From a5687f3070877fc28435d9db4d5fed8c521dbf41 Mon Sep 17 00:00:00 2001

From: Petr Spacek <pspacek@redhat.com>

Date: Sun, 20 Dec 2015 19:19:28 +0100

Subject: [PATCH] DNSSEC: ipa-ods-exporter: add ldap-cleanup command

Command "ldap-cleanup <zone name>" will remove all key metadata from

LDAP. This can be used manually in sequence like:

ldap-cleanup <zone name>

update <zone name>

to delete all key metadata from LDAP and re-export them from OpenDNSSEC.

ldap-cleanup command should be called when disabling DNSSEC on a DNS

zone to remove stale key metadata from LDAP.

https://fedorahosted.org/freeipa/ticket/5348

Reviewed-By: Martin Basti <mbasti@redhat.com>

Reviewed-By: Martin Basti <mbasti@redhat.com>

---

 daemons/dnssec/ipa-ods-exporter | 60 ++++++++++++++++++++++++++++++++---------

 1 file changed, 48 insertions(+), 12 deletions(-)

diff --git a/daemons/dnssec/ipa-ods-exporter b/daemons/dnssec/ipa-ods-exporter

index 2a1cc4315355569b24ec6ef42a68f4d64fee9f4f..8abb5cf7c6d1e5e8ea996b8925d2e8cffc44133c 100755

--- a/daemons/dnssec/ipa-ods-exporter

+++ b/daemons/dnssec/ipa-ods-exporter

@@ -227,7 +227,9 @@ def get_ldap_zone(ldap, dns_base, name):

         except ipalib.errors.NotFound:

             continue

-    assert ldap_zone is not None, 'DNS zone "%s" should exist in LDAP' % name

+    if ldap_zone is None:

+        raise ipalib.errors.NotFound(

+            reason='DNS zone "%s" not found in LDAP' % name)

     return ldap_zone

@@ -481,25 +483,37 @@ def parse_command(cmd):

     if cmd == 'ipa-hsm-update':

         return (0,

                 'HSM synchronization finished, skipping zone synchronization.',

-                None)

+                None,

+                cmd)

     elif cmd == 'ipa-full-update':

         return (None,

                 'Synchronization of all zones was finished.',

-                None)

+                None,

+                cmd)

+

+    elif cmd.startswith('ldap-cleanup '):

+        zone_name = cmd2ods_zone_name(cmd)

+        return (None,

+                'Zone "%s" metadata will be removed from LDAP.\n' % zone_name,

+                zone_name,

+                'ldap-cleanup')

-    elif not cmd.startswith('update '):

+    elif cmd.startswith('update '):

+        zone_name = cmd2ods_zone_name(cmd)

+        return (None,

+                'Zone "%s" metadata will be updated in LDAP.\n' % zone_name,

+                zone_name,

+                'update')

+

+    else:

         return (0,

                 'Command "%s" is not supported by IPA; '

                 'HSM synchronization was finished and the command '

                 'will be ignored.' % cmd,

+                None,

                 None)

-    else:

-        zone_name = cmd2ods_zone_name(cmd)

-        return (None,

-                'Zone was "%s" updated.\n' % zone_name,

-                zone_name)

 def send_systemd_reply(conn, reply):

         # Reply & close connection early.

@@ -510,7 +524,7 @@ def send_systemd_reply(conn, reply):

 def cmd2ods_zone_name(cmd):

     # ODS stores zone name without trailing period

-    zone_name = cmd[7:].strip()

+    zone_name = cmd.split(' ', 1)[1].strip()

     if len(zone_name) > 1 and zone_name[-1] == '.':

         zone_name = zone_name[:-1]

@@ -584,6 +598,25 @@ def sync_zone(log, ldap, dns_dn, zone_name):

         except ipalib.errors.EmptyModlist:

             continue

+def cleanup_ldap_zone(log, ldap, dns_dn, zone_name):

+    """delete all key metadata about zone keys for single DNS zone

+

+    Key material has to be synchronized elsewhere.

+    Keep in mind that keys could be shared among multiple zones!"""

+    log = log.getChild("%s.%s" % (__name__, zone_name))

+    log.debug('cleaning up key metadata from zone "%s"', zone_name)

+

+    try:

+        ldap_zone = get_ldap_zone(ldap, dns_dn, zone_name)

+        ldap_keys = get_ldap_keys(ldap, ldap_zone.dn)

+    except ipalib.errors.NotFound as ex:

+        # zone or cn=keys container does not exist, we are done

+        log.debug(str(ex))

+        return

+

+    for ldap_key in ldap_keys:

+        log.debug('deleting key metadata "%s"', ldap_key.dn)

+        ldap.delete_entry(ldap_key)

 log = logging.getLogger('root')

 # this service is usually socket-activated

@@ -656,7 +689,7 @@ except KeyError as e:

     conn = None

     cmd = sys.argv[1]

-exitcode, msg, zone_name = parse_command(cmd)

+exitcode, msg, zone_name, cmd = parse_command(cmd)

 if exitcode is not None:

     if conn:

@@ -686,7 +719,10 @@ try:

     if zone_name is not None:

         # only one zone should be processed

-        sync_zone(log, ldap, dns_dn, zone_name)

+        if cmd == 'update':

+            sync_zone(log, ldap, dns_dn, zone_name)

+        elif cmd == 'ldap-cleanup':

+            cleanup_ldap_zone(log, ldap, dns_dn, zone_name)

     else:

         # process all zones

         for zone_row in db.execute("SELECT name FROM zones"):

-- 

2.4.3