Imported Debian patch 4.7.2-3

ipatests/test_ipaserver/httptest.py

@@ -20,12 +20,11 @@
 Base class for HTTP request tests
 """
 
-import urllib
+from six.moves import urllib
 
 from ipalib import api, util
 
-
-class Unauthorized_HTTP_test:
+class Unauthorized_HTTP_test(object):
     """
     Base class for simple HTTP request tests executed against URI
     with no required authorization

ipatests/test_ipaserver/test_adtrust_mockup.py

@@ -4,24 +4,23 @@ from __future__ import print_function
 import ipaserver.install.adtrust as adtr
 from ipaserver.install.adtrust import set_and_check_netbios_name
 from collections import namedtuple
-from unittest import mock
+from unittest import TestCase
+try:
+    from unittest import mock
+except ImportError:
+    import mock
 from io import StringIO
 
-import pytest
 
-
-class ApiMockup:
+class ApiMockup(object):
     Backend = namedtuple('Backend', 'ldap2')
     Calls = namedtuple('Callbacks', 'retrieve_netbios_name')
     env = namedtuple('Environment', 'domain')
 
 
-class TestNetbiosName:
-    api = None
-
-    @pytest.fixture(autouse=True, scope="class")
-    def netbiosname_setup(self, request):
-        cls = request.cls
+class TestNetbiosName(TestCase):
+    @classmethod
+    def setUpClass(cls):
         api = ApiMockup()
         ldap2 = namedtuple('LDAP', 'isconnected')
         ldap2.isconnected = mock.MagicMock(return_value=True)
@@ -30,9 +29,9 @@ class TestNetbiosName:
         adtr.retrieve_netbios_name = mock.MagicMock(return_value=None)
         cls.api = api
 
-        def fin():
-            adtr.retrieve_netbios_name = cls.api.Calls.retrieve_netbios_name
-        request.addfinalizer(fin)
+    @classmethod
+    def tearDownClass(cls):
+        adtr.retrieve_netbios_name = cls.api.Calls.retrieve_netbios_name
 
     def test_NetbiosName(self):
         """

ipatests/test_ipaserver/test_changepw.py

@@ -17,6 +17,8 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import unittest
+
 import pytest
 
 from ipatests.test_ipaserver.httptest import Unauthorized_HTTP_test
@@ -35,23 +37,20 @@ new_password = u'new_password'
 class test_changepw(XMLRPC_test, Unauthorized_HTTP_test):
     app_uri = '/ipa/session/change_password'
 
-    @pytest.fixture(autouse=True)
-    def changepw_setup(self, request):
+    def setup(self):
         try:
             api.Command['user_add'](uid=testuser, givenname=u'Test', sn=u'User')
             api.Command['passwd'](testuser, password=u'old_password')
         except errors.ExecutionError as e:
-            pytest.skip(
+            raise unittest.SkipTest(
                 'Cannot set up test user: %s' % e
             )
 
-        def fin():
-            try:
-                api.Command['user_del']([testuser])
-            except errors.NotFound:
-                pass
-
-        request.addfinalizer(fin)
+    def teardown(self):
+        try:
+            api.Command['user_del']([testuser])
+        except errors.NotFound:
+            pass
 
     def _changepw(self, user, old_password, new_password):
         return self.send_request(params={'user': str(user),

ipatests/test_ipaserver/test_install/test_adtrustinstance.py

@@ -29,7 +29,7 @@ if six.PY3:
 
 
 @pytest.mark.tier0
-class test_adtrustinstance:
+class test_adtrustinstance(object):
     """
     Test `adtrustinstance`.
     """

