freeipa.git/daemons/dnssec, branch mindatefix

Remove unused locking "context manager"

2016-06-17T16:27:22+00:00

Class ods_db_lock is unused since August 2015.

Reviewed-By: Martin Basti

DNSSEC: Log debug messages at log level DEBUG

2016-01-07T13:13:23+00:00

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti

DNSSEC: ipa-ods-exporter: add ldap-cleanup command

2016-01-07T13:13:23+00:00

Command "ldap-cleanup " will remove all key metadata from
LDAP. This can be used manually in sequence like:
ldap-cleanup 
update 
to delete all key metadata from LDAP and re-export them from OpenDNSSEC.

ldap-cleanup command should be called when disabling DNSSEC on a DNS
zone to remove stale key metadata from LDAP.

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti

DNSSEC: remove keys purged by OpenDNSSEC from master HSM from LDAP

2016-01-07T13:13:23+00:00

Key purging has to be only only after key metadata purging so
ipa-dnskeysyncd on replices does not fail while dereferencing
non-existing keys.

https://fedorahosted.org/freeipa/ticket/5334

Reviewed-By: Martin Basti

DNSSEC: logging improvements in ipa-ods-exporter

2016-01-07T13:13:23+00:00

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti

DNSSEC: Make sure that current state in OpenDNSSEC matches key state in LDAP

2016-01-07T13:13:23+00:00

Previously we published timestamps of planned state changes in LDAP.
This led to situations where state transition in OpenDNSSEC was blocked
by an additional condition (or unavailability of OpenDNSSEC) but BIND
actually did the transition as planned.

Additionally key state mapping was incorrect for KSK so sometimes KSK
was not used for signing when it should.

Example (for code without this fix):
- Add a zone and let OpenDNSSEC to generate keys.
- Wait until keys are in state "published" and next state is "inactive".
- Shutdown OpenDNSSEC or break replication from DNSSEC key master.
- See that keys on DNS replicas will transition to state "inactive" even
  though it should not happen because OpenDNSSEC is not available
  (i.e. new keys may not be available).
- End result is that affected zone will not be signed anymore, even
  though it should stay signed with the old keys.

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti

DNSSEC: Improve error reporting from ipa-ods-exporter

2016-01-07T13:13:23+00:00

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti

Remove unused imports

2015-12-23T06:59:22+00:00

This patch removes unused imports, alse pylint has been configured to
check unused imports.

Reviewed-By: Jan Cholasta

Avoid ipa-dnskeysync-replica & ipa-ods-exporter crashes caused by exceeding LDAP limits

2015-10-07T12:28:50+00:00

ldap2 internally does LDAP search to find out what LDAP search limits
should be used (!). The problem is that this internal search has hardcoded
limits and throws LimitExceeded exception when DS is too slow.

DNSSEC daemons do not need any abstractions from ldap2 so we are going
to use ipaldap directly. This will avoid the unnecessary search and
associated risks.

https://fedorahosted.org/freeipa/ticket/5342

Reviewed-By: Martin Basti

DNSSEC: Wrap master key using RSA OAEP instead of old PKCS v1.5.

2015-09-03T16:22:53+00:00

https://fedorahosted.org/freeipa/ticket/5273

Reviewed-By: Martin Basti