3 # update our DNS names using TSIG-GSS
5 # Copyright (C) Andrew Tridgell 2010
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
27 # ensure we get messages out immediately, so they get in the samba logs,
28 # and don't get swallowed by a timeout
29 os
.environ
['PYTHONUNBUFFERED'] = '1'
31 # forcing GMT avoids a problem in some timezones with kerberos. Both MIT
32 # heimdal can get mutual authentication errors due to the 24 second difference
33 # between UTC and GMT when using some zone files (eg. the PDT zone from
35 os
.environ
["TZ"] = "GMT"
37 # Find right directory when running from source tree
38 sys
.path
.insert(0, "bin/python")
42 from samba
import getopt
as options
43 from ldb
import SCOPE_BASE
44 from samba
.auth
import system_session
45 from samba
.samdb
import SamDB
46 from samba
.dcerpc
import netlogon
, winbind
48 samba
.ensure_external_module("dns", "dnspython")
56 parser
= optparse
.OptionParser("samba_dnsupdate")
57 sambaopts
= options
.SambaOptions(parser
)
58 parser
.add_option_group(sambaopts
)
59 parser
.add_option_group(options
.VersionOptions(parser
))
60 parser
.add_option("--verbose", action
="store_true")
61 parser
.add_option("--all-names", action
="store_true")
62 parser
.add_option("--all-interfaces", action
="store_true")
63 parser
.add_option("--use-file", type="string", help="Use a file, rather than real DNS calls")
64 parser
.add_option("--update-list", type="string", help="Add DNS names from the given file")
65 parser
.add_option("--fail-immediately", action
='store_true', help="Exit on first failure")
70 opts
, args
= parser
.parse_args()
76 lp
= sambaopts
.get_loadparm()
78 domain
= lp
.get("realm")
79 host
= lp
.get("netbios name")
80 if opts
.all_interfaces
:
83 all_interfaces
= False
85 IPs
= samba
.interface_ips(lp
, all_interfaces
)
86 nsupdate_cmd
= lp
.get('nsupdate command')
89 print "No IP interfaces - skipping DNS updates"
97 # we don't want link local addresses for DNS updates
104 print "IPs: %s" % IPs
106 ########################################################
107 # get credentials if we haven't got them already
108 def get_credentials(lp
):
109 from samba
import credentials
110 global ccachename
, creds
111 if creds
is not None:
113 creds
= credentials
.Credentials()
115 creds
.set_machine_account(lp
)
116 creds
.set_krb_forwardable(credentials
.NO_KRB_FORWARDABLE
)
117 (tmp_fd
, ccachename
) = tempfile
.mkstemp()
118 creds
.get_named_ccache(lp
, ccachename
)
121 #############################################
122 # an object to hold a parsed DNS line
123 class dnsobj(object):
124 def __init__(self
, string_form
):
125 list = string_form
.split()
129 self
.existing_port
= None
130 self
.existing_weight
= None
132 self
.name
= list[1].lower()
133 if self
.type == 'SRV':
134 self
.dest
= list[2].lower()
136 elif self
.type in ['A', 'AAAA']:
137 self
.ip
= list[2] # usually $IP, which gets replaced
138 elif self
.type == 'CNAME':
139 self
.dest
= list[2].lower()
141 print "Received unexpected DNS reply of type %s" % self
.type
145 if d
.type == "A": return "%s %s %s" % (self
.type, self
.name
, self
.ip
)
146 if d
.type == "AAAA": return "%s %s %s" % (self
.type, self
.name
, self
.ip
)
147 if d
.type == "SRV": return "%s %s %s %s" % (self
.type, self
.name
, self
.dest
, self
.port
)
148 if d
.type == "CNAME": return "%s %s %s" % (self
.type, self
.name
, self
.dest
)
151 ################################################
152 # parse a DNS line from
153 def parse_dns_line(line
, sub_vars
):
154 subline
= samba
.substitute_var(line
, sub_vars
)
158 ############################################
159 # see if two hostnames match
160 def hostname_match(h1
, h2
):
163 return h1
.lower().rstrip('.') == h2
.lower().rstrip('.')
166 ############################################
167 # check that a DNS entry exists
168 def check_dns_name(d
):
169 normalised_name
= d
.name
.rstrip('.') + '.'
