[SSSD] [PATCH] Active Directory dynamic DNS updates
Jakub Hrozek
jhrozek at redhat.com
Wed Apr 17 19:04:43 UTC 2013
https://fedorahosted.org/sssd/ticket/1504
Implements dynamic DNS updates for the AD provider. By default, the
updates also update the reverse zone and run periodically every 24
hours.
-------------- next part --------------
>From 5306abceba7e6eed97763a0cd48bb886ff161835 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 16 Apr 2013 17:04:43 +0200
Subject: [PATCH] Active Directory dynamic DNS updates
https://fedorahosted.org/sssd/ticket/1504
Implements dynamic DNS updates for the AD provider. By default, the
updates also update the reverse zone and run periodically every 24
hours.
---
Makefile.am | 1 +
src/man/sssd-ad.5.xml | 90 ++++++++++++
src/providers/ad/ad_common.c | 18 +++
src/providers/ad/ad_common.h | 13 ++
src/providers/ad/ad_dyndns.c | 311 +++++++++++++++++++++++++++++++++++++++++
src/providers/ad/ad_init.c | 8 ++
src/providers/ad/ad_opts.h | 11 ++
src/tests/ipa_ldap_opt-tests.c | 6 +
8 files changed, 458 insertions(+)
create mode 100644 src/providers/ad/ad_dyndns.c
diff --git a/Makefile.am b/Makefile.am
index f57279d75f131995ab25d3257ca1dc88b13a4c42..9e7f081671dcc093ff67fda4904614a00533aad7 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1580,6 +1580,7 @@ libsss_ad_la_SOURCES = \
src/providers/ad/ad_common.c \
src/providers/ad/ad_common.h \
src/providers/ad/ad_init.c \
+ src/providers/ad/ad_dyndns.c \
src/providers/ad/ad_id.c \
src/providers/ad/ad_id.h \
src/providers/ad/ad_access.c \
diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index 6ab133d5204fb2adcb65bafb33e8242a5afcaa70..1e575309fe12b648c550fb830cf2156b80119f23 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -128,6 +128,96 @@ ldap_id_mapping = False
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>dyndns_update (boolean)</term>
+ <listitem>
+ <para>
+ Optional. This option tells SSSD to automatically
+ update the Active Directory DNS server with
+ the IP address of this client.
+ </para>
+ <para>
+ NOTE: On older systems (such as RHEL 5), for this
+ behavior to work reliably, the default Kerberos
+ realm must be set properly in /etc/krb5.conf
+ </para>
+ <para>
+ Default: false
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>dyndns_ttl (integer)</term>
+ <listitem>
+ <para>
+ The TTL to apply to the client DNS record when updating it.
+ If dyndns_update is false this has no effect. This will
+ override the TTL serverside if set by an administrator.
+ </para>
+ <para>
+ Default: 3600 (seconds)
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>dyndns_iface (string)</term>
+ <listitem>
+ <para>
+ Optional. Applicable only when dyndns_update
+ is true. Choose the interface whose IP address
+ should be used for dynamic DNS updates.
+ </para>
+ <para>
+ Default: Use the IP address of the IPA LDAP connection
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>dyndns_refresh_interval (integer)</term>
+ <listitem>
+ <para>
+ How often should the back end perform periodic DNS update in
+ addition to the automatic update performed when the back end
+ becomes online.
+ This option is optional and applicable only when dyndns_update
+ is true.
+ </para>
+ <para>
+ Default: 86400 (24 hours)
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>dyndns_update_ptr (bool)</term>
+ <listitem>
+ <para>
+ Whether the PTR record should also be explicitly
+ updated when updating the client's DNS records.
+ Applicable only when dyndns_update is true.
+ </para>
+ <para>
+ Default: True
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>dyndns_use_tcp (bool)</term>
+ <listitem>
+ <para>
+ Whether the nsupdate utility should default to using
+ TCP for communicating with the DNS server.
