|
 |
2e9388 |
From 09ead70bf9a081d8e2961a83d5dfe64d8f4c0399 Mon Sep 17 00:00:00 2001
|
|
|
2e9388 |
From: Jan Cholasta <jcholast@redhat.com>
|
|
|
2e9388 |
Date: Mon, 9 Nov 2015 10:53:02 +0100
|
|
|
2e9388 |
Subject: [PATCH] cert renewal: make renewal of ipaCert atomic
|
|
|
2e9388 |
|
|
|
2e9388 |
This prevents errors when renewing other certificates during the renewal of
|
|
|
2e9388 |
ipaCert.
|
|
|
2e9388 |
|
|
|
2e9388 |
https://fedorahosted.org/freeipa/ticket/5436
|
|
|
2e9388 |
|
|
|
2e9388 |
Reviewed-By: David Kupka <dkupka@redhat.com>
|
|
|
2e9388 |
---
|
|
|
2e9388 |
install/restart_scripts/Makefile.am | 1 +
|
|
|
2e9388 |
install/restart_scripts/renew_ra_cert | 5 ++++-
|
|
|
2e9388 |
install/restart_scripts/renew_ra_cert_pre | 18 ++++++++++++++++++
|
|
|
2e9388 |
ipaserver/install/cainstance.py | 2 +-
|
|
|
2e9388 |
ipaserver/install/server/upgrade.py | 4 ++--
|
|
|
2e9388 |
5 files changed, 26 insertions(+), 4 deletions(-)
|
|
|
2e9388 |
create mode 100755 install/restart_scripts/renew_ra_cert_pre
|
|
|
2e9388 |
|
|
|
2e9388 |
diff --git a/install/restart_scripts/Makefile.am b/install/restart_scripts/Makefile.am
|
|
|
2e9388 |
index 58057aa3198c892fc8ebb0df403495566ed77d1d..c4bf8195ea85ee0a9dba53fc2581e90c18a9127d 100644
|
|
|
2e9388 |
--- a/install/restart_scripts/Makefile.am
|
|
|
2e9388 |
+++ b/install/restart_scripts/Makefile.am
|
|
|
2e9388 |
@@ -7,6 +7,7 @@ app_DATA = \
|
|
|
2e9388 |
renew_ca_cert \
|
|
|
2e9388 |
renew_ra_cert \
|
|
|
2e9388 |
stop_pkicad \
|
|
|
2e9388 |
+ renew_ra_cert_pre \
|
|
|
2e9388 |
$(NULL)
|
|
|
2e9388 |
|
|
|
2e9388 |
EXTRA_DIST = \
|
|
|
2e9388 |
diff --git a/install/restart_scripts/renew_ra_cert b/install/restart_scripts/renew_ra_cert
|
|
|
2e9388 |
index 3a36f739ae53391e502356f7b6b4fd96a536c3a6..988ada946aed47d1f2b76c1add48ea8c8d64a161 100644
|
|
|
2e9388 |
--- a/install/restart_scripts/renew_ra_cert
|
|
|
2e9388 |
+++ b/install/restart_scripts/renew_ra_cert
|
|
|
2e9388 |
@@ -77,8 +77,11 @@ def _main():
|
|
|
2e9388 |
|
|
|
2e9388 |
|
|
|
2e9388 |
def main():
|
|
|
2e9388 |
- with certs.renewal_lock:
|
|
|
2e9388 |
+ try:
|
|
|
2e9388 |
_main()
|
|
|
2e9388 |
+ finally:
|
|
|
2e9388 |
+ # lock acquired in renew_ra_cert_pre
|
|
|
2e9388 |
+ certs.renewal_lock.release('renew_ra_cert')
|
|
|
2e9388 |
|
|
|
2e9388 |
|
|
|
2e9388 |
try:
|
|
|
2e9388 |
diff --git a/install/restart_scripts/renew_ra_cert_pre b/install/restart_scripts/renew_ra_cert_pre
|
|
|
2e9388 |
new file mode 100755
|
|
|
2e9388 |
