4 # update our DNS names using TSIG-GSS
6 # Copyright (C) Andrew Tridgell 2010
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
28 # ensure we get messages out immediately, so they get in the samba logs,
29 # and don't get swallowed by a timeout
30 os
.environ
['PYTHONUNBUFFERED'] = '1'
32 # forcing GMT avoids a problem in some timezones with kerberos. Both MIT
33 # heimdal can get mutual authentication errors due to the 24 second difference
34 # between UTC and GMT when using some zone files (eg. the PDT zone from
36 os
.environ
["TZ"] = "GMT"
38 # Find right directory when running from source tree
39 sys
.path
.insert(0, "bin/python")
43 from samba
import getopt
as options
44 from ldb
import SCOPE_BASE
45 from samba
.auth
import system_session
46 from samba
.samdb
import SamDB
47 from samba
.dcerpc
import netlogon
, winbind
49 samba
.ensure_external_module("dns", "dnspython")
57 parser
= optparse
.OptionParser("samba_dnsupdate")
58 sambaopts
= options
.SambaOptions(parser
)
59 parser
.add_option_group(sambaopts
)
60 parser
.add_option_group(options
.VersionOptions(parser
))
61 parser
.add_option("--verbose", action
="store_true")
62 parser
.add_option("--all-names", action
="store_true")
63 parser
.add_option("--all-interfaces", action
="store_true")
64 parser
.add_option("--use-file", type="string", help="Use a file, rather than real DNS calls")
65 parser
.add_option("--update-list", type="string", help="Add DNS names from the given file")
66 parser
.add_option("--update-cache", type="string", help="Cache database of already registered records")
67 parser
.add_option("--fail-immediately", action
='store_true', help="Exit on first failure")
68 parser
.add_option("--no-credentials", dest
='nocreds', action
='store_true', help="don't try and get credentials")
69 parser
.add_option("--no-substiutions", dest
='nosubs', action
='store_true', help="don't try and expands variables in file specified by --update-list")
74 opts
, args
= parser
.parse_args()
80 lp
= sambaopts
.get_loadparm()
82 domain
= lp
.get("realm")
83 host
= lp
.get("netbios name")
84 if opts
.all_interfaces
:
87 all_interfaces
= False
89 IPs
= samba
.interface_ips(lp
, all_interfaces
)
90 nsupdate_cmd
= lp
.get('nsupdate command')
93 print "No IP interfaces - skipping DNS updates"
106 print "IPs: %s" % IPs
109 def get_credentials(lp
):
110 """# get credentials if we haven't got them already."""
111 from samba
import credentials
112 global ccachename
, creds
113 if creds
is not None:
115 creds
= credentials
.Credentials()
117 creds
.set_machine_account(lp
)
118 creds
.set_krb_forwardable(credentials
.NO_KRB_FORWARDABLE
)
119 (tmp_fd
, ccachename
) = tempfile
.mkstemp()
121 creds
.get_named_ccache(lp
, ccachename
)
122 except RuntimeError as e
:
123 os
.unlink(ccachename
)
127 class dnsobj(object):
128 """an object to hold a parsed DNS line"""
130 def __init__(self
, string_form
):
131 list = string_form
.split()
133 raise Exception("Invalid DNS entry %r" % string_form
)
137 self
.existing_port
= None
138 self
.existing_weight
= None
141 if self
.type == 'SRV':
143 raise Exception("Invalid DNS entry %r" % string_form
)
146 elif self
.type in ['A', 'AAAA']:
147 self
.ip
= list[2] # usually $IP, which gets replaced
148 elif self
.type == 'CNAME':
150 elif self
.type == 'NS':
153 raise Exception("Received unexpected DNS reply of type %s: %s" % (self
.type, string_form
))
157 return "%s %s %s" % (self
.type, self
.name
, self
.ip
)
158 if self
.type == "AAAA":
159 return "%s %s %s" % (self
.type, self
.name
, self
.ip
)
160 if self
.type == "SRV":
161 return "%s %s %s %s" % (self
.type, self
.name
, self
.dest
, self
.port
)
162 if self
.type == "CNAME":
163 return "%s %s %s" % (self
.type, self
.name
, self
.dest
)
164 if self
.type == "NS":
165 return "%s %s %s" % (self
.type, self
.name
, self
.dest
)
168 def parse_dns_line(line
, sub_vars
):
169 """parse a DNS line from."""
170 if line
.startswith("SRV _ldap._tcp.pdc._msdcs.") and not samdb
.am_pdc():
172 print "Skipping PDC entry (%s) as we are not a PDC" % line
174 subline
= samba
.substitute_var(line
, sub_vars
)
175 return dnsobj(subline
)
178 def hostname_match(h1
, h2
):
179 """see if two hostnames match."""
