diff options
| -rw-r--r-- | Makefile.am | 1 | ||||
| -rw-r--r-- | src/man/sssd-ad.5.xml | 90 | ||||
| -rw-r--r-- | src/providers/ad/ad_common.c | 18 | ||||
| -rw-r--r-- | src/providers/ad/ad_common.h | 13 | ||||
| -rw-r--r-- | src/providers/ad/ad_dyndns.c | 256 | ||||
| -rw-r--r-- | src/providers/ad/ad_init.c | 8 | ||||
| -rw-r--r-- | src/providers/ad/ad_opts.h | 11 | ||||
| -rw-r--r-- | src/tests/ipa_ldap_opt-tests.c | 6 |
8 files changed, 403 insertions, 0 deletions
diff --git a/Makefile.am b/Makefile.am index 5514fc02..3abea76c 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1614,6 +1614,7 @@ libsss_ad_la_SOURCES = \ src/providers/ad/ad_common.c \ src/providers/ad/ad_common.h \ src/providers/ad/ad_init.c \ + src/providers/ad/ad_dyndns.c \ src/providers/ad/ad_id.c \ src/providers/ad/ad_id.h \ src/providers/ad/ad_access.c \ diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml index 95a95f1a..c1960771 100644 --- a/src/man/sssd-ad.5.xml +++ b/src/man/sssd-ad.5.xml @@ -152,6 +152,96 @@ ldap_id_mapping = False </listitem> </varlistentry> + <varlistentry> + <term>dyndns_update (boolean)</term> + <listitem> + <para> + Optional. This option tells SSSD to automatically + update the Active Directory DNS server with + the IP address of this client. + </para> + <para> + NOTE: On older systems (such as RHEL 5), for this + behavior to work reliably, the default Kerberos + realm must be set properly in /etc/krb5.conf + </para> + <para> + Default: false + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>dyndns_ttl (integer)</term> + <listitem> + <para> + The TTL to apply to the client DNS record when updating it. + If dyndns_update is false this has no effect. This will + override the TTL serverside if set by an administrator. + </para> + <para> + Default: 3600 (seconds) + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>dyndns_iface (string)</term> + <listitem> + <para> + Optional. Applicable only when dyndns_update + is true. Choose the interface whose IP address + should be used for dynamic DNS updates. + </para> + <para> + Default: Use the IP address of the IPA LDAP connection + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>dyndns_refresh_interval (integer)</term> + <listitem> + <para> + How often should the back end perform periodic DNS update in + addition to the automatic update performed when the back end + goes online. + This option is optional and applicable only when dyndns_update + is true. + </para> + <para> + Default: 86400 (24 hours) + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>dyndns_update_ptr (bool)</term> + <listitem> + <para> + Whether the PTR record should also be explicitly + updated when updating the client's DNS records. + Applicable only when dyndns_update is true. + </para> + <para> + Default: True + </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>dyndns_force_tcp (bool)</term> + <listitem> + <para> + Whether the nsupdate utility should default to using + TCP for communicating with the DNS server. + </para> + <para> + Default: False (let nsupdate choose the protocol) + </para> + </listitem> + </varlistentry> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/override_homedir.xml" /> <varlistentry> diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c index dff1071d..e0a55c6d 100644 --- a/src/providers/ad/ad_common.c +++ b/src/providers/ad/ad_common.c @@ -23,6 +23,7 @@ #include "providers/ad/ad_common.h" #include "providers/ad/ad_opts.h" +#include "providers/dp_dyndns.h" errno_t ad_get_common_options(TALLOC_CTX *mem_ctx, @@ -698,3 +699,20 @@ done: talloc_free(tmp_ctx); return ret; } + +errno_t ad_get_dyndns_options(struct be_ctx *be_ctx, + struct ad_options *ad_opts) +{ + errno_t ret; + + ret = be_nsupdate_init(ad_opts, be_ctx, ad_dyndns_opts, ad_dyndns_timer, + ad_opts, &ad_opts->dyndns_ctx); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + ("Cannot initialize AD dyndns opts [%d]: %s\n", + ret, sss_strerror(ret))); + return ret; + } + + return EOK; +} diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h index 7be15ba9..792f32e0 100644 --- a/src/providers/ad/ad_common.h +++ b/src/providers/ad/ad_common.h @@ -64,6 +64,10 @@ struct ad_options { /* Auth and chpass Provider */ struct dp_option *auth; struct krb5_ctx *auth_ctx; + + /* Dynamic DNS updates */ + struct be_resolv_ctx *be_res; + struct be_nsupdate_ctx *dyndns_ctx; }; errno_t @@ -91,4 +95,13 @@ ad_get_auth_options(TALLOC_CTX *mem_ctx, struct be_ctx *bectx, struct dp_option **_opts); +errno_t +ad_get_dyndns_options(struct be_ctx *be_ctx, + struct ad_options *ad_opts); + +/* AD dynamic DNS updates */ +errno_t ad_dyndns_init(struct be_ctx *be_ctx, + struct ad_options *ctx); +void ad_dyndns_timer(void *pvt); + #endif /* AD_COMMON_H_ */ diff --git a/src/providers/ad/ad_dyndns.c b/src/providers/ad/ad_dyndns.c new file mode 100644 index 00000000..2b2d2462 --- /dev/null +++ b/src/providers/ad/ad_dyndns.c @@ -0,0 +1,256 @@ +/* + SSSD + + ad_dyndns.c + + Authors: + Jakub Hrozek <jhrozek@redhat.com> + + Copyright (C) 2013 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include <ctype.h> +#include "util/util.h" +#include "providers/ldap/sdap_dyndns.h" +#include "providers/data_provider.h" +#include "providers/dp_dyndns.h" +#include "providers/ad/ad_common.h" + +void ad_dyndns_update(void *pvt); + +errno_t ad_dyndns_init(struct be_ctx *be_ctx, + struct ad_options *ad_opts) +{ + errno_t ret; + + /* nsupdate is available. Dynamic updates + * are supported + */ + ret = ad_get_dyndns_options(be_ctx, ad_opts); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Could not set AD options\n")); + return ret; + } + + if (dp_opt_get_bool(ad_opts->dyndns_ctx->opts, + DP_OPT_DYNDNS_UPDATE) == false) { + DEBUG(SSSDBG_CONF_SETTINGS, ("Dynamic DNS updates not set\n")); + return EOK; + } + + DEBUG(SSSDBG_CONF_SETTINGS, + ("Dynamic DNS updates are on. Checking for nsupdate..\n")); + ret = be_nsupdate_check(); + if (ret == ENOENT) { + DEBUG(SSSDBG_MINOR_FAILURE, + ("DNS updates requested but nsupdate not available\n")); + return EOK; + } else if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("Could not check for nsupdate\n")); + return ret; + } + + ad_opts->be_res = be_ctx->be_res; + if (ad_opts->be_res == NULL) { + DEBUG(SSSDBG_OP_FAILURE, ("Resolver must be initialized in order " + "to use the AD dynamic DNS updates\n")); + return EINVAL; + } + + ret = be_add_online_cb(be_ctx, be_ctx, + ad_dyndns_update, + ad_opts, NULL); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Could not set up online callback\n")); + return ret; + } + + return EOK; +} + +static void ad_dyndns_timer_connected(struct tevent_req *req); + +void ad_dyndns_timer(void *pvt) +{ + struct ad_options *ctx = talloc_get_type(pvt, struct ad_options); + struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx; + struct tevent_req *req; + + req = sdap_dyndns_timer_conn_send(ctx, sdap_ctx->be->ev, sdap_ctx, + ctx->dyndns_ctx); + if (req == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory\n")); + /* Not much we can do. Just attempt to reschedule */ + be_nsupdate_timer_schedule(sdap_ctx->be->ev, ctx->dyndns_ctx); + return; + } + tevent_req_set_callback(req, ad_dyndns_timer_connected, ctx); +} + +static void ad_dyndns_timer_connected(struct tevent_req *req) +{ + errno_t ret; + struct ad_options *ctx = tevent_req_callback_data(req, struct ad_options); + + ret = sdap_dyndns_timer_conn_recv(req); + talloc_zfree(req); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + ("Failed to connect to AD: [%d](%s)\n", ret, sss_strerror(ret))); + return; + } + + return ad_dyndns_update(ctx); +} + +static struct tevent_req *ad_dyndns_update_send(struct ad_options *ctx); +static errno_t ad_dyndns_update_recv(struct tevent_req *req); +static void ad_dyndns_nsupdate_done(struct tevent_req *req); + +void ad_dyndns_update(void *pvt) +{ + struct ad_options *ctx = talloc_get_type(pvt, struct ad_options); + struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx; + struct tevent_req *req; + + /* Schedule timer after provider went offline */ + be_nsupdate_timer_schedule(sdap_ctx->be->ev, ctx->dyndns_ctx); + + req = ad_dyndns_update_send(ctx); + if (req == NULL) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Could not update DNS\n")); + return; + } + tevent_req_set_callback(req, ad_dyndns_nsupdate_done, NULL); +} + +static void ad_dyndns_nsupdate_done(struct tevent_req *req) +{ + int ret = ad_dyndns_update_recv(req); + talloc_free(req); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, ("Updating DNS entry failed [%d]: %s\n", + ret, sss_strerror(ret))); + return; + } + + DEBUG(SSSDBG_OP_FAILURE, ("DNS update finished\n")); +} + +struct ad_dyndns_update_state { + struct ad_options *ad_ctx; +}; + +static void ad_dyndns_sdap_update_done(struct tevent_req *subreq); + +static struct tevent_req * +ad_dyndns_update_send(struct ad_options *ctx) +{ + int ret; + struct ad_dyndns_update_state *state; + struct tevent_req *req, *subreq; + struct sdap_id_ctx *sdap_ctx = ctx->id_ctx->sdap_id_ctx; + const char *servername; + + DEBUG(SSSDBG_TRACE_FUNC, ("Performing update\n")); + + req = tevent_req_create(ctx, &state, struct ad_dyndns_update_state); + if (req == NULL) { + return NULL; + } + state->ad_ctx = ctx; + + if (ctx->dyndns_ctx->last_refresh + 60 > time(NULL) || + ctx->dyndns_ctx->timer_in_progress) { + DEBUG(SSSDBG_FUNC_DATA, ("Last periodic update ran recently or timer" + "in progress, not scheduling another update\n")); + tevent_req_done(req); + tevent_req_post(req, sdap_ctx->be->ev); + return req; + } + state->ad_ctx->dyndns_ctx->last_refresh = time(NULL); + + if (strncmp(ctx->service->sdap->uri, + "ldap://", 7) != 0) { + DEBUG(SSSDBG_CRIT_FAILURE, ("Unexpected format of LDAP URI.