summaryrefslogtreecommitdiffstats
path: root/install/tools/ipa-upgradeconfig
diff options
context:
space:
mode:
authorMartin Kosek <mkosek@redhat.com>2012-10-10 12:37:24 +0200
committerMartin Kosek <mkosek@redhat.com>2012-10-10 14:15:46 +0200
commitfff56ee1c8e4513805d838005777b4ade6c32de9 (patch)
treeb319b0645cc25b7a19498c167bb8f422fd1a1d31 /install/tools/ipa-upgradeconfig
parenteb79f5c955d80b6f6e1522d9d0206c9678b2b9e1 (diff)
downloadfreeipa-fff56ee1c8e4513805d838005777b4ade6c32de9.tar.gz
freeipa-fff56ee1c8e4513805d838005777b4ade6c32de9.tar.xz
freeipa-fff56ee1c8e4513805d838005777b4ade6c32de9.zip
Fix CA CRL migration crash in ipa-upgradeconfig
CRL migrate procedure did not check if a CA was actually configured on an updated master/replica. This caused ipa-upgradeconfig to crash on replicas without a CA. Make sure that CRL migrate procedure is not run when CA is not configured on given master. Also add few try..except clauses to make the procedure more robust. There is also a small refactoring of "<service> is not configured" log messages, so that they have matching log level and message. dogtag.py constants were updated to have a correct path to new CRL directory on Fedora 18 (dogtag 10). https://fedorahosted.org/freeipa/ticket/3159
Diffstat (limited to 'install/tools/ipa-upgradeconfig')
-rw-r--r--install/tools/ipa-upgradeconfig43
1 files changed, 29 insertions, 14 deletions
diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig
index 4ed718a9b..51e5b1d59 100644
--- a/install/tools/ipa-upgradeconfig
+++ b/install/tools/ipa-upgradeconfig
@@ -204,7 +204,7 @@ def check_certs():
else:
root_logger.debug('Certificate file exists')
-def upgrade_pki(fstore):
+def upgrade_pki(ca, fstore):
"""
Update/add the dogtag proxy configuration. The IPA side of this is
handled in ipa-pki-proxy.conf.
@@ -213,8 +213,8 @@ def upgrade_pki(fstore):
"""
configured_constants = dogtag.configured_constants()
root_logger.info('[Verifying that CA proxy configuration is correct]')
- if not os.path.exists(configured_constants.CS_CFG_PATH):
- root_logger.debug('No CA detected in /etc/pki-ca')
+ if not ca.is_configured():
+ root_logger.info('CA is not configured')
return
http = httpinstance.HTTPInstance(fstore)
@@ -300,7 +300,7 @@ def upgrade_ipa_profile(ca):
if audit or ski:
return True
else:
- root_logger.debug('CA is not configured')
+ root_logger.info('CA is not configured')
return False
@@ -329,7 +329,7 @@ def named_enable_psearch():
if not bindinstance.named_conf_exists():
# DNS service may not be configured
- root_logger.debug('DNS not configured')
+ root_logger.info('DNS is not configured')
return
try:
@@ -401,7 +401,7 @@ def named_enable_serial_autoincrement():
if not bindinstance.named_conf_exists():
# DNS service may not be configured
- root_logger.debug('DNS not configured')
+ root_logger.info('DNS is not configured')
return changed
try:
@@ -448,8 +448,9 @@ def enable_certificate_renewal(ca):
Returns True when CA needs to be restarted
"""
+ root_logger.info('[Enable certificate renewal]')
if not ca.is_configured():
- root_logger.debug('dogtag not configured')
+ root_logger.info('CA is not configured')
return False
# Using the nickname find the certmonger request_id
@@ -508,11 +509,20 @@ def migrate_crl_publish_dir(ca):
root_logger.info('CRL tree already moved')
return False
+ if not ca.is_configured():
+ root_logger.info('CA is not configured')
+ return False
+
caconfig = dogtag.configured_constants()
- old_publish_dir = installutils.get_directive(caconfig.CS_CFG_PATH,
- 'ca.publish.publisher.instance.FileBaseCRLPublisher.directory',
- separator='=')
+ try:
+ old_publish_dir = installutils.get_directive(caconfig.CS_CFG_PATH,
+ 'ca.publish.publisher.instance.FileBaseCRLPublisher.directory',
+ separator='=')
+ except OSError, e:
+ root_logger.error('Cannot read CA configuration file "%s": %s',
+ caconfig.CS_CFG_PATH, e)
+ return False
if old_publish_dir == caconfig.CRL_PUBLISH_PATH:
# publish dir is already updated
@@ -536,9 +546,14 @@ def migrate_crl_publish_dir(ca):
except Exception, e:
root_logger.error('Cannot move CRL file to new directory: %s', e)
- installutils.set_directive(caconfig.CS_CFG_PATH,
- 'ca.publish.publisher.instance.FileBaseCRLPublisher.directory',
- publishdir, quotes=False, separator='=')
+ try:
+ installutils.set_directive(caconfig.CS_CFG_PATH,
+ 'ca.publish.publisher.instance.FileBaseCRLPublisher.directory',
+ publishdir, quotes=False, separator='=')
+ except OSError, e:
+ root_logger.error('Cannot update CA configuration file "%s": %s',
+ caconfig.CS_CFG_PATH, e)
+ return False
sysupgrade.set_upgrade_state('dogtag', 'moved_crl_publish_dir', True)
root_logger.info('CRL publish directory has been migrated, '
'request pki-ca restart')
@@ -595,7 +610,7 @@ def main():
upgrade(sub_dict, "/etc/httpd/conf.d/ipa.conf", ipautil.SHARE_DIR + "ipa.conf")
upgrade(sub_dict, "/etc/httpd/conf.d/ipa-rewrite.conf", ipautil.SHARE_DIR + "ipa-rewrite.conf")
upgrade(sub_dict, "/etc/httpd/conf.d/ipa-pki-proxy.conf", ipautil.SHARE_DIR + "ipa-pki-proxy.conf", add=True)
- upgrade_pki(fstore)
+ upgrade_pki(ca, fstore)
update_dbmodules(api.env.realm)
uninstall_ipa_kpasswd()