freeipa

#9920 Failure to sign DNS zone with softhsm 2.7.0 rc1
Opened by frenaud. Modified

Open
Close Issue

Issue

Our upstream nightly tests detected a regression in rawhide (f44) when creating a DNS zone with DNSSEC enabled. The tool dnssec-keyfromlabel creates a coredump.

Steps to Reproduce

  1. Install freeipa server in rawhide: ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --forwarder 10.11.5.160 -a Secret123 -p Secret123 -U
  2. Set the machine as DNSSEC master: ipa-dns-install --dnssec-master --forwarder 10.11.5.160 -U
  3. Add a zone with DNSSEC enabled: kinit admin; ipa dnszone-add dnssec.test --skip-overlap-check --dnssec true --ttl 1 --default-ttl 1

Actual behavior

The command ipa dnszone-add succeeds but the new zone is not signed.
In the journal, we see the following:

Jan 19 09:39:27 server.ipa.test systemd-coredump[15003]: [🡕] Process 15001 (dnssec-keyfroml) of user 988 dumped core.
                                                         Module /usr/bin/dnssec-keyfromlabel from rpm bind-9.18.43-1.fc44.x86_64
                                                         Module libsqlite3.so.0 from rpm sqlite-3.51.0-1.fc44.x86_64
                                                         Module libsofthsm2.so from rpm softhsm-2.7.0-0.1.rc1.fc44.x86_64
                                                         Module pkcs11.so from rpm pkcs11-provider-1.1-1.fc44.x86_64
                                                         Module libpcre2-8.so.0 from rpm pcre2-10.47-1.fc44.x86_64
                                                         Module libselinux.so.1 from rpm libselinux-3.9-6.fc44.x86_64
                                                         Module libkeyutils.so.1 from rpm keyutils-1.6.3-6.fc43.x86_64
                                                         Module libkrb5support.so.0 from rpm krb5-1.21.3-11.fc44.x86_64
                                                         Module liblzma.so.5 from rpm xz-5.8.2-1.fc44.x86_64
                                                         Module liblmdb.so.0.0.0 from rpm lmdb-0.9.33-4.fc43.x86_64
                                                         Module libprotobuf-c.so.1 from rpm protobuf-c-1.5.2-1.fc44.x86_64
                                                         Module libfstrm.so.0 from rpm fstrm-0.6.1-13.fc43.x86_64
                                                         Module libmaxminddb.so.0 from rpm libmaxminddb-1.12.2-4.fc43.x86_64
                                                         Module libcom_err.so.2 from rpm e2fsprogs-1.47.3-3.fc44.x86_64
                                                         Module libk5crypto.so.3 from rpm krb5-1.21.3-11.fc44.x86_64
                                                         Module libkrb5.so.3 from rpm krb5-1.21.3-11.fc44.x86_64
                                                         Module libgssapi_krb5.so.2 from rpm krb5-1.21.3-11.fc44.x86_64
                                                         Module libxml2.so.2 from rpm libxml2-2.12.10-5.fc44.x86_64
                                                         Module libnghttp2.so.14 from rpm nghttp2-1.68.0-2.fc44.x86_64
                                                         Module libjson-c.so.5 from rpm json-c-0.18-7.fc43.x86_64
                                                         Module libz.so.1 from rpm zlib-ng-2.3.2-2.fc44.x86_64
                                                         Module libcrypto.so.3 from rpm openssl-3.5.4-1.fc44.x86_64
                                                         Module libssl.so.3 from rpm openssl-3.5.4-1.fc44.x86_64
                                                         Module libuv.so.1 from rpm libuv-1.51.0-2.fc43.x86_64
                                                         Module libdns-9.18.43.so from rpm bind-9.18.43-1.fc44.x86_64
                                                         Module libisc-9.18.43.so from rpm bind-9.18.43-1.fc44.x86_64
                                                         Stack trace of thread 15001:
                                                         #0  0x00007f93ee600f44 _ZN13HandleManager10getSessionEm (libsofthsm2.so + 0x8df44)
                                                         #1  0x00007f93ee5a7d24 _ZN7SoftHSM14C_CloseSessionEm (libsofthsm2.so + 0x34d24)
                                                         #2  0x00007f93ee5865a0 C_CloseSession (libsofthsm2.so + 0x135a0)
                                                         #3  0x00007f93ee671142 p11prov_CloseSession.isra.0 (pkcs11.so + 0x16142)
                                                         #4  0x00007f93ee68aa7b token_session_close.part.0 (pkcs11.so + 0x2fa7b)
                                                         #5  0x00007f93ee6906f3 session_free.lto_priv.0 (pkcs11.so + 0x356f3)
                                                         #6  0x00007f93ee6a232d p11prov_free_slots.part.0 (pkcs11.so + 0x4732d)
                                                         #7  0x00007f93ee683127 p11prov_ctx_free.lto_priv.0 (pkcs11.so + 0x28127)
