From 73ced07e2eefee137716452198d7cb0d59016c8f Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Fri, 5 Mar 2021 15:00:07 +0100 Subject: [PATCH] dnssec: concurrency issue when disabling old replica key When dnssec role is removed from the local node, the uninstaller creates a new replica key and marks the older replica keys as disabled (both in the local HSM and in LDAP). If ipa-ods-exporter runs in the middle of this operation, the old replica key may be disabled in the local HSM but not yet in LDAP and ipa-ods-exporter believes that it is a new replica key that needs to be imported from LDAP to local hsm. The op fails as there is already the key in the local HSM. The error can be ignored, ipa-ods-exporter simply needs to log a warning. Fixes: https://pagure.io/freeipa/issue/8654 Reviewed-By: Alexander Bokovoy --- daemons/dnssec/ipa-ods-exporter.in | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/daemons/dnssec/ipa-ods-exporter.in b/daemons/dnssec/ipa-ods-exporter.in index 6b1d08f9c..83d17a62c 100644 --- a/daemons/dnssec/ipa-ods-exporter.in +++ b/daemons/dnssec/ipa-ods-exporter.in @@ -37,6 +37,7 @@ from ipapython.dn import DN from ipapython.ipa_log_manager import standard_logging_setup from ipapython import ipaldap from ipaplatform.paths import paths +from ipaserver import p11helper from ipaserver.dnssec.abshsm import sync_pkcs11_metadata, wrappingmech_name2id from ipaserver.dnssec.ldapkeydb import LdapKeyDB, str_hexlify from ipaserver.dnssec.localhsm import LocalHSM @@ -301,7 +302,19 @@ def ldap2master_replica_keys_sync(ldapkeydb, localhsm): new_key_ldap['ipk11label'], str_hexlify(new_key_ldap['ipk11id']), str_hexlify(new_key_ldap['ipapublickey'])) - localhsm.import_public_key(new_key_ldap, new_key_ldap['ipapublickey']) + try: + localhsm.import_public_key( + new_key_ldap, new_key_ldap['ipapublickey']) + except p11helper.DuplicationError: + # we may have been called in the middle of operations + # disabling dnssec on the current node, while the + # replica key has already been disabled in localhsm but + # not yet in LDAP. + # Ignore the import error (key is already in localhsm but disabled) + # and log a warning + logger.warning("import of replica key to localhsm %s failed, " + "key already present but disabled", + str_hexlify(new_key_ldap['ipk11id'])) # set CKA_WRAP = FALSE for all replica keys removed from LDAP removed_replica_keys = set(localhsm.replica_pubkeys_wrap.keys()) \