+ </para>
+ <para>
+ Default: False (let nsupdate choose the protocol)
+ </para>
+ </listitem>
+ </varlistentry>
+
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/override_homedir.xml" />
</variablelist>
</para>
diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
index dff1071dd7dca99969f912d07184cc3ca401b9b8..e0a55c6dcd5a738ca5a40ec30c448c4b167dc980 100644
--- a/src/providers/ad/ad_common.c
+++ b/src/providers/ad/ad_common.c
@@ -23,6 +23,7 @@
#include "providers/ad/ad_common.h"
#include "providers/ad/ad_opts.h"
+#include "providers/dp_dyndns.h"
errno_t
ad_get_common_options(TALLOC_CTX *mem_ctx,
@@ -698,3 +699,20 @@ done:
talloc_free(tmp_ctx);
return ret;
}
+
+errno_t ad_get_dyndns_options(struct be_ctx *be_ctx,
+ struct ad_options *ad_opts)
+{
+ errno_t ret;
+
+ ret = be_nsupdate_init(ad_opts, be_ctx, ad_dyndns_opts, ad_dyndns_timer,
+ ad_opts, &ad_opts->dyndns_ctx);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ ("Cannot initialize AD dyndns opts [%d]: %s\n",
+ ret, sss_strerror(ret)));
+ return ret;
+ }
+
+ return EOK;
+}
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
index 320bf1c9de7b5abacb270eb0cd09cb10227211cb..c865e689cb1bce6f32305167bca1edb8fef85f9e 100644
--- a/src/providers/ad/ad_common.h
+++ b/src/providers/ad/ad_common.h
@@ -63,6 +63,10 @@ struct ad_options {
/* Auth and chpass Provider */
struct dp_option *auth;
struct krb5_ctx *auth_ctx;
+
+ /* Dynamic DNS updates */
+ struct be_resolv_ctx *be_res;
+ struct be_nsupdate_ctx *dyndns_ctx;
};
errno_t
@@ -90,4 +94,13 @@ ad_get_auth_options(TALLOC_CTX *mem_ctx,
struct be_ctx *bectx,
struct dp_option **_opts);
+errno_t
+ad_get_dyndns_options(struct be_ctx *be_ctx,
+ struct ad_options *ad_opts);
+
+/* AD dynamic DNS updates */
+errno_t ad_dyndns_init(struct be_ctx *be_ctx,
+ struct ad_options *ctx);
+void ad_dyndns_timer(void *pvt);
+
#endif /* AD_COMMON_H_ */
diff --git a/src/providers/ad/ad_dyndns.c b/src/providers/ad/ad_dyndns.c
new file mode 100644
index 0000000000000000000000000000000000000000..1ea46444ff76b6255e091ddc7f1bca3371d72d55
--- /dev/null
+++ b/src/providers/ad/ad_dyndns.c
@@ -0,0 +1,311 @@
+/*
+ SSSD
+
+ ad_dyndns.c
+
+ Authors:
+ Jakub Hrozek <jhrozek at redhat.com>
+
+ Copyright (C) 2013 Red Hat
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <ctype.h>
+#include "util/util.h"
+#include "providers/ldap/sdap_dyndns.h"
+#include "providers/data_provider.h"
+#include "providers/dp_dyndns.h"
+#include "providers/ad/ad_common.h"
+
+void ad_dyndns_update(void *pvt);
+
+errno_t ad_dyndns_init(struct be_ctx *be_ctx,
+ struct ad_options *ad_opts)
+{
+ errno_t ret;
+
+ /* nsupdate is available. Dynamic updates
+ * are supported
+ */
+ ret = ad_get_dyndns_options(be_ctx, ad_opts);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Could not set AD options\n"));
+ return ret;
+ }
+
+ if (dp_opt_get_bool(ad_opts->dyndns_ctx->opts,
+ DP_OPT_DYNDNS_UPDATE) == false) {
+ DEBUG(SSSDBG_CONF_SETTINGS, ("Dynamic DNS updates not set\n"));
+ return EOK;
+ }
+
+ DEBUG(SSSDBG_CONF_SETTINGS,
+ ("Dynamic DNS updates are on. Checking for nsupdate..\n"));
+ ret = be_nsupdate_check();
+ if (ret == ENOENT) {
