2 Unix SMB/CIFS mplementation.
6 Copyright (C) Andrew Tridgell 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 this module auto-creates the named.conf.update file, which tells
25 bind9 what KRB5 principals it should accept for updates to our zone
27 It also uses the samba_dnsupdate script to auto-create the right DNS
28 names for ourselves as a DC in the domain, using TSIG-GSS
32 #include "dsdb/samdb/samdb.h"
33 #include "auth/auth.h"
34 #include "smbd/service.h"
35 #include "lib/messaging/irpc.h"
36 #include "param/param.h"
37 #include "system/filesys.h"
38 #include "libcli/composite/composite.h"
40 struct dnsupdate_service
{
41 struct task_server
*task
;
42 struct auth_session_info
*system_session_info
;
43 struct ldb_context
*samdb
;
45 /* status for periodic config file update */
48 struct tevent_timer
*te
;
49 struct composite_context
*c
;
53 /* status for periodic DNS name check */
56 struct tevent_timer
*te
;
57 struct composite_context
*c
;
63 called when rndc reload has finished
65 static void dnsupdate_rndc_done(struct composite_context
*c
)
67 struct dnsupdate_service
*service
= talloc_get_type_abort(c
->async
.private_data
,
68 struct dnsupdate_service
);
69 service
->confupdate
.status
= composite_wait(c
);
71 service
->confupdate
.c
= NULL
;
72 if (!NT_STATUS_IS_OK(service
->confupdate
.status
)) {
73 DEBUG(0,(__location__
": Failed rndc update - %s\n",
74 nt_errstr(service
->confupdate
.status
)));
76 DEBUG(3,("Completed rndc reload OK\n"));
81 called every 'dnsupdate:conf interval' seconds
83 static void dnsupdate_rebuild(struct dnsupdate_service
*service
)
86 struct ldb_result
*res
;
87 const char *tmp_path
, *path
;
90 const char *attrs
[] = { "sAMAccountName", NULL
};
91 const char *realm
= lp_realm(service
->task
->lp_ctx
);
92 TALLOC_CTX
*tmp_ctx
= talloc_new(service
);
94 ret
= ldb_search(service
->samdb
, tmp_ctx
, &res
, NULL
, LDB_SCOPE_SUBTREE
,
95 attrs
, "(&(primaryGroupID=%u)(objectClass=computer))",
97 if (ret
!= LDB_SUCCESS
) {
98 DEBUG(0,(__location__
": Unable to find DCs list - %s", ldb_errstring(service
->samdb
)));
103 path
= lp_parm_string(service
->task
->lp_ctx
, NULL
, "dnsupdate", "path");
105 path
= private_path(tmp_ctx
, service
->task
->lp_ctx
, "named.conf.update");
108 tmp_path
= talloc_asprintf(tmp_ctx
, "%s.tmp", path
);
109 if (path
== NULL
|| tmp_path
== NULL
) {
110 DEBUG(0,(__location__
": Unable to get paths"));
111 talloc_free(tmp_ctx
);
116 fd
= open(tmp_path
, O_CREAT
|O_TRUNC
|O_WRONLY
, 0444);
118 DEBUG(1,(__location__
": Unable to open %s - %s\n", tmp_path
, strerror(errno
)));
119 talloc_free(tmp_ctx
);
123 dprintf(fd
, "/* this file is auto-generated - do not edit */\n");
124 dprintf(fd
, "update-policy {\n");
125 dprintf(fd
, "\tgrant %s ms-self * A AAAA;\n", realm
);
126 dprintf(fd
, "\tgrant administrator@%s wildcard * A AAAA SRV CNAME TXT;\n", realm
);
128 for (i
=0; i
<res
->count
; i
++) {
129 const char *acctname
;
130 acctname
= ldb_msg_find_attr_as_string(res
->msgs
[i
],
131 "sAMAccountName", NULL
);
132 if (!acctname
) continue;
133 dprintf(fd
, "\tgrant %s@%s wildcard * A AAAA SRV CNAME;\n",
139 if (service
->confupdate
.c
!= NULL
) {
140 talloc_free(service
->confupdate
.c
);
141 service
->confupdate
.c
= NULL
;
144 if (NT_STATUS_IS_OK(service
->confupdate
.status
) &&
145 file_compare(tmp_path
, path
) == true) {
147 talloc_free(tmp_ctx
);
151 if (rename(tmp_path
, path
) != 0) {
152 DEBUG(0,(__location__
": Failed to rename %s to %s - %s\n",
153 tmp_path
, path
, strerror(errno
)));
154 talloc_free(tmp_ctx
);
158 DEBUG(2,("Loading new DNS update grant rules\n"));
159 service
->confupdate
.c
= samba_runcmd(service
->task
->event_ctx
, service
,
160 timeval_current_ofs(10, 0),
162 lp_rndc_command(service
->task
->lp_ctx
),
164 service
->confupdate
.c
->async
.fn
= dnsupdate_rndc_done
;
165 service
->confupdate
.c
->async
.private_data
= service
;
167 talloc_free(tmp_ctx
);
170 static NTSTATUS
dnsupdate_confupdate_schedule(struct dnsupdate_service
*service
);
173 called every 'dnsupdate:conf interval' seconds
175 static void dnsupdate_confupdate_handler_te(struct tevent_context
*ev
, struct tevent_timer
*te
,
176 struct timeval t
, void *ptr
)
178 struct dnsupdate_service
*service
= talloc_get_type(ptr
, struct dnsupdate_service
);
180 dnsupdate_rebuild(service
);
