openstack/barbican
Code Issues Proposed changes

Address race condition in KEKDatum

Browse Source 
Change-Id: I7b2f088c8cb9f74507313072d901bcedea18fc34
Fixes-Bug: 1726378
This commit is contained in:
Ade Lee 2019-01-24 00:31:14 -05:00
parent 2c9a4b33bc
commit 6061e88fc1
1 changed files with 25 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
barbican/model/repositories.py
View File

@ -993,18 +993,17 @@ class KEKDatumRepo(BaseRepo):
session = self.get_session(session)
# TODO(jfwood): Reverse this...attempt insert first, then get on fail.
try:
query = session.query(models.KEKDatum)
query = query.filter_by(project_id=project.id,
plugin_name=plugin_name,
active=True,
deleted=False)
query = session.query(models.KEKDatum)
query = query.filter_by(project_id=project.id,
plugin_name=plugin_name,
active=True,
deleted=False)
kek_datum = query.one()
query = query.order_by(models.KEKDatum.created_at)
except sa_orm.exc.NoResultFound:
kek_datums = query.all()
if not kek_datums:
kek_datum = models.KEKDatum()
kek_datum.kek_label = "project-{0}-key-{1}".format(
@ -1014,6 +1013,23 @@ class KEKDatumRepo(BaseRepo):
kek_datum.status = models.States.ACTIVE
self.save(kek_datum)
else:
kek_datum = kek_datums.pop()
# (alee) There should be only one active KEKDatum.
# Due to a race condition with many threads or
# many barbican processes, its possible to have
# multiple active KEKDatum. The code below makes
# all the extra KEKDatum inactive
# See LP#1726378
for kd in kek_datums:
LOG.debug(
"Multiple active KEKDatum found for %s."
"Setting %s to be inactive.",
project.external_id,
kd.kek_label)
kd.active = False
self.save(kd)
return kek_datum