|
 |
f17082 |
From b35c75d864040b98ed3f9214d5d17d32f06d6ee1 Mon Sep 17 00:00:00 2001
|
|
|
f17082 |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
f17082 |
Date: Mon, 11 Jul 2022 14:20:32 -0400
|
|
|
f17082 |
Subject: [PATCH] Wipe the ipa-ca DNS record when updating system records
|
|
|
f17082 |
|
|
|
f17082 |
If a server with a CA has been marked as hidden and
|
|
|
f17082 |
contains the last A or AAAA address then that address
|
|
|
f17082 |
would remain in the ipa-ca entry.
|
|
|
f17082 |
|
|
|
f17082 |
This is because update-dns-system-records did not delete
|
|
|
f17082 |
values, it just re-computed them. So if no A or AAAA
|
|
|
f17082 |
records were found then the existing value was left.
|
|
|
f17082 |
|
|
|
f17082 |
Fixes: https://pagure.io/freeipa/issue/9195
|
|
|
f17082 |
|
|
|
f17082 |
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
|
|
|
f17082 |
---
|
|
|
f17082 |
ipaserver/dns_data_management.py | 12 +++++++++++-
|
|
|
f17082 |
1 file changed, 11 insertions(+), 1 deletion(-)
|
|
|
f17082 |
|
|
|
f17082 |
diff --git a/ipaserver/dns_data_management.py b/ipaserver/dns_data_management.py
|
|
|
f17082 |
index e2bc530ee8a..aaae5446856 100644
|
|
|
f17082 |
--- a/ipaserver/dns_data_management.py
|
|
|
f17082 |
+++ b/ipaserver/dns_data_management.py
|
|
|
f17082 |
@@ -19,6 +19,7 @@
|
|
|
f17082 |
from time import sleep, time
|
|
|
f17082 |
|
|
|
f17082 |
from ipalib import errors
|
|
|
f17082 |
+from ipalib.constants import IPA_CA_RECORD
|
|
|
f17082 |
from ipalib.dns import record_name_format
|
|
|
f17082 |
from ipapython.dnsutil import DNSName
|
|
|
f17082 |
from ipaserver.install import installutils
|
|
|
f17082 |
@@ -187,7 +188,7 @@ def __add_uri_records(
|
|
|
f17082 |
|
|
|
f17082 |
def __add_ca_records_from_hostname(self, zone_obj, hostname):
|
|
|
f17082 |
assert isinstance(hostname, DNSName) and hostname.is_absolute()
|
|
|
f17082 |
- r_name = DNSName('ipa-ca') + self.domain_abs
|
|
|
f17082 |
+ r_name = DNSName(IPA_CA_RECORD) + self.domain_abs
|
|
|
f17082 |
rrsets = None
|
|
|
f17082 |
end_time = time() + CA_RECORDS_DNS_TIMEOUT
|
|
|
f17082 |
while True:
|
|
|
f17082 |
@@ -210,6 +211,7 @@ def __add_ca_records_from_hostname(self, zone_obj, hostname):
|
|
|
f17082 |
|
|
|
f17082 |
for rrset in rrsets:
|
|
|
f17082 |
for rd in rrset:
|
|
|
f17082 |
+ logger.debug("Adding CA IP %s for %s", rd.to_text(), hostname)
|
|
|
f17082 |
rdataset = zone_obj.get_rdataset(
|
|
|
f17082 |
r_name, rd.rdtype, create=True)
|
|
|
f17082 |
rdataset.add(rd, ttl=self.TTL)
|
|
|
f17082 |
@@ -461,6 +463,14 @@ def update_base_records(self):
|
|
|
f17082 |
)
|
|
|
f17082 |
)
|
|
|
f17082 |
|
|
|
f17082 |
+ # Remove the ipa-ca record(s). They will be reconstructed in
|
|
|
f17082 |
+ # get_base_records().
|
|
|
f17082 |
+ r_name = DNSName(IPA_CA_RECORD) + self.domain_abs
|
|
|
f17082 |
+ try:
|
|
|
f17082 |
+ self.api_instance.Command.dnsrecord_del(
|
|
|
f17082 |
+ self.domain_abs, r_name, del_all=True)
|
|
|
f17082 |
+ except errors.NotFound:
|
|
|
f17082 |
+ pass
|
|
|
f17082 |
base_zone = self.get_base_records()
|
|
|
f17082 |
for record_name, node in base_zone.items():
|
|
|
f17082 |
set_cname_template = record_name in names_requiring_cname_templates
|