[SSSD] [PATCH] Active Directory dynamic DNS updates

Jakub Hrozek jhrozek at redhat.com
Thu May 2 18:04:12 UTC 2013


On Tue, Apr 30, 2013 at 08:16:05PM +0200, Jakub Hrozek wrote:
> On Mon, Apr 22, 2013 at 02:49:11PM +0200, Jakub Hrozek wrote:
> > On Mon, Apr 22, 2013 at 02:20:59PM +0200, Pavel Březina wrote:
> > > On 04/17/2013 09:04 PM, Jakub Hrozek wrote:
> > > >https://fedorahosted.org/sssd/ticket/1504
> > > >
> > > >Implements dynamic DNS updates for the AD provider. By default, the
> > > >updates also update the reverse zone and run periodically every 24
> > > >hours.
> > > 
> > > Hi,
> > > I will do more thorough review in next days, but there are two thing
> > > that struck in my eyes.
> > > 
> > > >0001-Active-Directory-dynamic-DNS-updates.patch
> > > >
> > > >
> > > >From 5306abceba7e6eed97763a0cd48bb886ff161835 Mon Sep 17 00:00:00
> > > >2001 From: Jakub Hrozek<jhrozek at redhat.com> Date: Tue, 16 Apr 2013
> > > >17:04:43 +0200 Subject: [PATCH] Active Directory dynamic DNS updates
> > > >
> > > >https://fedorahosted.org/sssd/ticket/1504
> > > >
> > > >Implements dynamic DNS updates for the AD provider. By default, the
> > > >updates also update the reverse zone and run periodically every 24
> > > >hours.
> > > 
> > > >--- a/src/man/sssd-ad.5.xml +++ b/src/man/sssd-ad.5.xml
> > > 
> > > Please, move dyndns options into a separate xml and include it into
> > > sssd-ad and sssd-ipa.
> > > 
> > 
> > yes, I wanted to do so, but there are two differences I didn't know how
> > to solve without spending too much time on a man page:
> > 1) defaults. We could solve this by saying "In IPA the default is foo
> > but in AD default is bar". It's ugly.
> > 2) the IPA manpage includes the old options.
> > 
> > Maybe it could be solved by using a stringparam of xsltproc, I'll take a
> > look. Ideally I wanted to get the feature accepted first so it's
> > testable, then worry about duplication in man pages :)
> > 
> > > ad_dyndns.c and ipa_dyndns.c are *very* similar. It must be possible to
> > > write this code only ones. Do you have any specific reasons why haven't
> > > you done so?
> > 
> > They access private data and call static functions directly. As above, I
> > will take a look, but reducing code duplication is something we can do
> > post-beta.
> 
> I split the common code into the sdap_dyndns.c module and now both IPA
> and AD timers are just thin wrappers around this request.
> 
> I didn't squash the new request into the periodic update task patch,
> sorry. I don't think it's necessary to spend time resolving conflicts
> and actually I think the patches are easier to review this way.
> 
> New patches attached.

Attached patches are rebased on top of Pavel's AD site patches.
-------------- next part --------------
>From b76a40db4910eb8a163cb878603aad9ef9a03054 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 30 Apr 2013 18:55:29 +0200
Subject: [PATCH 1/2] Split out the common code from timed DNS updates

---
 src/providers/ipa/ipa_dyndns.c   |  72 +++++---------------------
 src/providers/ldap/sdap_dyndns.c | 108 +++++++++++++++++++++++++++++++++++++++
 src/providers/ldap/sdap_dyndns.h |  13 +++++
 3 files changed, 133 insertions(+), 60 deletions(-)

diff --git a/src/providers/ipa/ipa_dyndns.c b/src/providers/ipa/ipa_dyndns.c
index b752f116f5149f1c576a017afd1091a225d8277a..81dae94a5029be39501ff321db07cd18439395f5 100644
--- a/src/providers/ipa/ipa_dyndns.c
+++ b/src/providers/ipa/ipa_dyndns.c
@@ -69,81 +69,33 @@ void ipa_dyndns_timer(void *pvt)
     struct ipa_options *ctx = talloc_get_type(pvt, struct ipa_options);
     struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx;
     struct tevent_req *req;
-    struct ipa_dyndns_timer_ctx *timer_ctx;
-    errno_t ret;
 
