pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone
Blob Blame History Raw
From a19cb9b5477901efc08c00c122f08e3d5ed126ff Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Tue, 21 Oct 2014 14:25:50 +0200
Subject: [PATCH] Disable DNSSEC support

---
 install/share/bind.named.conf.template |  2 +-
 install/tools/ipa-dns-install          | 52 ++++------------------------------
 install/tools/ipa-replica-install      | 16 ++++-------
 install/tools/ipa-replica-manage       | 12 --------
 install/tools/ipa-server-install       | 40 +++-----------------------
 install/tools/ipa-upgradeconfig        | 10 -------
 ipalib/plugins/dns.py                  |  4 ++-
 ipaplatform/redhat/services.py         |  6 ++--
 ipapython/Makefile                     |  2 +-
 ipapython/setup.py.in                  |  2 +-
 ipaserver/install/bindinstance.py      | 25 ----------------
 11 files changed, 24 insertions(+), 147 deletions(-)

diff --git a/install/share/bind.named.conf.template b/install/share/bind.named.conf.template
index 3c19383c0dde4353b30b16240ec2b81d7ea65776..b3b06211b15cc1736453b203b52bacfba8036618 100644
--- a/install/share/bind.named.conf.template
+++ b/install/share/bind.named.conf.template
@@ -18,7 +18,7 @@ options {
 	pid-file "$NAMED_PID";
 
 	dnssec-enable yes;
-	dnssec-validation yes;
+	dnssec-validation no;
 
 	/* Path to ISC DLV key */
 	bindkeys-file "$BINDKEYS_FILE";
diff --git a/install/tools/ipa-dns-install b/install/tools/ipa-dns-install
index cbf3faeef3644870b6978e02c95f67354cc7e61b..114351c9f7a5a779e4c8516c1411139c38d7138b 100755
--- a/install/tools/ipa-dns-install
+++ b/install/tools/ipa-dns-install
@@ -23,8 +23,7 @@ from optparse import OptionGroup, SUPPRESS_HELP
 
 import krbV
 
-from ipaserver.install import (service, bindinstance, ntpinstance,
-    httpinstance, dnskeysyncinstance, opendnssecinstance, odsexporterinstance)
+from ipaserver.install import service, bindinstance, ntpinstance, httpinstance
 from ipaserver.install.installutils import *
 from ipaserver.install import installutils
 from ipapython import version
@@ -54,10 +53,6 @@ def parse_options():
                       help="The reverse DNS zone to use")
     parser.add_option("--no-reverse", dest="no_reverse", action="store_true",
                       default=False, help="Do not create new reverse DNS zone")
-    parser.add_option("--no-dnssec-validation", dest="no_dnssec_validation", action="store_true",
-                      default=False, help="Disable DNSSEC validation")
-    parser.add_option("--dnssec-master", dest="dnssec_master", action="store_true",
-                      default=False, help="Setup server to be DNSSEC key master")
     parser.add_option("--zonemgr", action="callback", callback=bindinstance.zonemgr_callback,
                       type="string",
                       help="DNS zone manager e-mail address. Defaults to hostmaster@DOMAIN")
@@ -67,6 +62,10 @@ def parse_options():
     options, args = parser.parse_args()
     safe_options = parser.get_safe_opts(options)
 
+    # Disable DNSSEC support
+    options.no_dnssec_validation = False
+    options.dnssec_master = False
+
     if options.forwarders and options.no_forwarders:
         parser.error("You cannot specify a --forwarder option together with --no-forwarders")
     elif options.reverse_zones and options.no_reverse:
@@ -101,21 +100,6 @@ def main():
     print ""
     print "This includes:"
     print "  * Configure DNS (bind)"
-    print "  * Configure SoftHSM (required by DNSSEC)"
-    print "  * Configure ipa-dnskeysyncd (required by DNSSEC)"
-    if options.dnssec_master:
-        print "  * Configure ipa-ods-exporter (required by DNSSEC key master)"
-        print "  * Configure OpenDNSSEC (required by DNSSEC key master)"
-        print "  * Generate DNSSEC master key (required by DNSSEC key master)"
-    print ""
-    print "NOTE: DNSSEC zone signing is not enabled by default"
-    print ""
-    if options.dnssec_master:
-        print "DNSSEC support is experimental!"
-        print ""
-        print "Plan carefully, current version doesn't allow you to move DNSSEC"
-        print "key master to different server and master cannot be uninstalled"
-        print ""
     print ""
     print "To accept the default shown in brackets, press the Enter key."
     print ""
@@ -126,15 +110,9 @@ def main():
         sys.exit("Aborted")
 