182 return h1
.lower().rstrip('.') == h2
.lower().rstrip('.')
185 def check_dns_name(d
):
186 """check that a DNS entry exists."""
187 normalised_name
= d
.name
.rstrip('.') + '.'
189 print "Looking for DNS entry %s as %s" % (d
, normalised_name
)
191 if opts
.use_file
is not None:
193 dns_file
= open(opts
.use_file
, "r")
197 for line
in dns_file
:
199 if line
== '' or line
[0] == "#":
201 if line
.lower() == str(d
).lower():
205 resolver
= dns
.resolver
.Resolver()
207 # we need to lookup the nameserver for the parent domain,
208 # and use that to check the NS record
209 parent_domain
= '.'.join(normalised_name
.split('.')[1:])
211 ans
= resolver
.query(parent_domain
, 'NS')
212 except dns
.exception
.DNSException
:
214 print "Failed to find parent NS for %s" % d
217 for i
in range(len(ans
)):
219 ns
= resolver
.query(str(ans
[i
]), 'A')
220 except dns
.exception
.DNSException
:
222 for j
in range(len(ns
)):
223 nameservers
.add(str(ns
[j
]))
224 d
.nameservers
= list(nameservers
)
227 if getattr(d
, 'nameservers', None):
228 resolver
.nameservers
= list(d
.nameservers
)
229 ans
= resolver
.query(normalised_name
, d
.type)
230 except dns
.exception
.DNSException
:
232 print "Failed to find DNS entry %s" % d
234 if d
.type in ['A', 'AAAA']:
235 # we need to be sure that our IP is there
237 if str(rdata
) == str(d
.ip
):
239 elif d
.type == 'CNAME':
240 for i
in range(len(ans
)):
241 if hostname_match(ans
[i
].target
, d
.dest
):
244 for i
in range(len(ans
)):
245 if hostname_match(ans
[i
].target
, d
.dest
):
247 elif d
.type == 'SRV':
250 print "Checking %s against %s" % (rdata
, d
)
251 if hostname_match(rdata
.target
, d
.dest
):
252 if str(rdata
.port
) == str(d
.port
):
255 d
.existing_port
= str(rdata
.port
)
256 d
.existing_weight
= str(rdata
.weight
)
259 print "Failed to find matching DNS entry %s" % d
264 def get_subst_vars(samdb
):
265 """get the list of substitution vars."""
269 vars['DNSDOMAIN'] = samdb
.domain_dns_name()
270 vars['DNSFOREST'] = samdb
.forest_dns_name()
271 vars['HOSTNAME'] = samdb
.host_dns_name()
272 vars['NTDSGUID'] = samdb
.get_ntds_GUID()
273 vars['SITE'] = samdb
.server_site_name()
274 res
= samdb
.search(base
=samdb
.get_default_basedn(), scope
=SCOPE_BASE
, attrs
=["objectGUID"])
275 guid
= samdb
.schema_format_value("objectGUID", res
[0]['objectGUID'][0])
276 vars['DOMAINGUID'] = guid
277 am_rodc
= samdb
.am_rodc()
282 def call_nsupdate(d
, op
="add"):
283 """call nsupdate for an entry."""
284 global ccachename
, nsupdate_cmd
, krb5conf
286 assert(op
in ["add", "delete"])
289 print "Calling nsupdate for %s (%s)" % (d
, op
)
291 if opts
.use_file
is not None:
293 rfile
= open(opts
.use_file
, 'r+')
296 rfile
= open(opts
.use_file
, 'w+')
297 # Open it for reading again, in case someone else got to it first
298 rfile
= open(opts
.use_file
, 'r+')
299 fcntl
.lockf(rfile
, fcntl
.LOCK_EX
)
300 (file_dir
, file_name
) = os
.path
.split(opts
.use_file
)
301 (tmp_fd
, tmpfile
) = tempfile
.mkstemp(dir=file_dir
, prefix
=file_name
, suffix
="XXXXXX")
302 wfile
= os
.fdopen(tmp_fd
, 'a')
306 l
= parse_dns_line(line
, {})
307 if str(l
).lower() == str(d
).lower():
311 wfile
.write(str(d
)+"\n")
312 os
.rename(tmpfile
, opts
.use_file
)
313 fcntl
.lockf(rfile
, fcntl
.LOCK_UN
)
316 normalised_name
= d
.name
.rstrip('.') + '.'
