From c0d13f5e58cb84eb3162aec1c2202329230c120d Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Thu, 8 Jan 2015 09:06:46 +0000
Subject: [PATCH] Make certificate renewal process synchronized
Synchronization is achieved using a global renewal lock.
https://fedorahosted.org/freeipa/ticket/4803
Reviewed-By: David Kupka <dkupka@redhat.com>
---
freeipa.spec.in | 1 +
install/certmonger/Makefile.am | 1 +
.../certmonger/dogtag-ipa-ca-renew-agent-submit | 4 +-
install/certmonger/ipa-server-guard | 55 +++++++++++
install/restart_scripts/renew_ca_cert | 11 ++-
install/restart_scripts/renew_ra_cert | 11 ++-
install/restart_scripts/restart_dirsrv | 10 +-
install/restart_scripts/restart_httpd | 10 +-
install/restart_scripts/stop_pkicad | 4 +
install/tools/ipa-upgradeconfig | 3 +
ipaplatform/base/paths.py | 2 +
ipaserver/install/cainstance.py | 38 ++++++++
ipaserver/install/certs.py | 104 +++++++++++++++++++++
ipaserver/install/httpinstance.py | 42 +++++++++
14 files changed, 290 insertions(+), 6 deletions(-)
create mode 100755 install/certmonger/ipa-server-guard
diff --git a/freeipa.spec.in b/freeipa.spec.in
index 1c975b3912d0a7470a32f1b7e314cfde74446e85..b72d05a4c16d58144207233f2078a336b087604d 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -650,6 +650,7 @@ fi
%{_sbindir}/ipa-advise
%{_sbindir}/ipa-cacert-manage
%{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit
+%{_libexecdir}/certmonger/ipa-server-guard
%{_libexecdir}/ipa-otpd
%dir %{_libexecdir}/ipa
%{_libexecdir}/ipa/ipa-dnskeysyncd
diff --git a/install/certmonger/Makefile.am b/install/certmonger/Makefile.am
index ef6a0a635eed77a582bf0c43b40593678326c8eb..2dc476f188cb284f60a284a6cf90cf3c1ee8692f 100644
--- a/install/certmonger/Makefile.am
+++ b/install/certmonger/Makefile.am
@@ -3,6 +3,7 @@ NULL =
appdir = $(libexecdir)/certmonger/
app_SCRIPTS = \
dogtag-ipa-ca-renew-agent-submit \
+ ipa-server-guard \
$(NULL)
EXTRA_DIST = \
diff --git a/install/certmonger/dogtag-ipa-ca-renew-agent-submit b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
index 3c6e8175c337f65046f8631f4393aecfbf207f4d..7b91fc61148912c77d0ae962b3847d73e8d0720e 100755
--- a/install/certmonger/dogtag-ipa-ca-renew-agent-submit
+++ b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
@@ -38,7 +38,7 @@ from ipapython.dn import DN
from ipalib import api, errors, pkcs10, x509
from ipaplatform.paths import paths
from ipaserver.plugins.ldap2 import ldap2
-from ipaserver.install import cainstance
+from ipaserver.install import cainstance, certs
# This is a certmonger CA helper script for IPA CA subsystem cert renewal. See
# https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/submit.txt for more
@@ -437,6 +437,7 @@ def main():
return OPERATION_NOT_SUPPORTED_BY_HELPER
tmpdir = tempfile.mkdtemp(prefix="tmp-")
+ certs.renewal_lock.acquire()
try:
principal = str('host/%s@%s' % (api.env.host, api.env.realm))
ipautil.kinit_hostprincipal(paths.KRB5_KEYTAB, tmpdir, principal)
@@ -456,6 +457,7 @@ def main():
print item
return res[0]
finally:
+ certs.renewal_lock.release()
shutil.rmtree(tmpdir)
try:
diff --git a/install/certmonger/ipa-server-guard b/install/certmonger/ipa-server-guard
new file mode 100755
index 0000000000000000000000000000000000000000..5e31d89b7731a2bafb85cd7fed4a4b9bd6709a2a
--- /dev/null
+++ b/install/certmonger/ipa-server-guard
@@ -0,0 +1,55 @@
+#!/usr/bin/python2 -E
+#
+# Authors:
+# Jan Cholasta <jcholast@redhat.com>