                                                         #8  0x00007f93eeb51e6b ossl_provider_free.part.0 (libcrypto.so.3 + 0x151e6b)
                                                         #9  0x00007f93eeba5621 OPENSSL_sk_pop_free (libcrypto.so.3 + 0x1a5621)
                                                         #10 0x00007f93eeb51cbd ossl_provider_store_free.part.0 (libcrypto.so.3 + 0x151cbd)
                                                         #11 0x00007f93eeb3414b context_deinit_objs (libcrypto.so.3 + 0x13414b)
                                                         #12 0x00007f93eeb356b2 context_deinit.part.0.lto_priv.0 (libcrypto.so.3 + 0x1356b2)
                                                         #13 0x00007f93eeb3f7bc OPENSSL_cleanup (libcrypto.so.3 + 0x13f7bc)
                                                         #14 0x00007f93ef7590ab tls_shutdown (libisc-9.18.43.so + 0x490ab)
                                                         #15 0x00007f93ef27dabc __pthread_once_slow.isra.0 (libc.so.6 + 0x78abc)
                                                         #16 0x00007f93ef27db39 pthread_once@GLIBC_2.2.5 (libc.so.6 + 0x78b39)
                                                         #17 0x00007f93ef75681b isc__tls_shutdown (libisc-9.18.43.so + 0x4681b)
                                                         #18 0x00007f93ef7179f2 isc__shutdown (libisc-9.18.43.so + 0x79f2)
                                                         #19 0x00007f93ef7c32d2 _dl_call_fini (/usr/lib64/ld-linux-x86-64.so.2 + 0x12d2)
                                                         #20 0x00007f93ef7c732e _dl_fini (/usr/lib64/ld-linux-x86-64.so.2 + 0x532e)
                                                         #21 0x00007f93ef221c21 __run_exit_handlers (libc.so.6 + 0x1cc21)
                                                         #22 0x00007f93ef221cfe exit (libc.so.6 + 0x1ccfe)
                                                         #23 0x00007f93ef208688 __libc_start_call_main (libc.so.6 + 0x3688)
                                                         #24 0x00007f93ef208798 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x3798)
                                                         #25 0x0000563f4c642b65 _start (/usr/bin/dnssec-keyfromlabel + 0x2b65)
                                                         ELF object binary architecture: AMD x86-64
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]: Traceback (most recent call last):
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:   File "/usr/libexec/ipa/ipa-dnskeysyncd", line 130, in <module>
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     while ldap_connection.syncrepl_poll(all=1, msgid=ldap_search):
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:   File "/usr/lib64/python3.14/site-packages/ldap/syncrepl.py", line 465, in syncrepl_poll
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     self.syncrepl_refreshdone()
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     ~~~~~~~~~~~~~~~~~~~~~~~~~^^
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:   File "/usr/lib/python3.14/site-packages/ipaserver/dnssec/keysyncer.py", line 128, in syncrepl_refreshdone
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     self.bindmgr.sync(self.dnssec_zones)
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:   File "/usr/lib/python3.14/site-packages/ipaserver/dnssec/bindmgr.py", line 241, in sync
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     self.sync_zone(zone)
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     ~~~~~~~~~~~~~~^^^^^^
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:   File "/usr/lib/python3.14/site-packages/ipaserver/dnssec/bindmgr.py", line 214, in sync_zone
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     self.install_key(zone, uuid, attrs, tempdir)
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:   File "/usr/lib/python3.14/site-packages/ipaserver/dnssec/bindmgr.py", line 155, in install_key
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     result = ipautil.run(cmd, capture_output=True)
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:   File "/usr/lib/python3.14/site-packages/ipapython/ipautil.py", line 607, in run
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     raise CalledProcessError(
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:         p.returncode, arg_string, output_log, error_log
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]:     )
Jan 19 09:39:27 server.ipa.test ipa-dnskeysyncd[14986]: ipapython.ipautil.CalledProcessError: CalledProcessError(Command ['/usr/sbin/dnssec-keyfromlabel', '-K', '/var/named/dyndb-ldap/ipa/master/dnssec.test/tmpjwobl6fy', '-a', 'RSASHA256', '-l', 'pkcs11:object=d942d8f406b63930359d265861f274d4;token=ipaDNSSEC', '-P', '20260119134733', '-A', '20260119134733', '-I', 'none', '-D', 'none', '-f', 'KSK', 'dnssec.test.'] returned non-zero exit status -11: '')