318 (tmp_fd
, tmpfile
) = tempfile
.mkstemp()
319 f
= os
.fdopen(tmp_fd
, 'w')
320 if getattr(d
, 'nameservers', None):
321 f
.write('server %s\n' % d
.nameservers
[0])
323 f
.write("update %s %s %u A %s\n" % (op
, normalised_name
, default_ttl
, d
.ip
))
325 f
.write("update %s %s %u AAAA %s\n" % (op
, normalised_name
, default_ttl
, d
.ip
))
327 if op
== "add" and d
.existing_port
is not None:
328 f
.write("update delete %s SRV 0 %s %s %s\n" % (normalised_name
, d
.existing_weight
,
329 d
.existing_port
, d
.dest
))
330 f
.write("update %s %s %u SRV 0 100 %s %s\n" % (op
, normalised_name
, default_ttl
, d
.port
, d
.dest
))
331 if d
.type == "CNAME":
332 f
.write("update %s %s %u CNAME %s\n" % (op
, normalised_name
, default_ttl
, d
.dest
))
334 f
.write("update %s %s %u NS %s\n" % (op
, normalised_name
, default_ttl
, d
.dest
))
342 os
.environ
["KRB5CCNAME"] = ccachename
344 cmd
= nsupdate_cmd
[:]
348 env
["KRB5_CONFIG"] = krb5conf
350 env
["KRB5CCNAME"] = ccachename
351 ret
= subprocess
.call(cmd
, shell
=False, env
=env
)
353 if opts
.fail_immediately
:
355 print("Failed update with %s" % tmpfile
)
357 error_count
= error_count
+ 1
359 print("Failed nsupdate: %d" % ret
)
360 except Exception, estr
:
361 if opts
.fail_immediately
:
363 error_count
= error_count
+ 1
365 print("Failed nsupdate: %s : %s" % (str(d
), estr
))
370 def rodc_dns_update(d
, t
, op
):
371 '''a single DNS update via the RODC netlogon call'''
374 assert(op
in ["add", "delete"])
377 print "Calling netlogon RODC update for %s" % d
380 netlogon
.NlDnsLdapAtSite
: netlogon
.NlDnsInfoTypeNone
,
381 netlogon
.NlDnsGcAtSite
: netlogon
.NlDnsDomainNameAlias
,
382 netlogon
.NlDnsDsaCname
: netlogon
.NlDnsDomainNameAlias
,
383 netlogon
.NlDnsKdcAtSite
: netlogon
.NlDnsInfoTypeNone
,
384 netlogon
.NlDnsDcAtSite
: netlogon
.NlDnsInfoTypeNone
,
385 netlogon
.NlDnsRfc1510KdcAtSite
: netlogon
.NlDnsInfoTypeNone
,
386 netlogon
.NlDnsGenericGcAtSite
: netlogon
.NlDnsDomainNameAlias
389 w
= winbind
.winbind("irpc:winbind_server", lp
)
390 dns_names
= netlogon
.NL_DNS_NAME_INFO_ARRAY()
392 name
= netlogon
.NL_DNS_NAME_INFO()
394 name
.dns_domain_info_type
= typemap
[t
]
397 if d
.port
is not None:
398 name
.port
= int(d
.port
)
400 name
.dns_register
= True
402 name
.dns_register
= False
403 dns_names
.names
= [ name
]
404 site_name
= sub_vars
['SITE'].decode('utf-8')
409 ret_names
= w
.DsrUpdateReadOnlyServerDnsRecords(site_name
, default_ttl
, dns_names
)
410 if ret_names
.names
[0].status
!= 0:
411 print("Failed to set DNS entry: %s (status %u)" % (d
, ret_names
.names
[0].status
))
412 error_count
= error_count
+ 1
413 except RuntimeError, reason
:
414 print("Error setting DNS entry of type %u: %s: %s" % (t
, d
, reason
))
415 error_count
= error_count
+ 1
417 if error_count
!= 0 and opts
.fail_immediately
:
421 def call_rodc_update(d
, op
="add"):
422 '''RODCs need to use the netlogon API for nsupdate'''
425 assert(op
in ["add", "delete"])
427 # we expect failure for 3268 if we aren't a GC
428 if d
.port
is not None and int(d
.port
) == 3268:
431 # map the DNS request to a netlogon update type
433 netlogon
.NlDnsLdapAtSite
: '_ldap._tcp.${SITE}._sites.${DNSDOMAIN}',
434 netlogon
.NlDnsGcAtSite
: '_ldap._tcp.${SITE}._sites.gc._msdcs.${DNSDOMAIN}',
435 netlogon
.NlDnsDsaCname
: '${NTDSGUID}._msdcs.${DNSFOREST}',
436 netlogon
.NlDnsKdcAtSite
: '_kerberos._tcp.${SITE}._sites.dc._msdcs.${DNSDOMAIN}',
437 netlogon
.NlDnsDcAtSite