171 print "Looking for DNS entry %s as %s" % (d
, normalised_name
)
173 if opts
.use_file
is not None:
175 dns_file
= open(opts
.use_file
, "r")
179 for line
in dns_file
:
181 if line
== '' or line
[0] == "#":
183 if line
.lower() == str(d
).lower():
188 ans
= dns
.resolver
.query(normalised_name
, d
.type)
189 except dns
.exception
.DNSException
:
191 print "Failed to find DNS entry %s" % d
193 if d
.type in ['A', 'AAAA']:
194 # we need to be sure that our IP is there
196 if str(rdata
) == str(d
.ip
):
198 if d
.type == 'CNAME':
199 for i
in range(len(ans
)):
200 if hostname_match(ans
[i
].target
, d
.dest
):
205 print "Checking %s against %s" % (rdata
, d
)
206 if hostname_match(rdata
.target
, d
.dest
):
207 if str(rdata
.port
) == str(d
.port
):
210 d
.existing_port
= str(rdata
.port
)
211 d
.existing_weight
= str(rdata
.weight
)
214 print "Failed to find matching DNS entry %s" % d
219 ###########################################
220 # get the list of substitution vars
221 def get_subst_vars():
225 samdb
= SamDB(url
=lp
.samdb_url(), session_info
=system_session(),
228 vars['DNSDOMAIN'] = lp
.get('realm').lower()
229 vars['DNSFOREST'] = lp
.get('realm').lower()
230 vars['HOSTNAME'] = lp
.get('netbios name').lower() + "." + vars['DNSDOMAIN']
231 vars['NTDSGUID'] = samdb
.get_ntds_GUID()
232 vars['SITE'] = samdb
.server_site_name()
233 res
= samdb
.search(base
=None, scope
=SCOPE_BASE
, attrs
=["objectGUID"])
234 guid
= samdb
.schema_format_value("objectGUID", res
[0]['objectGUID'][0])
235 vars['DOMAINGUID'] = guid
236 am_rodc
= samdb
.am_rodc()
241 ############################################
242 # call nsupdate for an entry
243 def call_nsupdate(d
):
244 global ccachename
, nsupdate_cmd
247 print "Calling nsupdate for %s" % d
249 if opts
.use_file
is not None:
250 wfile
= open(opts
.use_file
, 'a')
251 fcntl
.lockf(wfile
, fcntl
.LOCK_EX
)
252 wfile
.write(str(d
)+"\n")
253 fcntl
.lockf(wfile
, fcntl
.LOCK_UN
)
256 normalised_name
= d
.name
.rstrip('.') + '.'
258 (tmp_fd
, tmpfile
) = tempfile
.mkstemp()
259 f
= os
.fdopen(tmp_fd
, 'w')
261 f
.write("update add %s %u A %s\n" % (normalised_name
, default_ttl
, d
.ip
))
263 f
.write("update add %s %u AAAA %s\n" % (normalised_name
, default_ttl
, d
.ip
))
265 if d
.existing_port
is not None:
266 f
.write("update delete %s SRV 0 %s %s %s\n" % (normalised_name
, d
.existing_weight
,
267 d
.existing_port
, d
.dest
))
268 f
.write("update add %s %u SRV 0 100 %s %s\n" % (normalised_name
, default_ttl
, d
.port
, d
.dest
))
269 if d
.type == "CNAME":
270 f
.write("update add %s %u CNAME %s\n" % (normalised_name
, default_ttl
, d
.dest
))
277 os
.environ
["KRB5CCNAME"] = ccachename
279 cmd
= nsupdate_cmd
[:]
281 ret
= subprocess
.call(cmd
, shell
=False)
283 if opts
.fail_immediately
:
285 error_count
= error_count
+ 1
287 print("Failed nsupdate: %d" % ret
)
288 except Exception, estr
:
289 if opts
.fail_immediately
:
291 error_count
= error_count
+ 1
293 print("Failed nsupdate: %s : %s" % (str(d
), estr
))
298 def rodc_dns_update(d
, t
):
299 '''a single DNS update via the RODC netlogon call'''
303 print "Calling netlogon RODC update for %s" % d
306 netlogon
.NlDnsLdapAtSite
: netlogon
.NlDnsInfoTypeNone
,
307 netlogon
.NlDnsGcAtSite
: netlogon
.NlDnsDomainNameAlias
,
308 netlogon
.NlDnsDsaCname
: netlogon
.NlDnsDomainNameAlias
,
309 netlogon
.NlDnsKdcAtSite
: netlogon
.NlDnsInfoTypeNone
,
310 netlogon
.NlDnsDcAtSite
: netlogon
.NlDnsInfoTypeNone
,