+ DEBUG(SSSDBG_MINOR_FAILURE,
+ ("DNS updates requested but nsupdate not available\n"));
+ return EOK;
+ } else if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Could not check for nsupdate\n"));
+ return ret;
+ }
+
+ ad_opts->be_res = be_ctx->be_res;
+ if (ad_opts->be_res == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Resolver must be initialized in order "
+ "to use the AD dynamic DNS updates\n"));
+ return EINVAL;
+ }
+
+ ret = be_add_online_cb(be_ctx, be_ctx,
+ ad_dyndns_update,
+ ad_opts, NULL);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Could not set up online callback\n"));
+ return ret;
+ }
+
+ return EOK;
+}
+
+struct ad_dyndns_timer_ctx {
+ struct sdap_id_op *sdap_op;
+ struct tevent_context *ev;
+
+ struct ad_options *ctx;
+};
+
+static void ad_dyndns_timer_connected(struct tevent_req *req);
+
+void ad_dyndns_timer(void *pvt)
+{
+ struct ad_options *ctx = talloc_get_type(pvt, struct ad_options);
+ struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx;
+ struct tevent_req *req;
+ struct ad_dyndns_timer_ctx *timer_ctx;
+ errno_t ret;
+
+ timer_ctx = talloc_zero(ctx, struct ad_dyndns_timer_ctx);
+ if (timer_ctx == NULL) {
+ /* Not much we can do */
+ return;
+ }
+ timer_ctx->ev = sdap_ctx->be->ev;
+ timer_ctx->ctx = ctx;
+
+ /* In order to prevent the connection triggering an
+ * online callback which would in turn trigger a concurrent DNS
+ * update
+ */
+ ctx->dyndns_ctx->timer_in_progress = true;
+
+ /* Make sure to have a valid LDAP connection */
+ timer_ctx->sdap_op = sdap_id_op_create(timer_ctx, sdap_ctx->conn_cache);
+ if (timer_ctx->sdap_op == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_create failed\n"));
+ goto fail;
+ }
+
+ req = sdap_id_op_connect_send(timer_ctx->sdap_op, timer_ctx, &ret);
+ if (req == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_connect_send failed: [%d](%s)\n",
+ ret, sss_strerror(ret)));
+ goto fail;
+ }
+ tevent_req_set_callback(req, ad_dyndns_timer_connected, timer_ctx);
+ return;
+
+fail:
+ ctx->dyndns_ctx->timer_in_progress = false;
+ be_nsupdate_timer_schedule(timer_ctx->ev, ctx->dyndns_ctx);
+ talloc_free(timer_ctx);
+}
+
+static void ad_dyndns_timer_connected(struct tevent_req *req)
+{
+ errno_t ret;
+ int dp_error;
+ struct ad_dyndns_timer_ctx *timer_ctx = tevent_req_callback_data(req,
+ struct ad_dyndns_timer_ctx);
+ struct tevent_context *ev;
+ struct ad_options *ctx;
+
+ ctx = timer_ctx->ctx;
+ ev = timer_ctx->ev;
+ ctx->dyndns_ctx->timer_in_progress = false;
+
+ ret = sdap_id_op_connect_recv(req, &dp_error);
+ talloc_zfree(req);
+ talloc_free(timer_ctx);
+ if (ret != EOK) {
+ if (dp_error == DP_ERR_OFFLINE) {
+ DEBUG(SSSDBG_MINOR_FAILURE, ("No AD server is available, "
+ "dynamic DNS update is skipped in offline mode.\n"));
+ /* Another timer will be scheduled when provider goes online
+ * and ad_dyndns_update() is called */
+ } else {
+ DEBUG(SSSDBG_OP_FAILURE,
+ ("Failed to connect to LDAP server: [%d](%s)\n",
+ ret, sss_strerror(ret)));
+
+ /* Just schedule another dyndns retry */
+ be_nsupdate_timer_schedule(ev, ctx->dyndns_ctx);
+ }
+ return;
+ }
+
