DNSSEC: add TLSA record type

Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
DNSSEC: WebUI: add TLSA record

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Fix ACI in DNS

Added ACI for idnssecinlinesigning, dlvrecord, nsec3paramrecord,
tlsarecord

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Update X-ORIGIN for 4.0

It was decided not to change the OID space for FreeIPA 4.0+ objectclasses.
However, we should still at least properly mark the X-ORIGIN to make
analyzing schema easier.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Remove NSEC3PARAM record

Revert 5b95be802c6aa12b9464813441f85eaee3e3e82b

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
Add NSEC3PARAM to zone settings

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
NSEC3PARAM tests

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
ipaldap: Override conversion of nsds5replicalast{update,init}{start,end}

The replication related attributes with generalized time syntax have
special behaviour implemented in 389, as follows:

In case they are explicitly requested for and not set, 0 is returned.

However, 0 is not a valid value for LDAP Generalized time. Thus
we need to add these attributes to the _SYNTAX_OVERRIDE dictionary,
overriding their conversion to datetime and converting them to
string instead, which perserves the old behaviour expected by the
replication codebase.

https://fedorahosted.org/freeipa/ticket/4350

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Do not fail if there are multiple nsDS5ReplicaId values in cn=replication,cn=etc

On systems installed before #3394 was fixed and nsDS5ReplicaId became
single-valued, there are two replica ID values stored in cn=replication:
the default (3) and the actual value we want.
Instead of failing when multiple values are found, use the largest one.

https://fedorahosted.org/freeipa/ticket/4375

Reviewed-By: Martin Kosek <mkosek@redhat.com>
Clear NSS session cache when socket is closed

Even when NSS connection is closed, there may be still cached
certificates in the NSS lib. This may cause subsequent NSS
initialization to crash. This problem especially reproduces in the
unit tests.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Allow to add non string values to named conf

Non string values should not start and end with '"' in options section
in named.conf

Required by ticket: https://fedorahosted.org/freeipa/ticket/4408

Reviewed-By: Petr Spacek <pspacek@redhat.com>
DNSSEC: Add experimental support for DNSSEC

Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Add warning about semantic change for zones

--forwarder have different semantic since
forward zones support.
Add warning if zone contains forwarders.

Ticket: https://fedorahosted.org/freeipa/ticket/3210#comment:16
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Add DNSSEC experimental support warning message

Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Use documentation addresses in dns help

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Help for forward zones

Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Split dns docstring

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Fix upgrade to forward zones

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Fix incompatible permission name *zone-del

Fixes ticket: https://fedorahosted.org/freeipa/ticket/4383

Reviewed-By: Petr Spacek <pspacek@redhat.com>
webui-build: use /usr/share/java/js.jar instead of rhino.jar

/usr/share/java/rhino.jar is a Fedora's symlink to /usr/share/java/js.jar

Debian doesn't have it. Direct usage of upstream /usr/share/java/js.jar should
work on both systems.

Reviewed-By: Timo Aaltonen <tjaalton@ubuntu.com>