index 0000000000000000000000000000000000000000..d0f743c099162e4c5afd7d96287e58492246db35
|
|
|
2e9388 |
--- /dev/null
|
|
|
2e9388 |
+++ b/install/restart_scripts/renew_ra_cert_pre
|
|
|
2e9388 |
@@ -0,0 +1,18 @@
|
|
|
2e9388 |
+#!/usr/bin/python2 -E
|
|
|
2e9388 |
+#
|
|
|
2e9388 |
+# Copyright (C) 2015 FreeIPA Contributors see COPYING for license
|
|
|
2e9388 |
+#
|
|
|
2e9388 |
+
|
|
|
2e9388 |
+import syslog
|
|
|
2e9388 |
+import traceback
|
|
|
2e9388 |
+
|
|
|
2e9388 |
+from ipaserver.install import certs
|
|
|
2e9388 |
+
|
|
|
2e9388 |
+
|
|
|
2e9388 |
+def main():
|
|
|
2e9388 |
+ certs.renewal_lock.acquire('renew_ra_cert')
|
|
|
2e9388 |
+
|
|
|
2e9388 |
+try:
|
|
|
2e9388 |
+ main()
|
|
|
2e9388 |
+except Exception:
|
|
|
2e9388 |
+ syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
|
|
|
2e9388 |
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
|
|
|
2e9388 |
index dfe023c08c9b8d1b28f1659b7c5a6395f3afe879..d230c9bdcab68f02cce32a2aeb89ca3e2143eefe 100644
|
|
|
2e9388 |
--- a/ipaserver/install/cainstance.py
|
|
|
2e9388 |
+++ b/ipaserver/install/cainstance.py
|
|
|
2e9388 |
@@ -1305,7 +1305,7 @@ class CAInstance(DogtagInstance):
|
|
|
2e9388 |
pin=None,
|
|
|
2e9388 |
pinfile=paths.ALIAS_PWDFILE_TXT,
|
|
|
2e9388 |
secdir=paths.HTTPD_ALIAS_DIR,
|
|
|
2e9388 |
- pre_command=None,
|
|
|
2e9388 |
+ pre_command='renew_ra_cert_pre',
|
|
|
2e9388 |
post_command='renew_ra_cert')
|
|
|
2e9388 |
except RuntimeError, e:
|
|
|
2e9388 |
self.log.error(
|
|
|
2e9388 |
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
|
|
|
2e9388 |
index e0a45a097171613397db42e1c035f0d818a3ecf5..c8f744c392c7b859459bda63c1f397226553d4ba 100644
|
|
|
2e9388 |
--- a/ipaserver/install/server/upgrade.py
|
|
|
2e9388 |
+++ b/ipaserver/install/server/upgrade.py
|
|
|
2e9388 |
@@ -799,7 +799,7 @@ def certificate_renewal_update(ca):
|
|
|
2e9388 |
dogtag_constants = dogtag.configured_constants()
|
|
|
2e9388 |
|
|
|
2e9388 |
# bump version when requests is changed
|
|
|
2e9388 |
- version = 3
|
|
|
2e9388 |
+ version = 4
|
|
|
2e9388 |
requests = (
|
|
|
2e9388 |
(
|
|
|
2e9388 |
dogtag_constants.ALIAS_DIR,
|
|
|
2e9388 |
@@ -837,7 +837,7 @@ def certificate_renewal_update(ca):
|
|
|
2e9388 |
paths.HTTPD_ALIAS_DIR,
|
|
|
2e9388 |
'ipaCert',
|
|
|
2e9388 |
'dogtag-ipa-ca-renew-agent',
|
|
|
2e9388 |
- None,
|
|
|
2e9388 |
+ 'renew_ra_cert_pre',
|
|
|
2e9388 |
'renew_ra_cert',
|
|
|
2e9388 |
None,
|
|
|
2e9388 |
),
|
|
|
2e9388 |
--
|
|
|
2e9388 |
2.4.3
|
|
|
2e9388 |
|