Expected behavior

The zone should be signed.

Version/Release/Distribution

# rpm -qa freeipa-server softhsm bind bind-dyndb-ldap
softhsm-2.7.0-0.1.rc1.fc44.x86_64
bind-9.18.43-1.fc44.x86_64
bind-dyndb-ldap-11.11-9.fc44.x86_64
freeipa-server-4.13.1-1.fc44.x86_64

gdb stack:

(gdb) where
#0  HandleManager::getSession (this=0x0, hSession=hSession@entry=2) at HandleManager.cpp:75
#1  0x00007f195833ad24 in SoftHSM::C_CloseSession (this=0x564d6d862710, hSession=hSession@entry=2) at SoftHSM.cpp:1451
#2  0x00007f19583195a0 in C_CloseSession (hSession=2) at main.cpp:332
#3  0x00007f1958404142 in p11prov_CloseSession.isra.0 (ctx=<optimized out>, hSession=<optimized out>) at ../src/interface.gen.c:331
#4  0x00007f195841da7b in token_session_close (session=session@entry=0x564d6d8d7860) at ../src/session.c:110
#5  0x00007f19584236f3 in token_session_close (session=0x564d6d8d7860) at ../src/session.c:108
#6  session_free (session=0x564d6d8d7860) at ../src/session.c:386
#7  session_free (session=0x564d6d8d7860) at ../src/session.c:357
#8  0x00007f195843532d in p11prov_session_pool_free (pool=0x564d6d89c6c0) at ../src/session.c:170
#9  p11prov_session_pool_free (pool=0x564d6d89c6c0) at ../src/session.c:159
#10 p11prov_free_slots (sctx=0x564d6d89b7a0) at ../src/slot.c:354
#11 0x00007f1958416127 in p11prov_free_slots (sctx=<optimized out>) at ../src/slot.c:342
#12 p11prov_ctx_free (ctx=0x564d6d812fd0) at ../src/provider.c:559
#13 0x00007f1958951e6b in ossl_provider_teardown (prov=0x564d6d812940) at crypto/provider_core.c:1751
#14 ossl_provider_free (prov=0x564d6d812940) at crypto/provider_core.c:743
#15 0x00007f19589a5621 in OPENSSL_sk_pop_free (st=<optimized out>, func=<optimized out>) at crypto/stack/stack.c:439
#16 OPENSSL_sk_pop_free (st=0x564d6d7faa10, func=0x7f195894a8f0 <provider_deactivate_free>) at crypto/stack/stack.c:431
#17 0x00007f1958951cbd in sk_OSSL_PROVIDER_pop_free (sk=<optimized out>, freefunc=<optimized out>) at crypto/provider_core.c:200
#18 ossl_provider_store_free (vstore=0x564d6d7fa9b0) at crypto/provider_core.c:296
#19 0x00007f195893414b in ossl_provider_store_free (vstore=<optimized out>) at crypto/provider_core.c:292
#20 context_deinit_objs (ctx=ctx@entry=0x7f1958d3caa0 <default_context_int.lto_priv>) at crypto/context.c:339
#21 0x00007f19589356b2 in context_deinit.part.0.lto_priv.0 (ctx=0x7f1958d3caa0 <default_context_int.lto_priv>) at crypto/context.c:436
#22 0x00007f195893f7bc in context_deinit (ctx=<optimized out>) at crypto/context.c:431
