From 0598ed6e1c48c6600774c53065716aad759da5e7 Mon Sep 17 00:00:00 2001
From: Christian Heimes <cheimes@redhat.com>
Date: Tue, 10 Jul 2018 14:03:28 +0200
Subject: [PATCH] Handle races in replica config
When multiple replicas are installed in parallel, two replicas may try
to create the cn=replica entry at the same time. This leads to a
conflict on one of the replicas. replica_config() and
ensure_replication_managers() now handle conflicts.
ipaldap now maps TYPE_OR_VALUE_EXISTS to DuplicateEntry(). The type or
value exists exception is raised, when an attribute value or type is
already set.
Fixes: https://pagure.io/freeipa/issue/7566
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
---
ipapython/ipaldap.py | 5 ++
ipaserver/install/replication.py | 123 ++++++++++++++++++-------------
ipaserver/plugins/ldap2.py | 3 +-
3 files changed, 79 insertions(+), 52 deletions(-)
diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py
index dcac32c31c670753b83f99eac7f6483fbad2b14d..53fdf4967868961effea7f3f64dfb3c0edfc75f3 100644
--- a/ipapython/ipaldap.py
+++ b/ipapython/ipaldap.py
@@ -1016,7 +1016,12 @@ class LDAPClient(object):
except ldap.NO_SUCH_OBJECT:
raise errors.NotFound(reason=arg_desc or 'no such entry')
except ldap.ALREADY_EXISTS:
+ # entry already exists
raise errors.DuplicateEntry()
+ except ldap.TYPE_OR_VALUE_EXISTS:
+ # attribute type or attribute value already exists, usually only
+ # occurs, when two machines try to write at the same time.
+ raise errors.DuplicateEntry(message=unicode(desc))
except ldap.CONSTRAINT_VIOLATION:
# This error gets thrown by the uniqueness plugin
_msg = 'Another entry with the same attribute value already exists'
diff --git a/ipaserver/install/replication.py b/ipaserver/install/replication.py
index d0f92c76c108d237104a81c72567250583ac4ff1..78c4a43cc9b8d9a6740d26209f347f64b879743e 100644
--- a/ipaserver/install/replication.py
+++ b/ipaserver/install/replication.py
@@ -34,7 +34,7 @@ import ldap
from ipalib import api, errors
from ipalib.cli import textui
from ipalib.text import _
-from ipapython import ipautil, ipaldap, kerberos
+from ipapython import ipautil, ipaldap
from ipapython.admintool import ScriptError
from ipapython.dn import DN
from ipapython.ipaldap import ldap_initialize
@@ -461,7 +461,7 @@ class ReplicationManager(object):
return DN(('cn', 'replica'), ('cn', self.db_suffix),
('cn', 'mapping tree'), ('cn', 'config'))
- def set_replica_binddngroup(self, r_conn, entry):
+ def _set_replica_binddngroup(self, r_conn, entry):
"""
Set nsds5replicabinddngroup attribute on remote master's replica entry.
Older masters (ipa < 3.3) may not support setting this attribute. In
@@ -476,11 +476,6 @@ class ReplicationManager(object):
mod.append((ldap.MOD_ADD, 'nsds5replicabinddngroup',
self.repl_man_group_dn))
- if 'nsds5replicabinddngroupcheckinterval' not in entry:
- mod.append(
- (ldap.MOD_ADD,
- 'nsds5replicabinddngroupcheckinterval',
- '60'))
if mod:
try:
r_conn.modify_s(entry.dn, mod)
@@ -488,49 +483,62 @@ class ReplicationManager(object):
logger.debug(
"nsds5replicabinddngroup attribute not supported on "
"remote master.")
+ except (ldap.ALREADY_EXISTS, ldap.CONSTRAINT_VIOLATION):
+ logger.debug("No update to %s necessary", entry.dn)
def replica_config(self, conn, replica_id, replica_binddn):
assert isinstance(replica_binddn, DN)
dn = self.replica_dn()
assert isinstance(dn, DN)
+ logger.debug("Add or update replica config %s", dn)
try:
entry = conn.get_entry(dn)
except errors.NotFound:
- pass
- else:
- binddns = entry.setdefault('nsDS5ReplicaBindDN', [])
- if replica_binddn not in {DN(m) for m in binddns}:
- # Add the new replication manager
- binddns.append(replica_binddn)
- for key, value in REPLICA_CREATION_SETTINGS.items():
- entry[key] = value
+ # no entry, create new one
+ entry = conn.make_entry(
+ dn,
+ objectclass=["top", "nsds5replica", "extensibleobject"],
+ cn=["replica"],
+ nsds5replicaroot=[str(self.db_suffix)],
+ nsds5replicaid=[str(replica_id)],
+ nsds5replicatype=[self.get_replica_type()],
+ nsds5flags=["1"],
+ nsds5replicabinddn=[replica_binddn],
+ nsds5replicabinddngroup=[self.repl_man_group_dn],
+ nsds5replicalegacyconsumer=["off"],
+ **REPLICA_CREATION_SETTINGS
+ )
try:
- conn.update_entry(entry)
- except errors.EmptyModlist:
- pass
+ conn.add_entry(entry)
+ except errors.DuplicateEntry:
+ logger.debug("Lost race against another replica, updating")