ipatests/test_ipaserver/test_install/test_bindinstance.py

@@ -0,0 +1,96 @@
+#
+# Copyright (C) 2018  FreeIPA Contributors.  See COPYING for license
+#
+
+from __future__ import absolute_import
+
+import tempfile
+
+import pytest
+
+from ipaplatform.paths import paths
+from ipaserver.install.server.upgrade import named_add_crypto_policy
+
+try:
+    from unittest.mock import patch  # pylint: disable=import-error
+except ImportError:
+    from mock import patch  # pylint: disable=import-error
+
+
+TEST_CONFIG = """
+options {
+\tdnssec-enable yes;
+\tdnssec-validation yes;
+};
+
+include "random/file";
+"""
+
+EXPECTED_CONFIG = """
+options {
+\tdnssec-enable yes;
+\tdnssec-validation yes;
+\tinclude "/etc/crypto-policies/back-ends/bind.config";
+};
+
+include "random/file";
+"""
+
+# bindinstance.named_conf_exists() looks for a section like this
+IPA_DYNDB_CONFIG = """
+dyndb "ipa" "/usr/lib/bind/ldap.so" {
+};
+"""
+
+POLICY_FILE = "/etc/crypto-policies/back-ends/bind.config"
+
+
+@pytest.fixture
+def namedconf():
+    with tempfile.NamedTemporaryFile('w+') as f:
+        with patch.multiple(paths,
+                            NAMED_CONF=f.name,
+                            NAMED_CRYPTO_POLICY_FILE=POLICY_FILE):
+            yield f.name
+
+
+@patch('ipaserver.install.sysupgrade.get_upgrade_state')
+@patch('ipaserver.install.sysupgrade.set_upgrade_state')
+def test_add_crypto_policy(m_set, m_get, namedconf):
+    m_get.return_value = False
+    with open(namedconf, 'w') as f:
+        f.write(TEST_CONFIG)
+        f.write(IPA_DYNDB_CONFIG)
+
+    result = named_add_crypto_policy()
+    assert result
+    m_get.assert_called_with('named.conf', 'add_crypto_policy')
+    m_set.assert_called_with('named.conf', 'add_crypto_policy', True)
+
+    with open(namedconf) as f:
+        content = f.read()
+    assert content == ''.join([EXPECTED_CONFIG, IPA_DYNDB_CONFIG])
+
+    m_get.reset_mock()
+    m_set.reset_mock()
+
+    m_get.return_value = True
+    named_add_crypto_policy()
+    m_get.assert_called_with('named.conf', 'add_crypto_policy')
+    m_set.assert_not_called()
+
+
+@patch('ipaserver.install.sysupgrade.get_upgrade_state')
+@patch('ipaserver.install.sysupgrade.set_upgrade_state')
+def test_add_crypto_policy_no_ipa(m_set, m_get, namedconf):
+    # Test if the update step is skipped when named.conf doesn't contain
+    # IPA related settings.
+    m_get.return_value = False
+    with open(namedconf, 'w') as f:
+        f.write(TEST_CONFIG)
+
+    result = named_add_crypto_policy()
+    assert not result
+
+    m_get.assert_not_called()
+    m_set.assert_not_called()

ipatests/test_ipaserver/test_install/test_cainstance.py

@@ -0,0 +1,125 @@
+#
+# Copyright (C) 2017  FreeIPA Contributors see COPYING for license
+#
+
+from binascii import hexlify
+import pickle
+# pylint: disable=import-error
+from six.moves.configparser import RawConfigParser
+# pylint: enable=import-error
+from six import StringIO
+import pytest
+from ipaserver.install import cainstance
+
+pytestmark = pytest.mark.tier0
+
+
+class test_ExternalCAProfile(object):
+    def test_MSCSTemplateV1_good(self):
+        o = cainstance.MSCSTemplateV1("MySubCA")
+        assert hexlify(o.get_ext_data()) == b'1e0e004d007900530075006200430041'
+
+    def test_MSCSTemplateV1_bad(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV1("MySubCA:1")
+
+    def test_MSCSTemplateV1_pickle_roundtrip(self):
+        o = cainstance.MSCSTemplateV1("MySubCA")
+        s = pickle.dumps(o)
+        assert o.get_ext_data() == pickle.loads(s).get_ext_data()
+
+    def test_MSCSTemplateV2_too_few_parts(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV2("1.2.3.4")
+
+    def test_MSCSTemplateV2_too_many_parts(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV2("1.2.3.4:100:200:300")
+
+    def test_MSCSTemplateV2_bad_oid(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV2("not_an_oid:1")
+
+    def test_MSCSTemplateV2_non_numeric_major_version(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV2("1.2.3.4:major:200")
+
+    def test_MSCSTemplateV2_non_numeric_minor_version(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV2("1.2.3.4:100:minor")
+
+    def test_MSCSTemplateV2_major_version_lt_zero(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV2("1.2.3.4:-1:200")
+
+    def test_MSCSTemplateV2_minor_version_lt_zero(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV2("1.2.3.4:100:-1")
+
+    def test_MSCSTemplateV2_major_version_gt_max(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV2("1.2.3.4:4294967296:200")
+
+    def test_MSCSTemplateV2_minor_version_gt_max(self):
+        with pytest.raises(ValueError):
+            cainstance.MSCSTemplateV2("1.2.3.4:100:4294967296")
+
+    def test_MSCSTemplateV2_good_major(self):
+        o = cainstance.MSCSTemplateV2("1.2.3.4:4294967295")
+        assert hexlify(o.get_ext_data()) == b'300c06032a0304020500ffffffff'
+
+    def test_MSCSTemplateV2_good_major_minor(self):
+        o = cainstance.MSCSTemplateV2("1.2.3.4:4294967295:0")
+        assert hexlify(o.get_ext_data()) \
+            == b'300f06032a0304020500ffffffff020100'
+
+    def test_MSCSTemplateV2_pickle_roundtrip(self):
+        o = cainstance.MSCSTemplateV2("1.2.3.4:4294967295:0")
+        s = pickle.dumps(o)
+        assert o.get_ext_data() == pickle.loads(s).get_ext_data()
+
+    def test_ExternalCAProfile_dispatch(self):
+        """
+        Test that constructing ExternalCAProfile actually returns an
+        instance of the appropriate subclass.
+        """
+        assert isinstance(
+            cainstance.ExternalCAProfile("MySubCA"),
+            cainstance.MSCSTemplateV1)
+        assert isinstance(
+            cainstance.ExternalCAProfile("1.2.3.4:100"),
+            cainstance.MSCSTemplateV2)
+
+    def test_write_pkispawn_config_file_MSCSTemplateV1(self):
+        template = cainstance.MSCSTemplateV1(u"SubCA")
+        expected = (
+            '[CA]\n'
+            'pki_req_ext_oid = 1.3.6.1.4.1.311.20.2\n'
+            'pki_req_ext_data = 1e0a00530075006200430041\n\n'
+        )
+        self._test_write_pkispawn_config_file(template, expected)
+
+    def test_write_pkispawn_config_file_MSCSTemplateV2(self):
+        template = cainstance.MSCSTemplateV2(u"1.2.3.4:4294967295")
+        expected = (
+            '[CA]\n'
+            'pki_req_ext_oid = 1.3.6.1.4.1.311.21.7\n'
+            'pki_req_ext_data = 300c06032a0304020500ffffffff\n\n'
+        )
+        self._test_write_pkispawn_config_file(template, expected)
+
+    def _test_write_pkispawn_config_file(self, template, expected):
+        """
+        Test that the values we read from an ExternalCAProfile
+        object can be used to produce a reasonable-looking pkispawn
+        configuration.
+        """
+        config = RawConfigParser()
+        config.optionxform = str
+        config.add_section("CA")
+        config.set("CA", "pki_req_ext_oid", template.ext_oid)
+        config.set("CA", "pki_req_ext_data",
+                   hexlify(template.get_ext_data()).decode('ascii'))
+        out = StringIO()
+        config.write(out)
+        assert out.getvalue() == expected

ipatests/test_ipaserver/test_install/test_installer.py

@@ -9,8 +9,6 @@ from abc import ABCMeta, abstractproperty
 from collections import namedtuple
 import itertools
 
-import pytest
-
 from ipatests.util import assert_equal
 from ipaserver.install.ipa_replica_install import ReplicaInstall
 
@@ -25,18 +23,16 @@ class InstallerTestBase(six.with_metaclass(ABCMeta, object)):
     def tested_cls(self):
         return None
 
