bbecb6
From 4e0ad96fbd9f438c884eeeaa60c2fb0c910a2b61 Mon Sep 17 00:00:00 2001
bbecb6
From: Rob Crittenden <rcritten@redhat.com>
bbecb6
Date: Mon, 11 Jul 2022 14:20:32 -0400
bbecb6
Subject: [PATCH] Wipe the ipa-ca DNS record when updating system records
bbecb6
bbecb6
If a server with a CA has been marked as hidden and
bbecb6
contains the last A or AAAA address then that address
bbecb6
would remain in the ipa-ca entry.
bbecb6
bbecb6
This is because update-dns-system-records did not delete
bbecb6
values, it just re-computed them. So if no A or AAAA
bbecb6
records were found then the existing value was left.
bbecb6
bbecb6
Fixes: https://pagure.io/freeipa/issue/9195
bbecb6
bbecb6
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
bbecb6
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
bbecb6
Reviewed-By: Stanislav Levin <slev@altlinux.org>
bbecb6
---
bbecb6
 ipaserver/dns_data_management.py | 12 +++++++++++-
bbecb6
 1 file changed, 11 insertions(+), 1 deletion(-)
bbecb6
bbecb6
diff --git a/ipaserver/dns_data_management.py b/ipaserver/dns_data_management.py
bbecb6
index e2bc530ee8a8d7ade853652680c524ccd229205c..aaae5446856aba5e39ca9bb9c03decd434e4f71a 100644
bbecb6
--- a/ipaserver/dns_data_management.py
bbecb6
+++ b/ipaserver/dns_data_management.py
bbecb6
@@ -19,6 +19,7 @@ from dns import (
bbecb6
 from time import sleep, time
bbecb6
 
bbecb6
 from ipalib import errors
bbecb6
+from ipalib.constants import IPA_CA_RECORD
bbecb6
 from ipalib.dns import record_name_format
bbecb6
 from ipapython.dnsutil import DNSName
bbecb6
 from ipaserver.install import installutils
bbecb6
@@ -187,7 +188,7 @@ class IPASystemRecords:
bbecb6
 
bbecb6
     def __add_ca_records_from_hostname(self, zone_obj, hostname):
bbecb6
         assert isinstance(hostname, DNSName) and hostname.is_absolute()
bbecb6
-        r_name = DNSName('ipa-ca') + self.domain_abs
bbecb6
+        r_name = DNSName(IPA_CA_RECORD) + self.domain_abs
bbecb6
         rrsets = None
bbecb6
         end_time = time() + CA_RECORDS_DNS_TIMEOUT
bbecb6
         while True:
bbecb6
@@ -210,6 +211,7 @@ class IPASystemRecords:
bbecb6
 
bbecb6
         for rrset in rrsets:
bbecb6
             for rd in rrset:
bbecb6
+                logger.debug("Adding CA IP %s for %s", rd.to_text(), hostname)
bbecb6
                 rdataset = zone_obj.get_rdataset(
bbecb6
                     r_name, rd.rdtype, create=True)
bbecb6
                 rdataset.add(rd, ttl=self.TTL)
bbecb6
@@ -461,6 +463,14 @@ class IPASystemRecords:
bbecb6
             )
bbecb6
         )
bbecb6
 
bbecb6
+        # Remove the ipa-ca record(s). They will be reconstructed in
bbecb6
+        # get_base_records().
bbecb6
+        r_name = DNSName(IPA_CA_RECORD) + self.domain_abs
bbecb6
+        try:
bbecb6
+            self.api_instance.Command.dnsrecord_del(
bbecb6
+                self.domain_abs, r_name, del_all=True)
bbecb6
+        except errors.NotFound:
bbecb6
+            pass
bbecb6
         base_zone = self.get_base_records()
bbecb6
         for record_name, node in base_zone.items():
bbecb6
             set_cname_template = record_name in names_requiring_cname_templates
bbecb6
-- 
bbecb6
2.39.1
bbecb6