On multiple occasions, IPA code doesn't correctly sort SRV records.
The entries are sorted by priority. However that is not sufficient. RFC requires that a client randomly distributes load between servers with same priority. This can be easily archived by using (answer.priority, random.random()) as sort key. In theory we also have to obey the weight, but in practice IPA doesn't use weight.
(answer.priority, random.random())
The code should also remove duplicated names from the result.
https://pagure.io/freeipa/blob/master/f/ipalib/rpc.py#_889
The SRV records are not sorted at all. The set() operation even discards the sort order from the resolver.
set()
There are more places that need additional attention.
IPA's SRV code has made some questionable decisions, too. For example it assumes that _ldap._tcp maps to port 389.
_ldap._tcp
I think this is a duplicate of https://pagure.io/freeipa/issue/5500
Yes, bug #5500 describes the same issue as get_url_list paragraph of this bug. The description isn't correct. The order isn't randomized. It's a fixed order that is influenced by hash randomization value in each server process. It's only enabled in Python 3 and only changes when the WSGI process is restarted.
(I'd rather close #5500 and keep this bug.)
Metadata Update from @fbarreto: - Issue priority set to: low - Issue set to the milestone: Future Releases - Issue tagged with: easyfix
Metadata Update from @cheimes: - Issue assigned to cheimes
Metadata Update from @cheimes: - Issue untagged with: easyfix - Issue priority set to: important (was: low) - Issue set to the milestone: FreeIPA 4.5.5 (was: Future Releases)
Metadata Update from @cheimes: - Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/2032
master:
ipa-4-6:
ipa-4-5:
Metadata Update from @tdudlak: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
Metadata Update from @pvoborni: - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1594142
Issue linked to bug 1594142
Login to comment on this ticket.