-    @pytest.fixture(autouse=True, scope="class")
-    def installer_setup(self, request):
+    def setup_class(self):
         """Initializes the tested class so that it can be used later on
         """
-        cls = request.cls
-        cls.tested_cls.make_parser()
+        self.tested_cls.make_parser()
         assert \
-            getattr(cls.tested_cls, 'option_parser', False), \
+            getattr(self.tested_cls, 'option_parser', False), \
             ("Unable to generate option parser for {}"
-             .format(cls.tested_cls.__name__))
+             .format(self.tested_cls.__name__))
 
-        cls._populate_opts_dict()
+        self._populate_opts_dict()
 
     @classmethod
     def _populate_opts_dict(cls):

ipatests/test_ipaserver/test_install/test_installutils.py

@@ -5,23 +5,32 @@ from __future__ import absolute_import
 
 import binascii
 import os
-import psutil
 import re
+import shutil
 import subprocess
+import tempfile
 import textwrap
 
 import pytest
 
-from unittest.mock import patch, mock_open
-
 from ipaplatform.paths import paths
 from ipapython import ipautil
-from ipapython.admintool import ScriptError
 from ipaserver.install import installutils
 from ipaserver.install import ipa_backup
 from ipaserver.install import ipa_restore
 
 
+@pytest.fixture
+def tempdir(request):
+    tempdir = tempfile.mkdtemp()
+
+    def fin():
+        shutil.rmtree(tempdir)
+
+    request.addfinalizer(fin)
+    return tempdir
+
+
 GPG_GENKEY = textwrap.dedent("""
 %echo Generating a standard key
 Key-Type: RSA
@@ -54,8 +63,8 @@ def gpgkey(request, tempdir):
         f.write("verbose\n")
         f.write("allow-preset-passphrase\n")
 
-    # daemonize agent (detach from the console and run in the background)
-    subprocess.Popen(
+    # run agent in background
+    agent = subprocess.Popen(
         [paths.GPG_AGENT, '--batch', '--daemon'],
         env=env, stdout=devnull, stderr=devnull
     )
@@ -65,11 +74,8 @@ def gpgkey(request, tempdir):
             os.environ['GNUPGHOME'] = orig_gnupghome
         else:
             os.environ.pop('GNUPGHOME', None)
-        subprocess.run(
-            [paths.GPG_CONF, '--kill', 'all'],
-            check=True,
-            env=env,
-        )
+        agent.kill()
+        agent.wait()
 
     request.addfinalizer(fin)
 