311 netlogon
.NlDnsRfc1510KdcAtSite
: netlogon
.NlDnsInfoTypeNone
,
312 netlogon
.NlDnsGenericGcAtSite
: netlogon
.NlDnsDomainNameAlias
315 w
= winbind
.winbind("irpc:winbind_server", lp
)
316 dns_names
= netlogon
.NL_DNS_NAME_INFO_ARRAY()
318 name
= netlogon
.NL_DNS_NAME_INFO()
320 name
.dns_domain_info_type
= typemap
[t
]
323 if d
.port
is not None:
324 name
.port
= int(d
.port
)
325 name
.dns_register
= True
326 dns_names
.names
= [ name
]
327 site_name
= sub_vars
['SITE'].decode('utf-8')
332 ret_names
= w
.DsrUpdateReadOnlyServerDnsRecords(site_name
, default_ttl
, dns_names
)
333 if ret_names
.names
[0].status
!= 0:
334 print("Failed to set DNS entry: %s (status %u)" % (d
, ret_names
.names
[0].status
))
335 error_count
= error_count
+ 1
336 except RuntimeError, reason
:
337 print("Error setting DNS entry of type %u: %s: %s" % (t
, d
, reason
))
338 error_count
= error_count
+ 1
340 if error_count
!= 0 and opts
.fail_immediately
:
344 def call_rodc_update(d
):
345 '''RODCs need to use the netlogon API for nsupdate'''
348 # we expect failure for 3268 if we aren't a GC
349 if d
.port
is not None and int(d
.port
) == 3268:
352 # map the DNS request to a netlogon update type
354 netlogon
.NlDnsLdapAtSite
: '_ldap._tcp.${SITE}._sites.${DNSDOMAIN}',
355 netlogon
.NlDnsGcAtSite
: '_ldap._tcp.${SITE}._sites.gc._msdcs.${DNSDOMAIN}',
356 netlogon
.NlDnsDsaCname
: '${NTDSGUID}._msdcs.${DNSFOREST}',
357 netlogon
.NlDnsKdcAtSite
: '_kerberos._tcp.${SITE}._sites.dc._msdcs.${DNSDOMAIN}',
358 netlogon
.NlDnsDcAtSite
: '_ldap._tcp.${SITE}._sites.dc._msdcs.${DNSDOMAIN}',
359 netlogon
.NlDnsRfc1510KdcAtSite
: '_kerberos._tcp.${SITE}._sites.${DNSDOMAIN}',
360 netlogon
.NlDnsGenericGcAtSite
: '_gc._tcp.${SITE}._sites.${DNSFOREST}'
364 subname
= samba
.substitute_var(map[t
], sub_vars
)
365 if subname
.lower() == d
.name
.lower():
366 # found a match - do the update
367 rodc_dns_update(d
, t
)
370 print("Unable to map to netlogon DNS update: %s" % d
)
373 # get the list of DNS entries we should have
375 dns_update_list
= opts
.update_list
377 dns_update_list
= lp
.private_path('dns_update_list')
379 # use our private krb5.conf to avoid problems with the wrong domain
380 # bind9 nsupdate wants the default domain set
381 krb5conf
= lp
.private_path('krb5.conf')
382 os
.environ
['KRB5_CONFIG'] = krb5conf
384 file = open(dns_update_list
, "r")
386 # get the substitution dictionary
387 sub_vars
= get_subst_vars()
389 # build up a list of update commands to pass to nsupdate
393 # read each line, and check that the DNS name exists
396 if line
== '' or line
[0] == "#":
398 d
= parse_dns_line(line
, sub_vars
)
399 if d
.type == 'A' and len(IP4s
) == 0:
401 if d
.type == 'AAAA' and len(IP6s
) == 0:
405 # now expand the entries, if any are A record with ip set to $IP
406 # then replace with multiple entries, one for each interface IP
412 for i
in range(len(IP4s
)-1):
418 for i
in range(len(IP6s
)-1):
423 # now check if the entries already exist on the DNS server
425 if opts
.all_names
or not check_dns_name(d
):
426 update_list
.append(d
)
428 if len(update_list
) == 0:
430 print "No DNS updates needed"
436 # ask nsupdate to add entries as needed
437 for d
in update_list
:
439 if d
.name
.lower() == domain
.lower():
441 if not d
.type in [ 'A', 'AAAA' ]:
448 # delete the ccache if we created it
449 if ccachename
is not None:
450 os
.unlink(ccachename
)
453 print("Failed update of %u entries" % error_count
)
454 sys
.exit(error_count
)