgi_execute
[Mon Apr 02 09:40:32 2012] [error]     result = self.Command[name](*args, **options)
[Mon Apr 02 09:40:32 2012] [error]   File "/usr/lib/python2.6/site-packages/ipalib/frontend.py", line 438, in __call__
[Mon Apr 02 09:40:32 2012] [error]     ret = self.run(*args, **options)
[Mon Apr 02 09:40:32 2012] [error]   File "/usr/lib/python2.6/site-packages/ipalib/frontend.py", line 716, in run
[Mon Apr 02 09:40:32 2012] [error]     return self.execute(*args, **options)
[Mon Apr 02 09:40:32 2012] [error]   File "/usr/lib/python2.6/site-packages/ipalib/plugins/baseldap.py", line 1509, in execute
[Mon Apr 02 09:40:32 2012] [error]     dn = callback(ldap, dn, member_dns, failed, *keys, **options)
[Mon Apr 02 09:40:32 2012] [error]   File "/usr/lib/python2.6/site-packages/ipalib/plugins/netgroup.py", line 266, in pre_callback
[Mon Apr 02 09:40:32 2012] [error]     return add_external_pre_callback('host', ldap, dn, keys, options)
[Mon Apr 02 09:40:32 2012] [error]   File "/usr/lib/python2.6/site-packages/ipalib/plugins/baseldap.py", line 334, in add_external_pre_callback
[Mon Apr 02 09:40:32 2012] [error]     for value in options[membertype]:
[Mon Apr 02 09:40:32 2012] [error] TypeError: 'NoneType' object is not iterable
[Mon Apr 02 09:40:32 2012] [error] ipa: INFO: admin: netgroup_add_member(u'netgroup1', all=False, raw=False, version=u'2.32', host=None): TypeError

Comment 9 Scott Poore 2012-04-02 14:45:31 UTC
That was with the 2.2.0-7 version.

Comment 10 Martin Kosek 2012-04-02 15:20:24 UTC
Good catch, I will reopen the upstream ticket. This case should be fixed.

Comment 12 Scott Poore 2012-04-17 14:05:34 UTC
I have opened a separate bug to cover the setattr/addattr issue/question here.  That can be handled there instead of here.   That is bug 813325.

There is still the question of the internal errors on empty --hosts= options.

Comment 15 Scott Poore 2012-04-19 23:42:41 UTC
Verified.

Version :: ipa-server-2.2.0-10.el6.x86_64

Automated Test Results ::

# netgroup_bz_797256

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: netgroup_bz_797256: ipa netgroup-add-member --hosts should not allow invalid characters
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

-------------------------------------
Added netgroup "netgroup_bz_797256_1"
-------------------------------------
  Netgroup name: netgroup_bz_797256_1
  Description: desc1
  NIS domain name: testrelm.com
  IPA unique ID: 62eb79b6-8a78-11e1-a1bb-5254009625e8
:: [   PASS   ] :: Running 'ipa netgroup-add netgroup_bz_797256_1 --desc=desc1'
:: [   PASS   ] :: Running 'ipa netgroup-add-member netgroup_bz_797256_1 --hosts=badhost? > /tmp/errormsg.out 2>&1'
:: [   PASS   ] :: BZ 797256 not found for ipa netgroup-add-member --hosts with ?
---------------------------------------
Deleted netgroup "netgroup_bz_797256_1"
---------------------------------------
:: [   PASS   ] :: Running 'ipa netgroup-del netgroup_bz_797256_1'
-------------------------------------
Added netgroup "netgroup_bz_797256_2"
-------------------------------------
  Netgroup name: netgroup_bz_797256_2
  Description: desc2
  NIS domain name: testrelm.com
  IPA unique ID: 69a5455c-8a78-11e1-819d-5254009625e8
:: [   PASS   ] :: Running 'ipa netgroup-add netgroup_bz_797256_2 --desc=desc2'
:: [   PASS   ] :: Running 'ipa netgroup-add-member netgroup_bz_797256_2 --hosts=badhost\!\@\#$\%\^\&\*\(\) > /tmp/errormsg.out 2>&1'
:: [   PASS   ] :: BZ 797256 not found for ipa netgroup-add-member --hosts with other invalid characters
---------------------------------------
Deleted netgroup "netgroup_bz_797256_2"
---------------------------------------
:: [   PASS   ] :: Running 'ipa netgroup-del netgroup_bz_797256_2'

Manual Test Results ::


# ipa netgroup-add test2 --desc=test2
----------------------
Added netgroup "test2"
----------------------
  Netgroup name: test2
  Description: test2
  NIS domain name: testrelm.com
  IPA unique ID: dd3d1f80-8a78-11e1-a25b-5254009625e8

# ipa netgroup-add-member test2 --hosts=badhost? 
ipa: ERROR: invalid 'host': only letters, numbers, _, and - are allowed. - must not be the DNS label character

# ipa netgroup-add-member test2 --hosts=badhost\!\@\#$\%\^\&\*\(\)
ipa: ERROR: invalid 'host': only letters, numbers, _, and - are allowed. - must not be the DNS label character

# ipa netgroup-add-member test2 --hosts=
  Netgroup name: test2
  Description: test2
  NIS domain name: testrelm.com
-------------------------
Number of members added 0
-------------------------

# ipa netgroup-add-member test2 --hosts=""
  Netgroup name: test2
  Description: test2
  NIS domain name: testrelm.com
-------------------------
Number of members added 0
-------------------------

# ipa netgroup-add-member test2 --hosts=" "
  Netgroup name: test2
  Description: test2
  NIS domain name: testrelm.com
-------------------------
Number of members added 0
-------------------------

Comment 17 Martin Kosek 2012-04-24 11:59:37 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
No documentation needed.

Comment 19 errata-xmlrpc 2012-06-20 13:19:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0819.html