+ # fetch entry that have been added by another replica
+ entry = conn.get_entry(dn)
+ else:
+ logger.debug("Added replica config %s", dn)
+ # added entry successfully
+ return entry
- self.set_replica_binddngroup(conn, entry)
+ # either existing entry or lost race
+ binddns = entry.setdefault('nsDS5ReplicaBindDN', [])
+ if replica_binddn not in {DN(m) for m in binddns}:
+ # Add the new replication manager
+ binddns.append(replica_binddn)
- # replication is already configured
- return
+ for key, value in REPLICA_CREATION_SETTINGS.items():
+ entry[key] = value
- replica_type = self.get_replica_type()
+ try:
+ conn.update_entry(entry)
+ except errors.EmptyModlist:
+ logger.debug("No update to %s necessary", entry.dn)
+ else:
+ logger.debug("Update replica config %s", entry.dn)
- entry = conn.make_entry(
- dn,
- objectclass=["top", "nsds5replica", "extensibleobject"],
- cn=["replica"],
- nsds5replicaroot=[str(self.db_suffix)],
- nsds5replicaid=[str(replica_id)],
- nsds5replicatype=[replica_type],
- nsds5flags=["1"],
- nsds5replicabinddn=[replica_binddn],
- nsds5replicabinddngroup=[self.repl_man_group_dn],
- nsds5replicalegacyconsumer=["off"],
- **REPLICA_CREATION_SETTINGS
- )
- conn.add_entry(entry)
+ self._set_replica_binddngroup(conn, entry)
+
+ return entry
def setup_changelog(self, conn):
ent = conn.get_entry(
@@ -690,7 +698,10 @@ class ReplicationManager(object):
uid=["passsync"],
userPassword=[password],
)
- conn.add_entry(entry)
+ try:
+ conn.add_entry(entry)
+ except errors.DuplicateEntry:
+ pass
# Add the user to the list of users allowed to bypass password policy
extop_dn = DN(('cn', 'ipa_pwd_extop'), ('cn', 'plugins'), ('cn', 'config'))
@@ -1658,7 +1669,10 @@ class ReplicationManager(object):
objectclass=['top', 'groupofnames'],
cn=['replication managers']
)
- conn.add_entry(entry)
+ try:
+ conn.add_entry(entry)
+ except errors.DuplicateEntry:
+ pass
def ensure_replication_managers(self, conn, r_hostname):
"""
@@ -1668,23 +1682,24 @@ class ReplicationManager(object):
On FreeIPA 3.x masters lacking support for nsds5ReplicaBinddnGroup
attribute, add replica bind DN directly into the replica entry.
"""
- my_princ = kerberos.Principal((u'ldap', unicode(self.hostname)),
- realm=self.realm)
- remote_princ = kerberos.Principal((u'ldap', unicode(r_hostname)),
- realm=self.realm)
- services_dn = DN(api.env.container_service, api.env.basedn)
-
- mydn, remote_dn = tuple(
- DN(('krbprincipalname', unicode(p)), services_dn) for p in (
- my_princ, remote_princ))
+ my_dn = DN(
+ ('krbprincipalname', u'ldap/%s@%s' % (self.hostname, self.realm)),
+ api.env.container_service,
+ api.env.basedn
+ )
+ remote_dn = DN(
+ ('krbprincipalname', u'ldap/%s@%s' % (r_hostname, self.realm)),
+ api.env.container_service,
+ api.env.basedn
+ )
try:
conn.get_entry(self.repl_man_group_dn)
except errors.NotFound:
- self._add_replica_bind_dn(conn, mydn)
+ self._add_replica_bind_dn(conn, my_dn)
self._add_replication_managers(conn)
- self._add_dn_to_replication_managers(conn, mydn)
+ self._add_dn_to_replication_managers(conn, my_dn)
self._add_dn_to_replication_managers(conn, remote_dn)
def add_temp_sasl_mapping(self, conn, r_hostname):
@@ -1704,7 +1719,10 @@ class ReplicationManager(object):
entry = conn.get_entry(self.replica_dn())
entry['nsDS5ReplicaBindDN'].append(replica_binddn)
- conn.update_entry(entry)
+ try:
+ conn.update_entry(entry)
+ except errors.EmptyModlist:
+ pass
entry = conn.make_entry(
DN(('cn', 'Peer Master'), ('cn', 'mapping'), ('cn', 'sasl'),
@@ -1716,7 +1734,10 @@ class ReplicationManager(object):
nsSaslMapFilterTemplate=['(cn=&@%s)' % self.realm],
nsSaslMapPriority=['1'],
)
- conn.add_entry(entry)
+ try:
+ conn.add_entry(entry)
+ except errors.DuplicateEntry:
+ pass
def remove_temp_replication_user(self, conn, r_hostname):
"""
diff --git a/ipaserver/plugins/ldap2.py b/ipaserver/plugins/ldap2.py
index 8745866ad11cf6248d2b9dcff560c0a5ee6d109b..5d39cdf628d7e20ce5b259d97b479ef7c8ed88d5 100644
--- a/ipaserver/plugins/ldap2.py
+++ b/ipaserver/plugins/ldap2.py
@@ -419,7 +419,8 @@ class ldap2(CrudBackend, LDAPClient):
modlist = [(a, b, self.encode(c))
for a, b, c in modlist]
self.conn.modify_s(str(group_dn), modlist)
- except errors.DatabaseError:
+ except errors.DuplicateEntry:
+ # TYPE_OR_VALUE_EXISTS
raise errors.AlreadyGroupMember()
def remove_entry_from_group(self, dn, group_dn, member_attr='member'):
--
2.17.1