     # Check bind packages are installed
-    if not (bindinstance.check_inst(options.unattended) and
-            dnskeysyncinstance.check_inst()):
+    if not bindinstance.check_inst(options.unattended):
         sys.exit("Aborting installation.")
 
-    if options.dnssec_master:
-        # check opendnssec packages are installed
-        if not opendnssecinstance.check_inst():
-            sys.exit("Aborting installation")
-
     # Initialize the ipalib api
     cfg = dict(
         in_server=True,
@@ -160,14 +138,6 @@ def main():
     except errors.ACIError:
         sys.exit("Password is not valid!")
 
-    ods = opendnssecinstance.OpenDNSSECInstance(fstore, dm_password)
-    if options.dnssec_master:
-        dnssec_masters = ods.get_masters()
-        # we can reinstall current server if it is dnssec master
-        if not api.env.host in dnssec_masters and dnssec_masters:
-            print "DNSSEC key master(s):", u','.join(dnssec_masters)
-            sys.exit("Only one DNSSEC key master is supported in current version.")
-
     ip_addresses = get_server_ip_address(api.env.host, fstore,
         options.unattended, True, options.ip_addresses)
 
@@ -213,16 +183,6 @@ def main():
                no_dnssec_validation=options.no_dnssec_validation)
     bind.create_instance()
 
-    # on dnssec master this must be installed last
-    dnskeysyncd = dnskeysyncinstance.DNSKeySyncInstance(fstore, dm_password)
-    dnskeysyncd.create_instance(api.env.host, api.env.realm)
-    if options.dnssec_master:
-        ods_exporter = odsexporterinstance.ODSExporterInstance(fstore, dm_password)
-
-        ods_exporter.create_instance(api.env.host, api.env.realm)
-        ods.create_instance(api.env.host, api.env.realm)
-
-    dnskeysyncd.start_dnskeysyncd()
     bind.start_named()
 
     # Restart http instance to make sure that python-dns has the right resolver
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index 70190b718965518803b9767325d58f9526c32f7c..b8813aaa5d54d40756e9d9b8f0ee3e2dd7e8b253 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -33,7 +33,7 @@ from ipapython import ipautil
 
 from ipaserver.install import dsinstance, installutils, krbinstance, service
 from ipaserver.install import bindinstance, httpinstance, ntpinstance
-from ipaserver.install import memcacheinstance, dnskeysyncinstance
+from ipaserver.install import memcacheinstance
 from ipaserver.install import otpdinstance
 from ipaserver.install.replication import replica_conn_check, ReplicationManager
 from ipaserver.install.installutils import (ReplicaConfig, expand_replica_info,
@@ -112,8 +112,6 @@ def parse_options():
                          action="append", help="The reverse DNS zone to use")
     dns_group.add_option("--no-reverse", dest="no_reverse", action="store_true",
                       default=False, help="Do not create new reverse DNS zone")
-    dns_group.add_option("--no-dnssec-validation", dest="no_dnssec_validation", action="store_true",
-                      default=False, help="Disable DNSSEC validation")
     dns_group.add_option("--no-host-dns", dest="no_host_dns", action="store_true",
                       default=False,
                       help="Do not use DNS for hostname lookup during installation")
@@ -127,6 +125,9 @@ def parse_options():
     # pkinit is disabled in production version
     options.setup_pkinit = False
 