+ /* all OK just call ad_dyndns_update and schedule another refresh */
+ be_nsupdate_timer_schedule(ev, ctx->dyndns_ctx);
+ return ad_dyndns_update(ctx);
+}
+static struct tevent_req *ad_dyndns_update_send(struct ad_options *ctx);
+static errno_t ad_dyndns_update_recv(struct tevent_req *req);
+static void ad_dyndns_nsupdate_done(struct tevent_req *req);
+
+void ad_dyndns_update(void *pvt)
+{
+ struct ad_options *ctx = talloc_get_type(pvt, struct ad_options);
+ struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx;
+ struct tevent_req *req;
+
+ /* Schedule timer after provider went offline */
+ be_nsupdate_timer_schedule(sdap_ctx->be->ev, ctx->dyndns_ctx);
+
+ req = ad_dyndns_update_send(ctx);
+ if (req == NULL) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Could not update DNS\n"));
+ return;
+ }
+ tevent_req_set_callback(req, ad_dyndns_nsupdate_done, NULL);
+}
+
+static void ad_dyndns_nsupdate_done(struct tevent_req *req)
+{
+ int ret = ad_dyndns_update_recv(req);
+ talloc_free(req);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Updating DNS entry failed [%d]: %s\n",
+ ret, sss_strerror(ret)));
+ return;
+ }
+
+ DEBUG(SSSDBG_OP_FAILURE, ("DNS update finished\n"));
+}
+
+struct ad_dyndns_update_state {
+ struct ad_options *ad_ctx;
+};
+
+static void ad_dyndns_sdap_update_done(struct tevent_req *subreq);
+
+static struct tevent_req *
+ad_dyndns_update_send(struct ad_options *ctx)
+{
+ int ret;
+ struct ad_dyndns_update_state *state;
+ struct tevent_req *req, *subreq;
+ struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx;
+ const char *servername;
+
+ DEBUG(SSSDBG_TRACE_FUNC, ("Performing update\n"));
+
+ req = tevent_req_create(ctx, &state, struct ad_dyndns_update_state);
+ if (req == NULL) {
+ return NULL;
+ }
+ state->ad_ctx = ctx;
+
+ if (ctx->dyndns_ctx->last_refresh + 60 > time(NULL) ||
+ ctx->dyndns_ctx->timer_in_progress) {
+ DEBUG(SSSDBG_FUNC_DATA, ("Last periodic update ran recently or timer"
+ "in progress, not scheduling another update\n"));
+ tevent_req_done(req);
+ tevent_req_post(req, sdap_ctx->be->ev);
+ return req;
+ }
+ state->ad_ctx->dyndns_ctx->last_refresh = time(NULL);
+
+ if (strncmp(ctx->service->sdap->uri,
+ "ldap://", 7) != 0) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Unexpected format of LDAP URI.\n"));
+ ret = EIO;
+ goto done;
+ }
+ servername = ctx->service->sdap->uri + 7;
+ if (!servername) {
+ ret = EIO;
+ goto done;
+ }
+
+ subreq = sdap_dyndns_update_send(state, sdap_ctx->be->ev,
+ sdap_ctx->be,
+ ctx->dyndns_ctx->opts,
+ sdap_ctx,
+ ctx->dyndns_ctx->auth_type,
+ dp_opt_get_string(ctx->dyndns_ctx->opts,
+ DP_OPT_DYNDNS_IFACE),
+ dp_opt_get_string(ctx->basic,
+ AD_HOSTNAME),
+ NULL,
+ dp_opt_get_string(ctx->basic,
+ AD_KRB5_REALM),
+ servername,
+ dp_opt_get_int(ctx->dyndns_ctx->opts,
+ DP_OPT_DYNDNS_TTL),
+ false);
+ if (!subreq) {
+ ret = EIO;
+ DEBUG(SSSDBG_OP_FAILURE,
+ ("sdap_id_op_connect_send failed: [%d](%s)\n",
+ ret, sss_strerror(ret)));
+ goto done;
+ }
+ tevent_req_set_callback(subreq, ad_dyndns_sdap_update_done, req);
+
+ ret = EOK;
+done:
+ if (ret != EOK) {
+ tevent_req_error(req, ret);
