[SSSD] [PATCH] DYNDNS: Add a new option dyndns_server

Jakub Hrozek jhrozek at redhat.com
Wed Jul 9 21:06:06 UTC 2014


Hi,

one of our users ran into an interesting problem -- her AD
infrastructure was different from the DNS server. Because by default, we
perform update against the server we're connected to, the DNS update
didn't work.

Per Simo's suggestion, I've implemented a new option that allows the
administrator to override the DNS server used for DNS updates.
-------------- next part --------------
>From 0bb210bc1edd72c9b94f3b88723967cf410b6b9e Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Sun, 6 Jul 2014 22:53:27 +0200
Subject: [PATCH] DYNDNS: Add a new option dyndns_server

Some environments use a different DNS server than identity server. For
these environments, it would be useful to be able to override the DNS
server used to perform DNS updates.

This patch adds a new option dyndns_server that, if set, would be used
to hardcode a DNS server address into the nsupdate message.
---
 src/config/SSSDConfig/__init__.py.in |  1 +
 src/config/SSSDConfigTest.py         |  2 ++
 src/config/etc/sssd.api.conf         |  1 +
 src/man/sssd-ad.5.xml                | 20 ++++++++++++++++++++
 src/man/sssd-ipa.5.xml               | 19 +++++++++++++++++++
 src/providers/ad/ad_opts.h           |  1 +
 src/providers/dp_dyndns.c            |  1 +
 src/providers/dp_dyndns.h            |  1 +
 src/providers/ipa/ipa_opts.h         |  1 +
 src/providers/ldap/sdap_dyndns.c     |  7 +++++++
 10 files changed, 54 insertions(+)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index d9b186f73220363f429b51260e6b83bd00a9cdb6..79fa892592e9c1cb9cef36d93e40b1991343b4cc 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -138,6 +138,7 @@ option_strings = {
     'dyndns_update_ptr' : _("Whether the provider should explicitly update the PTR record as well"),
     'dyndns_force_tcp' : _("Whether the nsupdate utility should default to using TCP"),
     'dyndns_auth' : _("What kind of authentication should be used to perform the DNS update"),
+    'dyndns_server' : _("Override the DNS server used to perform the DNS update"),
     'subdomain_enumerate' : _('Control enumeration of trusted domains'),
     'subdomain_refresh_interval' : _('How often should subdomains list be refreshed'),
 
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 14500031beca7b621eb6a77011e1a48fa22c2f9a..2e7c84496c61c382e67ac2b3e38cf36c69cd112b 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -517,6 +517,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
             'dyndns_update_ptr',
             'dyndns_force_tcp',
             'dyndns_auth',
+            'dyndns_server',
             'subdomain_enumerate',
             'override_gid',
             'case_sensitive',
@@ -875,6 +876,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
             'dyndns_update_ptr',
             'dyndns_force_tcp',
             'dyndns_auth',
+            'dyndns_server',
             'subdomain_enumerate',
             'override_gid',
             'case_sensitive',
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 5e5a9284e9ad80d822fe1db4269353aeb7925682..52de1bd975833c3d055bb70faaf7eb722adbaba3 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -143,6 +143,7 @@ dyndns_refresh_interval = int, None, false
 dyndns_update_ptr = bool, None, false
 dyndns_force_tcp = bool, None, false
 dyndns_auth = str, None, false
+dyndns_server = str, None, false
 
 # Special providers
 [provider/permit]
diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index 9070144ce4f478d20e93c8b7a4f732b56de98836..0526da3f9da51b75e1278fe13db85682facafe5e 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -412,6 +412,26 @@ FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)
                     </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                    <term>dyndns_server (string)</term>
+                    <listitem>
+                        <para>
+                            The DNS server to use when performing a DNS
+                            update. In most setups, it's recommended to leave
+                            this option unset.
+                        </para>
+                        <para>
+                            Setting this option makes sense for environments
+                            where the DNS server is different from the identity
+                            server.
+                        </para>
+                        <para>
+                            Default: None (let nsupdate choose the server)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+
                 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/override_homedir.xml" />
                 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/homedir_substring.xml" />
 
diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml
index dfcc595deda736fd039cd60448f55256d765d39d..858cc4f27465c97a45a1ed1de3719ea88ea8af34 100644
--- a/src/man/sssd-ipa.5.xml
+++ b/src/man/sssd-ipa.5.xml
@@ -257,6 +257,25 @@
                 </varlistentry>
 
