diff options
author | Simo Sorce <simo@redhat.com> | 2017-03-31 11:22:45 -0400 |
---|---|---|
committer | Simo Sorce <simo@redhat.com> | 2017-05-03 07:35:53 -0400 |
commit | 06e65f8859164bc7e12a2c42d64b9f7c381a3219 (patch) | |
tree | 240969d9d637f065161b68ccd46ad6f56f7dae80 | |
parent | 92313c9e9d37733feb79d1b1c825178f48d6c69c (diff) | |
download | freeipa-cakeysfix.tar.gz freeipa-cakeysfix.tar.xz freeipa-cakeysfix.zip |
Make sure remote hosts have our keyscakeysfix
In complex replication setups a replica may try to obtain CA keys from a
host that is not the master we initially create the keys against.
In this case race conditions may happen due to replication. So we need
to make sure the server we are contacting to get the CA keys has our
keys in LDAP. We do this by waiting to positively fetch our encryption
public key (the last one we create) from the target host LDAP server.
Fixes: https://pagure.io/freeipa/issue/6838
Signed-off-by: Simo Sorce <simo@redhat.com>
-rw-r--r-- | ipaserver/install/custodiainstance.py | 28 | ||||
-rw-r--r-- | ipaserver/secrets/kem.py | 11 |
2 files changed, 38 insertions, 1 deletions
diff --git a/ipaserver/install/custodiainstance.py b/ipaserver/install/custodiainstance.py index 6a6139231..e14638171 100644 --- a/ipaserver/install/custodiainstance.py +++ b/ipaserver/install/custodiainstance.py @@ -1,6 +1,6 @@ # Copyright (C) 2015 FreeIPa Project Contributors, see 'COPYING' for license. -from ipaserver.secrets.kem import IPAKEMKeys +from ipaserver.secrets.kem import IPAKEMKeys, KEMLdap from ipaserver.secrets.client import CustodiaClient from ipaplatform.paths import paths from ipaplatform.constants import constants @@ -18,6 +18,7 @@ import shutil import os import stat import tempfile +import time import pwd @@ -122,6 +123,27 @@ class CustodiaInstance(SimpleServiceInstance): cli = self.__CustodiaClient(server=master_host_name) cli.fetch_key('dm/DMHash') + def __wait_keys(self, host, timeout=300): + ldap_uri = 'ldap://%s' % host + deadline = int(time.time()) + timeout + root_logger.info("Waiting up to {} seconds to see our keys " + "appear on host: {}".format(timeout, host)) + + konn = KEMLdap(ldap_uri) + saved_e = None + while True: + try: + konn.check_host_keys(self.fqdn) + except Exception as e: + # log only once for the same error + if not isinstance(e, type(saved_e)): + root_logger.debug( + "Transient error getting keys: '{err}'".format(err=e)) + saved_e = e + if int(time.time()) > deadline: + raise RuntimeError("Timed out trying to obtain keys.") + time.sleep(1) + def __get_keys(self, ca_host, cacerts_file, cacerts_pwd, data): # Fecth all needed certs one by one, then combine them in a single # p12 file @@ -129,6 +151,10 @@ class CustodiaInstance(SimpleServiceInstance): prefix = data['prefix'] certlist = data['list'] + # Before we attempt to fetch keys from this host, make sure our public + # keys have been replicated there. + self.__wait_keys(ca_host) + cli = self.__CustodiaClient(server=ca_host) # Temporary nssdb diff --git a/ipaserver/secrets/kem.py b/ipaserver/secrets/kem.py index 28fb4d31b..74ae70d5d 100644 --- a/ipaserver/secrets/kem.py +++ b/ipaserver/secrets/kem.py @@ -24,6 +24,7 @@ import ldap IPA_REL_BASE_DN = 'cn=custodia,cn=ipa,cn=etc' IPA_KEYS_QUERY = '(&(ipaKeyUsage={usage:s})(memberPrincipal={princ:s}))' +IPA_CHECK_QUERY = '(cn=enc/{host:s})' RFC5280_USAGE_MAP = {KEY_USAGE_SIG: 'digitalSignature', KEY_USAGE_ENC: 'dataEncipherment'} @@ -78,6 +79,16 @@ class KEMLdap(iSecLdap): jwk['use'] = KEY_USAGE_MAP[usage] return json_encode(jwk) + def check_host_keys(self, host): + conn = self.connect() + scope = ldap.SCOPE_SUBTREE + + ldap_filter = self.build_filter(IPA_CHECK_QUERY, {'host': host}) + r = conn.search_s(self.keysbase, scope, ldap_filter) + if len(r) != 1: + raise ValueError("Incorrect number of results (%d) searching for" + "public key for %s" % (len(r), host)) + def _format_public_key(self, key): if isinstance(key, str): jwkey = json_decode(key) |