+    # Disable DNSSEC support
+    options.no_dnssec_validation = False
+
     if len(args) != 1:
         parser.error("you must provide a file generated by ipa-replica-prepare")
 
@@ -139,8 +140,6 @@ def parse_options():
             parser.error("You cannot specify a --reverse-zone option without the --setup-dns option")
         if options.no_reverse:
             parser.error("You cannot specify a --no-reverse option without the --setup-dns option")
-        if options.no_dnssec_validation:
-            parser.error("You cannot specify a --no-dnssec-validation option without the --setup-dns option")
     elif options.forwarders and options.no_forwarders:
         parser.error("You cannot specify a --forwarder option together with --no-forwarders")
     elif not options.forwarders and not options.no_forwarders:
@@ -274,10 +273,6 @@ def install_bind(config, options):
                no_dnssec_validation=options.no_dnssec_validation)
     bind.create_instance()
     print ""
-    dnskeysyncd = dnskeysyncinstance.DNSKeySyncInstance(
-        dm_password=config.dirman_password)
-    dnskeysyncd.create_instance(api.env.host, api.env.realm)
-    dnskeysyncd.start_dnskeysyncd()
     bind.start_named()
     print ""
     bind.check_global_configuration()
@@ -354,8 +349,7 @@ def check_dirsrv():
         sys.exit(1)
 
 def check_bind():
-    if not (bindinstance.check_inst(unattended=True) and
-            dnskeysyncinstance.check_inst()):
+    if not bindinstance.check_inst(unattended=True):
         print "Aborting installation"
         sys.exit(1)
 
diff --git a/install/tools/ipa-replica-manage b/install/tools/ipa-replica-manage
index 4f92c0c927b3267eeb466a06d3283823c05437b0..86d77844489abe4d7151a29a4e81320e01d5c412 100755
--- a/install/tools/ipa-replica-manage
+++ b/install/tools/ipa-replica-manage
@@ -29,7 +29,6 @@ import socket
 from ipapython import ipautil
 from ipaserver.install import replication, dsinstance, installutils
 from ipaserver.install import bindinstance, cainstance, certs
-from ipaserver.install import opendnssecinstance, dnskeysyncinstance
 from ipaserver.plugins import ldap2
 from ipapython import version, ipaldap
 from ipalib import api, errors, util
@@ -695,14 +694,6 @@ def del_master(realm, hostname, options):
             if not options.force and not ipautil.user_input("Continue to delete?", False):
                 sys.exit("Deletion aborted")
 
-        # test if replica is not DNSSEC master
-        # allow to delete it if is last DNS server
-        if 'DNS' in this_services and other_dns and not options.force:
-            dnssec_masters = opendnssecinstance.get_dnssec_key_masters(delrepl.conn)
-            if hostname in dnssec_masters:
-                print "Replica is active DNSSEC key master. Uninstall could break your DNS system."
-                sys.exit("Deletion aborted")
-
         # Pick CA renewal master
         ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
         if ca.is_renewal_master(hostname):
@@ -757,9 +748,6 @@ def del_master(realm, hostname, options):
             bind.remove_master_dns_records(hostname, realm, realm.lower())
             bind.remove_ipa_ca_dns_records(hostname, realm.lower())
             bind.remove_server_ns_records(hostname)
-
-            keysyncd = dnskeysyncinstance.DNSKeySyncInstance()
-            keysyncd.remove_replica_public_keys(hostname)
     except Exception, e:
         print "Failed to cleanup %s DNS entries: %s" % (hostname, e)
         print "You may need to manually remove them from the tree"
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 3b748aaab37fa8806ebc7a4983ed97cc8243a9c4..6bcb0a16dbdfc0258ab40c70ea94740dfb537d8a 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -49,9 +49,6 @@ except ImportError:
 from ipaserver.install import dsinstance
 from ipaserver.install import krbinstance
 from ipaserver.install import bindinstance
-from ipaserver.install import dnskeysyncinstance
-from ipaserver.install import opendnssecinstance
-from ipaserver.install import odsexporterinstance
 from ipaserver.install import httpinstance
 from ipaserver.install import ntpinstance
 from ipaserver.install import certs
@@ -272,8 +269,6 @@ def parse_options():
                       action="append", default=[])
     dns_group.add_option("--no-reverse", dest="no_reverse", action="store_true",
                       default=False, help="Do not create reverse DNS zone")
-    dns_group.add_option("--no-dnssec-validation", dest="no_dnssec_validation", action="store_true",
-                      default=False, help="Disable DNSSEC validation")
     dns_group.add_option("--zonemgr", action="callback", callback=bindinstance.zonemgr_callback,
                       type="string",
                       help="DNS zone manager e-mail address. Defaults to hostmaster@DOMAIN")
@@ -297,6 +292,9 @@ def parse_options():
     options.pkinit_pin = False
     options.pkinit_cert_files = False
 
