From c50f7610b1781ccbd6f169805d29d84e34e46db8 Mon Sep 17 00:00:00 2001 From: Petr Spacek Date: Mon, 31 Aug 2015 18:01:12 +0200 Subject: [PATCH] DNSSEC: Fix deadlock in ipa-ods-exporter <-> ods-enforcerd interaction https://fedorahosted.org/freeipa/ticket/5273 Reviewed-By: Martin Basti Reviewed-By: Oleg Fayans --- daemons/dnssec/ipa-ods-exporter | 39 +++++++++++++++++++++++++++++++-------- 1 file changed, 31 insertions(+), 8 deletions(-) diff --git a/daemons/dnssec/ipa-ods-exporter b/daemons/dnssec/ipa-ods-exporter index 9544db149aed6574a8962d6c8e6b6f1bc520d6db..76c7e484c65888b3d722448ee669ca8d95e3f3d9 100755 --- a/daemons/dnssec/ipa-ods-exporter +++ b/daemons/dnssec/ipa-ods-exporter @@ -368,12 +368,12 @@ def parse_command(cmd): """ if cmd == 'ipa-hsm-update': return (0, - 'HSM synchronization finished, exiting.', + 'HSM synchronization finished, skipping zone synchronization.', None) elif cmd == 'ipa-full-update': return (None, - 'Synchronization of all zones requested.', + 'Synchronization of all zones was finished.', None) elif not cmd.startswith('update '): @@ -386,7 +386,7 @@ def parse_command(cmd): else: zone_name = cmd2ods_zone_name(cmd) return (None, - 'Update request for zone "%s" queued.\n' % zone_name, + 'Zone was "%s" updated.\n' % zone_name, zone_name) def send_systemd_reply(conn, reply): @@ -541,18 +541,29 @@ except KeyError as e: exitcode, msg, zone_name = parse_command(cmd) -if conn: - send_systemd_reply(conn, msg) if exitcode is not None: + if conn: + send_systemd_reply(conn, msg) log.info(msg) sys.exit(exitcode) else: log.debug(msg) # Open DB directly and read key timestamps etc. -with ods_db_lock(): - db = sqlite3.connect(paths.OPENDNSSEC_KASP_DB, - isolation_level="EXCLUSIVE") +db = None +try: + # LOCK WARNING: + # ods-enforcerd is holding kasp.db.our_lock when processing all zones and + # the lock is unlocked only after all calls to ods-signer are finished, + # i.e. when ods-enforcerd receives reply from each ods-signer call. + # + # Consequently, ipa-ods-exporter (ods-signerd implementation) must not + # request kasp.db.our_lock to prevent deadlocks. + # SQLite transaction isolation should suffice. + # Beware: Reply can be sent back only after DB is unlocked and closed + # otherwise ods-enforcerd will fail. + + db = sqlite3.connect(paths.OPENDNSSEC_KASP_DB) db.row_factory = sqlite3.Row db.execute('BEGIN') @@ -564,4 +575,16 @@ with ods_db_lock(): for zone_row in db.execute("SELECT name FROM zones"): sync_zone(log, ldap, dns_dn, zone_row['name']) +except Exception as ex: + msg = "ipa-ods-exporter exception: %s" % ex + raise ex + +finally: + try: + if db: + db.close() + finally: + if conn: + send_systemd_reply(conn, msg) + log.debug('Done') -- 2.5.1