+#
+# Copyright (C) 2015 Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import os
+# Prevent garbage from readline on standard output
+# (see https://fedorahosted.org/freeipa/ticket/4064)
+if not os.isatty(1):
+ os.environ['TERM'] = 'dumb'
+import sys
+import syslog
+import traceback
+
+from ipapython import ipautil
+from ipaserver.install import certs
+
+
+def main():
+ if len(sys.argv) < 2:
+ raise RuntimeError("Not enough arguments")
+
+ with certs.renewal_lock:
+ stdout, stderr, rc = ipautil.run(sys.argv[1:], raiseonerr=False,
+ env=os.environ)
+ sys.stdout.write(stdout)
+ sys.stdout.flush()
+ sys.stderr.write(stderr)
+ sys.stderr.flush()
+
+ return rc
+
+
+try:
+ sys.exit(main())
+except Exception, e:
+ syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
+ print "Internal error"
+ sys.exit(3)
diff --git a/install/restart_scripts/renew_ca_cert b/install/restart_scripts/renew_ca_cert
index 2ad2038703a74fe3549708549091633b35695907..261c424381d8246ab2ca6da2689a7f90010b2a97 100644
--- a/install/restart_scripts/renew_ca_cert
+++ b/install/restart_scripts/renew_ca_cert
@@ -35,7 +35,8 @@ from ipaserver.plugins.ldap2 import ldap2
from ipaplatform import services
from ipaplatform.paths import paths
-def main():
+
+def _main():
nickname = sys.argv[1]
api.bootstrap(context='restart')
@@ -209,6 +210,14 @@ def main():
syslog.syslog(
syslog.LOG_NOTICE, "Started %s" % dogtag_service.service_name)
+
+def main():
+ try:
+ _main()
+ finally:
+ certs.renewal_lock.release('renew_ca_cert')
+
+
try:
main()
except Exception:
diff --git a/install/restart_scripts/renew_ra_cert b/install/restart_scripts/renew_ra_cert
index 6d4b81a5393dcaced56a8335cd0ec6b7a994acdc..7dae3562380e919b2cc5f53825820291fc93fdc5 100644
--- a/install/restart_scripts/renew_ra_cert
+++ b/install/restart_scripts/renew_ra_cert
@@ -32,9 +32,10 @@ from ipaserver.install import certs, cainstance
from ipaplatform import services
from ipaplatform.paths import paths
-nickname = 'ipaCert'
-def main():
+def _main():
+ nickname = 'ipaCert'
+
api.bootstrap(context='restart')
api.finalize()
@@ -68,6 +69,12 @@ def main():
else:
syslog.syslog(syslog.LOG_NOTICE, "Restarted httpd")
+
+def main():
+ with certs.renewal_lock:
+ _main()
+
+
try:
main()
except Exception:
diff --git a/install/restart_scripts/restart_dirsrv b/install/restart_scripts/restart_dirsrv
index 837378191765babbcb4b09afec37ab82cb675e28..723644215cb76aa83b2d8eee70070b979986c0cc 100644
--- a/install/restart_scripts/restart_dirsrv
+++ b/install/restart_scripts/restart_dirsrv
@@ -24,8 +24,10 @@ import syslog
import traceback
from ipalib import api
from ipaplatform import services
+from ipaserver.install import certs
-def main():
+
+def _main():
try:
instance = sys.argv[1]
except IndexError:
@@ -41,6 +43,12 @@ def main():
except Exception, e:
syslog.syslog(syslog.LOG_ERR, "Cannot restart dirsrv (instance: '%s'): %s" % (instance, str(e)))
+
+def main():
+ with certs.renewal_lock:
+ _main()
+
+
try:
main()
except Exception:
diff --git a/install/restart_scripts/restart_httpd b/install/restart_scripts/restart_httpd
index e3ef73c4fad29bd0ca4dda167352ad023d5ff31f..f060a3091d439b7811d680b75d9995f5cc391e53 100644
--- a/install/restart_scripts/restart_httpd
+++ b/install/restart_scripts/restart_httpd
@@ -22,8 +22,10 @@
import syslog
import traceback
from ipaplatform import services
+from ipaserver.install import certs
-def main():