-    timer_ctx = talloc_zero(ctx, struct ipa_dyndns_timer_ctx);
-    if (timer_ctx == NULL) {
+    req = sdap_dyndns_timer_conn_send(ctx, sdap_ctx->be->ev, sdap_ctx,
+                                      ctx->dyndns_ctx);
+    if (req == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory\n"));
-        /* Not much we can do */
+        /* Not much we can do. Just attempt to reschedule */
+        be_nsupdate_timer_schedule(sdap_ctx->be->ev, ctx->dyndns_ctx);
         return;
     }
-    timer_ctx->ev = sdap_ctx->be->ev;
-    timer_ctx->ctx = ctx;
-
-    /* In order to prevent the connection triggering an
-     * online callback which would in turn trigger a concurrent DNS
-     * update
-     */
-    ctx->dyndns_ctx->timer_in_progress = true;
-
-    /* Make sure to have a valid LDAP connection */
-    timer_ctx->sdap_op = sdap_id_op_create(timer_ctx, sdap_ctx->conn_cache);
-    if (timer_ctx->sdap_op == NULL) {
-        DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_create failed\n"));
-        goto fail;
-    }
-
-    req = sdap_id_op_connect_send(timer_ctx->sdap_op, timer_ctx, &ret);
-    if (req == NULL) {
-        DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_connect_send failed: [%d](%s)\n",
-              ret, sss_strerror(ret)));
-        goto fail;
-    }
-    tevent_req_set_callback(req, ipa_dyndns_timer_connected, timer_ctx);
-    return;
-
-fail:
-    ctx->dyndns_ctx->timer_in_progress = false;
-    be_nsupdate_timer_schedule(timer_ctx->ev, ctx->dyndns_ctx);
-    talloc_free(timer_ctx);
+    tevent_req_set_callback(req, ipa_dyndns_timer_connected, ctx);
 }
 
 static void ipa_dyndns_timer_connected(struct tevent_req *req)
 {
     errno_t ret;
-    int dp_error;
-    struct ipa_dyndns_timer_ctx *timer_ctx = tevent_req_callback_data(req,
-                                     struct ipa_dyndns_timer_ctx);
-    struct tevent_context *ev;
-    struct ipa_options *ctx;
+    struct ipa_options *ctx = tevent_req_callback_data(req,
+                                                struct ipa_options);
 
-    ctx = timer_ctx->ctx;
-    ev = timer_ctx->ev;
-    ctx->dyndns_ctx->timer_in_progress = false;
-
-    ret = sdap_id_op_connect_recv(req, &dp_error);
+    ret = sdap_dyndns_timer_conn_recv(req);
     talloc_zfree(req);
-    talloc_free(timer_ctx);
     if (ret != EOK) {
-        if (dp_error == DP_ERR_OFFLINE) {
-            DEBUG(SSSDBG_MINOR_FAILURE, ("No IPA server is available, "
-                  "dynamic DNS update is skipped in offline mode.\n"));
-            /* Another timer will be scheduled when provider goes online
-             * and ipa_dyndns_update() is called */
-        } else {
-            DEBUG(SSSDBG_OP_FAILURE,
-                  ("Failed to connect to LDAP server: [%d](%s)\n",
-                  ret, sss_strerror(ret)));
-
-            /* Just schedule another dyndns retry */
-            be_nsupdate_timer_schedule(ev, ctx->dyndns_ctx);
-        }
+        DEBUG(SSSDBG_OP_FAILURE,
+              ("Failed to connect to IPA: [%d](%s)\n",
+              ret, sss_strerror(ret)));
         return;
     }
 
