From 82e860ae81b9e34fc6a326be4183f37a21ac1564 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 23 Jun 2017 04:48:41 -0400 Subject: [PATCH] Always check peer has keys before connecting When pulling the DM password we may have the same issues reported in ticket #6838 for CA keys. This commit makes sure we always check the peer has keys before any client operation. Ticket #6838 Signed-off-by: Simo Sorce Reviewed-By: Stanislav Laznicka Reviewed-By: Michal Reznik --- ipaserver/install/custodiainstance.py | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/ipaserver/install/custodiainstance.py b/ipaserver/install/custodiainstance.py index 390576bc0c0edfb7d8f8895eca9df30079526aa8..bc3cea7063dff183c85b4f6e8ced7567f691001d 100644 --- a/ipaserver/install/custodiainstance.py +++ b/ipaserver/install/custodiainstance.py @@ -13,7 +13,6 @@ from ipaserver.install import ldapupdate from ipaserver.install import sysupgrade from base64 import b64decode from jwcrypto.common import json_decode -import functools import shutil import os import stat @@ -31,13 +30,6 @@ class CustodiaInstance(SimpleServiceInstance): self.ldap_uri = None self.fqdn = host_name self.realm = realm - self.__CustodiaClient = functools.partial( - CustodiaClient, - client_service='host@%s' % self.fqdn, - keyfile=self.server_keys, - keytab=paths.KRB5_KEYTAB, - realm=realm, - ) def __config_file(self): template_file = os.path.basename(self.config_file) + '.template' @@ -144,6 +136,14 @@ class CustodiaInstance(SimpleServiceInstance): raise RuntimeError("Timed out trying to obtain keys.") time.sleep(1) + def __CustodiaClient(self, server): + # Before we attempt to fetch keys from this host, make sure our public + # keys have been replicated there. + self.__wait_keys(server) + + return CustodiaClient('host@%s' % self.fqdn, self.server_keys, + paths.KRB5_KEYTAB, server, realm=self.realm) + def __get_keys(self, ca_host, cacerts_file, cacerts_pwd, data): # Fecth all needed certs one by one, then combine them in a single # p12 file @@ -151,10 +151,6 @@ class CustodiaInstance(SimpleServiceInstance): prefix = data['prefix'] certlist = data['list'] - # Before we attempt to fetch keys from this host, make sure our public - # keys have been replicated there. - self.__wait_keys(ca_host) - cli = self.__CustodiaClient(server=ca_host) # Temporary nssdb -- 2.13.5