diff options
6 files changed, 250 insertions, 0 deletions
diff --git a/examples/bind9-patches/0001-leave-the-question-section-in-update-responses.patch b/examples/bind9-patches/0001-leave-the-question-section-in-update-responses.patch new file mode 100644 index 0000000000..3716dd4ab6 --- /dev/null +++ b/examples/bind9-patches/0001-leave-the-question-section-in-update-responses.patch @@ -0,0 +1,29 @@ +From 1d97835f07fd5142187629941422f87b33015414 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell <tridge@samba.org> +Date: Wed, 17 Feb 2010 10:47:59 +1100 +Subject: [PATCH 1/5] leave the question section in update responses. + +This fixes TSIG-GSS updates from windows7 and w2k8r2, which require +the question to be included in the initial refusal for the unsigned +update. +--- + lib/dns/message.c | 3 ++- + 1 files changed, 2 insertions(+), 1 deletions(-) + +diff --git a/lib/dns/message.c b/lib/dns/message.c +index b541635..ae4965f 100644 +--- a/lib/dns/message.c ++++ b/lib/dns/message.c +@@ -2474,7 +2474,8 @@ dns_message_reply(dns_message_t *msg, isc_boolean_t want_question_section) { + if (!msg->header_ok) + return (DNS_R_FORMERR); + if (msg->opcode != dns_opcode_query && +- msg->opcode != dns_opcode_notify) ++ msg->opcode != dns_opcode_notify && ++ msg->opcode != dns_opcode_update) + want_question_section = ISC_FALSE; + if (want_question_section) { + if (!msg->question_ok) +-- +1.6.3.3 + diff --git a/examples/bind9-patches/0002-prevent-a-valgrind-uninitialised-memory-warning.patch b/examples/bind9-patches/0002-prevent-a-valgrind-uninitialised-memory-warning.patch new file mode 100644 index 0000000000..22f0ce493f --- /dev/null +++ b/examples/bind9-patches/0002-prevent-a-valgrind-uninitialised-memory-warning.patch @@ -0,0 +1,34 @@ +From 31059dee4a706bb4f25f3dccaae7616451eabd8b Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell <tridge@samba.org> +Date: Wed, 17 Feb 2010 10:59:42 +1100 +Subject: [PATCH 2/5] prevent a valgrind uninitialised memory warning + +epoll uses a union, so to prevent passing uninitialised data in a +syscall we need to zero it before use. +--- + lib/isc/unix/socket.c | 2 ++ + 1 files changed, 2 insertions(+), 0 deletions(-) + +diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c +index d09fe51..4796ee4 100644 +--- a/lib/isc/unix/socket.c ++++ b/lib/isc/unix/socket.c +@@ -652,6 +652,7 @@ watch_fd(isc_socketmgr_t *manager, int fd, int msg) { + event.events = EPOLLIN; + else + event.events = EPOLLOUT; ++ memset(&event.data, 0, sizeof(event.data)); + event.data.fd = fd; + if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_ADD, fd, &event) == -1 && + errno != EEXIST) { +@@ -719,6 +720,7 @@ unwatch_fd(isc_socketmgr_t *manager, int fd, int msg) { + event.events = EPOLLIN; + else + event.events = EPOLLOUT; ++ memset(&event.data, 0, sizeof(event.data)); + event.data.fd = fd; + if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_DEL, fd, &event) == -1 && + errno != ENOENT) { +-- +1.6.3.3 + diff --git a/examples/bind9-patches/0003-don-t-compress-TSIG-names.patch b/examples/bind9-patches/0003-don-t-compress-TSIG-names.patch new file mode 100644 index 0000000000..e92dce3937 --- /dev/null +++ b/examples/bind9-patches/0003-don-t-compress-TSIG-names.patch @@ -0,0 +1,58 @@ +From ec22ed6c9797dbdcd820e352167bef8500ca00c6 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell <tridge@samba.org> +Date: Wed, 17 Feb 2010 12:20:35 +1100 +Subject: [PATCH 3/5] don't compress TSIG names + +windows DNS servers will refuse TSIG-GSS requests with compressed +names +--- + bin/nsupdate/nsupdate.c | 4 ++++ + lib/dns/message.c | 2 ++ + lib/dns/tsig.c | 3 +++ + 3 files changed, 9 insertions(+), 0 deletions(-) + +diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c +index 6cf4cf4..f7ce6db 100644 +--- a/bin/nsupdate/nsupdate.c ++++ b/bin/nsupdate/nsupdate.c +@@ -1985,6 +1985,10 @@ send_update(dns_name_t *zonename, isc_sockaddr_t *master, + fprintf(stderr, "Sending update to %s\n", addrbuf); + } + ++ /* windows doesn't like the tsig name to be compressed */ ++ if (updatemsg->tsigname) ++ updatemsg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS; ++ + result = dns_request_createvia3(requestmgr, updatemsg, srcaddr, + master, options, tsigkey, timeout, + udp_timeout, udp_retries, global_task, +diff --git a/lib/dns/message.c b/lib/dns/message.c +index ae4965f..cb4528f 100644 +--- a/lib/dns/message.c ++++ b/lib/dns/message.c +@@ -1531,6 +1531,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx, + } else if (rdtype == dns_rdatatype_tsig && msg->tsig == NULL) { + msg->tsig = rdataset; + msg->tsigname = name; ++ /* TSIG names should not be compressed */ ++ msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS; + rdataset = NULL; + free_rdataset = ISC_FALSE; + free_name = ISC_FALSE; +diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c +index 74a7af3..3223942 100644 +--- a/lib/dns/tsig.c ++++ b/lib/dns/tsig.c +@@ -889,6 +889,9 @@ dns_tsig_sign(dns_message_t *msg) { + msg->tsig = dataset; + msg->tsigname = owner; + ++ /* windows does not like the tsig name being compressed */ ++ msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS; ++ + return (ISC_R_SUCCESS); + + cleanup_rdatalist: +-- +1.6.3.3 + diff --git a/examples/bind9-patches/0004-If-tkey-gssapi-initialisation-fails-then-heck-for-th.patch b/examples/bind9-patches/0004-If-tkey-gssapi-initialisation-fails-then-heck-for-th.patch new file mode 100644 index 0000000000..3130a05fd0 --- /dev/null +++ b/examples/bind9-patches/0004-If-tkey-gssapi-initialisation-fails-then-heck-for-th.patch @@ -0,0 +1,94 @@ +From c73ceb48ffc518e171d1d40b82ae2b5f603fe038 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell <tridge@samba.org> +Date: Wed, 17 Feb 2010 15:27:44 +1100 +Subject: [PATCH 4/5] If tkey-gssapi initialisation fails, then heck for the most common + configuration errors so that the admin doesn't spend all day trying to + work out why the config is broken. + +--- + lib/dns/gssapictx.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ + 1 files changed, 48 insertions(+), 0 deletions(-) + +diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c +index 11eadb9..879393c 100644 +--- a/lib/dns/gssapictx.c ++++ b/lib/dns/gssapictx.c +@@ -66,6 +66,7 @@ + * we include SPNEGO's OID. + */ + #if defined(GSSAPI) ++#include <krb5/krb5.h> + + static unsigned char krb5_mech_oid_bytes[] = { + 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x01, 0x02, 0x02 +@@ -191,6 +192,50 @@ log_cred(const gss_cred_id_t cred) { + } + #endif + ++#ifdef GSSAPI ++/* ++ * check for the most common configuration errors. ++ * ++ * The errors checked for are: ++ * - tkey-gssapi-credential doesn't start with DNS/ ++ * - the default realm in /etc/krb5.conf and the ++ * tkey-gssapi-credential bind config option don't match ++ */ ++static void dst_gssapi_check_config(const char *gss_name) ++{ ++ const char *p; ++ krb5_context krb5_ctx; ++ char *krb5_realm = NULL; ++ ++ if (strncasecmp(gss_name, "DNS/", 4) != 0) { ++ gss_log(ISC_LOG_ERROR, "tkey-gssapi-credential (%s) should start with 'DNS/'"); ++ return; ++ } ++ ++ if (krb5_init_context(&krb5_ctx) != 0) { ++ gss_log(ISC_LOG_ERROR, "Unable to initialise krb5 context"); ++ return; ++ } ++ if (krb5_get_default_realm(krb5_ctx, &krb5_realm) != 0) { ++ gss_log(ISC_LOG_ERROR, "Unable to get krb5 default realm"); ++ krb5_free_context(krb5_ctx); ++ return; ++ } ++ if (!(p = strchr(gss_name, '/'))) { ++ gss_log(ISC_LOG_ERROR, "badly formatted tkey-gssapi-credentials (%s)", gss_name); ++ krb5_free_context(krb5_ctx); ++ return; ++ } ++ if (strcasecmp(p+1, krb5_realm) != 0) { ++ gss_log(ISC_LOG_ERROR,"default realm from krb5.conf (%s) does not match tkey-gssapi-credential (%s)", ++ krb5_realm, gss_name); ++ krb5_free_context(krb5_ctx); ++ return; ++ } ++ krb5_free_context(krb5_ctx); ++} ++#endif ++ + isc_result_t + dst_gssapi_acquirecred(dns_name_t *name, isc_boolean_t initiate, + gss_cred_id_t *cred) +@@ -223,6 +268,8 @@ dst_gssapi_acquirecred(dns_name_t *name, isc_boolean_t initiate, + gret = gss_import_name(&minor, &gnamebuf, + GSS_C_NO_OID, &gname); + if (gret != GSS_S_COMPLETE) { ++ dst_gssapi_check_config((char *)array); ++ + gss_log(3, "failed gss_import_name: %s", + gss_error_tostring(gret, minor, buf, + sizeof(buf))); +@@ -254,6 +301,7 @@ dst_gssapi_acquirecred(dns_name_t *name, isc_boolean_t initiate, + initiate ? "initiate" : "accept", + (char *)gnamebuf.value, + gss_error_tostring(gret, minor, buf, sizeof(buf))); ++ dst_gssapi_check_config((char *)array); + return (ISC_R_FAILURE); + } + +-- +1.6.3.3 + diff --git a/examples/bind9-patches/0005-windows-doesn-t-return-valid-GSSAPI-sequence-numbers.patch b/examples/bind9-patches/0005-windows-doesn-t-return-valid-GSSAPI-sequence-numbers.patch new file mode 100644 index 0000000000..a44813dd62 --- /dev/null +++ b/examples/bind9-patches/0005-windows-doesn-t-return-valid-GSSAPI-sequence-numbers.patch @@ -0,0 +1,30 @@ +From 0f6a49d9fb4a3b9f917ee9caed3a94e44db045a5 Mon Sep 17 00:00:00 2001 +From: Andrew Tridgell <tridge@samba.org> +Date: Wed, 17 Feb 2010 15:28:51 +1100 +Subject: [PATCH 5/5] windows doesn't return valid GSSAPI sequence numbers on its + TSIG-GSS DNS update replies + +--- + lib/dns/gssapictx.c | 5 ++++- + 1 files changed, 4 insertions(+), 1 deletions(-) + +diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c +index 879393c..69b66c5 100644 +--- a/lib/dns/gssapictx.c ++++ b/lib/dns/gssapictx.c +@@ -536,8 +536,11 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken, + gintokenp = NULL; + } + ++ /* note that we don't set GSS_C_SEQUENCE_FLAG as Windows DNS ++ * servers don't like it ++ */ + flags = GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG | +- GSS_C_SEQUENCE_FLAG | GSS_C_INTEG_FLAG; ++ GSS_C_INTEG_FLAG; + + gret = gss_init_sec_context(&minor, GSS_C_NO_CREDENTIAL, gssctx, + gname, GSS_SPNEGO_MECHANISM, flags, +-- +1.6.3.3 + diff --git a/examples/bind9-patches/README b/examples/bind9-patches/README new file mode 100644 index 0000000000..172d0e6740 --- /dev/null +++ b/examples/bind9-patches/README @@ -0,0 +1,5 @@ +These patches fix the TSIG-GSS dynamic DNS updates in bind9 to allow +dynamic updates to work with recent windows versions. + +The patches were developed against bind9 version 9.6.1, and were +tested on Ubuntu Karmic. |