@@ -144,119 +150,3 @@ def test_gpg_asymmetric(tempdir, gpgkey):
     assert os.path.isfile(src)
     with open(src) as f:
         assert f.read() == payload
-
-
-@pytest.mark.parametrize(
-    "platform, expected",
-    [
-        ("fedora", "fedora"),
-        ("fedora_container", "fedora"),
-        ("fedora_containers", "fedora_containers"),
-        ("fedoracontainer", "fedoracontainer"),
-        ("rhel", "rhel"),
-        ("rhel_container", "rhel"),
-    ]
-)
-def test_get_current_platform(monkeypatch, platform, expected):
-    monkeypatch.setattr(installutils.ipaplatform, "NAME", platform)
-    assert installutils.get_current_platform() == expected
-
-
-# The mock_exists in the following tests mocks that the cgroups
-# files exist even in non-containers. The values are provided by
-# mock_open_multi.
-
-
-@patch('ipaserver.install.installutils.in_container')
-@patch('os.path.exists')
-def test_in_container_no_cgroup(mock_exists, mock_in_container):
-    """
-    In a container in a container without cgroups, can't detect RAM
-    """
-    mock_in_container.return_value = True
-    mock_exists.side_effect = [False, False]
-    with pytest.raises(ScriptError):
-        installutils.check_available_memory(False)
-
-
-def mock_open_multi(*contents):
-    """Mock opening multiple files.
-
-       For our purposes the first read is limit, second is usage.
-
-       Note: this overrides *all* opens so if you use pdb then you will
-             need to extend the list by 2.
-    """
-    mock_files = [
-        mock_open(read_data=content).return_value for content in contents
-    ]
-    mock_multi = mock_open()
-    mock_multi.side_effect = mock_files
-
-    return mock_multi
-
-
-RAM_OK = str(1800 * 1000 * 1000)
-RAM_CA_USED = str(150 * 1000 * 1000)
-RAM_MOSTLY_USED = str(1500 * 1000 * 1000)
-RAM_NOT_OK = str(10 * 1000 * 1000)
-
-
-@patch('ipaserver.install.installutils.in_container')
-@patch('builtins.open', mock_open_multi(RAM_NOT_OK, "0"))
-@patch('os.path.exists')
-def test_in_container_insufficient_ram(mock_exists, mock_in_container):
-    """In a container with insufficient RAM and zero used"""
-    mock_in_container.return_value = True
-    mock_exists.side_effect = [True, True]
-
-    with pytest.raises(ScriptError):
-        installutils.check_available_memory(True)
-
-
-@patch('ipaserver.install.installutils.in_container')
-@patch('builtins.open', mock_open_multi(RAM_OK, RAM_CA_USED))
-@patch('os.path.exists')
-def test_in_container_ram_ok_no_ca(mock_exists, mock_in_container):
-    """In a container with just enough RAM to install w/o a CA"""
-    mock_in_container.return_value = True
-    mock_exists.side_effect = [True, True]
-
-    installutils.check_available_memory(False)
-
-
-@patch('ipaserver.install.installutils.in_container')
-@patch('builtins.open', mock_open_multi(RAM_OK, RAM_MOSTLY_USED))
-@patch('os.path.exists')
-def test_in_container_insufficient_ram_with_ca(mock_exists, mock_in_container):
-    """In a container and just miss the minimum RAM required"""
-    mock_in_container.return_value = True
-    mock_exists.side_effect = [True, True]
-
-    with pytest.raises(ScriptError):
-        installutils.check_available_memory(True)
-
-
-@patch('ipaserver.install.installutils.in_container')
-@patch('psutil.virtual_memory')
-def test_not_container_insufficient_ram_with_ca(mock_psutil, mock_in_container):
-    """Not a container and insufficient RAM"""
-    mock_in_container.return_value = False
-    fake_memory = psutil._pslinux.svmem
-    fake_memory.available = int(RAM_NOT_OK)
-    mock_psutil.return_value = fake_memory
-
-    with pytest.raises(ScriptError):
-        installutils.check_available_memory(True)
-
-
-@patch('ipaserver.install.installutils.in_container')
-@patch('psutil.virtual_memory')
-def test_not_container_ram_ok(mock_psutil, mock_in_container):
-    """Not a container and sufficient RAM"""
-    mock_in_container.return_value = False
-    fake_memory = psutil._pslinux.svmem
-    fake_memory.available = int(RAM_OK)
-    mock_psutil.return_value = fake_memory
-
-    installutils.check_available_memory(True)

ipatests/test_ipaserver/test_ipap11helper.py

@@ -91,7 +91,7 @@ def p11(request, token_path):
     return p11
 
 
-class test_p11helper:
+class test_p11helper(object):
     def test_generate_master_key(self, p11):
         assert p11.generate_master_key(master_key_label, master_key_id,
                                        key_length=16, cka_wrap=True,

ipatests/test_ipaserver/test_kadmin.py

@@ -13,9 +13,10 @@ import tempfile
 from ipalib import api
 
 from ipaserver.install import installutils
+from ipatests.test_util import yield_fixture
 
 
-@pytest.fixture
+@yield_fixture()
 def keytab():
     fd, keytab_path = tempfile.mkstemp(suffix='.keytab')
     os.close(fd)
@@ -71,15 +72,15 @@ def service_in_service_subtree(request):
     return princ
 
 
-@pytest.fixture(params=["service_in_kerberos_subtree",
-                        "service_in_service_subtree"])
+@pytest.fixture(params=[service_in_kerberos_subtree,
+                        service_in_service_subtree])
 def service(request):
-    return request.getfixturevalue(request.param)
+    return request.param(request)
 
