diff options
| -rw-r--r-- | source3/utils/net_ads.c | 13 | ||||
| -rw-r--r-- | source3/utils/net_dns.c | 78 | ||||
| -rw-r--r-- | source3/utils/net_dns.h | 9 |
3 files changed, 76 insertions, 24 deletions
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c index ffb79991de..7648dc7797 100644 --- a/source3/utils/net_ads.c +++ b/source3/utils/net_ads.c @@ -1206,6 +1206,17 @@ static NTSTATUS net_update_dns_internal(struct net_context *c, for (i=0; i < ns_count; i++) { + uint32_t flags = DNS_UPDATE_SIGNED | + DNS_UPDATE_UNSIGNED | + DNS_UPDATE_UNSIGNED_SUFFICIENT | + DNS_UPDATE_PROBE | + DNS_UPDATE_PROBE_SUFFICIENT; + + if (c->opt_force) { + flags &= ~DNS_UPDATE_PROBE_SUFFICIENT; + flags &= ~DNS_UPDATE_UNSIGNED_SUFFICIENT; + } + status = NT_STATUS_UNSUCCESSFUL; /* Now perform the dns update - we'll try non-secure and if we fail, @@ -1213,7 +1224,7 @@ static NTSTATUS net_update_dns_internal(struct net_context *c, fstrcpy( dns_server, nameservers[i].hostname ); - dns_err = DoDNSUpdate(dns_server, dnsdomain, machine_name, addrs, num_addrs); + dns_err = DoDNSUpdate(dns_server, dnsdomain, machine_name, addrs, num_addrs, flags); if (ERR_DNS_IS_OK(dns_err)) { status = NT_STATUS_OK; goto done; diff --git a/source3/utils/net_dns.c b/source3/utils/net_dns.c index 437b4c1b96..9bbefdb8b1 100644 --- a/source3/utils/net_dns.c +++ b/source3/utils/net_dns.c @@ -40,6 +40,14 @@ DNS_ERROR DoDNSUpdate(char *pszServerName, OM_uint32 minor; struct dns_update_request *req, *resp; + DEBUG(10,("DoDNSUpdate called with flags: 0x%08x\n", flags)); + + if (!(flags & DNS_UPDATE_SIGNED) && + !(flags & DNS_UPDATE_UNSIGNED) && + !(flags & DNS_UPDATE_PROBE)) { + return ERROR_DNS_INVALID_PARAMETER; + } + if ( (num_addrs <= 0) || !sslist ) { return ERROR_DNS_INVALID_PARAMETER; } @@ -53,45 +61,65 @@ DNS_ERROR DoDNSUpdate(char *pszServerName, goto error; } - /* - * Probe if everything's fine - */ + if (flags & DNS_UPDATE_PROBE) { - err = dns_create_probe(mem_ctx, pszDomainName, pszHostName, - num_addrs, sslist, &req); - if (!ERR_DNS_IS_OK(err)) goto error; + /* + * Probe if everything's fine + */ - err = dns_update_transaction(mem_ctx, conn, req, &resp); - if (!ERR_DNS_IS_OK(err)) goto error; + err = dns_create_probe(mem_ctx, pszDomainName, pszHostName, + num_addrs, sslist, &req); + if (!ERR_DNS_IS_OK(err)) goto error; - if (dns_response_code(resp->flags) == DNS_NO_ERROR) { - TALLOC_FREE(mem_ctx); - return ERROR_DNS_SUCCESS; + err = dns_update_transaction(mem_ctx, conn, req, &resp); + if (!ERR_DNS_IS_OK(err)) goto error; + + if (!ERR_DNS_IS_OK(err)) { + DEBUG(3,("DoDNSUpdate: failed to probe DNS\n")); + } + + if ((dns_response_code(resp->flags) == DNS_NO_ERROR) && + (flags & DNS_UPDATE_PROBE_SUFFICIENT)) { + TALLOC_FREE(mem_ctx); + return ERROR_DNS_SUCCESS; + } } - /* - * First try without signing - */ + if (flags & DNS_UPDATE_UNSIGNED) { - err = dns_create_update_request(mem_ctx, pszDomainName, pszHostName, - sslist, num_addrs, &req); - if (!ERR_DNS_IS_OK(err)) goto error; + /* + * First try without signing + */ - err = dns_update_transaction(mem_ctx, conn, req, &resp); - if (!ERR_DNS_IS_OK(err)) goto error; + err = dns_create_update_request(mem_ctx, pszDomainName, pszHostName, + sslist, num_addrs, &req); + if (!ERR_DNS_IS_OK(err)) goto error; + + err = dns_update_transaction(mem_ctx, conn, req, &resp); + if (!ERR_DNS_IS_OK(err)) goto error; + + if (!ERR_DNS_IS_OK(err)) { + DEBUG(3,("DoDNSUpdate: unsigned update failed\n")); + } - if (dns_response_code(resp->flags) == DNS_NO_ERROR) { - TALLOC_FREE(mem_ctx); - return ERROR_DNS_SUCCESS; + if ((dns_response_code(resp->flags) == DNS_NO_ERROR) && + (flags & DNS_UPDATE_UNSIGNED_SUFFICIENT)) { + TALLOC_FREE(mem_ctx); + return ERROR_DNS_SUCCESS; + } } /* * Okay, we have to try with signing */ - { + if (flags & DNS_UPDATE_SIGNED) { gss_ctx_id_t gss_context; char *keyname; + err = dns_create_update_request(mem_ctx, pszDomainName, pszHostName, + sslist, num_addrs, &req); + if (!ERR_DNS_IS_OK(err)) goto error; + if (!(keyname = dns_generate_keyname( mem_ctx ))) { err = ERROR_DNS_NO_MEMORY; goto error; @@ -122,6 +150,10 @@ DNS_ERROR DoDNSUpdate(char *pszServerName, err = (dns_response_code(resp->flags) == DNS_NO_ERROR) ? ERROR_DNS_SUCCESS : ERROR_DNS_UPDATE_FAILED; + + if (!ERR_DNS_IS_OK(err)) { + DEBUG(3,("DoDNSUpdate: signed update failed\n")); + } } diff --git a/source3/utils/net_dns.h b/source3/utils/net_dns.h index 19bf86683e..31e541be99 100644 --- a/source3/utils/net_dns.h +++ b/source3/utils/net_dns.h @@ -19,6 +19,15 @@ along with this program. If not, see <http://www.gnu.org/licenses/>. */ +/* flags for DoDNSUpdate */ + +#define DNS_UPDATE_SIGNED 0x01 +#define DNS_UPDATE_SIGNED_SUFFICIENT 0x02 +#define DNS_UPDATE_UNSIGNED 0x04 +#define DNS_UPDATE_UNSIGNED_SUFFICIENT 0x08 +#define DNS_UPDATE_PROBE 0x10 +#define DNS_UPDATE_PROBE_SUFFICIENT 0x20 + #if defined(WITH_DNS_UPDATES) #include "../lib/addns/dns.h" |