From 2c0a123e99d943f115cc726e391f5d79b5bfb70e Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Thu, 8 Jul 2021 09:49:53 +0200 Subject: [PATCH] Server install: do not use unchecked ip addr for ipa-ca record At the end of a server installation, the DNS records for ipa-ca.$DOMAIN are created/updated with the IP addresses of the new server. The current code resolves the IP addresses of the new server but doesn't check them. This can result in the addition of a link-local address to ipa-ca record. For each address, make sure that it's neither reserved nor a link-local address. Fixes: https://pagure.io/freeipa/issue/8810 Signed-off-by: Florence Blanc-Renaud Reviewed-By: Francois Cami --- ipaserver/install/installutils.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ipaserver/install/installutils.py b/ipaserver/install/installutils.py index 56b137476..f3c90bc28 100644 --- a/ipaserver/install/installutils.py +++ b/ipaserver/install/installutils.py @@ -491,6 +491,13 @@ def resolve_rrsets_nss(fqdn): ipv4 = [] ipv6 = [] for ip_address in ip_addresses: + # Skip reserved or link-local addresses + try: + ipautil.CheckedIPAddress(ip_address) + except ValueError as e: + logger.warning("Invalid IP address %s for %s: %s", + ip_address, fqdn, unicode(e)) + continue if ip_address.version == 4: ipv4.append(str(ip_address)) elif ip_address.version == 6: