pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0146-cert-renewal-make-renewal-of-ipaCert-atomic.patch

2e9388
From 09ead70bf9a081d8e2961a83d5dfe64d8f4c0399 Mon Sep 17 00:00:00 2001
2e9388
From: Jan Cholasta <jcholast@redhat.com>
2e9388
Date: Mon, 9 Nov 2015 10:53:02 +0100
2e9388
Subject: [PATCH] cert renewal: make renewal of ipaCert atomic
2e9388
2e9388
This prevents errors when renewing other certificates during the renewal of
2e9388
ipaCert.
2e9388
2e9388
https://fedorahosted.org/freeipa/ticket/5436
2e9388
2e9388
Reviewed-By: David Kupka <dkupka@redhat.com>
2e9388
---
2e9388
 install/restart_scripts/Makefile.am       |  1 +
2e9388
 install/restart_scripts/renew_ra_cert     |  5 ++++-
2e9388
 install/restart_scripts/renew_ra_cert_pre | 18 ++++++++++++++++++
2e9388
 ipaserver/install/cainstance.py           |  2 +-
2e9388
 ipaserver/install/server/upgrade.py       |  4 ++--
2e9388
 5 files changed, 26 insertions(+), 4 deletions(-)
2e9388
 create mode 100755 install/restart_scripts/renew_ra_cert_pre
2e9388
2e9388
diff --git a/install/restart_scripts/Makefile.am b/install/restart_scripts/Makefile.am
2e9388
index 58057aa3198c892fc8ebb0df403495566ed77d1d..c4bf8195ea85ee0a9dba53fc2581e90c18a9127d 100644
2e9388
--- a/install/restart_scripts/Makefile.am
2e9388
+++ b/install/restart_scripts/Makefile.am
2e9388
@@ -7,6 +7,7 @@ app_DATA =                              \
2e9388
 	renew_ca_cert			\
2e9388
 	renew_ra_cert			\
2e9388
 	stop_pkicad			\
2e9388
+	renew_ra_cert_pre		\
2e9388
 	$(NULL)
2e9388
 
2e9388
 EXTRA_DIST =                            \
2e9388
diff --git a/install/restart_scripts/renew_ra_cert b/install/restart_scripts/renew_ra_cert
2e9388
index 3a36f739ae53391e502356f7b6b4fd96a536c3a6..988ada946aed47d1f2b76c1add48ea8c8d64a161 100644
2e9388
--- a/install/restart_scripts/renew_ra_cert
2e9388
+++ b/install/restart_scripts/renew_ra_cert
2e9388
@@ -77,8 +77,11 @@ def _main():
2e9388
 
2e9388
 
2e9388
 def main():
2e9388
-    with certs.renewal_lock:
2e9388
+    try:
2e9388
         _main()
2e9388
+    finally:
2e9388
+        # lock acquired in renew_ra_cert_pre
2e9388
+        certs.renewal_lock.release('renew_ra_cert')
2e9388
 
2e9388
 
2e9388
 try:
2e9388
diff --git a/install/restart_scripts/renew_ra_cert_pre b/install/restart_scripts/renew_ra_cert_pre
2e9388
new file mode 100755
2e9388
index 0000000000000000000000000000000000000000..d0f743c099162e4c5afd7d96287e58492246db35
2e9388
--- /dev/null
2e9388
+++ b/install/restart_scripts/renew_ra_cert_pre
2e9388
@@ -0,0 +1,18 @@
2e9388
+#!/usr/bin/python2 -E
2e9388
+#
2e9388
+# Copyright (C) 2015  FreeIPA Contributors see COPYING for license
2e9388
+#
2e9388
+
2e9388
+import syslog
2e9388
+import traceback
2e9388
+
2e9388
+from ipaserver.install import certs
2e9388
+
2e9388
+
2e9388
+def main():
2e9388
+    certs.renewal_lock.acquire('renew_ra_cert')
2e9388
+
2e9388
+try:
2e9388
+    main()
2e9388
+except Exception:
2e9388
+    syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
2e9388
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
2e9388
index dfe023c08c9b8d1b28f1659b7c5a6395f3afe879..d230c9bdcab68f02cce32a2aeb89ca3e2143eefe 100644
2e9388
--- a/ipaserver/install/cainstance.py
2e9388
+++ b/ipaserver/install/cainstance.py
2e9388
@@ -1305,7 +1305,7 @@ class CAInstance(DogtagInstance):
2e9388
                 pin=None,
2e9388
                 pinfile=paths.ALIAS_PWDFILE_TXT,
2e9388
                 secdir=paths.HTTPD_ALIAS_DIR,
2e9388
-                pre_command=None,
2e9388
+                pre_command='renew_ra_cert_pre',
2e9388
                 post_command='renew_ra_cert')
2e9388
         except RuntimeError, e:
2e9388
             self.log.error(
2e9388
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
2e9388
index e0a45a097171613397db42e1c035f0d818a3ecf5..c8f744c392c7b859459bda63c1f397226553d4ba 100644
2e9388
--- a/ipaserver/install/server/upgrade.py
2e9388
+++ b/ipaserver/install/server/upgrade.py
2e9388
@@ -799,7 +799,7 @@ def certificate_renewal_update(ca):
2e9388
     dogtag_constants = dogtag.configured_constants()
2e9388
 
2e9388
     # bump version when requests is changed
2e9388
-    version = 3
2e9388
+    version = 4
2e9388
     requests = (
2e9388
         (
2e9388
             dogtag_constants.ALIAS_DIR,
2e9388
@@ -837,7 +837,7 @@ def certificate_renewal_update(ca):
2e9388
             paths.HTTPD_ALIAS_DIR,
2e9388
             'ipaCert',
2e9388
             'dogtag-ipa-ca-renew-agent',
2e9388
-            None,
2e9388
+            'renew_ra_cert_pre',
2e9388
             'renew_ra_cert',
2e9388
             None,
2e9388
         ),
2e9388
-- 
2e9388
2.4.3
2e9388