-    /* all OK just call ipa_dyndns_update and schedule another refresh */
-    be_nsupdate_timer_schedule(ev, ctx->dyndns_ctx);
     return ipa_dyndns_update(ctx);
 }
 
diff --git a/src/providers/ldap/sdap_dyndns.c b/src/providers/ldap/sdap_dyndns.c
index fbeb6a3d4fd5a53c70584daf4e40f74d8f9799e4..d7e20ca4ffada5e775d45b86f73b69bddb2180a1 100644
--- a/src/providers/ldap/sdap_dyndns.c
+++ b/src/providers/ldap/sdap_dyndns.c
@@ -627,3 +627,111 @@ sdap_dyndns_get_addrs_recv(struct tevent_req *req,
     *_addresses = talloc_steal(mem_ctx, state->addresses);
     return EOK;
 }
+
+struct sdap_dyndns_timer_state {
+    struct tevent_context *ev;
+    struct sdap_id_ctx *sdap_ctx;
+    struct be_nsupdate_ctx *dyndns_ctx;
+
+    struct sdap_id_op *sdap_op;
+};
+
+static void sdap_dyndns_timer_conn_done(struct tevent_req *req);
+
+struct tevent_req *
+sdap_dyndns_timer_conn_send(TALLOC_CTX *mem_ctx,
+                            struct tevent_context *ev,
+                            struct sdap_id_ctx *sdap_ctx,
+                            struct be_nsupdate_ctx *dyndns_ctx)
+{
+    struct sdap_dyndns_timer_state *state;
+    struct tevent_req *req;
+    struct tevent_req *subreq;
+    errno_t ret;
+
+    req = tevent_req_create(mem_ctx, &state, struct sdap_dyndns_timer_state);
+    if (req == NULL) {
+        return NULL;
+    }
+    state->ev = ev;
+    state->sdap_ctx = sdap_ctx;
+    state->dyndns_ctx = dyndns_ctx;
+
+    /* In order to prevent the connection triggering an
+     * online callback which would in turn trigger a concurrent DNS
+     * update
+     */
+    state->dyndns_ctx->timer_in_progress = true;
+
+    /* Make sure to have a valid LDAP connection */
+    state->sdap_op = sdap_id_op_create(state, state->sdap_ctx->conn_cache);
+    if (state->sdap_op == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_create failed\n"));
+        ret = ENOMEM;
+        goto fail;
+    }
+
+    subreq = sdap_id_op_connect_send(state->sdap_op, state, &ret);
+    if (subreq == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_connect_send failed: [%d](%s)\n",
+              ret, sss_strerror(ret)));
+        ret = ENOMEM;
+        goto fail;
+    }
+    tevent_req_set_callback(subreq, sdap_dyndns_timer_conn_done, req);
+    return req;
+
+fail:
+    dyndns_ctx->timer_in_progress = false;
+    be_nsupdate_timer_schedule(ev, dyndns_ctx);
+    tevent_req_error(req, ret);
+    tevent_req_post(req, ev);
+    return req;
+}
+
+
+static void
+sdap_dyndns_timer_conn_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    struct sdap_dyndns_timer_state *state = tevent_req_data(req,
+                                            struct sdap_dyndns_timer_state);
+    errno_t ret;
+    int dp_error;
+
+    state->dyndns_ctx->timer_in_progress = false;
+
+    ret = sdap_id_op_connect_recv(subreq, &dp_error);
+    talloc_zfree(subreq);
+    if (ret != EOK) {
+        if (dp_error == DP_ERR_OFFLINE) {
+            DEBUG(SSSDBG_MINOR_FAILURE, ("No server is available, "
+                  "dynamic DNS update is skipped in offline mode.\n"));
+            /* Another timer will be scheduled when provider goes online */
+            tevent_req_error(req, ERR_DYNDNS_OFFLINE);
+        } else {
+            DEBUG(SSSDBG_OP_FAILURE,
+                  ("Failed to connect to LDAP server: [%d](%s)\n",
+                  ret, sss_strerror(ret)));
+
+            /* Just schedule another dyndns retry */
+            be_nsupdate_timer_schedule(state->ev, state->dyndns_ctx);
+            tevent_req_error(req, ERR_NETWORK_IO);
+        }
+        return;
+    }
+
+    /* All OK, schedule another refresh and let the user call its
+     * provider-specific update
+     */
+    be_nsupdate_timer_schedule(state->ev, state->dyndns_ctx);
+    tevent_req_done(req);
+}
+
+errno_t
+sdap_dyndns_timer_conn_recv(struct tevent_req *req)
+{
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+    return EOK;
+}
diff --git a/src/providers/ldap/sdap_dyndns.h b/src/providers/ldap/sdap_dyndns.h
index 66de64a59c9b5408641b7f4c32a3e1dc814c80af..7aaff5d2c69fbda55fff5208c97b953b970c55cc 100644
--- a/src/providers/ldap/sdap_dyndns.h
+++ b/src/providers/ldap/sdap_dyndns.h
@@ -47,4 +47,17 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,
 
