From c0d13f5e58cb84eb3162aec1c2202329230c120d Mon Sep 17 00:00:00 2001 From: Jan Cholasta Date: Thu, 8 Jan 2015 09:06:46 +0000 Subject: [PATCH] Make certificate renewal process synchronized Synchronization is achieved using a global renewal lock. https://fedorahosted.org/freeipa/ticket/4803 Reviewed-By: David Kupka --- freeipa.spec.in | 1 + install/certmonger/Makefile.am | 1 + .../certmonger/dogtag-ipa-ca-renew-agent-submit | 4 +- install/certmonger/ipa-server-guard | 55 +++++++++++ install/restart_scripts/renew_ca_cert | 11 ++- install/restart_scripts/renew_ra_cert | 11 ++- install/restart_scripts/restart_dirsrv | 10 +- install/restart_scripts/restart_httpd | 10 +- install/restart_scripts/stop_pkicad | 4 + install/tools/ipa-upgradeconfig | 3 + ipaplatform/base/paths.py | 2 + ipaserver/install/cainstance.py | 38 ++++++++ ipaserver/install/certs.py | 104 +++++++++++++++++++++ ipaserver/install/httpinstance.py | 42 +++++++++ 14 files changed, 290 insertions(+), 6 deletions(-) create mode 100755 install/certmonger/ipa-server-guard diff --git a/freeipa.spec.in b/freeipa.spec.in index 1c975b3912d0a7470a32f1b7e314cfde74446e85..b72d05a4c16d58144207233f2078a336b087604d 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -650,6 +650,7 @@ fi %{_sbindir}/ipa-advise %{_sbindir}/ipa-cacert-manage %{_libexecdir}/certmonger/dogtag-ipa-ca-renew-agent-submit +%{_libexecdir}/certmonger/ipa-server-guard %{_libexecdir}/ipa-otpd %dir %{_libexecdir}/ipa %{_libexecdir}/ipa/ipa-dnskeysyncd diff --git a/install/certmonger/Makefile.am b/install/certmonger/Makefile.am index ef6a0a635eed77a582bf0c43b40593678326c8eb..2dc476f188cb284f60a284a6cf90cf3c1ee8692f 100644 --- a/install/certmonger/Makefile.am +++ b/install/certmonger/Makefile.am @@ -3,6 +3,7 @@ NULL = appdir = $(libexecdir)/certmonger/ app_SCRIPTS = \ dogtag-ipa-ca-renew-agent-submit \ + ipa-server-guard \ $(NULL) EXTRA_DIST = \ diff --git a/install/certmonger/dogtag-ipa-ca-renew-agent-submit b/install/certmonger/dogtag-ipa-ca-renew-agent-submit index 3c6e8175c337f65046f8631f4393aecfbf207f4d..7b91fc61148912c77d0ae962b3847d73e8d0720e 100755 --- a/install/certmonger/dogtag-ipa-ca-renew-agent-submit +++ b/install/certmonger/dogtag-ipa-ca-renew-agent-submit @@ -38,7 +38,7 @@ from ipapython.dn import DN from ipalib import api, errors, pkcs10, x509 from ipaplatform.paths import paths from ipaserver.plugins.ldap2 import ldap2 -from ipaserver.install import cainstance +from ipaserver.install import cainstance, certs # This is a certmonger CA helper script for IPA CA subsystem cert renewal. See # https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/submit.txt for more @@ -437,6 +437,7 @@ def main(): return OPERATION_NOT_SUPPORTED_BY_HELPER tmpdir = tempfile.mkdtemp(prefix="tmp-") + certs.renewal_lock.acquire() try: principal = str('host/%s@%s' % (api.env.host, api.env.realm)) ipautil.kinit_hostprincipal(paths.KRB5_KEYTAB, tmpdir, principal) @@ -456,6 +457,7 @@ def main(): print item return res[0] finally: + certs.renewal_lock.release() shutil.rmtree(tmpdir) try: diff --git a/install/certmonger/ipa-server-guard b/install/certmonger/ipa-server-guard new file mode 100755 index 0000000000000000000000000000000000000000..5e31d89b7731a2bafb85cd7fed4a4b9bd6709a2a --- /dev/null +++ b/install/certmonger/ipa-server-guard @@ -0,0 +1,55 @@ +#!