Bug 1258944 - DNSSEC daemons may deadlock when processing more than 1 zone
DNSSEC daemons may deadlock when processing more than 1 zone
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
7.2
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: IPA Maintainers
Namita Soman
: TestBlocker
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-01 10:43 EDT by Petr Vobornik
Modified: 2015-11-19 07:06 EST (History)
4 users (show)

See Also:
Fixed In Version: ipa-4.2.0-9.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-19 07:06:14 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Petr Vobornik 2015-09-01 10:43:44 EDT
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5273

ods-enforcerd is holding kasp.db.our_lock when processing all zones and the lock is unlocked only after all calls to ods-signer are finished, i.e. when ods-enforcerd receives reply from each ods-signer calls.

Consequently, ipa-ods-exporter (ods-signerd implementation) must not request kasp.db.our_lock to prevent deadlocks. SQLite transaction isolation should suffice. I hope.
Comment 5 Kaleem 2015-09-15 07:08:06 EDT
How to verify this? SanityOnly?
Comment 7 Martin Bašti 2015-09-28 07:27:30 EDT
This can be verified with upstream DNSSEC CItest
Comment 8 Kaleem 2015-10-15 05:06:00 EDT
Verified.

CI tests in beaker passing..

snip from beaker log:
=====================

-----------------------------[RPMs & OS: [RHEL-7.2-20151014.n.0 - x86_64]-----------------------------+
|       ipa-admintools-4.2.0-15.el7.x86_64
|       ipa-client-4.2.0-15.el7.x86_64
|       ipa-server-4.2.0-15.el7.x86_64
|       ipa-server-dns-4.2.0-15.el7.x86_64
|       ipa-tests-ipa-server-rhel72-ipa-integration-testing-ksiddiqu-20151014230104-0.noarch
|       ipa-tests-ipa-server-rhel72-shared-20150930150523-0.noarch
|       sssd-ipa-1.13.0-40.el7.x86_64
------------------------------------------------------------------------------------------

 +-----------------------------------------------------------------------------------------+
     Test:[/ipa-server/rhel72/ipa-integration-testing/root]: [ Pass(12/12): 100% ] 
 +-----------------------------------------------------------------------------------------+
:: [   PASS   ]   ipa-integration-testing-startup: installing ipa-tests and other required packages
:: [   PASS   ]   ipa-integration-testing-master: test_dnssec_py
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_install_dnssec_master
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_if_zone_is_signed_master
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_if_zone_is_signed_replica
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_disable_reenable_signing_master
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECLast-test_disable_reenable_signing_replica
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECFirst-test_sign_root_zone
:: [   PASS   ]   test_integration-test_dnssec-TestInstallDNSSECFirst-test_chain_of_trust
:: [   PASS   ]   test_integration-test_dnssec-TestMigrateDNSSECMaster-test_migrate_dnssec_master
:: [   PASS   ]   ipa-integration-testing-cleanup: Destroying admin credentials.
:: [   PASS   ]   /ipa-server/rhel72/ipa-integration-testing/root

 +----------------------------------------------------------------------+
                    Fail / unfinished / ABORT [ Fail(0/12): 0% ]
 +----------------------------------------------------------------------+
Comment 9 errata-xmlrpc 2015-11-19 07:06:14 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html

Note You need to log in before you can comment on or make changes to this bug.