 errno_t sdap_dyndns_update_recv(struct tevent_req *req);
 
+/* Connects to the LDAP server in order to read the address from the
+ * socket and be able to perform dynamic DNS updates. Reschedules the
+ * task automatically on errors and sets/resets the timer_in_progress
+ * guard in be_nsupdate_ctx.
+ */
+struct tevent_req *
+sdap_dyndns_timer_conn_send(TALLOC_CTX *mem_ctx,
+                            struct tevent_context *ev,
+                            struct sdap_id_ctx *sdap_ctx,
+                            struct be_nsupdate_ctx *dyndns_ctx);
+
+errno_t sdap_dyndns_timer_conn_recv(struct tevent_req *req);
+
 #endif /* SDAP_DYNDNS_H_ */
-- 
1.8.2.1

-------------- next part --------------
>From 8c6f6fdc8e7b0471a1062e21577bc3ef2f2b648b Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 16 Apr 2013 17:04:43 +0200
Subject: [PATCH 2/2] Active Directory dynamic DNS updates

https://fedorahosted.org/sssd/ticket/1504

Implements dynamic DNS updates for the AD provider. By default, the
updates also update the reverse zone and run periodically every 24
hours.
---
 Makefile.am                    |   1 +
 src/man/sssd-ad.5.xml          |  90 +++++++++++++++
 src/providers/ad/ad_common.c   |  18 +++
 src/providers/ad/ad_common.h   |  13 +++
 src/providers/ad/ad_dyndns.c   | 256 +++++++++++++++++++++++++++++++++++++++++
 src/providers/ad/ad_init.c     |   8 ++
 src/providers/ad/ad_opts.h     |  11 ++
 src/tests/ipa_ldap_opt-tests.c |   6 +
 8 files changed, 403 insertions(+)
 create mode 100644 src/providers/ad/ad_dyndns.c

