CRLIssuingPoint: reinit from LDAP when re-enabled #138
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Clean up some obsolete comments and dead code.
For type safety, use an enum instead of int for expressing CRLIssuingPoint initialisation status.
Dogtag only reads from LDAP when it initializes the CRLIssuingPoint object. After the object is initizialized, the plugin never syncs back from LDAP. In the following scenario, this can cause the CRL number to jump back (a violation of RFC 5280; the CRL number must monotonically increase): - disabled MasterCRL on one server with OP_TYPE=OP_MODIFY&OP_SCOPE=crlIPs&id=MasterCRL&description=CRL&enable=false request to /ca/caadmin - enable MasterCRL on another PKI clone - reverse settings on both servers after some CRLs have been generated by the second server This patch resolves the issue by forcing the CRLIssuingPoint to read the CRL from LDAP each time its update thread (re)starts. Fixes: https://pagure.io/dogtagpki/issue/3085
edewata
approved these changes
Feb 1, 2019
There was a problem hiding this comment.
I'm not super familiar with this, but it LGTM. Feel free to push unless @jmagne has any other comments.
Please note that 10.6 has branched and master is now 10.7. If this needs to go to 10.6 feel free to cherry pick it to that branch.
|
There were no further comments so I'll merge this. I'm only merging to master. If backport is needed later it will be straightforward. |
This was referenced Oct 1, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Dogtag only reads from LDAP when it initializes the CRLIssuingPoint object.
After the object is initizialized, the plugin never syncs back from LDAP.
In the following scenario, this can cause the CRL number to jump back (a
violation of RFC 5280; the CRL number must monotonically increase):
enable MasterCRL on another PKI clone
reverse settings on both servers after some CRLs have been generated by the second server
This patch resolves the issue by forcing the CRLIssuingPoint to read the CRL
from LDAP each time its update thread (re)starts.
Fixes: https://pagure.io/dogtagpki/issue/3085
Related: https://pagure.io/freeipa/issue/7815
This PR also includes some minor cleanup and refactor commits.