|
 |
9ad913 |
From c63b6cbe536987d3e1818542a2f8530e44948812 Mon Sep 17 00:00:00 2001
|
|
|
9ad913 |
From: Christian Heimes <cheimes@redhat.com>
|
|
|
9ad913 |
Date: Fri, 25 Jan 2019 16:12:11 +0100
|
|
|
9ad913 |
Subject: [PATCH] Add workaround for slow host/service del
|
|
|
9ad913 |
|
|
|
9ad913 |
host-del and service-del are slow because cert revokation is implemented
|
|
|
9ad913 |
inefficiently. The internal cert_find() call retrieves all certificates
|
|
|
9ad913 |
from Dogtag.
|
|
|
9ad913 |
|
|
|
9ad913 |
The workaround special cases service and host find without additional RA
|
|
|
9ad913 |
search options. A search for service and host certs limits the scope to
|
|
|
9ad913 |
certificate with matching subject common name.
|
|
|
9ad913 |
|
|
|
9ad913 |
See: https://pagure.io/freeipa/issue/7835
|
|
|
9ad913 |
Signed-off-by: Christian Heimes <cheimes@redhat.com>
|
|
|
9ad913 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
9ad913 |
---
|
|
|
9ad913 |
ipaserver/plugins/cert.py | 16 ++++++++++++++++
|
|
|
9ad913 |
1 file changed, 16 insertions(+)
|
|
|
9ad913 |
|
|
|
9ad913 |
diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py
|
|
|
9ad913 |
index ed78388c8b8b4688873a5b047fb1b67e417a8a6d..b6a132ffdb27b4d7b1f761c4bee835f46c5d9721 100644
|
|
|
9ad913 |
--- a/ipaserver/plugins/cert.py
|
|
|
9ad913 |
+++ b/ipaserver/plugins/cert.py
|
|
|
9ad913 |
@@ -1470,6 +1470,22 @@ class cert_find(Search, CertMethod):
|
|
|
9ad913 |
result = collections.OrderedDict()
|
|
|
9ad913 |
complete = bool(ra_options)
|
|
|
9ad913 |
|
|
|
9ad913 |
+ # workaround for RHBZ#1669012
|
|
|
9ad913 |
+ # Improve performance for service and host case by also searching
|
|
|
9ad913 |
+ # for subject. This limits the amount of certificate retrieved from
|
|
|
9ad913 |
+ # Dogtag. The special case is only used, when no ra_options are set
|
|
|
9ad913 |
+ # and exactly one service or host is supplied.
|
|
|
9ad913 |
+ # The complete flag is left to False.
|
|
|
9ad913 |
+ if not ra_options:
|
|
|
9ad913 |
+ services = options.get('service', ())
|
|
|
9ad913 |
+ hosts = options.get('host', ())
|
|
|
9ad913 |
+ if len(services) == 1 and not hosts:
|
|
|
9ad913 |
+ principal = kerberos.Principal(options['service'][0])
|
|
|
9ad913 |
+ if principal.is_service:
|
|
|
9ad913 |
+ ra_options['subject'] = principal.hostname
|
|
|
9ad913 |
+ elif len(hosts) == 1 and not services:
|
|
|
9ad913 |
+ ra_options['subject'] = options['host'][0]
|
|
|
9ad913 |
+
|
|
|
9ad913 |
try:
|
|
|
9ad913 |
ca_enabled_check(self.api)
|
|
|
9ad913 |
except errors.NotFound:
|
|
|
9ad913 |
--
|
|
|
9ad913 |
2.20.1
|
|
|
9ad913 |
|