diff --git a/Makefile.am b/Makefile.am
index c2428f800c54c8a06c74a69d91ce580d70af75c8..4d31bedd449cd93d39561a4a835c8956c85dc771 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1586,6 +1586,7 @@ libsss_ad_la_SOURCES = \
     src/providers/ad/ad_common.c \
     src/providers/ad/ad_common.h \
     src/providers/ad/ad_init.c \
+    src/providers/ad/ad_dyndns.c \
     src/providers/ad/ad_id.c \
     src/providers/ad/ad_id.h \
     src/providers/ad/ad_access.c \
diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index 95a95f1ac4c8301c2320b9d6dae735cc0c9a6dad..c19607715dafd39f167c3066831ae7ad09ffe459 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -152,6 +152,96 @@ ldap_id_mapping = False
                     </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                    <term>dyndns_update (boolean)</term>
+                    <listitem>
+                        <para>
+                            Optional. This option tells SSSD to automatically
+                            update the Active Directory DNS server with
+                            the IP address of this client.
+                        </para>
+                        <para>
+                            NOTE: On older systems (such as RHEL 5), for this
+                            behavior to work reliably, the default Kerberos
+                            realm must be set properly in /etc/krb5.conf
+                        </para>
+                        <para>
+                            Default: false
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>dyndns_ttl (integer)</term>
+                    <listitem>
+                        <para>
+                            The TTL to apply to the client DNS record when updating it.
+                            If dyndns_update is false this has no effect. This will
+                            override the TTL serverside if set by an administrator.
+                        </para>
+                        <para>
+                            Default: 3600 (seconds)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>dyndns_iface (string)</term>
+                    <listitem>
+                        <para>
+                            Optional. Applicable only when dyndns_update
+                            is true. Choose the interface whose IP address
+                            should be used for dynamic DNS updates.
+                        </para>
+                        <para>
+                            Default: Use the IP address of the IPA LDAP connection
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>dyndns_refresh_interval (integer)</term>
+                    <listitem>
+                        <para>
+                            How often should the back end perform periodic DNS update in
+                            addition to the automatic update performed when the back end
+                            goes online.
+                            This option is optional and applicable only when dyndns_update
+                            is true.
+                        </para>
+                        <para>
+                            Default: 86400 (24 hours)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>dyndns_update_ptr (bool)</term>
+                    <listitem>
+                        <para>
+                            Whether the PTR record should also be explicitly
+                            updated when updating the client's DNS records.
+                            Applicable only when dyndns_update is true.
+                        </para>
+                        <para>
+                            Default: True
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
+                    <term>dyndns_force_tcp (bool)</term>
+                    <listitem>
+                        <para>
+                            Whether the nsupdate utility should default to using
+                            TCP for communicating with the DNS server.
+                        </para>
+                        <para>
+                            Default: False (let nsupdate choose the protocol)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
                 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/override_homedir.xml" />
 
                 <varlistentry>
diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
index dff1071dd7dca99969f912d07184cc3ca401b9b8..e0a55c6dcd5a738ca5a40ec30c448c4b167dc980 100644
--- a/src/providers/ad/ad_common.c
+++ b/src/providers/ad/ad_common.c
@@ -23,6 +23,7 @@
 
 #include "providers/ad/ad_common.h"
 #include "providers/ad/ad_opts.h"
+#include "providers/dp_dyndns.h"
 
 errno_t
 ad_get_common_options(TALLOC_CTX *mem_ctx,
@@ -698,3 +699,20 @@ done:
     talloc_free(tmp_ctx);
     return ret;
 }
+
+errno_t ad_get_dyndns_options(struct be_ctx *be_ctx,
+                              struct ad_options *ad_opts)
+{
+    errno_t ret;
+
+    ret = be_nsupdate_init(ad_opts, be_ctx, ad_dyndns_opts, ad_dyndns_timer,
+                           ad_opts, &ad_opts->dyndns_ctx);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              ("Cannot initialize AD dyndns opts [%d]: %s\n",
+               ret, sss_strerror(ret)));
+        return ret;
+    }
+
+    return EOK;
+}
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
index 7be15ba9b44d38b884538b22268e6f4a5a47da9d..792f32e0876ad73b0fb422c4cc7ebc86058e7ed6 100644
--- a/src/providers/ad/ad_common.h
+++ b/src/providers/ad/ad_common.h
@@ -64,6 +64,10 @@ struct ad_options {
     /* Auth and chpass Provider */
     struct dp_option *auth;
     struct krb5_ctx *auth_ctx;
+
+    /* Dynamic DNS updates */
+    struct be_resolv_ctx *be_res;
+    struct be_nsupdate_ctx *dyndns_ctx;
 };
 
 errno_t
@@ -91,4 +95,13 @@ ad_get_auth_options(TALLOC_CTX *mem_ctx,
                     struct be_ctx *bectx,
                     struct dp_option **_opts);
 