                 <varlistentry>
+                    <term>dyndns_server (string)</term>
+                    <listitem>
+                        <para>
+                            The DNS server to use when performing a DNS
+                            update. In most setups, it's recommended to leave
+                            this option unset.
+                        </para>
+                        <para>
+                            Setting this option makes sense for environments
+                            where the DNS server is different from the identity
+                            server.
+                        </para>
+                        <para>
+                            Default: None (let nsupdate choose the server)
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
                     <term>ipa_hbac_search_base (string)</term>
                     <listitem>
                         <para>
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index b80aaddf29b7fb236d89bfb4e148bba7aeeecd14..3a2ce790714c90a340379e3d1b1e866b27dfedec 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -259,6 +259,7 @@ struct dp_option ad_dyndns_opts[] = {
     { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
+    { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/dp_dyndns.c b/src/providers/dp_dyndns.c
index a12560ecd6b8d01a463962d08994bf215d0cd5cc..9e6e02d897fc027d4531ddba1cbc9bcf6efe62a4 100644
--- a/src/providers/dp_dyndns.c
+++ b/src/providers/dp_dyndns.c
@@ -1142,6 +1142,7 @@ static struct dp_option default_dyndns_opts[] = {
     { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_FALSE },
     { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
+    { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
 
     DP_OPTION_TERMINATOR
 };
diff --git a/src/providers/dp_dyndns.h b/src/providers/dp_dyndns.h
index 1e81c9b91df9f6cbc03b261341aa79c03b6372f1..ba296b17abddb2553e7fc8c1454c7a060cbcf586 100644
--- a/src/providers/dp_dyndns.h
+++ b/src/providers/dp_dyndns.h
@@ -55,6 +55,7 @@ enum dp_dyndns_opts {
     DP_OPT_DYNDNS_UPDATE_PTR,
     DP_OPT_DYNDNS_FORCE_TCP,
     DP_OPT_DYNDNS_AUTH,
+    DP_OPT_DYNDNS_SERVER,
 
     DP_OPT_DYNDNS /* attrs counter */
 };
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index d7c2b189fad57cb60c29b56c5e351a46070349e2..b56b477dd0f6f8d2f524084b11673eaebeb8131b 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -61,6 +61,7 @@ struct dp_option ipa_dyndns_opts[] = {
     { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
     { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
+    { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     DP_OPTION_TERMINATOR
 };
 
diff --git a/src/providers/ldap/sdap_dyndns.c b/src/providers/ldap/sdap_dyndns.c
index 1c5611b048142d8514cd130a5c8b93ad210ea69a..cb4e9242fb5efcc428de4a998844c513aa806ac8 100644
--- a/src/providers/ldap/sdap_dyndns.c
+++ b/src/providers/ldap/sdap_dyndns.c
@@ -91,6 +91,7 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,
     struct tevent_req *req;
     struct tevent_req *subreq;
     struct sdap_dyndns_update_state *state;
+    const char *conf_servername;
 
     req = tevent_req_create(mem_ctx, &state, struct sdap_dyndns_update_state);
     if (req == NULL) {
@@ -109,6 +110,12 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,
     state->opts = opts;
     state->auth_type = auth_type;
 
+    conf_servername = dp_opt_get_string(opts, DP_OPT_DYNDNS_SERVER);
+    if (conf_servername != NULL) {
+        state->servername = conf_servername;
+        state->use_server_with_nsupdate = true;
+    }
+
     if (ifname) {
        /* Unless one family is restricted, just replace all
         * address families during the update
-- 
1.9.3



More information about the sssd-devel mailing list