: '_ldap._tcp.${SITE}._sites.dc._msdcs.${DNSDOMAIN}',
438 netlogon
.NlDnsRfc1510KdcAtSite
: '_kerberos._tcp.${SITE}._sites.${DNSDOMAIN}',
439 netlogon
.NlDnsGenericGcAtSite
: '_gc._tcp.${SITE}._sites.${DNSFOREST}'
443 subname
= samba
.substitute_var(map[t
], sub_vars
)
444 if subname
.lower() == d
.name
.lower():
445 # found a match - do the update
446 rodc_dns_update(d
, t
, op
)
449 print("Unable to map to netlogon DNS update: %s" % d
)
452 # get the list of DNS entries we should have
454 dns_update_list
= opts
.update_list
456 dns_update_list
= lp
.private_path('dns_update_list')
458 if opts
.update_cache
:
459 dns_update_cache
= opts
.update_cache
461 dns_update_cache
= lp
.private_path('dns_update_cache')
463 # use our private krb5.conf to avoid problems with the wrong domain
464 # bind9 nsupdate wants the default domain set
465 krb5conf
= lp
.private_path('krb5.conf')
466 os
.environ
['KRB5_CONFIG'] = krb5conf
468 file = open(dns_update_list
, "r")
473 samdb
= SamDB(url
=lp
.samdb_url(), session_info
=system_session(), lp
=lp
)
475 # get the substitution dictionary
476 sub_vars
= get_subst_vars(samdb
)
478 # build up a list of update commands to pass to nsupdate
487 rebuild_cache
= False
489 cfile
= open(dns_update_cache
, 'r+')
492 cfile
= open(dns_update_cache
, 'w+')
493 # Open it for reading again, in case someone else got to it first
494 cfile
= open(dns_update_cache
, 'r+')
495 fcntl
.lockf(cfile
, fcntl
.LOCK_EX
)
498 if line
== '' or line
[0] == "#":
500 c
= parse_dns_line(line
, {})
503 if str(c
) not in cache_set
:
505 cache_set
.add(str(c
))
507 # read each line, and check that the DNS name exists
510 if line
== '' or line
[0] == "#":
512 d
= parse_dns_line(line
, sub_vars
)
515 if d
.type == 'A' and len(IP4s
) == 0:
517 if d
.type == 'AAAA' and len(IP6s
) == 0:
519 if str(d
) not in dup_set
:
523 # now expand the entries, if any are A record with ip set to $IP
524 # then replace with multiple entries, one for each interface IP
530 for i
in range(len(IP4s
)-1):
536 for i
in range(len(IP6s
)-1):
541 # now check if the entries already exist on the DNS server
545 if str(c
).lower() == str(d
).lower():
550 if opts
.all_names
or not check_dns_name(d
):
551 update_list
.append(d
)
556 if str(c
).lower() == str(d
).lower():
562 if not opts
.all_names
and not check_dns_name(c
):
564 delete_list
.append(c
)
566 if len(delete_list
) == 0 and len(update_list
) == 0 and not rebuild_cache
:
568 print "No DNS updates needed"
572 if len(delete_list
) != 0 or len(update_list
) != 0:
576 # ask nsupdate to delete entries as needed
577 for d
in delete_list
:
579 if d
.name
.lower() == domain
.lower():
581 if not d
.type in [ 'A', 'AAAA' ]:
582 call_rodc_update(d
, op
="delete")
584 call_nsupdate(d
, op
="delete")
586 call_nsupdate(d
, op
="delete")
588 # ask nsupdate to add entries as needed
589 for d
in update_list
:
591 if d
.name
.lower() == domain
.lower():
593 if not d
.type in [ 'A', 'AAAA' ]:
601 (file_dir
, file_name
) = os
.path
.split(dns_update_cache
)
602 (tmp_fd
, tmpfile
) = tempfile
.mkstemp(dir=file_dir
, prefix
=file_name
, suffix
="XXXXXX")
603 wfile
= os
.fdopen(tmp_fd
, 'a')
605 wfile
.write(str(d
)+"\n")
606 os
.rename(tmpfile
, dns_update_cache
)
607 fcntl
.lockf(cfile
, fcntl
.LOCK_UN
)
609 # delete the ccache if we created it
610 if ccachename
is not None:
611 os
.unlink(ccachename
)
614 print("Failed update of %u entries" % error_count
)
615 sys
.exit(error_count
)