+errno_t
+ad_get_dyndns_options(struct be_ctx *be_ctx,
+                      struct ad_options *ad_opts);
+
+/* AD dynamic DNS updates */
+errno_t ad_dyndns_init(struct be_ctx *be_ctx,
+                       struct ad_options *ctx);
+void ad_dyndns_timer(void *pvt);
+
 #endif /* AD_COMMON_H_ */
diff --git a/src/providers/ad/ad_dyndns.c b/src/providers/ad/ad_dyndns.c
new file mode 100644
index 0000000000000000000000000000000000000000..2b2d246251791a290db8a7fda47520b21b8a6d6f
--- /dev/null
+++ b/src/providers/ad/ad_dyndns.c
@@ -0,0 +1,256 @@
+/*
+    SSSD
+
+    ad_dyndns.c
+
+    Authors:
+        Jakub Hrozek <jhrozek at redhat.com>
+
+    Copyright (C) 2013 Red Hat
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <ctype.h>
+#include "util/util.h"
+#include "providers/ldap/sdap_dyndns.h"
+#include "providers/data_provider.h"
+#include "providers/dp_dyndns.h"
+#include "providers/ad/ad_common.h"
+
+void ad_dyndns_update(void *pvt);
+
+errno_t ad_dyndns_init(struct be_ctx *be_ctx,
+                       struct ad_options *ad_opts)
+{
+    errno_t ret;
+
+    /* nsupdate is available. Dynamic updates
+     * are supported
+     */
+    ret = ad_get_dyndns_options(be_ctx, ad_opts);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("Could not set AD options\n"));
+        return ret;
+    }
+
+    if (dp_opt_get_bool(ad_opts->dyndns_ctx->opts,
+                        DP_OPT_DYNDNS_UPDATE) == false) {
+        DEBUG(SSSDBG_CONF_SETTINGS, ("Dynamic DNS updates not set\n"));
+        return EOK;
+    }
+
+    DEBUG(SSSDBG_CONF_SETTINGS,
+          ("Dynamic DNS updates are on. Checking for nsupdate..\n"));
+    ret = be_nsupdate_check();
+    if (ret == ENOENT) {
+        DEBUG(SSSDBG_MINOR_FAILURE,
+              ("DNS updates requested but nsupdate not available\n"));
+        return EOK;
+    } else if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Could not check for nsupdate\n"));
+        return ret;
+    }
+
+    ad_opts->be_res = be_ctx->be_res;
+    if (ad_opts->be_res == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Resolver must be initialized in order "
+              "to use the AD dynamic DNS updates\n"));
+        return EINVAL;
+    }
+
+    ret = be_add_online_cb(be_ctx, be_ctx,
+                           ad_dyndns_update,
+                           ad_opts, NULL);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("Could not set up online callback\n"));
+        return ret;
+    }
+
+    return EOK;
+}
+
+static void ad_dyndns_timer_connected(struct tevent_req *req);
+
+void ad_dyndns_timer(void *pvt)
+{
+    struct ad_options *ctx = talloc_get_type(pvt, struct ad_options);
+    struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx;
+    struct tevent_req *req;
+
+    req = sdap_dyndns_timer_conn_send(ctx, sdap_ctx->be->ev, sdap_ctx,
+                                      ctx->dyndns_ctx);
+    if (req == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory\n"));
+        /* Not much we can do. Just attempt to reschedule */
+        be_nsupdate_timer_schedule(sdap_ctx->be->ev, ctx->dyndns_ctx);
+        return;
+    }
+    tevent_req_set_callback(req, ad_dyndns_timer_connected, ctx);
+}
+
+static void ad_dyndns_timer_connected(struct tevent_req *req)
+{
+    errno_t ret;
+    struct ad_options *ctx = tevent_req_callback_data(req, struct ad_options);
+
+    ret = sdap_dyndns_timer_conn_recv(req);
+    talloc_zfree(req);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              ("Failed to connect to AD: [%d](%s)\n", ret, sss_strerror(ret)));
+        return;
+    }
+
+    return ad_dyndns_update(ctx);
+}
+
+static struct tevent_req *ad_dyndns_update_send(struct ad_options *ctx);
+static errno_t ad_dyndns_update_recv(struct tevent_req *req);
+static void ad_dyndns_nsupdate_done(struct tevent_req *req);
+
+void ad_dyndns_update(void *pvt)
+{
+    struct ad_options *ctx = talloc_get_type(pvt, struct ad_options);
+    struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx;
+    struct tevent_req *req;
+
+    /* Schedule timer after provider went offline */
+    be_nsupdate_timer_schedule(sdap_ctx->be->ev, ctx->dyndns_ctx);
+
+    req = ad_dyndns_update_send(ctx);
+    if (req == NULL) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("Could not update DNS\n"));
+        return;