#23 ossl_lib_ctx_default_deinit () at crypto/context.c:477
#24 ossl_lib_ctx_default_deinit () at crypto/context.c:473
#25 OPENSSL_cleanup () at crypto/init.c:464
#26 OPENSSL_cleanup () at crypto/init.c:377
#27 0x00007f19594ed0ab in tls_shutdown () at ../../../lib/isc/tls.c:146
#28 0x00007f195907dabc in __pthread_once_slow (once_control=0x7f1959540548 <shut_once>, init_routine=0x7f19594ed070 <tls_shutdown>)
    at pthread_once.c:116
#29 0x00007f195907db39 in ___pthread_once (once_control=once_control@entry=0x7f1959540548 <shut_once>, 
    init_routine=init_routine@entry=0x7f19594ed070 <tls_shutdown>) at pthread_once.c:143
#30 0x00007f19594ea81b in isc__tls_shutdown () at ../../../lib/isc/tls.c:173
#31 0x00007f19594ab9f2 in isc__shutdown () at ../../../lib/isc/lib.c:52
#32 0x00007f19595562d2 in _dl_call_fini (closure_map=closure_map@entry=0x7f195954b0c0) at dl-call_fini.c:43
#33 0x00007f195955a32e in _dl_fini () at dl-fini.c:120
#34 0x00007f1959021c21 in __run_exit_handlers (status=0, listp=0x7f19591f6680 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, 
    run_dtors=run_dtors@entry=true) at exit.c:118
#35 0x00007f1959021cfe in __GI_exit (status=<optimized out>) at exit.c:148
#36 0x00007f1959008688 in __libc_start_call_main (main=main@entry=0x564d50f34cb0 <main>, argc=argc@entry=18, argv=argv@entry=0x7ffce4ca8fc8)
    at ../sysdeps/nptl/libc_start_call_main.h:83
#37 0x00007f1959008798 in __libc_start_main_impl (main=0x564d50f34cb0 <main>, argc=18, argv=0x7ffce4ca8fc8, init=<optimized out>, 
    fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffce4ca8fb8) at ../csu/libc-start.c:360
#38 0x0000564d50f36b65 in _start ()

Logs can be found in https://$ARTIFACTS_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-rawhide/master/2026-01-17_19-30/rawhide/test_dnssec/2/report.html?sort=result

The following tests are broken due to this issue:
- test_integration/test_dnssec.py
- test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithDNSSEC
- test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithDNSSEC

Metadata Update from @frenaud:
- Issue tagged with: test-failure

Companion issue opened against softhsm in rawhide: https://bugzilla.redhat.com/show_bug.cgi?id=2430851

The experimental patch we had in Fedora wasn't merged upstream. I restored it for final 2.7.0 release build but it breaks almost all tests now. Back to drawing table...
Metadata
None

test-failure

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.