Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1258944

Summary:	DNSSEC daemons may deadlock when processing more than 1 zone
Product:	Red Hat Enterprise Linux 7	Reporter:	Petr Vobornik <pvoborni>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.2	CC:	ksiddiqu, mbasti, mkosek, rcritten
Target Milestone:	rc	Keywords:	TestBlocker
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.2.0-9.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-19 12:06:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Petr Vobornik 2015-09-01 14:43:44 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5273

ods-enforcerd is holding kasp.db.our_lock when processing all zones and the lock is unlocked only after all calls to ods-signer are finished, i.e. when ods-enforcerd receives reply from each ods-signer calls.

Consequently, ipa-ods-exporter (ods-signerd implementation) must not request kasp.db.our_lock to prevent deadlocks. SQLite transaction isolation should suffice. I hope.

Comment 2 Martin Bašti 2015-09-03 16:24:21 UTC

Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/b6435f2cc6fb803869776c57c7bc9b8ebffd92fd
https://fedorahosted.org/freeipa/changeset/e7a876d88a0ed07de69d9654ebdbf8ebb7bda364
https://fedorahosted.org/freeipa/changeset/f1436c4ed89e96312d65e648e0b4ee47fa3a21a4
https://fedorahosted.org/freeipa/changeset/d24db5d9215e45397942438cf77376e6f409a70d
https://fedorahosted.org/freeipa/changeset/025a9b16c8e223a6e752f84f7619cff57ab2549e
https://fedorahosted.org/freeipa/changeset/e84006117637832f63904edeb45b7296151be6ad
https://fedorahosted.org/freeipa/changeset/ecf796e9c021a3b06e670f0602e8a10dcfd6f1f1

ipa-4-2:
https://fedorahosted.org/freeipa/changeset/a007a15e2e3a9d0cc52ac802b6ade570bbbcc3aa
https://fedorahosted.org/freeipa/changeset/8767fff853a68389ed6786abf0b0eea3f4ef6764
https://fedorahosted.org/freeipa/changeset/f8c637d95dc27e0abcbadcbf663ec6e2a73dd121
https://fedorahosted.org/freeipa/changeset/87c494593eaf5eec55331ecb2e552cbb2205786f
https://fedorahosted.org/freeipa/changeset/e1101c22f6c4d4c8fbed7f1b229a32a1158ed0ec
https://fedorahosted.org/freeipa/changeset/73058caa625e5e966beff9122cf235cb45d6b0bc
https://fedorahosted.org/freeipa/changeset/5ad806ecf89f1aa4119398e65dff4e986b19b1a6

Comment 5 Kaleem 2015-09-15 11:08:06 UTC

How to verify this? SanityOnly?

Comment 7 Martin Bašti 2015-09-28 11:27:30 UTC

This can be verified with upstream DNSSEC CItest

Comment 8 Kaleem 2015-10-15 09:06:00 UTC

Verified.

CI tests in beaker passing..

snip from beaker log:
=====================

-----------------------------[RPMs & OS: [RHEL-7.2-20151014.n.0 - x86_64]-----------------------------+
|       ipa-admintools-4.2.0-15.el7.x86_64
|       ipa-client-4.2.0-15.el7.x86_64
|       ipa-server-4.2.0-15.el7.x86_64
|       ipa-server-dns-4.2.0-15.el7.x86_64
|       ipa-tests-ipa-server-rhel72-ipa-integration-testing-ksiddiqu-20151014230104-0.noarch
|       ipa-tests-ipa-server-rhel72-shared-20150930150523-0.noarch
|       sssd-ipa-1.13.0-40.el7.x86_64
------------------------------------------------------------------------------------------

 +-----------------------------------------------------------------------------------------+
     Test:[/ipa-server/rhel72/ipa-integration-testing/root]: [ Pass(12/12): 100% ] 
 +-----------------------------------------------------------------------------------------+
:: [   PASS   ]   ipa-integration-testing-startup: installing ipa-tests and other required packages
:: [   PASS   ]   ipa-integration-testing-master: test_dnssec_py
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_install_dnssec_master
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_if_zone_is_signed_master
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_if_zone_is_signed_replica
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_disable_reenable_signing_master
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_disable_reenable_signing_replica
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECFirst-test_sign_root_zone
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECFirst-test_chain_of_trust
:: [   PASS   ]   test_integration-test_dnssec-TestMigrateDNSSECMaster-test_migrate_dnssec_master
:: [   PASS   ]   ipa-integration-testing-cleanup: Destroying admin credentials.
:: [   PASS   ]   /ipa-server/rhel72/ipa-integration-testing/root

 +----------------------------------------------------------------------+
                    Fail / unfinished / ABORT [ Fail(0/12): 0% ]
 +----------------------------------------------------------------------+

Comment 9 errata-xmlrpc 2015-11-19 12:06:14 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html