+    }
+    tevent_req_set_callback(req, ad_dyndns_nsupdate_done, NULL);
+}
+
+static void ad_dyndns_nsupdate_done(struct tevent_req *req)
+{
+    int ret = ad_dyndns_update_recv(req);
+    talloc_free(req);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Updating DNS entry failed [%d]: %s\n",
+              ret, sss_strerror(ret)));
+        return;
+    }
+
+    DEBUG(SSSDBG_OP_FAILURE, ("DNS update finished\n"));
+}
+
+struct ad_dyndns_update_state {
+    struct ad_options *ad_ctx;
+};
+
+static void ad_dyndns_sdap_update_done(struct tevent_req *subreq);
+
+static struct tevent_req *
+ad_dyndns_update_send(struct ad_options *ctx)
+{
+    int ret;
+    struct ad_dyndns_update_state *state;
+    struct tevent_req *req, *subreq;
+    struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx;
+    const char *servername;
+
+    DEBUG(SSSDBG_TRACE_FUNC, ("Performing update\n"));
+
+    req = tevent_req_create(ctx, &state, struct ad_dyndns_update_state);
+    if (req == NULL) {
+        return NULL;
+    }
+    state->ad_ctx = ctx;
+
+    if (ctx->dyndns_ctx->last_refresh + 60 > time(NULL) ||
+        ctx->dyndns_ctx->timer_in_progress) {
+        DEBUG(SSSDBG_FUNC_DATA, ("Last periodic update ran recently or timer"
+              "in progress, not scheduling another update\n"));
+        tevent_req_done(req);
+        tevent_req_post(req, sdap_ctx->be->ev);
+        return req;
+    }
+    state->ad_ctx->dyndns_ctx->last_refresh = time(NULL);
+
+    if (strncmp(ctx->service->sdap->uri,
+                "ldap://", 7) != 0) {
+        DEBUG(SSSDBG_CRIT_FAILURE, ("Unexpected format of LDAP URI.\n"));
+        ret = EIO;
+        goto done;
+    }
+    servername = ctx->service->sdap->uri + 7;
+    if (!servername) {
+        ret = EIO;
+        goto done;
+    }
+
+    subreq = sdap_dyndns_update_send(state, sdap_ctx->be->ev,
+                                     sdap_ctx->be,
+                                     ctx->dyndns_ctx->opts,
+                                     sdap_ctx,
+                                     ctx->dyndns_ctx->auth_type,
+                                     dp_opt_get_string(ctx->dyndns_ctx->opts,
+                                                       DP_OPT_DYNDNS_IFACE),
+                                     dp_opt_get_string(ctx->basic,
+                                                       AD_HOSTNAME),
+                                     NULL,
+                                     dp_opt_get_string(ctx->basic,
+                                                       AD_KRB5_REALM),
+                                     servername,
+                                     dp_opt_get_int(ctx->dyndns_ctx->opts,
+                                                    DP_OPT_DYNDNS_TTL),
+                                     false);
+    if (!subreq) {
+        ret = EIO;
+        DEBUG(SSSDBG_OP_FAILURE,
+              ("sdap_id_op_connect_send failed: [%d](%s)\n",
+               ret, sss_strerror(ret)));
+        goto done;
+    }
+    tevent_req_set_callback(subreq, ad_dyndns_sdap_update_done, req);
+
+    ret = EOK;
+done:
+    if (ret != EOK) {
+        tevent_req_error(req, ret);
+        tevent_req_post(req, sdap_ctx->be->ev);
+    }
+    return req;
+}
+
+static void ad_dyndns_sdap_update_done(struct tevent_req *subreq)
+{
+    struct tevent_req *req = tevent_req_callback_data(subreq,
+                                                      struct tevent_req);
+    errno_t ret;
+
+    ret = sdap_dyndns_update_recv(subreq);
+    talloc_zfree(subreq);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              ("Dynamic DNS update failed [%d]: %s\n",
+              ret, sss_strerror(ret)));
+        tevent_req_error(req, ret);
+        return;
+    }
+
+    tevent_req_done(req);
+}
+
+static errno_t ad_dyndns_update_recv(struct tevent_req *req)
+{
+    TEVENT_REQ_RETURN_ON_ERROR(req);
+
+    return EOK;
+}
diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c
index 4d10986895715fc51f48d0f88ab76912ee9e2796..7ebe2a0e5d5ced1daacb2dd6817fb5291a2afa5f 100644
--- a/src/providers/ad/ad_init.c
+++ b/src/providers/ad/ad_init.c
@@ -36,6 +36,7 @@
 #include "providers/krb5/krb5_init_shared.h"
 #include "providers/ad/ad_id.h"
 #include "providers/ad/ad_srv.h"
+#include "providers/dp_dyndns.h"
 