+    # Disable DNSSEC support
+    options.no_dnssec_validation = False
+
     if options.dm_password is not None:
         try:
             validate_dm_password(options.dm_password)
@@ -323,8 +321,6 @@ def parse_options():
             parser.error("You cannot specify a --reverse-zone option without the --setup-dns option")
         if options.no_reverse:
             parser.error("You cannot specify a --no-reverse option without the --setup-dns option")
-        if options.no_dnssec_validation:
-            parser.error("You cannot specify a --no-dnssec-validation option without the --setup-dns option")
     elif options.forwarders and options.no_forwarders:
         parser.error("You cannot specify a --forwarder option together with --no-forwarders")
     elif options.reverse_zones and options.no_reverse:
@@ -564,17 +560,7 @@ def uninstall():
         api.env.realm, certs.NSS_DIR, dogtag_constants=dogtag_constants)
     if ca_instance.is_configured():
         ca_instance.uninstall()
-
-    ods = opendnssecinstance.OpenDNSSECInstance(fstore)
-    if ods.is_configured():
-        ods.uninstall()
-
-    ods_exporter = odsexporterinstance.ODSExporterInstance(fstore)
-    if ods_exporter.is_configured():
-        ods_exporter.uninstall()
-
     bindinstance.BindInstance(fstore).uninstall()
-    dnskeysyncinstance.DNSKeySyncInstance(fstore).uninstall()
     httpinstance.HTTPInstance(fstore).uninstall()
     krbinstance.KrbInstance(fstore).uninstall()
     dsinstance.DsInstance(fstore=fstore).uninstall()
@@ -737,20 +723,6 @@ def main():
                    "agreements.\n\n")
             print textwrap.fill(msg, width=80, replace_whitespace=False)
         else:
-
-            # test if server is DNSSEC key master
-            masters = opendnssecinstance.get_dnssec_key_masters(conn)
-            if api.env.host in masters:
-                print "This server is active DNSSEC key master. Uninstall could break your DNS system."
-                if not (options.unattended or user_input("Are you sure you "
-                                                         "want to continue "
-                                                         "with the uninstall "
-                                                         "procedure?",
-                                                         False)):
-                    print ""
-                    print "Aborting uninstall operation."
-                    sys.exit(1)
-
             rm = replication.ReplicationManager(
                 realm=api.env.realm,
                 hostname=api.env.host,
@@ -899,8 +871,7 @@ def main():
 
     # check bind packages are installed
     if options.setup_dns:
-        if not (bindinstance.check_inst(options.unattended) and
-                dnskeysyncinstance.check_inst()):
+        if not bindinstance.check_inst(options.unattended):
             sys.exit("Aborting installation")
 