/usr/bin/python2 -E +# +# Authors: +# Jan Cholasta +# +# Copyright (C) 2015 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import os +# Prevent garbage from readline on standard output +# (see https://fedorahosted.org/freeipa/ticket/4064) +if not os.isatty(1): + os.environ['TERM'] = 'dumb' +import sys +import syslog +import traceback + +from ipapython import ipautil +from ipaserver.install import certs + + +def main(): + if len(sys.argv) < 2: + raise RuntimeError("Not enough arguments") + + with certs.renewal_lock: + stdout, stderr, rc = ipautil.run(sys.argv[1:], raiseonerr=False, + env=os.environ) + sys.stdout.write(stdout) + sys.stdout.flush() + sys.stderr.write(stderr) + sys.stderr.flush() + + return rc + + +try: + sys.exit(main()) +except Exception, e: + syslog.syslog(syslog.LOG_ERR, traceback.format_exc()) + print "Internal error" + sys.exit(3) diff --git a/install/restart_scripts/renew_ca_cert b/install/restart_scripts/renew_ca_cert index 2ad2038703a74fe3549708549091633b35695907..261c424381d8246ab2ca6da2689a7f90010b2a97 100644 --- a/install/restart_scripts/renew_ca_cert +++ b/install/restart_scripts/renew_ca_cert @@ -35,7 +35,8 @@ from ipaserver.plugins.ldap2 import ldap2 from ipaplatform import services from ipaplatform.paths import paths -def main(): + +def _main(): nickname = sys.argv[1] api.bootstrap(context='restart') @@ -209,6 +210,14 @@ def main(): syslog.syslog( syslog.LOG_NOTICE, "Started %s" % dogtag_service.service_name) + +def main(): + try: + _main() + finally: + certs.renewal_lock.release('renew_ca_cert') + + try: main() except Exception: diff --git a/install/restart_scripts/renew_ra_cert b/install/restart_scripts/renew_ra_cert index 6d4b81a5393dcaced56a8335cd0ec6b7a994acdc..7dae3562380e919b2cc5f53825820291fc93fdc5 100644 --- a/install/restart_scripts/renew_ra_cert +++ b/install/restart_scripts/renew_ra_cert @@ -32,9 +32,10 @@ from ipaserver.install import certs, cainstance from ipaplatform import services from ipaplatform.paths import paths -nickname = 'ipaCert' -def main(): +def _main(): + nickname = 'ipaCert' + api.bootstrap(context='restart') api.finalize() @@ -68,6 +69,12 @@ def main(): else: syslog.syslog(syslog.LOG_NOTICE, "Restarted httpd") + +def main(): + with certs.renewal_lock: + _main() + + try: main() except Exception: diff --git a/install/restart_scripts/restart_dirsrv b/install/restart_scripts/restart_dirsrv index 837378191765babbcb4b09afec37ab82cb675e28..723644215cb76aa83b2d8eee70070b979986c0cc 100644 --- a/install/restart_scripts/restart_dirsrv +++ b/install/restart_scripts/restart_dirsrv @@ -24,8 +24,10 @@ import syslog import traceback from ipalib import api from ipaplatform import services +from ipaserver.install import certs -def main(): + +def _main(): try: instance = sys.argv[1] except IndexError: @@ -41,6 +43,12 @@ def main(): except Exception, e: syslog.syslog(syslog.LOG_ERR, "Cannot restart dirsrv (instance: '%s'): %s" % (instance, str(e))) + +def main(): + with certs.renewal_lock: + _main() + + try: main() except Exception: diff --git a/install/restart_scripts/restart_httpd b/install/restart_scripts/restart_httpd index e3ef73c4fad29bd0ca4dda167352ad023d5ff31f..f060a3091d439b7811d680b75d9995f5cc391e53 100644 --- a/install/restart_scripts/restart_httpd +++ b/install/restart_scripts/restart_httpd @@ -22,8 +22,10 @@ import syslog import traceback from ipaplatform import services +from ipaserver.install import certs -def main(): + +def _main(): syslog.syslog(syslog.LOG_NOTICE, 'certmonger restarted httpd') try: @@ -31,6 +33,12 @@ def main(): except Exception, e: syslog.syslog(syslog.LOG_ERR, "Cannot restart httpd: %s" % str(e)) + +def main(): + with certs.renewal_lock: + _main() + + try: main() except Exception: diff --git a/install/restart_scripts/stop_pkicad b/install/restart_scripts/stop_pkicad index b8866f16edbec8c58327616324357f7f23ba368a..871e5e7616701ef6925fa2725cb1a90ad0aae512 100644 --- a/install/restart_scripts/stop_pkicad +++ b/install/restart_scripts/stop_pkicad @@ -25,6 +25,8 @@ import traceback from ipapython import dogtag from ipalib import api from ipaplatform import services +from ipaserver.install import certs + def main(): api.bootstrap(context='restart') @@ -34,6 +36,8 @@ def main(): dogtag_service = services.knownservices[configured_constants.SERVICE_NAME] dogtag_instance = configured_constants.PKI_INSTANCE_NAME + certs.renewal_lock.acquire('renew_ca_cert') + syslog.syslog(syslog.LOG_NOTICE, "Stopping %s" % dogtag_service.service_name) try: dogtag_service.stop(dogtag_instance) diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig index b00161d58418d6205c0ba0db0260af272ec96130..3f671c3bd5ebb643201b13b2024447bb1273c292 100755 --- a/install/tools/ipa-upgradeconfig +++ b/install/tools/ipa-upgradeconfig @@ -1372,6 +1372,8 @@ def main(): ) upgrade_pki(ca, fstore) + ca.configure_certmonger_renewal_guard() + update_dbmodules(api.env.realm) uninstall_ipa_kpasswd() @@ -1384,6 +1386,7 @@ def main(): http = httpinstance.HTTPInstance(fstore) http.configure_selinux_for_httpd() http.change_mod_nss_port_from_http() + http.configure_certmonger_renewal_guard() http.stop() update_mod_nss_protocol(http) diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py index 8bfab1bc92f79b5e76555b35a8b646e1ff56f84b..f78c1f940a101038226ff98e229df775028e3bf1 100644 --- a/ipaplatform/base/paths.py +++ b/ipaplatform/base/paths.py @@ -204,6 +204,7 @@ class BasePathNamespace(object): LIBSOFTHSM2_SO_64 = "/usr/lib64/pkcs11/libsofthsm2.so" DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT = "/usr/libexec/certmonger/dogtag-ipa-ca-renew-agent-submit" DOGTAG_IPA_RENEW_AGENT_SUBMIT = "/usr/libexec/certmonger/dogtag-ipa-renew-agent-submit" + IPA_SERVER_GUARD = "/usr/libexec/certmonger/ipa-server-guard" IPA_DNSKEYSYNCD_REPLICA = "/usr/libexec/ipa/ipa-dnskeysync-replica" IPA_DNSKEYSYNCD = "/usr/libexec/ipa/ipa-dnskeysyncd" IPA_ODS_EXPORTER = "/usr/libexec/ipa/ipa-ods-exporter" @@ -320,6 +321,7 @@ class BasePathNamespace(object): VAR_OPENDNSSEC_DIR = "/var/opendnssec" OPENDNSSEC_KASP_DB = "/var/opendnssec/kasp.db" VAR_RUN_DIRSRV_DIR = "/var/run/dirsrv" + IPA_RENEWAL_LOCK = "/var/run/ipa/renewal.lock" SVC_LIST_FILE = "/var/run/ipa/services.list" IPA_MEMCACHED_DIR = "/var/run/ipa_memcached" VAR_RUN_IPA_MEMCACHED = "/var/run/ipa_memcached/ipa_memcached" diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index aac7f4c7ccbad5a68bfd9756c7f7638416e3f6a0..13a75bbb568a25d155325e7084406eb19e8ffc92 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -37,6 +37,8 @@ import stat import syslog import ConfigParser import dbus +import shlex +import pipes from ipapython import dogtag from ipapython.certdb import get_ca_nickname @@ -1422,6 +1424,16 @@ class CAInstance(service.Service): if path: iface.remove_known_ca(path) + helper = self.restore_state('certmonger_dogtag_helper') + if helper: + path = iface.find_ca_by_nickname('dogtag-ipa-renew-agent') + if path: + ca_obj = bus.get_object('org.fedorahosted.certmonger', path) + ca_iface = dbus.Interface(ca_obj, + 'org.freedesktop.DBus.Properties') + ca_iface.Set('org.fedorahosted.certmonger.ca', + 'external-helper', helper) + cmonger.stop() # remove CRL files @@ -1481,6 +1493,32 @@ class CAInstance(service.Service): 'dogtag-ipa-ca-renew-agent', paths.DOGTAG_IPA_CA_RENEW_AGENT_SUBMIT, []) + self.configure_certmonger_renewal_guard() + + def configure_certmonger_renewal_guard(self): + if not self.is_configured(): + return + + bus = dbus.SystemBus() + obj = bus.get_object('org.fedorahosted.certmonger', + '/org/fedorahosted/certmonger') + iface = dbus.Interface(obj, 'org.fedorahosted.certmonger') + path = iface.find_ca_by_nickname('dogtag-ipa-renew-agent') + if path: + ca_obj = bus.get_object('org.fedorahosted.certmonger', path) + ca_iface = dbus.Interface(ca_obj, + 'org.freedesktop.DBus.Properties') + helper = ca_iface.Get('org.fedorahosted.certmonger.ca', + 'external-helper') + if helper: + args = shlex.split(helper) + if args[0] != paths.IPA_SERVER_GUARD: + self.backup_state('certmonger_dogtag_helper', helper) + args = [paths.IPA_SERVER_GUARD] + args + helper = ' '.join(pipes.quote(a) for a in args) + ca_iface.Set('org.fedorahosted.certmonger.ca', + 'external-helper', helper) + def configure_agent_renewal(self): try: certmonger.dogtag_start_tracking( diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py index 7292cbbe3574f57d32daa6f1e310669486fa5eff..bc7dccf805386e9fa84b58d2ff9346085e1b93b1 100644 --- a/ipaserver/install/certs.py +++ b/ipaserver/install/certs.py @@ -26,6 +26,10 @@ import xml.dom.minidom import pwd import base64 from hashlib import sha1 +import fcntl +import time +import datetime +import ConfigParser as configparser from ipapython.ipa_log_manager import root_logger from ipapython import dogtag @@ -647,3 +651,103 @@ class CertDB(object): def export_pem_cert(self, nickname, location): return self.nssdb.export_pem_cert(nickname, location) + + +class _CrossProcessLock(object): + _DATETIME_FORMAT = '%Y%m%d%H%M%S%f' + + def __init__(self, filename): + self._filename = filename + + def __enter__(self): + self.acquire() + + def __exit__(self, exc_type, exc_value, traceback): + self.release() + + def acquire(self, owner=None): + self._do(self._acquire, owner) + + def release(self, owner=None): + self._do(self._release, owner) + + def _acquire(self, owner): + now = datetime.datetime.utcnow() + + if self._locked and now >= self._expire: + self._locked = False + + if self._locked: + return False + + self._locked = True + self._owner = owner + self._expire = now + datetime.timedelta(hours=1) + + return True + + def _release(self, owner): + if not self._locked or self._owner != owner: + raise RuntimeError("lock not acquired by %s" % owner) + + self._locked = False + self._owner = None + self._expire = None + + return True + + def _do(self, func, owner): + if owner is None: + owner = '%s[%s]' % (os.path.basename(sys.argv[0]), os.getpid()) + + while True: + with open(self._filename, 'a+') as f: + fcntl.flock(f, fcntl.LOCK_EX) + + f.seek(0) + self._read(f) + + if func(owner): + f.seek(0) + f.truncate() + self._write(f) + return + + time.sleep(10) + + def _read(self, fileobj): + p = configparser.RawConfigParser() + p.readfp(fileobj) + + try: + self._locked = p.getboolean('lock', 'locked') + + if self._locked: + self._owner = p.get('lock', 'owner') + + expire = p.get('lock', 'expire') + try: + self._expire = datetime.datetime.strptime( + expire, self._DATETIME_FORMAT) + except ValueError: + raise configparser.Error + except configparser.Error: + self._locked = False + self._owner = None + self._expire = None + + def _write(self, fileobj): + p = configparser.RawConfigParser() + p.add_section('lock') + + locked = '1' if self._locked else '0' + p.set('lock', 'locked', locked) + + if self._locked: + expire = self._expire.strftime(self._DATETIME_FORMAT) + p.set('lock', 'owner', self._owner) + p.set('lock', 'expire', expire) + + p.write(fileobj) + +renewal_lock = _CrossProcessLock(paths.IPA_RENEWAL_LOCK) diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py index f9e020039734c7ff61e06ead0e30fb28701d6fc8..2fb315b6b822343860a9c31b016d6a0a22388488 100644 --- a/ipaserver/install/httpinstance.py +++ b/ipaserver/install/httpinstance.py @@ -23,6 +23,9 @@ import tempfile import pwd import shutil import re +import dbus +import shlex +import pipes import service import certs @@ -121,6 +124,9 @@ class HTTPInstance(service.Service): self.step("enabling mod_nss renegotiate", self.enable_mod_nss_renegotiate) self.step("adding URL rewriting rules", self.__add_include) self.step("configuring httpd", self.__configure_http) + if self.ca_is_configured: + self.step("configure certmonger for renewals", + self.configure_certmonger_renewal_guard) self.step("setting up ssl", self.__setup_ssl) self.step("importing CA certificates from LDAP", self.__import_ca_certs) if autoconfig: @@ -221,6 +227,27 @@ class HTTPInstance(service.Service): if installutils.update_file(paths.HTTPD_NSS_CONF, '', 'Include conf.d/ipa-rewrite.conf\n') != 0: print "Adding Include conf.d/ipa-rewrite to %s failed." % paths.HTTPD_NSS_CONF + def configure_certmonger_renewal_guard(self): + bus = dbus.SystemBus() + obj = bus.get_object('org.fedorahosted.certmonger', + '/org/fedorahosted/certmonger') + iface = dbus.Interface(obj, 'org.fedorahosted.certmonger') + path = iface.find_ca_by_nickname('IPA') + if path: + ca_obj = bus.get_object('org.fedorahosted.certmonger', path) + ca_iface = dbus.Interface(ca_obj, + 'org.freedesktop.DBus.Properties') + helper = ca_iface.Get('org.fedorahosted.certmonger.ca', + 'external-helper') + if helper: + args = shlex.split(helper) + if args[0] != paths.IPA_SERVER_GUARD: + self.backup_state('certmonger_ipa_helper', helper) + args = [paths.IPA_SERVER_GUARD] + args + helper = ' '.join(pipes.quote(a) for a in args) + ca_iface.Set('org.fedorahosted.certmonger.ca', + 'external-helper', helper) + def __setup_ssl(self): fqdn = self.fqdn @@ -355,6 +382,21 @@ class HTTPInstance(service.Service): self.stop() self.stop_tracking_certificates() + + helper = self.restore_state('certmonger_ipa_helper') + if helper: + bus = dbus.SystemBus() + obj = bus.get_object('org.fedorahosted.certmonger', + '/org/fedorahosted/certmonger') + iface = dbus.Interface(obj, 'org.fedorahosted.certmonger') + path = iface.find_ca_by_nickname('IPA') + if path: + ca_obj = bus.get_object('org.fedorahosted.certmonger', path) + ca_iface = dbus.Interface(ca_obj, + 'org.freedesktop.DBus.Properties') + ca_iface.Set('org.fedorahosted.certmonger.ca', + 'external-helper', helper) + if not enabled is None and not enabled: self.disable() -- 2.1.0