From a5687f3070877fc28435d9db4d5fed8c521dbf41 Mon Sep 17 00:00:00 2001 From: Petr Spacek Date: Sun, 20 Dec 2015 19:19:28 +0100 Subject: [PATCH] DNSSEC: ipa-ods-exporter: add ldap-cleanup command Command "ldap-cleanup " will remove all key metadata from LDAP. This can be used manually in sequence like: ldap-cleanup update to delete all key metadata from LDAP and re-export them from OpenDNSSEC. ldap-cleanup command should be called when disabling DNSSEC on a DNS zone to remove stale key metadata from LDAP. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti Reviewed-By: Martin Basti --- daemons/dnssec/ipa-ods-exporter | 60 ++++++++++++++++++++++++++++++++--------- 1 file changed, 48 insertions(+), 12 deletions(-) diff --git a/daemons/dnssec/ipa-ods-exporter b/daemons/dnssec/ipa-ods-exporter index 2a1cc4315355569b24ec6ef42a68f4d64fee9f4f..8abb5cf7c6d1e5e8ea996b8925d2e8cffc44133c 100755 --- a/daemons/dnssec/ipa-ods-exporter +++ b/daemons/dnssec/ipa-ods-exporter @@ -227,7 +227,9 @@ def get_ldap_zone(ldap, dns_base, name): except ipalib.errors.NotFound: continue - assert ldap_zone is not None, 'DNS zone "%s" should exist in LDAP' % name + if ldap_zone is None: + raise ipalib.errors.NotFound( + reason='DNS zone "%s" not found in LDAP' % name) return ldap_zone @@ -481,25 +483,37 @@ def parse_command(cmd): if cmd == 'ipa-hsm-update': return (0, 'HSM synchronization finished, skipping zone synchronization.', - None) + None, + cmd) elif cmd == 'ipa-full-update': return (None, 'Synchronization of all zones was finished.', - None) + None, + cmd) + + elif cmd.startswith('ldap-cleanup '): + zone_name = cmd2ods_zone_name(cmd) + return (None, + 'Zone "%s" metadata will be removed from LDAP.\n' % zone_name, + zone_name, + 'ldap-cleanup') - elif not cmd.startswith('update '): + elif cmd.startswith('update '): + zone_name = cmd2ods_zone_name(cmd) + return (None, + 'Zone "%s" metadata will be updated in LDAP.\n' % zone_name, + zone_name, + 'update') + + else: return (0, 'Command "%s" is not supported by IPA; ' 'HSM synchronization was finished and the command ' 'will be ignored.' % cmd, + None, None) - else: - zone_name = cmd2ods_zone_name(cmd) - return (None, - 'Zone was "%s" updated.\n' % zone_name, - zone_name) def send_systemd_reply(conn, reply): # Reply & close connection early. @@ -510,7 +524,7 @@ def send_systemd_reply(conn, reply): def cmd2ods_zone_name(cmd): # ODS stores zone name without trailing period - zone_name = cmd[7:].strip() + zone_name = cmd.split(' ', 1)[1].strip() if len(zone_name) > 1 and zone_name[-1] == '.': zone_name = zone_name[:-1] @@ -584,6 +598,25 @@ def sync_zone(log, ldap, dns_dn, zone_name): except ipalib.errors.EmptyModlist: continue +def cleanup_ldap_zone(log, ldap, dns_dn, zone_name): + """delete all key metadata about zone keys for single DNS zone + + Key material has to be synchronized elsewhere. + Keep in mind that keys could be shared among multiple zones!""" + log = log.getChild("%s.%s" % (__name__, zone_name)) + log.debug('cleaning up key metadata from zone "%s"', zone_name) + + try: + ldap_zone = get_ldap_zone(ldap, dns_dn, zone_name) + ldap_keys = get_ldap_keys(ldap, ldap_zone.dn) + except ipalib.errors.NotFound as ex: + # zone or cn=keys container does not exist, we are done + log.debug(str(ex)) + return + + for ldap_key in ldap_keys: + log.debug('deleting key metadata "%s"', ldap_key.dn) + ldap.delete_entry(ldap_key) log = logging.getLogger('root') # this service is usually socket-activated @@ -656,7 +689,7 @@ except KeyError as e: conn = None cmd = sys.argv[1] -exitcode, msg, zone_name = parse_command(cmd) +exitcode, msg, zone_name, cmd = parse_command(cmd) if exitcode is not None: if conn: @@ -686,7 +719,10 @@ try: if zone_name is not None: # only one zone should be processed - sync_zone(log, ldap, dns_dn, zone_name) + if cmd == 'update': + sync_zone(log, ldap, dns_dn, zone_name) + elif cmd == 'ldap-cleanup': + cleanup_ldap_zone(log, ldap, dns_dn, zone_name) else: # process all zones for zone_row in db.execute("SELECT name FROM zones"): -- 2.4.3