181 dnsupdate_confupdate_schedule(service
);
185 static NTSTATUS
dnsupdate_confupdate_schedule(struct dnsupdate_service
*service
)
187 service
->confupdate
.te
= tevent_add_timer(service
->task
->event_ctx
, service
,
188 timeval_current_ofs(service
->confupdate
.interval
, 0),
189 dnsupdate_confupdate_handler_te
, service
);
190 NT_STATUS_HAVE_NO_MEMORY(service
->confupdate
.te
);
196 called when dns update script has finished
198 static void dnsupdate_nameupdate_done(struct composite_context
*c
)
200 struct dnsupdate_service
*service
= talloc_get_type_abort(c
->async
.private_data
,
201 struct dnsupdate_service
);
202 service
->nameupdate
.status
= composite_wait(c
);
204 service
->nameupdate
.c
= NULL
;
205 if (!NT_STATUS_IS_OK(service
->nameupdate
.status
)) {
206 DEBUG(0,(__location__
": Failed DNS update - %s\n",
207 nt_errstr(service
->nameupdate
.status
)));
209 DEBUG(3,("Completed DNS update check OK\n"));
214 called every 'dnsupdate:name interval' seconds
216 static void dnsupdate_check_names(struct dnsupdate_service
*service
)
218 /* kill any existing child */
219 if (service
->nameupdate
.c
!= NULL
) {
220 talloc_free(service
->nameupdate
.c
);
221 service
->nameupdate
.c
= NULL
;
224 DEBUG(3,("Calling DNS name update script\n"));
225 service
->nameupdate
.c
= samba_runcmd(service
->task
->event_ctx
, service
,
226 timeval_current_ofs(10, 0),
228 lp_dns_update_command(service
->task
->lp_ctx
),
230 service
->nameupdate
.c
->async
.fn
= dnsupdate_nameupdate_done
;
231 service
->nameupdate
.c
->async
.private_data
= service
;
234 static NTSTATUS
dnsupdate_nameupdate_schedule(struct dnsupdate_service
*service
);
237 called every 'dnsupdate:name interval' seconds
239 static void dnsupdate_nameupdate_handler_te(struct tevent_context
*ev
, struct tevent_timer
*te
,
240 struct timeval t
, void *ptr
)
242 struct dnsupdate_service
*service
= talloc_get_type(ptr
, struct dnsupdate_service
);
244 dnsupdate_check_names(service
);
245 dnsupdate_nameupdate_schedule(service
);
249 static NTSTATUS
dnsupdate_nameupdate_schedule(struct dnsupdate_service
*service
)
251 service
->nameupdate
.te
= tevent_add_timer(service
->task
->event_ctx
, service
,
252 timeval_current_ofs(service
->nameupdate
.interval
, 0),
253 dnsupdate_nameupdate_handler_te
, service
);
254 NT_STATUS_HAVE_NO_MEMORY(service
->nameupdate
.te
);
259 startup the dns update task
261 static void dnsupdate_task_init(struct task_server
*task
)
264 struct dnsupdate_service
*service
;
266 if (lp_server_role(task
->lp_ctx
) != ROLE_DOMAIN_CONTROLLER
) {
267 /* not useful for non-DC */
271 task_server_set_title(task
, "task[dnsupdate]");
273 service
= talloc_zero(task
, struct dnsupdate_service
);
275 task_server_terminate(task
, "dnsupdate_task_init: out of memory", true);
278 service
->task
= task
;
279 task
->private_data
= service
;
281 service
->system_session_info
= system_session(service
->task
->lp_ctx
);
282 if (!service
->system_session_info
) {
283 task_server_terminate(task
,
284 "dnsupdate: Failed to obtain server credentials\n",
289 service
->samdb
= samdb_connect(service
, service
->task
->event_ctx
, task
->lp_ctx
,
290 service
->system_session_info
);
291 if (!service
->samdb
) {
292 task_server_terminate(task
, "dnsupdate: Failed to connect to local samdb\n",
297 service
->confupdate
.interval
= lp_parm_int(task
->lp_ctx
, NULL
,
298 "dnsupdate", "config interval", 60); /* in seconds */
300 service
->nameupdate
.interval
= lp_parm_int(task
->lp_ctx
, NULL
,
301 "dnsupdate", "name interval", 600); /* in seconds */
303 dnsupdate_rebuild(service
);
304 status
= dnsupdate_confupdate_schedule(service
);
305 if (!NT_STATUS_IS_OK(status
)) {
306 task_server_terminate(task
, talloc_asprintf(task
,
307 "dnsupdate: Failed to confupdate schedule: %s\n",
308 nt_errstr(status
)), true);
312 dnsupdate_check_names(service
);
313 status
= dnsupdate_nameupdate_schedule(service
);
314 if (!NT_STATUS_IS_OK(status
)) {
315 task_server_terminate(task
, talloc_asprintf(task
,
316 "dnsupdate: Failed to nameupdate schedule: %s\n",
317 nt_errstr(status
)), true);
321 irpc_add_name(task
->msg_ctx
, "dnsupdate");
323 /* create the intial file */
324 dnsupdate_rebuild(service
);
329 register ourselves as a available server
331 NTSTATUS
server_service_dnsupdate_init(void)
333 return register_server_service("dnsupdate", dnsupdate_task_init
);