         # Don't require an external DNS to say who we are if we are
@@ -1289,9 +1260,6 @@ def main():
         api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')), bind_pw=dm_password)
 
         bind.create_instance()
-        dnskeysyncd = dnskeysyncinstance.DNSKeySyncInstance(fstore, dm_password)
-        dnskeysyncd.create_instance(api.env.host, api.env.realm)
-        dnskeysyncd.start_dnskeysyncd()
         bind.start_named()
         print ""
         bind.check_global_configuration()
diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig
index cd50edeecb055c71831fad806afde43c2779cdf8..cf85f58c26510fcd105b54126152a50474c869b5 100755
--- a/install/tools/ipa-upgradeconfig
+++ b/install/tools/ipa-upgradeconfig
@@ -53,7 +53,6 @@ from ipaserver.install import cainstance
 from ipaserver.install import certs
 from ipaserver.install import otpdinstance
 from ipaserver.install import sysupgrade
-from ipaserver.install import dnskeysyncinstance
 
 
 def parse_options():
@@ -1421,14 +1420,6 @@ def main():
         except ipalib.errors.DuplicateEntry:
             pass
 
-    # install DNSKeySync service only if DNS is configured on server
-    if bindinstance.named_conf_exists():
-            dnskeysyncd = dnskeysyncinstance.DNSKeySyncInstance(fstore, ldapi=True)
-            if not dnskeysyncd.is_configured():
-                ds.start()
-                dnskeysyncd.create_instance(fqdn, api.env.realm)
-                dnskeysyncd.start_dnskeysyncd()
-
     cleanup_kdc(fstore)
     cleanup_adtrust(fstore)
     setup_firefox_extension(fstore)
@@ -1447,7 +1438,6 @@ def main():
                           named_bindkey_file_option(),
                           named_managed_keys_dir_option(),
                           named_root_key_include(),
-                          mask_named_regular(),
                          )
 
     if any(named_conf_changes):
diff --git a/ipalib/plugins/dns.py b/ipalib/plugins/dns.py
index ea4c212b42631e8513a13d2a7f5a859b2176376b..60129f8b873fad1d3552ca749068f36db41108e9 100644
--- a/ipalib/plugins/dns.py
+++ b/ipalib/plugins/dns.py
@@ -2389,7 +2389,9 @@ class dnszone(DNSZoneBase):
             if options['idnssecinlinesigning'] is True:
                 messages.add_message(options['version'], result,
                     messages.DNSSECWarning(
-                    additional_info=_("Visit 'http://www.freeipa.org/page/Releases/4.1.0#DNSSEC_Support'.")
+                    additional_info=_("Manual configuration needed, please "
+                    "visit 'http://www.freeipa.org/page/Releases/4.0.0#"
+                    "Experimental_DNSSEC_Support'")
                 ))
             else:
                 messages.add_message(options['version'], result,
diff --git a/ipaplatform/redhat/services.py b/ipaplatform/redhat/services.py
index 20d0adec421ecd3285464e2a51b9d5c61a0e3d92..5c9bae56552cefec1f3b8a16a52b8704171d4024 100644
--- a/ipaplatform/redhat/services.py
+++ b/ipaplatform/redhat/services.py
@@ -69,7 +69,7 @@ redhat_system_units['ipa-otpd'] = 'ipa-otpd.socket'
 redhat_system_units['ipa-dnskeysyncd'] = 'ipa-dnskeysyncd.service'
 redhat_system_units['named-regular'] = 'named.service'
 redhat_system_units['named-pkcs11'] = 'named-pkcs11.service'
-redhat_system_units['named'] = redhat_system_units['named-pkcs11']
+redhat_system_units['named'] = redhat_system_units['named-regular']
 redhat_system_units['ods-enforcerd'] = 'ods-enforcerd.service'
 redhat_system_units['ods_enforcerd'] = redhat_system_units['ods-enforcerd']
 redhat_system_units['ods-signerd'] = 'ods-signerd.service'
@@ -242,10 +242,10 @@ class RedHatNamedService(RedHatService):
         return u'named'
 
     def get_binary_path(self):
-        return paths.NAMED_PKCS11
+        return paths.NAMED
 
     def get_package_name(self):
-        return u"bind-pkcs11"
+        return u"bind"
 
 
 class RedHatODSEnforcerdService(RedHatService):
diff --git a/ipapython/Makefile b/ipapython/Makefile
index b2cf719fdd580801a147def17e5a7483665b3d79..e09956ad32cf48d1ed585a494c8083e58c48d037 100644
--- a/ipapython/Makefile
+++ b/ipapython/Makefile
@@ -3,7 +3,7 @@ PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/ipa
 CONFIGDIR ?= $(DESTDIR)/etc/ipa
 TESTS = $(wildcard test/*.py)
 
