>From 0bb210bc1edd72c9b94f3b88723967cf410b6b9e Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Sun, 6 Jul 2014 22:53:27 +0200 Subject: [PATCH] DYNDNS: Add a new option dyndns_server Some environments use a different DNS server than identity server. For these environments, it would be useful to be able to override the DNS server used to perform DNS updates. This patch adds a new option dyndns_server that, if set, would be used to hardcode a DNS server address into the nsupdate message. --- src/config/SSSDConfig/__init__.py.in | 1 + src/config/SSSDConfigTest.py | 2 ++ src/config/etc/sssd.api.conf | 1 + src/man/sssd-ad.5.xml | 20 ++++++++++++++++++++ src/man/sssd-ipa.5.xml | 19 +++++++++++++++++++ src/providers/ad/ad_opts.h | 1 + src/providers/dp_dyndns.c | 1 + src/providers/dp_dyndns.h | 1 + src/providers/ipa/ipa_opts.h | 1 + src/providers/ldap/sdap_dyndns.c | 7 +++++++ 10 files changed, 54 insertions(+) diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in index d9b186f73220363f429b51260e6b83bd00a9cdb6..79fa892592e9c1cb9cef36d93e40b1991343b4cc 100644 --- a/src/config/SSSDConfig/__init__.py.in +++ b/src/config/SSSDConfig/__init__.py.in @@ -138,6 +138,7 @@ option_strings = { 'dyndns_update_ptr' : _("Whether the provider should explicitly update the PTR record as well"), 'dyndns_force_tcp' : _("Whether the nsupdate utility should default to using TCP"), 'dyndns_auth' : _("What kind of authentication should be used to perform the DNS update"), + 'dyndns_server' : _("Override the DNS server used to perform the DNS update"), 'subdomain_enumerate' : _('Control enumeration of trusted domains'), 'subdomain_refresh_interval' : _('How often should subdomains list be refreshed'), diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py index 14500031beca7b621eb6a77011e1a48fa22c2f9a..2e7c84496c61c382e67ac2b3e38cf36c69cd112b 100755 --- a/src/config/SSSDConfigTest.py +++ b/src/config/SSSDConfigTest.py @@ -517,6 +517,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): 'dyndns_update_ptr', 'dyndns_force_tcp', 'dyndns_auth', + 'dyndns_server', 'subdomain_enumerate', 'override_gid', 'case_sensitive', @@ -875,6 +876,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): 'dyndns_update_ptr', 'dyndns_force_tcp', 'dyndns_auth', + 'dyndns_server', 'subdomain_enumerate', 'override_gid', 'case_sensitive', diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf index 5e5a9284e9ad80d822fe1db4269353aeb7925682..52de1bd975833c3d055bb70faaf7eb722adbaba3 100644 --- a/src/config/etc/sssd.api.conf +++ b/src/config/etc/sssd.api.conf @@ -143,6 +143,7 @@ dyndns_refresh_interval = int, None, false dyndns_update_ptr = bool, None, false dyndns_force_tcp = bool, None, false dyndns_auth = str, None, false +dyndns_server = str, None, false # Special providers [provider/permit] diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml index 9070144ce4f478d20e93c8b7a4f732b56de98836..0526da3f9da51b75e1278fe13db85682facafe5e 100644 --- a/src/man/sssd-ad.5.xml +++ b/src/man/sssd-ad.5.xml @@ -412,6 +412,26 @@ FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com) + + dyndns_server (string) + + + The DNS server to use when performing a DNS + update. In most setups, it's recommended to leave + this option unset. + + + Setting this option makes sense for environments + where the DNS server is different from the identity + server. + + + Default: None (let nsupdate choose the server) + + + + + diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml index dfcc595deda736fd039cd60448f55256d765d39d..858cc4f27465c97a45a1ed1de3719ea88ea8af34 100644 --- a/src/man/sssd-ipa.5.xml +++ b/src/man/sssd-ipa.5.xml @@ -257,6 +257,25 @@ + dyndns_server (string) + + + The DNS server to use when performing a DNS + update. In most setups, it's recommended to leave + this option unset. + + + Setting this option makes sense for environments + where the DNS server is different from the identity + server. + + + Default: None (let nsupdate choose the server) + + + + + ipa_hbac_search_base (string) diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h index b80aaddf29b7fb236d89bfb4e148bba7aeeecd14..3a2ce790714c90a340379e3d1b1e866b27dfedec 100644 --- a/src/providers/ad/ad_opts.h +++ b/src/providers/ad/ad_opts.h @@ -259,6 +259,7 @@ struct dp_option ad_dyndns_opts[] = { { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE }, { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING }, + { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING }, DP_OPTION_TERMINATOR }; diff --git a/src/providers/dp_dyndns.c b/src/providers/dp_dyndns.c index a12560ecd6b8d01a463962d08994bf215d0cd5cc..9e6e02d897fc027d4531ddba1cbc9bcf6efe62a4 100644 --- a/src/providers/dp_dyndns.c +++ b/src/providers/dp_dyndns.c @@ -1142,6 +1142,7 @@ static struct dp_option default_dyndns_opts[] = { { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_FALSE }, { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING }, + { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING }, DP_OPTION_TERMINATOR }; diff --git a/src/providers/dp_dyndns.h b/src/providers/dp_dyndns.h index 1e81c9b91df9f6cbc03b261341aa79c03b6372f1..ba296b17abddb2553e7fc8c1454c7a060cbcf586 100644 --- a/src/providers/dp_dyndns.h +++ b/src/providers/dp_dyndns.h @@ -55,6 +55,7 @@ enum dp_dyndns_opts { DP_OPT_DYNDNS_UPDATE_PTR, DP_OPT_DYNDNS_FORCE_TCP, DP_OPT_DYNDNS_AUTH, + DP_OPT_DYNDNS_SERVER, DP_OPT_DYNDNS /* attrs counter */ }; diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h index d7c2b189fad57cb60c29b56c5e351a46070349e2..b56b477dd0f6f8d2f524084b11673eaebeb8131b 100644 --- a/src/providers/ipa/ipa_opts.h +++ b/src/providers/ipa/ipa_opts.h @@ -61,6 +61,7 @@ struct dp_option ipa_dyndns_opts[] = { { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING }, + { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING }, DP_OPTION_TERMINATOR }; diff --git a/src/providers/ldap/sdap_dyndns.c b/src/providers/ldap/sdap_dyndns.c index 1c5611b048142d8514cd130a5c8b93ad210ea69a..cb4e9242fb5efcc428de4a998844c513aa806ac8 100644 --- a/src/providers/ldap/sdap_dyndns.c +++ b/src/providers/ldap/sdap_dyndns.c @@ -91,6 +91,7 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx, struct tevent_req *req; struct tevent_req *subreq; struct sdap_dyndns_update_state *state; + const char *conf_servername; req = tevent_req_create(mem_ctx, &state, struct sdap_dyndns_update_state); if (req == NULL) { @@ -109,6 +110,12 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx, state->opts = opts; state->auth_type = auth_type; + conf_servername = dp_opt_get_string(opts, DP_OPT_DYNDNS_SERVER); + if (conf_servername != NULL) { + state->servername = conf_servername; + state->use_server_with_nsupdate = true; + } + if (ifname) { /* Unless one family is restricted, just replace all * address families during the update -- 1.9.3