|
 |
e0ab38 |
From 31a9cec3fc366954b3cb8943621834fdfce04bd3 Mon Sep 17 00:00:00 2001
|
|
|
e0ab38 |
From: Petr Spacek <pspacek@redhat.com>
|
|
|
e0ab38 |
Date: Thu, 26 Nov 2015 15:19:03 +0100
|
|
|
e0ab38 |
Subject: [PATCH] DNSSEC: Make sure that current key state in LDAP matches key
|
|
|
e0ab38 |
state in BIND
|
|
|
e0ab38 |
|
|
|
e0ab38 |
We have to explicitly specify "none" value to prevent dnssec-keyfromlabel
|
|
|
e0ab38 |
utility from using current time for keys without "publish" and "activate"
|
|
|
e0ab38 |
timestamps.
|
|
|
e0ab38 |
|
|
|
e0ab38 |
Previously this lead to situation where key was in (intermediate) state
|
|
|
e0ab38 |
"generated" in OpenDNSSEC but BIND started to use this key for signing.
|
|
|
e0ab38 |
|
|
|
e0ab38 |
https://fedorahosted.org/freeipa/ticket/5348
|
|
|
e0ab38 |
|
|
|
e0ab38 |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
e0ab38 |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
e0ab38 |
---
|
|
|
e0ab38 |
ipapython/dnssec/bindmgr.py | 6 +++++-
|
|
|
e0ab38 |
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
e0ab38 |
|
|
|
e0ab38 |
diff --git a/ipapython/dnssec/bindmgr.py b/ipapython/dnssec/bindmgr.py
|
|
|
e0ab38 |
index 2c6781609594fa27812af3a01d16318198a3e120..70caaf4ee74f594c652cd82bccb8964e172bc719 100644
|
|
|
e0ab38 |
--- a/ipapython/dnssec/bindmgr.py
|
|
|
e0ab38 |
+++ b/ipapython/dnssec/bindmgr.py
|
|
|
e0ab38 |
@@ -58,6 +58,8 @@ class BINDMgr(object):
|
|
|
e0ab38 |
return dt.strftime(time_bindfmt)
|
|
|
e0ab38 |
|
|
|
e0ab38 |
def dates2params(self, ldap_attrs):
|
|
|
e0ab38 |
+ """Convert LDAP timestamps to list of parameters suitable
|
|
|
e0ab38 |
+ for dnssec-keyfromlabel utility"""
|
|
|
e0ab38 |
attr2param = {'idnsseckeypublish': '-P',
|
|
|
e0ab38 |
'idnsseckeyactivate': '-A',
|
|
|
e0ab38 |
'idnsseckeyinactive': '-I',
|
|
|
e0ab38 |
@@ -65,10 +67,12 @@ class BINDMgr(object):
|
|
|
e0ab38 |
|
|
|
e0ab38 |
params = []
|
|
|
e0ab38 |
for attr, param in attr2param.items():
|
|
|
e0ab38 |
+ params.append(param)
|
|
|
e0ab38 |
if attr in ldap_attrs:
|
|
|
e0ab38 |
- params.append(param)
|
|
|
e0ab38 |
assert len(ldap_attrs[attr]) == 1, 'Timestamp %s is expected to be single-valued' % attr
|
|
|
e0ab38 |
params.append(self.time_ldap2bindfmt(ldap_attrs[attr][0]))
|
|
|
e0ab38 |
+ else:
|
|
|
e0ab38 |
+ params.append('none')
|
|
|
e0ab38 |
|
|
|
e0ab38 |
return params
|
|
|
e0ab38 |
|
|
|
e0ab38 |
--
|
|
|
e0ab38 |
2.4.3
|
|
|
e0ab38 |
|