Version

FreeIPA 4.12.2-24.el10 (AlmaLinux 10), also confirmed present in upstream master.

Description

ipa-ods-exporter enters an infinite crash loop after enabling DNSSEC
via ipa-dns-install --dnssec-master. The crash is caused by a bare
assert in localhsm.py:Key.__init__() that fails when SoftHSM
contains objects with zero-length CKA_ID.

Root cause

FreeIPA's DNSSEC setup creates ipaSecretKeyObject LDAP entries
(wrapped master key copies) without setting ipk11Id. When
ipa-dnskeysyncd syncs these to SoftHSM, the objects get empty
CKA_ID attributes. localhsm.py line 38 asserts
len(cka_id) != 0 and crashes the process.

The crash is in find_keys() → Key.__init__(), which means one
malformed key prevents enumeration of ALL keys in the token.

Traceback

File "/usr/libexec/ipa/ipa-ods-exporter", line 720
master2ldap_zone_keys_sync(ldapkeydb, localhsm)
File "/usr/libexec/ipa/ipa-ods-exporter", line 425
pubkeys_local = localhsm.zone_pubkeys
File "ipaserver/dnssec/localhsm.py", line 114, in find_keys
key = Key(self.p11, h)
File "ipaserver/dnssec/localhsm.py", line 38, in init
assert len(cka_id) != 0, 'ipk11id length should not be 0'
AssertionError: ipk11id length should not be 0

Steps to reproduce

1. Fresh FreeIPA install with DNS (3-replica topology)
2. ipa-dns-install --dnssec-master on the master
3. ipa-ods-exporter crash-loops immediately

Cleaning SoftHSM tokens and re-running --dnssec-master reproduces
the same crash — the bug is in the setup code path, not stale data.

Additional issues found

1. LocalHSM.__del__() crashes with AttributeError: 'LocalHSM' object has no attribute 'p11' when __init__ fails (e.g., missing
   SoftHSM token after cleanup).

2. The LDAP counterpart ldapkeydb.py:_get_key_dict() already handles
   missing ipk11Id gracefully with raise ValueError — but
   localhsm.py uses a bare assert for the equivalent check.

Prior reports

• freeipa-users mailing list (April 2024): identical crash on
  FreeIPA 4.10.2 / AlmaLinux 9.3, went unanswered.
• Pagure #8654: related but fixes missing master key, not empty CKA_ID.
• Pagure #9057: related crash after upgrade, different code path.

Proposed fix

PR forthcoming. The fix:
1. Replaces bare assert with _ipap11helper.NotFound exception
2. Adds try/except in find_keys() to log and skip malformed keys
3. Fixes __del__ AttributeError with hasattr guard