 
 @pytest.mark.skipif(
     os.getuid() != 0, reason="kadmin.local is accesible only to root")
-class TestKadmin:
+class TestKadmin(object):
     def assert_success(self, command, *args):
         """
         Since kadmin.local returns 0 also when internal errors occur, we have
@@ -123,9 +124,3 @@ class TestKadmin:
             installutils.create_keytab,
             keytab,
             service)
-
-    def test_getprincs(self):
-        """
-        tests that kadmin.local getprincs command returns a list of principals
-        """
-        self.assert_success(installutils.kadmin, 'getprincs')

ipatests/test_ipaserver/test_ldap.py

@@ -29,6 +29,7 @@ from __future__ import absolute_import
 
 import os
 import sys
+import unittest
 
 import pytest
 import six
@@ -44,22 +45,20 @@ if six.PY3:
 
 @pytest.mark.tier0
 @pytest.mark.needs_ipaapi
-class test_ldap:
+class test_ldap(object):
     """
     Test various LDAP client bind methods.
     """
 
-    @pytest.fixture(autouse=True)
-    def ldap_setup(self, request):
+    def setup(self):
         self.conn = None
         self.ldapuri = api.env.ldap_uri
         self.dn = DN(('krbprincipalname','ldap/%s@%s' % (api.env.host, api.env.realm)),
                      ('cn','services'),('cn','accounts'),api.env.basedn)
 
-        def fin():
-            if self.conn and self.conn.isconnected():
-                self.conn.disconnect()
-        request.addfinalizer(fin)
+    def teardown(self):
+        if self.conn and self.conn.isconnected():
+            self.conn.disconnect()
 
     def test_anonymous(self):
         """
@@ -91,7 +90,7 @@ class test_ldap:
             with open(pwfile, "r") as fp:
                 dm_password = fp.read().rstrip()
         else:
-            pytest.skip(
+            raise unittest.SkipTest(
                 "No directory manager password in %s" % pwfile
             )
         self.conn = ldap2(api)
@@ -117,7 +116,7 @@ class test_ldap:
             with open(pwfile, "r") as fp:
                 dm_password = fp.read().rstrip()
         else:
-            pytest.skip(
+            raise unittest.SkipTest(
                 "No directory manager password in %s" % pwfile
             )
         myapi.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')), bind_pw=dm_password)
@@ -135,7 +134,7 @@ class test_ldap:
         try:
             self.conn.connect(autobind=True)
         except errors.ACIError:
-            pytest.skip("Only executed as root")
+            raise unittest.SkipTest("Only executed as root")
         entry_attrs = self.conn.get_entry(self.dn, ['usercertificate'])
         cert = entry_attrs.get('usercertificate')[0]
         assert cert.serial_number is not None
@@ -143,7 +142,7 @@ class test_ldap:
 
 @pytest.mark.tier0
 @pytest.mark.needs_ipaapi
-class test_LDAPEntry:
+class test_LDAPEntry(object):
     """
     Test the LDAPEntry class
     """
@@ -152,18 +151,16 @@ class test_LDAPEntry:
     dn1 = DN(('cn', cn1[0]))
     dn2 = DN(('cn', cn2[0]))
 
-    @pytest.fixture(autouse=True)
-    def ldapentry_setup(self, request):
+    def setup(self):
         self.ldapuri = api.env.ldap_uri
         self.conn = ldap2(api)
         self.conn.connect(autobind=AUTOBIND_DISABLED)
 
         self.entry = self.conn.make_entry(self.dn1, cn=self.cn1)
 
-        def fin():
-            if self.conn and self.conn.isconnected():
-                self.conn.disconnect()
-        request.addfinalizer(fin)
+    def teardown(self):
+        if self.conn and self.conn.isconnected():
+            self.conn.disconnect()
 
     def test_entry(self):
         e = self.entry
@@ -236,7 +233,7 @@ class test_LDAPEntry:
         e = self.entry
         assert e.pop('cn') == self.cn1
         assert 'cn' not in e
-        assert e.pop('cn', 'default') == 'default'
+        assert e.pop('cn', 'default') is 'default'
         with pytest.raises(KeyError):
             e.pop('cn')
 