+ tevent_req_post(req, sdap_ctx->be->ev);
+ }
+ return req;
+}
+
+static void ad_dyndns_sdap_update_done(struct tevent_req *subreq)
+{
+ struct tevent_req *req = tevent_req_callback_data(subreq,
+ struct tevent_req);
+ errno_t ret;
+
+ ret = sdap_dyndns_update_recv(subreq);
+ talloc_zfree(subreq);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ ("Dynamic DNS update failed [%d]: %s\n",
+ ret, sss_strerror(ret)));
+ tevent_req_error(req, ret);
+ return;
+ }
+
+ tevent_req_done(req);
+}
+
+static errno_t ad_dyndns_update_recv(struct tevent_req *req)
+{
+ TEVENT_REQ_RETURN_ON_ERROR(req);
+
+ return EOK;
+}
diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c
index 087ec3c4507adc13be63242f15d5a1a9cd23e26c..235cdc818843be35df072ad95c11f79825a7feae 100644
--- a/src/providers/ad/ad_init.c
+++ b/src/providers/ad/ad_init.c
@@ -35,6 +35,7 @@
#include "providers/krb5/krb5_auth.h"
#include "providers/krb5/krb5_init_shared.h"
#include "providers/ad/ad_id.h"
+#include "providers/dp_dyndns.h"
struct ad_options *ad_options = NULL;
@@ -163,6 +164,13 @@ sssm_ad_id_init(struct be_ctx *bectx,
if (ret != EOK) goto done;
}
+ ret = ad_dyndns_init(sdap_ctx->be, ad_options);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_MINOR_FAILURE,
+ ("Failure setting up automatic DNS update\n"));
+ /* Continue without DNS updates */
+ }
+
ret = sdap_id_setup_tasks(sdap_ctx);
if (ret != EOK) {
goto done;
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index 09aee7e27cca0e1104e65ab3fd6b7c9bf623ada6..d3bcc55111b8b0b47837e6a2fe808f8b30e96d15 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -236,4 +236,15 @@ struct sdap_attr_map ad_autofs_entry_map[] = {
SDAP_ATTR_MAP_TERMINATOR
};
+struct dp_option ad_dyndns_opts[] = {
+ { "dyndns_update", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+ { "dyndns_refresh_interval", DP_OPT_NUMBER, { .number = 86400 }, NULL_NUMBER },
+ { "dyndns_iface", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+ { "dyndns_ttl", DP_OPT_NUMBER, { .number = 3600 }, NULL_NUMBER },
+ { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_FALSE },
+ { "dyndns_use_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+ { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
+ DP_OPTION_TERMINATOR
+};
+
#endif /* AD_OPTS_H_ */
diff --git a/src/tests/ipa_ldap_opt-tests.c b/src/tests/ipa_ldap_opt-tests.c
index d1a96dc8658f9b2bf46970afa51bf9de3ae8ff65..ea4991c805c43403d6219678e9714baeda684a69 100644
--- a/src/tests/ipa_ldap_opt-tests.c
+++ b/src/tests/ipa_ldap_opt-tests.c
@@ -32,6 +32,8 @@
#include "providers/ldap/ldap_opts.h"
#include "providers/krb5/krb5_opts.h"
#include "providers/krb5/krb5_common.h"
+#include "providers/ad/ad_opts.h"
+#include "providers/dp_dyndns.h"
#include "tests/common.h"
struct test_domain {
@@ -88,6 +90,10 @@ START_TEST(test_compare_opts)
ret = compare_dp_options(default_krb5_opts, KRB5_OPTS,
ipa_def_krb5_opts);
fail_unless(ret == EOK, "[%s]", strerror(ret));
+
+ ret = compare_dp_options(ipa_dyndns_opts, DP_OPT_DYNDNS,
+ ad_dyndns_opts);
+ fail_unless(ret == EOK, "[%s]", strerror(ret));
}
END_TEST
--
1.8.1.4
More information about the sssd-devel
mailing list