-SUBDIRS = py_default_encoding ipap11helper
+SUBDIRS = py_default_encoding
 
 all:
 	@for subdir in $(SUBDIRS); do \
diff --git a/ipapython/setup.py.in b/ipapython/setup.py.in
index 6caf179051533e0db77a4091db5874bbdae426c9..a839f094ac0f9a2c303862e397bb4deb7589cc62 100644
--- a/ipapython/setup.py.in
+++ b/ipapython/setup.py.in
@@ -65,7 +65,7 @@ def setup_package():
             classifiers=filter(None, CLASSIFIERS.split('\n')),
             platforms = ["Linux", "Solaris", "Unix"],
             package_dir = {'ipapython': ''},
-            packages = [ "ipapython", "ipapython.dnssec" ],
+            packages = [ "ipapython" ],
         )
     finally:
         del sys.path[0]
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py
index 547cf19ee36140b5f29fcf7d217933fa68e1952b..9085cf9b59a064d82c0df774a6fa961c9d158ccf 100644
--- a/ipaserver/install/bindinstance.py
+++ b/ipaserver/install/bindinstance.py
@@ -543,7 +543,6 @@ class BindInstance(service.Service):
         self.sub_dict = None
         self.reverse_zones = []
         self.dm_password = dm_password
-        self.named_regular = services.service('named-regular')
 
         if fstore:
             self.fstore = fstore
@@ -652,8 +651,6 @@ class BindInstance(service.Service):
             if self.get_state("running") is None:
                 # first time store status
                 self.backup_state("running", self.is_running())
-                self.backup_state("named-regular-running",
-                                  self.named_regular.is_running())
             self.restart()
         except Exception as e:
             root_logger.error("Named service failed to start (%s)", e)
@@ -662,8 +659,6 @@ class BindInstance(service.Service):
     def __enable(self):
         if self.get_state("enabled") is None:
             self.backup_state("enabled", self.is_running())
-            self.backup_state("named-regular-enabled",
-                              self.named_regular.is_running())
         # We do not let the system start IPA components on its own,
         # Instead we reply on the IPA init script to start only enabled
         # components as found in our LDAP configuration tree
@@ -674,17 +669,6 @@ class BindInstance(service.Service):
             # don't crash, just report error
             root_logger.error("DNS service already exists")
 
-        # disable named, we need to run named-pkcs11 only
-        try:
-            self.named_regular.stop()
-        except Exception as e:
-            root_logger.debug("Unable to stop named (%s)", e)
-
-        try:
-            self.named_regular.mask()
-        except Exception as e:
-            root_logger.debug("Unable to mask named (%s)", e)
-
     def __setup_sub_dict(self):
         if self.forwarders:
             fwds = "\n"
@@ -1167,8 +1151,6 @@ class BindInstance(service.Service):
 
         running = self.restore_state("running")
         enabled = self.restore_state("enabled")
-        named_regular_running = self.restore_state("named-regular-running")
-        named_regular_enabled = self.restore_state("named-regular-enabled")
 
         self.dns_backup.clear_records(api.Backend.ldap2.isconnected())
 
@@ -1187,10 +1169,3 @@ class BindInstance(service.Service):
 
         if not running is None and running:
             self.start()
-
-        self.named_regular.unmask()
-        if named_regular_enabled:
-            self.named_regular.enable()
-
-        if named_regular_running:
-            self.named_regular.start()
-- 
2.1.0