+
+def _main():
syslog.syslog(syslog.LOG_NOTICE, 'certmonger restarted httpd')
try:
@@ -31,6 +33,12 @@ def main():
except Exception, e:
syslog.syslog(syslog.LOG_ERR, "Cannot restart httpd: %s" % str(e))
+
+def main():
+ with certs.renewal_lock:
+ _main()
+
+
try:
main()
except Exception:
diff --git a/install/restart_scripts/stop_pkicad b/install/restart_scripts/stop_pkicad
index b8866f16edbec8c58327616324357f7f23ba368a..871e5e7616701ef6925fa2725cb1a90ad0aae512 100644
--- a/install/restart_scripts/stop_pkicad
+++ b/install/restart_scripts/stop_pkicad
@@ -25,6 +25,8 @@ import traceback
from ipapython import dogtag
from ipalib import api
from ipaplatform import services
+from ipaserver.install import certs
+
def main():
api.bootstrap(context='restart')
@@ -34,6 +36,8 @@ def main():
dogtag_service = services.knownservices[configured_constants.SERVICE_NAME]
dogtag_instance = configured_constants.PKI_INSTANCE_NAME
+ certs.renewal_lock.acquire('renew_ca_cert')
+
syslog.syslog(syslog.LOG_NOTICE, "Stopping %s" % dogtag_service.service_name)
try:
dogtag_service.stop(dogtag_instance)
diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig
index b00161d58418d6205c0ba0db0260af272ec96130..3f671c3bd5ebb643201b13b2024447bb1273c292 100755
--- a/install/tools/ipa-upgradeconfig
+++ b/install/tools/ipa-upgradeconfig
@@ -1372,6 +1372,8 @@ def main():
)
upgrade_pki(ca, fstore)
+ ca.configure_certmonger_renewal_guard()
+
update_dbmodules(api.env.realm)
uninstall_ipa_kpasswd()
@@ -1384,6 +1386,7 @@ def main():
http = httpinstance.HTTPInstance(fstore)
http.configure_selinux_for_httpd()
http.change_mod_nss_port_from_http()
+ http.configure_certmonger_renewal_guard()
http.stop()
update_mod_nss_protocol(http)
diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py
index 8bfab1bc92f79b5e76555b35a8b646e1ff56f84b..f78c1f940a101038226ff98e229df775028e3bf1 100644
--- a/ipaplatform/base/paths.py
+++ b/ipaplatform/base/paths.py
@@ -204,6 +204,7 @@ class BasePathNamespace(object):
LIBSOFTHSM2_SO_64 = "/usr/lib64/pkcs11/libsofthsm2.so"
DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT = "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit"
DOGTAG_IPA_RENEW_AGENT_SUBMIT = "/usr/libexec/certmonger/dogtag-ipa-renew-agent-submit"
+ IPA_SERVER_GUARD = "/usr/libexec/certmonger/ipa-server-guard"
IPA_DNSKEYSYNCD_REPLICA = "/usr/libexec/ipa/ipa-dnskeysync-replica"
IPA_DNSKEYSYNCD = "/usr/libexec/ipa/ipa-dnskeysyncd"
IPA_ODS_EXPORTER = "/usr/libexec/ipa/ipa-ods-exporter"
@@ -320,6 +321,7 @@ class BasePathNamespace(object):
VAR_OPENDNSSEC_DIR = "/var/opendnssec"
OPENDNSSEC_KASP_DB = "/var/opendnssec/kasp.db"
VAR_RUN_DIRSRV_DIR = "/var/run/dirsrv"
+ IPA_RENEWAL_LOCK = "/var/run/ipa/renewal.lock"
SVC_LIST_FILE = "/var/run/ipa/services.list"
IPA_MEMCACHED_DIR = "/var/run/ipa_memcached"
VAR_RUN_IPA_MEMCACHED = "/var/run/ipa_memcached/ipa_memcached"
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index aac7f4c7ccbad5a68bfd9756c7f7638416e3f6a0..13a75bbb568a25d155325e7084406eb19e8ffc92 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -37,6 +37,8 @@ import stat
import syslog
import ConfigParser
import dbus
+import shlex
+import pipes
from ipapython import dogtag
from ipapython.certdb import get_ca_nickname
@@ -1422,6 +1424,16 @@ class CAInstance(service.Service):
if path:
iface.remove_known_ca(path)
+ helper = self.restore_state('certmonger_dogtag_helper')
+ if helper:
+ path = iface.find_ca_by_nickname('dogtag-ipa-renew-agent')
+ if path:
+ ca_obj = bus.get_object('org.fedorahosted.certmonger', path)
+ ca_iface = dbus.Interface(ca_obj,
+ 'org.freedesktop.DBus.Properties')
+ ca_iface.Set('org.fedorahosted.certmonger.ca',
+ 'external-helper', helper)
+
cmonger.stop()
# remove CRL files
@@ -1481,6 +1493,32 @@ class CAInstance(service.Service):
'dogtag-ipa-ca-renew-agent',
paths.DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT, [])
+ self.configure_certmonger_renewal_guard()
+
+ def configure_certmonger_renewal_guard(self):
+ if not self.is_configured():
+ return
+
+ bus = dbus.SystemBus()
+ obj = bus.get_object('org.fedorahosted.certmonger',
+ '/org/fedorahosted/certmonger')
+ iface = dbus.Interface(obj, 'org.fedorahosted.certmonger')
+ path = iface.find_ca_by_nickname('dogtag-ipa-renew-agent')
+ if path:
+ ca_obj = bus.get_object('org.fedorahosted.certmonger', path)
+ ca_iface = dbus.Interface(ca_obj,
+ 'org.freedesktop.DBus.Properties')
+ helper = ca_iface.Get('org.fedorahosted.certmonger.ca',
+ 'external-helper')
+ if helper:
+ args = shlex.split(helper)
+ if args[0] != paths.IPA_SERVER_GUARD:
+ self.backup_state('certmonger_dogtag_helper', helper)
+ args = [paths.IPA_SERVER_GUARD] + args
+ helper = ' '.join(pipes.quote(a) for a in args)
+ ca_iface.Set('org.fedorahosted.certmonger.ca',
+ 'external-helper', helper)
+
def configure_agent_renewal(self):
try:
certmonger.dogtag_start_tracking(
diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
index 7292cbbe3574f57d32daa6f1e310669486fa5eff..bc7dccf805386e9fa84b58d2ff9346085e1b93b1 100644
--- a/ipaserver/install/certs.py
+++ b/ipaserver/install/certs.py
@@ -26,6 +26,10 @@ import xml.dom.minidom
import pwd
import base64
from hashlib import sha1
+import fcntl
+import time
+import datetime
+import ConfigParser as configparser
from ipapython.ipa_log_manager import root_logger
from ipapython import dogtag
@@ -647,3 +651,103 @@ class CertDB(object):
def export_pem_cert(self, nickname, location):
return self.nssdb.export_pem_cert(nickname, location)
+
+
+class _CrossProcessLock(object):
+ _DATETIME_FORMAT = '%Y%m%d%H%M%S%f'
+
+ def __init__(self, filename):
+ self._filename = filename
+
+ def __enter__(self):
+ self.acquire()
+
+ def __exit__(self, exc_type, exc_value, traceback):
+ self.release()
+
+ def acquire(self, owner=None):
+ self._do(self._acquire, owner)
+
+ def release(self, owner=None):
+ self._do(self._release, owner)
+
+ def _acquire(self, owner):
+ now = datetime.datetime.utcnow()
+
+ if self._locked and now >= self._expire:
+ self._locked = False
+
+ if self._locked:
+ return False
+
+ self._locked = True
+ self._owner = owner
+ self._expire = now + datetime.timedelta(hours=1)
+
+ return True
+
+ def _release(self, owner):
+ if not self._locked or self._owner != owner:
+ raise RuntimeError("lock not acquired by %s" % owner)
+
+ self._locked = False
+ self._owner = None
+ self._expire = None
+
+ return True
+
+ def _do(self, func, owner):
+ if owner is None:
+ owner = '%s[%s]' % (os.path.basename(sys.argv[0]), os.getpid())
+
+ while True:
+ with open(self._filename, 'a+') as f:
+ fcntl.flock(f, fcntl.LOCK_EX)
+
+ f.seek(0)
+ self._read(f)
+
+ if func(owner):
+ f.seek(0)
+ f.truncate()
+ self._write(f)
+ return
+
+ time.sleep(10)
+
+ def _read(self, fileobj):
+ p = configparser.RawConfigParser()
+ p.readfp(fileobj)
+
+ try:
+ self._locked = p.getboolean('lock', 'locked')
+
+ if self._locked:
+ self._owner = p.get('lock', 'owner')
+
+ expire = p.get('lock', 'expire')
+ try:
+ self._expire = datetime.datetime.strptime(
+ expire, self._DATETIME_FORMAT)
+ except ValueError:
+ raise configparser.Error
+ except configparser.Error:
+ self._locked = False
+ self._owner = None
+ self._expire = None
+
+ def _write(self, fileobj):
+ p = configparser.RawConfigParser()
+ p.add_section('lock')
+
+ locked = '1' if self._locked else '0'
+ p.set('lock', 'locked', locked)
+
+ if self._locked:
+ expire = self._expire.strftime(self._DATETIME_FORMAT)
+ p.set('lock', 'owner', self._owner)
+ p.set('lock', 'expire', expire)
+
+ p.write(fileobj)
+
+renewal_lock = _CrossProcessLock(paths.IPA_RENEWAL_LOCK)
diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py
index f9e020039734c7ff61e06ead0e30fb28701d6fc8..2fb315b6b822343860a9c31b016d6a0a22388488 100644
--- a/ipaserver/install/httpinstance.py
+++ b/ipaserver/install/httpinstance.py
@@ -23,6 +23,9 @@ import tempfile
import pwd
import shutil
import re
+import dbus
+import shlex
+import pipes
import service
import certs
@@ -121,6 +124,9 @@ class HTTPInstance(service.Service):
self.step("enabling mod_nss renegotiate", self.enable_mod_nss_renegotiate)
self.step("adding URL rewriting rules", self.__add_include)
self.step("configuring httpd", self.__configure_http)
+ if self.ca_is_configured:
+ self.step("configure certmonger for renewals",
+ self.configure_certmonger_renewal_guard)
self.step("setting up ssl", self.__setup_ssl)
self.step("importing CA certificates from LDAP", self.__import_ca_certs)
if autoconfig:
@@ -221,6 +227,27 @@ class HTTPInstance(service.Service):
if installutils.update_file(paths.HTTPD_NSS_CONF, '</VirtualHost>', 'Include conf.d/ipa-rewrite.conf\n</VirtualHost>') != 0:
print "Adding Include conf.d/ipa-rewrite to %s failed." % paths.HTTPD_NSS_CONF
+ def configure_certmonger_renewal_guard(self):
+ bus = dbus.SystemBus()
+ obj = bus.get_object('org.fedorahosted.certmonger',
+ '/org/fedorahosted/certmonger')
+ iface = dbus.Interface(obj, 'org.fedorahosted.certmonger')
+ path = iface.find_ca_by_nickname('IPA')
+ if path:
+ ca_obj = bus.get_object('org.fedorahosted.certmonger', path)
+ ca_iface = dbus.Interface(ca_obj,
+ 'org.freedesktop.DBus.Properties')
+ helper = ca_iface.Get('org.fedorahosted.certmonger.ca',
+ 'external-helper')
+ if helper:
+ args = shlex.split(helper)
+ if args[0] != paths.IPA_SERVER_GUARD:
+ self.backup_state('certmonger_ipa_helper', helper)
+ args = [paths.IPA_SERVER_GUARD] + args
+ helper = ' '.join(pipes.quote(a) for a in args)
+ ca_iface.Set('org.fedorahosted.certmonger.ca',
+ 'external-helper', helper)
+
def __setup_ssl(self):
fqdn = self.fqdn
@@ -355,6 +382,21 @@ class HTTPInstance(service.Service):
self.stop()
self.stop_tracking_certificates()
+
+ helper = self.restore_state('certmonger_ipa_helper')
+ if helper:
+ bus = dbus.SystemBus()
+ obj = bus.get_object('org.fedorahosted.certmonger',
+ '/org/fedorahosted/certmonger')
+ iface = dbus.Interface(obj, 'org.fedorahosted.certmonger')
+ path = iface.find_ca_by_nickname('IPA')
+ if path:
+ ca_obj = bus.get_object('org.fedorahosted.certmonger', path)
+ ca_iface = dbus.Interface(ca_obj,
+ 'org.freedesktop.DBus.Properties')
+ ca_iface.Set('org.fedorahosted.certmonger.ca',
+ 'external-helper', helper)
+
if not enabled is None and not enabled:
self.disable()
--
2.1.0