 struct ad_options *ad_options = NULL;
 
@@ -166,6 +167,13 @@ sssm_ad_id_init(struct be_ctx *bectx,
         if (ret != EOK) goto done;
     }
 
+    ret = ad_dyndns_init(sdap_ctx->be, ad_options);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_MINOR_FAILURE,
+             ("Failure setting up automatic DNS update\n"));
+        /* Continue without DNS updates */
+    }
+
     ret = sdap_id_setup_tasks(sdap_ctx);
     if (ret != EOK) {
         goto done;
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index c48be86749f41ee3031b64a1b244753866584cf5..32bbe3db2f4048056c7e96619eaf53ce22bf52f8 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -238,4 +238,15 @@ struct sdap_attr_map ad_autofs_entry_map[] = {
     SDAP_ATTR_MAP_TERMINATOR
 };
 
+struct dp_option ad_dyndns_opts[] = {
+    { "dyndns_update", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+    { "dyndns_refresh_interval", DP_OPT_NUMBER, { .number = 86400 }, NULL_NUMBER },
+    { "dyndns_iface", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "dyndns_ttl", DP_OPT_NUMBER, { .number = 3600 }, NULL_NUMBER },
+    { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_FALSE },
+    { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
+    { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
+    DP_OPTION_TERMINATOR
+};
+
 #endif /* AD_OPTS_H_ */
diff --git a/src/tests/ipa_ldap_opt-tests.c b/src/tests/ipa_ldap_opt-tests.c
index d1a96dc8658f9b2bf46970afa51bf9de3ae8ff65..ea4991c805c43403d6219678e9714baeda684a69 100644
--- a/src/tests/ipa_ldap_opt-tests.c
+++ b/src/tests/ipa_ldap_opt-tests.c
@@ -32,6 +32,8 @@
 #include "providers/ldap/ldap_opts.h"
 #include "providers/krb5/krb5_opts.h"
 #include "providers/krb5/krb5_common.h"
+#include "providers/ad/ad_opts.h"
+#include "providers/dp_dyndns.h"
 #include "tests/common.h"
 
 struct test_domain {
@@ -88,6 +90,10 @@ START_TEST(test_compare_opts)
     ret = compare_dp_options(default_krb5_opts, KRB5_OPTS,
                              ipa_def_krb5_opts);
     fail_unless(ret == EOK, "[%s]", strerror(ret));
+
+    ret = compare_dp_options(ipa_dyndns_opts, DP_OPT_DYNDNS,
+                             ad_dyndns_opts);
+    fail_unless(ret == EOK, "[%s]", strerror(ret));
 }
 END_TEST
 
-- 
1.8.2.1



More information about the sssd-devel mailing list