Bug 1014729 - [RFE] realm discovers only the first three IP addresses
[RFE] realm discovers only the first three IP addresses
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: realmd (Show other bugs)
7.0
Unspecified Unspecified
low Severity low
: rc
: ---
Assigned To: Stef Walter
Patrik Kis
: FutureFeature
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-10-02 11:46 EDT by Patrik Kis
Modified: 2015-07-14 14:37 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-07-14 14:37:54 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Patrik Kis 2013-10-02 11:46:37 EDT
Description of problem:
When an AD (probably IPA too) has more IP addresses (typically IPv6) it seems only the first three are discovered.
Is this any reason for this limitation?

Version-Release number of selected component (if applicable):
realmd-0.14.6-1.el7

How reproducible:
always

Steps to Reproduce:
Block IPv6 traffic:
# ip6tables -A INPUT -j REJECT
# ip6tables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     all      anywhere             anywhere             reject-with icmp6-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
#
# realm -v discover ad.baseos.qe 
 * Resolving: _ldap._tcp.ad.baseos.qe
 * Performing LDAP DSE lookup on: 2001:db8:ee8c:180:1dfe:a8ea:f0d8:380c
 * Performing LDAP DSE lookup on: 2620:52:0:2223::1:1
 * Performing LDAP DSE lookup on: 2620:52:0:2223:1dfe:a8ea:f0d8:380c
 ! Discovery timed out after 15 seconds
ad.baseos.qe
  type: kerberos
  realm-name: AD.BASEOS.QE
  domain-name: ad.baseos.qe
  configured: no
# host ad.baseos.qe 
ad.baseos.qe has address 10.34.37.22
ad.baseos.qe has IPv6 address 2001:db8:ee8c:180:1dfe:a8ea:f0d8:380c
ad.baseos.qe has IPv6 address 2620:52:0:2223::1:1
#
# ip6tables -F
# realm -v discover ad.baseos.qe 
 * Resolving: _ldap._tcp.ad.baseos.qe
 * Performing LDAP DSE lookup on: 2001:db8:ee8c:180:1dfe:a8ea:f0d8:380c
 * Performing LDAP DSE lookup on: 2620:52:0:2223::1:1
 * Performing LDAP DSE lookup on: 2620:52:0:2223:1dfe:a8ea:f0d8:380c
 ! Can't contact LDAP server
 * Performing LDAP DSE lookup on: 10.34.37.22
 * Successfully discovered: ad.baseos.qe
ad.baseos.qe
  type: kerberos
  realm-name: AD.BASEOS.QE
  domain-name: ad.baseos.qe
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common

Then deleted the address "2001:db8:ee8c:180:1dfe:a8ea:f0d8:380c" from DNS of AD:

# ip6tables -A INPUT -j REJECT
# realm -v discover ad.baseos.qe 
 * Resolving: _ldap._tcp.ad.baseos.qe
 * Performing LDAP DSE lookup on: 2620:52:0:2223::1:1
 * Performing LDAP DSE lookup on: 2620:52:0:2223:1dfe:a8ea:f0d8:380c
 * Performing LDAP DSE lookup on: 10.34.37.22
 * Successfully discovered: ad.baseos.qe
ad.baseos.qe
  type: kerberos
  realm-name: AD.BASEOS.QE
  domain-name: ad.baseos.qe
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common
Comment 1 Stef Walter 2013-10-03 03:34:09 EDT
Discovering and contacting all DC addresses for a large domain is a potentially nearly unbounded operation. We have to stop somewhere, so we chose to contact 3 addresses.

Please reopen if this is an actual problem. Do you have a use case this breaks?Otherwise this is NOTABUG.
Comment 2 Patrik Kis 2013-10-03 11:06:27 EDT
Well, there isn't a real use case I'm just trying to test a scenario where the IPv6 network is down between the host and server. And wen there are 3 IPv6 addresses realm newer tries IPv4, the only one that actually works.
I can fix it by removing one IPv6 address, so not a big deal. I just wanted to see if this is by purpose.
Comment 3 Patrik Kis 2013-10-04 10:13:44 EDT
I did some research how exactly it works and it looks like this:

realmd tries to connect to remote ldap with the first 3 addresses and where no response is returned withing 15 sec. it quits with no result.
If and error (e.g. icmp net unreachable) is returned from one of the addresses the next address from the pool is picked and that is tried and so on. All this within  the first 15 seconds.

This mechanisms seems to be ok, when errors are returned, but IMHO it could be more robust when no error is returned. For example try more (all) addresses (maybe not at once but e.g. 3 every 1 second) until one is answered. And timeout after 15 secs as it is. But this is really a marginal case, so feel free to close it as not a bug (and definitely we shouldn't bother with it in RHEL-7.0).
Comment 4 Stef Walter 2013-10-07 07:11:20 EDT
Makes sense.
Comment 8 Stef Walter 2015-07-14 13:25:46 EDT
This does not have a solid real world use case. I'm not against someone providing and including a patch for this, but I'm unable to spend time fixing what seems like an extreme edge case.
Comment 9 RHEL Product and Program Management 2015-07-14 14:37:54 EDT
Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.

Note You need to log in before you can comment on or make changes to this bug.