diff options
| author | Petr Spacek <pspacek@redhat.com> | 2015-12-20 18:36:48 +0100 |
|---|---|---|
| committer | Martin Basti <mbasti@redhat.com> | 2016-01-07 14:13:23 +0100 |
| commit | 43acb994f6cd78098f5dc3671c14b3ab17ca164b (patch) | |
| tree | cd4176b50f7818ff7e075d3185749797b1346144 /ipapython/dnssec/bindmgr.py | |
| parent | ddf7397a4beb8095a24981998461aecc0e1ec40d (diff) | |
DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
This filtering is useful in cases where LDAP contains DNS zones which
have old metadata objects and DNSSEC disabled. Such zones must be
ignored to prevent errors while calling dnssec-keyfromlabel or rndc.
https://fedorahosted.org/freeipa/ticket/5348
Reviewed-By: Martin Basti <mbasti@redhat.com>
Diffstat (limited to 'ipapython/dnssec/bindmgr.py')
| -rw-r--r-- | ipapython/dnssec/bindmgr.py | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/ipapython/dnssec/bindmgr.py b/ipapython/dnssec/bindmgr.py index e92afff97..33d071f45 100644 --- a/ipapython/dnssec/bindmgr.py +++ b/ipapython/dnssec/bindmgr.py @@ -189,10 +189,20 @@ class BINDMgr(object): self.notify_zone(zone) - def sync(self): - """Synchronize list of zones in LDAP with BIND.""" + def sync(self, dnssec_zones): + """Synchronize list of zones in LDAP with BIND. + + dnssec_zones lists zones which should be processed. All other zones + will be ignored even though they were modified using ldap_event(). + + This filter is useful in cases where LDAP contains DNS zones which + have old metadata objects and DNSSEC disabled. Such zones must be + ignored to prevent errors while calling dnssec-keyfromlabel or rndc. + """ self.log.debug('Key metadata in LDAP: %s' % self.ldap_keys) - for zone in self.modified_zones: + self.log.debug('Zones modified but skipped during bindmgr.sync: %s', + self.modified_zones - dnssec_zones) + for zone in self.modified_zones.intersection(dnssec_zones): self.sync_zone(zone) self.modified_zones = set() |