@@ -249,9 +246,9 @@ class test_LDAPEntry:
     @pytest.mark.skipif(sys.version_info >= (3, 0), reason="Python 2 only")
     def test_has_key(self):
         e = self.entry
-        assert not e.has_key('xyz')  # noqa
-        assert e.has_key('cn')  # noqa
-        assert e.has_key('COMMONNAME')  # noqa
+        assert not e.has_key('xyz')
+        assert e.has_key('cn')
+        assert e.has_key('COMMONNAME')
 
     def test_in(self):
         e = self.entry
@@ -320,21 +317,3 @@ class test_LDAPEntry:
 
         e.raw['test'].append(b'second')
         assert e['test'] == ['not list', u'second']
-
-    def test_modlist_with_varying_encodings(self):
-        """
-        Test modlist is correct when only encoding of new value differs
-
-        See: https://bugzilla.redhat.com/show_bug.cgi?id=1658302
-        """
-        dn_ipa_encoded = b'O=Red Hat\\, Inc.'
-        dn_389ds_encoded = b'O=Red Hat\\2C Inc.'
-        entry = self.entry
-        entry.raw['distinguishedName'] = [dn_389ds_encoded]
-        # This is to make entry believe that that value was part of the
-        # original data we received from LDAP
-        entry.reset_modlist()
-        entry['distinguishedName'] = [entry['distinguishedName'][0]]
-        assert entry.generate_modlist() == [
-            (1, 'distinguishedName', [dn_389ds_encoded]),
-            (0, 'distinguishedName', [dn_ipa_encoded])]

ipatests/test_ipaserver/test_migratepw.py

@@ -20,21 +20,21 @@ class test_migratepw(XMLRPC_test, Unauthorized_HTTP_test):
     """
     app_uri = '/ipa/migration/migration.py'
 
-    @pytest.fixture(autouse=True)
-    def migratepw_setup(self, request):
+    def setup(self):
         """
         Prepare for tests
         """
         api.Command['user_add'](uid=testuser, givenname=u'Test', sn=u'User')
         api.Command['passwd'](testuser, password=password)
 
-        def fin():
-            try:
-                api.Command['user_del']([testuser])
-            except errors.NotFound:
-                pass
-
-        request.addfinalizer(fin)
+    def teardown(self):
+        """
+        Clean up
+        """
+        try:
+            api.Command['user_del']([testuser])
+        except errors.NotFound:
+            pass
 
     def _migratepw(self, user, password, method='POST'):
         """

ipatests/test_ipaserver/test_otptoken_import.py

@@ -27,7 +27,7 @@ from ipaserver.install.ipa_otptoken_import import convertHashName
 basename = os.path.join(os.path.dirname(__file__), "data")
 
 @pytest.mark.tier1
-class test_otptoken_import:
+class test_otptoken_import(object):
     def test_figure3(self):
         doc = PSKCDocument(os.path.join(basename, "pskc-figure3.xml"))
         assert doc.keyname is None

ipatests/test_ipaserver/test_rpcserver.py

@@ -35,8 +35,7 @@ if six.PY3:
 
 pytestmark = pytest.mark.tier0
 
-
-class StartResponse:
+class StartResponse(object):
     def __init__(self):
         self.reset()
 
@@ -136,7 +135,7 @@ def test_params_2_args_options():
     assert f([args, options]) == (args, options)
 
 
-class test_session:
+class test_session(object):
     klass = rpcserver.wsgi_dispatch
 
     def test_route(self):

ipatests/test_ipaserver/test_secrets.py

@@ -6,8 +6,7 @@ import os
 import shutil
 import subprocess
 import tempfile
-
-import pytest
+import unittest
 
 
 def _test_password_callback():
@@ -16,13 +15,9 @@ def _test_password_callback():
     return password
 
 
-class TestiSecStore:
-    certdb = None
-    cert2db = None
-
-    @pytest.fixture(autouse=True, scope="class")
-    def isec_store_setup(self, request):
-        cls = request.cls
+class TestiSecStore(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
         cls.testdir = tempfile.mkdtemp(suffix='ipa-sec-store')
         pwfile = os.path.join(cls.testdir, 'pwfile')
         with open(pwfile, 'w') as f:
@@ -50,9 +45,9 @@ class TestiSecStore:
             cwd=cls.testdir
         )
 
