Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-2189

The CRL can get corrupted if two workers revoke certs at same time

    XMLWordPrintable

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Duplicate
    • None
    • PUP 6.0.0
    • None
    • Major
    • 3 - 25-50% of Customers
    • 4 - Major
    • 4 - $$$$$
    • Faced by anyone with large scale decommissioning of nodes.

    Description

      The CRL file (and many other SSL related files) are missing locking, so concurrent access can lead to corruptions.

      In Scope

      • Confirm that PE in the Cloud etc will be leveraging puppet cert command line tools (as opposed to modifying CRL directly or revoking certs via server http api) confirmed
      • Investigate filesystem-based locking of CRL file in ruby puppet on update
      • Limited to updates to CRL via the puppet cert CLI

      Out of Scope

      • Changes to puppet server CRL handling / API - PUP-7991

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. PUP-3703 puppca appears to have a race condition on the ca_crl.pem creation with many parallel revocations

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. SERVER-115 Concurrent access to the CRL can corrupt it

          • Major - Major loss of function.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. PUP-1627 Puppet agent's locking is subject to race conditions

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Task - A task that needs to be done. SERVER-1999 Investigate puppet server CRL handling for atomicity

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed
          mentioned in

          Page Loading...

          Page Loading...

          Page Loading...

          Page Loading...

          Activity

            People

              eric.sorenson Eric Sorenson
              dalen Erik Dalén
              Votes:
              3 Vote for this issue
              Watchers:
              23 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Zendesk Support