URL: https://github.com/freeipa/freeipa/pull/892 Author: simo5 Title: #892: Always check peer has keys before connecting Action: opened
PR body: """ When pulling the DM password we may have the same issues reported in ticket #6838 for CA keys. This commit makes sure we always check the peer has keys before any client operation. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/892/head:pr892 git checkout pr892
From 923d928fa0aa1b9a1b0ee096e0a7063755a1c4ab Mon Sep 17 00:00:00 2001 From: Simo Sorce <s...@redhat.com> Date: Fri, 23 Jun 2017 04:48:41 -0400 Subject: [PATCH] Always check peer has keys before connecting When pulling the DM password we may have the same issues reported in ticket #6838 for CA keys. This commit makes sure we always check the peer has keys before any client operation. Ticket #6838 Signed-off-by: Simo Sorce <s...@redhat.com> --- ipaserver/install/custodiainstance.py | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/ipaserver/install/custodiainstance.py b/ipaserver/install/custodiainstance.py index 390576bc0c..bc3cea7063 100644 --- a/ipaserver/install/custodiainstance.py +++ b/ipaserver/install/custodiainstance.py @@ -13,7 +13,6 @@ from ipaserver.install import sysupgrade from base64 import b64decode from jwcrypto.common import json_decode -import functools import shutil import os import stat @@ -31,13 +30,6 @@ def __init__(self, host_name=None, realm=None): self.ldap_uri = None self.fqdn = host_name self.realm = realm - self.__CustodiaClient = functools.partial( - CustodiaClient, - client_service='host@%s' % self.fqdn, - keyfile=self.server_keys, - keytab=paths.KRB5_KEYTAB, - realm=realm, - ) def __config_file(self): template_file = os.path.basename(self.config_file) + '.template' @@ -144,6 +136,14 @@ def __wait_keys(self, host, timeout=300): raise RuntimeError("Timed out trying to obtain keys.") time.sleep(1) + def __CustodiaClient(self, server): + # Before we attempt to fetch keys from this host, make sure our public + # keys have been replicated there. + self.__wait_keys(server) + + return CustodiaClient('host@%s' % self.fqdn, self.server_keys, + paths.KRB5_KEYTAB, server, realm=self.realm) + def __get_keys(self, ca_host, cacerts_file, cacerts_pwd, data): # Fecth all needed certs one by one, then combine them in a single # p12 file @@ -151,10 +151,6 @@ def __get_keys(self, ca_host, cacerts_file, cacerts_pwd, data): prefix = data['prefix'] certlist = data['list'] - # Before we attempt to fetch keys from this host, make sure our public - # keys have been replicated there. - self.__wait_keys(ca_host) - cli = self.__CustodiaClient(server=ca_host) # Temporary nssdb
_______________________________________________ FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-le...@lists.fedorahosted.org