-        def fin():
-            shutil.rmtree(cls.testdir)
-        request.addfinalizer(fin)
+    @classmethod
+    def tearDownClass(cls):
+        shutil.rmtree(cls.testdir)
 
     def test_iSecStore(self):
         iss = iSecStore({})

ipatests/test_ipaserver/test_serverroles.py

@@ -16,7 +16,6 @@ import pytest
 from ipaplatform.paths import paths
 from ipalib import api, create_api, errors
 from ipapython.dn import DN
-from ipaserver.masters import ENABLED_SERVICE
 
 pytestmark = pytest.mark.needs_ipaapi
 
@@ -26,7 +25,7 @@ def _make_service_entry(ldap_backend, dn, enabled=True, other_config=None):
         'objectClass': ['top', 'nsContainer', 'ipaConfigObject'],
     }
     if enabled:
-        mods.update({'ipaConfigString': [ENABLED_SERVICE]})
+        mods.update({'ipaConfigString': ['enabledService']})
 
     if other_config is not None:
         mods.setdefault('ipaConfigString', [])
@@ -55,7 +54,8 @@ def _make_master_entry(ldap_backend, dn, ca=False):
 
 _adtrust_agents = DN(
     ('cn', 'adtrust agents'),
-    api.env.container_sysaccounts,
+    ('cn', 'sysaccounts'),
+    ('cn', 'etc'),
     api.env.basedn
 )
 
@@ -218,7 +218,7 @@ master_data = {
 }
 
 
-class MockMasterTopology:
+class MockMasterTopology(object):
     """
     object that will set up and tear down entries in LDAP backend to mimic
     a presence of real IPA masters with services running on them.
@@ -587,7 +587,7 @@ def dns_server(request):
     return request.param
 
 
-class TestServerRoleStatusRetrieval:
+class TestServerRoleStatusRetrieval(object):
     def retrieve_role(self, master, role, mock_api, mock_masters):
         fqdn = mock_masters.get_fqdn(master)
         return mock_api.Backend.serverroles.server_role_retrieve(
@@ -683,7 +683,7 @@ class TestServerRoleStatusRetrieval:
                                    'ca-dns-dnssec-keymaster-pkinit-server'))
 
 
-class TestServerAttributes:
+class TestServerAttributes(object):
     def config_retrieve(self, assoc_role_name, mock_api):
         return mock_api.Backend.serverroles.config_retrieve(
             assoc_role_name)

ipatests/test_ipaserver/test_topology_plugin.py

@@ -11,7 +11,7 @@ import pytest
 
 
 @pytest.mark.tier1
-class TestTopologyPlugin:
+class TestTopologyPlugin(object):
     """
     Test Topology plugin from the DS point of view
     Testcase: http://www.freeipa.org/page/V4/Manage_replication_topology/
@@ -20,17 +20,15 @@ class TestTopologyPlugin:
     """
     pwfile = os.path.join(api.env.dot_ipa, ".dmpw")
 
-    @pytest.fixture(autouse=True)
-    def topologyplugin_setup(self, request):
+    def setup(self):
         """
         setup for test
         """
         self.conn = None
 
-        def fin():
-            if self.conn and self.conn.isconnected():
-                self.conn.disconnect()
-        request.addfinalizer(fin)
+    def teardown(self):
+        if self.conn and self.conn.isconnected():
+            self.conn.disconnect()
 
     @pytest.mark.skipif(os.path.isfile(pwfile) is False,
                         reason="You did not provide a .dmpw file with the DM password")

ipatests/test_ipaserver/test_version_comparison.py

@@ -33,8 +33,7 @@ version_strings = [
 def versions(request):
     return request.param
 
-
-class TestVersionComparsion:
+class TestVersionComparsion(object):
 
     def test_versions(self, versions):
         version_string1, version_string2, expected_comparison = versions