\n")); + ret = EIO; + goto done; + } + servername = ctx->service->sdap->uri + 7; + if (!servername) { + ret = EIO; + goto done; + } + + subreq = sdap_dyndns_update_send(state, sdap_ctx->be->ev, + sdap_ctx->be, + ctx->dyndns_ctx->opts, + sdap_ctx, + ctx->dyndns_ctx->auth_type, + dp_opt_get_string(ctx->dyndns_ctx->opts, + DP_OPT_DYNDNS_IFACE), + dp_opt_get_string(ctx->basic, + AD_HOSTNAME), + NULL, + dp_opt_get_string(ctx->basic, + AD_KRB5_REALM), + servername, + dp_opt_get_int(ctx->dyndns_ctx->opts, + DP_OPT_DYNDNS_TTL), + false); + if (!subreq) { + ret = EIO; + DEBUG(SSSDBG_OP_FAILURE, + ("sdap_id_op_connect_send failed: [%d](%s)\n", + ret, sss_strerror(ret))); + goto done; + } + tevent_req_set_callback(subreq, ad_dyndns_sdap_update_done, req); + + ret = EOK; +done: + if (ret != EOK) { + tevent_req_error(req, ret); + tevent_req_post(req, sdap_ctx->be->ev); + } + return req; +} + +static void ad_dyndns_sdap_update_done(struct tevent_req *subreq) +{ + struct tevent_req *req = tevent_req_callback_data(subreq, + struct tevent_req); + errno_t ret; + + ret = sdap_dyndns_update_recv(subreq); + talloc_zfree(subreq); + if (ret != EOK) { + DEBUG(SSSDBG_OP_FAILURE, + ("Dynamic DNS update failed [%d]: %s\n", + ret, sss_strerror(ret))); + tevent_req_error(req, ret); + return; + } + + tevent_req_done(req); +} + +static errno_t ad_dyndns_update_recv(struct tevent_req *req) +{ + TEVENT_REQ_RETURN_ON_ERROR(req); + + return EOK; +} diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c index 4d109868..7ebe2a0e 100644 --- a/src/providers/ad/ad_init.c +++ b/src/providers/ad/ad_init.c @@ -36,6 +36,7 @@ #include "providers/krb5/krb5_init_shared.h" #include "providers/ad/ad_id.h" #include "providers/ad/ad_srv.h" +#include "providers/dp_dyndns.h" struct ad_options *ad_options = NULL; @@ -166,6 +167,13 @@ sssm_ad_id_init(struct be_ctx *bectx, if (ret != EOK) goto done; } + ret = ad_dyndns_init(sdap_ctx->be, ad_options); + if (ret != EOK) { + DEBUG(SSSDBG_MINOR_FAILURE, + ("Failure setting up automatic DNS update\n")); + /* Continue without DNS updates */ + } + ret = sdap_id_setup_tasks(sdap_ctx); if (ret != EOK) { goto done; diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h index c48be867..32bbe3db 100644 --- a/src/providers/ad/ad_opts.h +++ b/src/providers/ad/ad_opts.h @@ -238,4 +238,15 @@ struct sdap_attr_map ad_autofs_entry_map[] = { SDAP_ATTR_MAP_TERMINATOR }; +struct dp_option ad_dyndns_opts[] = { + { "dyndns_update", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, + { "dyndns_refresh_interval", DP_OPT_NUMBER, { .number = 86400 }, NULL_NUMBER }, + { "dyndns_iface", DP_OPT_STRING, NULL_STRING, NULL_STRING }, + { "dyndns_ttl", DP_OPT_NUMBER, { .number = 3600 }, NULL_NUMBER }, + { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_FALSE }, + { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE }, + { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING }, + DP_OPTION_TERMINATOR +}; + #endif /* AD_OPTS_H_ */ diff --git a/src/tests/ipa_ldap_opt-tests.c b/src/tests/ipa_ldap_opt-tests.c index d1a96dc8..ea4991c8 100644 --- a/src/tests/ipa_ldap_opt-tests.c +++ b/src/tests/ipa_ldap_opt-tests.c @@ -32,6 +32,8 @@ #include "providers/ldap/ldap_opts.h" #include "providers/krb5/krb5_opts.h" #include "providers/krb5/krb5_common.h" +#include "providers/ad/ad_opts.h" +#include "providers/dp_dyndns.h" #include "tests/common.h" struct test_domain { @@ -88,6 +90,10 @@ START_TEST(test_compare_opts) ret = compare_dp_options(default_krb5_opts, KRB5_OPTS, ipa_def_krb5_opts); fail_unless(ret == EOK, "[%s]", strerror(ret)); + + ret = compare_dp_options(ipa_dyndns_opts, DP_OPT_DYNDNS, + ad_dyndns_opts); + fail_unless(ret == EOK, "[%s]", strerror(ret)); } END_TEST |