From faa122a8b8fc9a6850811ed1466166a7bff13be3 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Thu, 13 Dec 2018 14:54:07 +0100 Subject: [PATCH] replication: check remote ds version before editing attributes When the remote server has an old DS version, update of the replication attributes nsds5ReplicaReleaseTimeout nsds5ReplicaBackoffMax and nsDS5ReplicaBindDnGroupCheckInterval fails even if the remote schema has been updated. Check first the remote server version and update the attributes only if the version is high enough. A previous fix was already performing this check (commit 02f4a7a), but not in all the cases. This fix also handles when the remote server already has a cn=replica entry (for instance because it has already established replication with another host). Fixes https://pagure.io/freeipa/issue/7796 Reviewed-By: Christian Heimes --- ipaserver/install/replication.py | 33 ++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/ipaserver/install/replication.py b/ipaserver/install/replication.py index d25b9372c..ae1c279b4 100644 --- a/ipaserver/install/replication.py +++ b/ipaserver/install/replication.py @@ -215,6 +215,22 @@ def wait_for_entry(connection, dn, timeout, attr=None, attrvalue='*', time.sleep(1) +def get_ds_version(conn): + """Returns the DS version + + Retrieves the DS version from the vendorVersion attribute stored in LDAP. + :param conn: LDAP connection established and authenticated to the server + for which we need the version + :return: a tuple containing the DS version + """ + # Find which 389-ds is installed + rootdse = conn.get_entry(DN(''), ['vendorVersion']) + version = rootdse.single_value.get('vendorVersion') + mo = re.search(r'(\d+)\.(\d+)\.(\d+)[\.\d]*', version) + vendor_version = tuple(int(v) for v in mo.groups()) + return vendor_version + + class ReplicationManager: """Manage replication agreements @@ -527,8 +543,16 @@ class ReplicationManager: # Add the new replication manager binddns.append(replica_binddn) - for key, value in REPLICA_CREATION_SETTINGS.items(): - entry[key] = value + # If the remote server has 389-ds < 1.3, it does not + # support the attributes we are trying to set. + # Find which 389-ds is installed + vendor_version = get_ds_version(conn) + if vendor_version >= (1, 3, 0): + for key, value in REPLICA_CREATION_SETTINGS.items(): + entry[key] = value + else: + logger.debug("replication attributes not supported " + "on remote master, skipping update.") try: conn.update_entry(entry) @@ -604,10 +628,7 @@ class ReplicationManager: # If the remote server has 389-ds < 1.3, it does not # support the attributes we are trying to set. # Find which 389-ds is installed - rootdse = r_conn.get_entry(DN(''), ['vendorVersion']) - version = rootdse.single_value.get('vendorVersion') - mo = re.search(r'(\d+)\.(\d+)\.(\d+)[\.\d]*', version) - vendor_version = tuple(int(v) for v in mo.groups()) + vendor_version = get_ds_version(r_conn) if vendor_version >= (1, 3, 0): # 389-ds understands the replication attributes, # we can safely modify them