2 Unix SMB/CIFS mplementation.
6 Copyright (C) Andrew Tridgell 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 this module auto-creates the named.conf.update file, which tells
25 bind9 what KRB5 principals it should accept for updates to our zone
27 It also uses the samba_dnsupdate script to auto-create the right DNS
28 names for ourselves as a DC in the domain, using TSIG-GSS
32 #include "dsdb/samdb/samdb.h"
33 #include "auth/auth.h"
34 #include "smbd/service.h"
35 #include "lib/messaging/irpc.h"
36 #include "param/param.h"
37 #include "system/filesys.h"
38 #include "libcli/composite/composite.h"
40 struct dnsupdate_service
{
41 struct task_server
*task
;
42 struct auth_session_info
*system_session_info
;
43 struct ldb_context
*samdb
;
45 /* status for periodic config file update */
48 struct tevent_timer
*te
;
49 struct tevent_req
*subreq
;
53 /* status for periodic DNS name check */
56 struct tevent_timer
*te
;
57 struct tevent_req
*subreq
;
58 struct tevent_req
*spnreq
;
64 called when rndc reload has finished
66 static void dnsupdate_rndc_done(struct tevent_req
*subreq
)
68 struct dnsupdate_service
*service
= tevent_req_callback_data(subreq
,
69 struct dnsupdate_service
);
73 service
->confupdate
.subreq
= NULL
;
75 ret
= samba_runcmd_recv(subreq
, &sys_errno
);
78 service
->confupdate
.status
= map_nt_error_from_unix(sys_errno
);
80 service
->confupdate
.status
= NT_STATUS_OK
;
83 if (!NT_STATUS_IS_OK(service
->confupdate
.status
)) {
84 DEBUG(0,(__location__
": Failed rndc update - %s\n",
85 nt_errstr(service
->confupdate
.status
)));
87 DEBUG(3,("Completed rndc reload OK\n"));
92 called every 'dnsupdate:conf interval' seconds
94 static void dnsupdate_rebuild(struct dnsupdate_service
*service
)
98 struct ldb_result
*res
;
99 const char *tmp_path
, *path
, *path_static
;
100 char *static_policies
;
103 const char *attrs
[] = { "sAMAccountName", NULL
};
104 const char *realm
= lp_realm(service
->task
->lp_ctx
);
105 TALLOC_CTX
*tmp_ctx
= talloc_new(service
);
106 const char * const *rndc_command
= lp_rndc_command(service
->task
->lp_ctx
);
108 /* abort any pending script run */
109 TALLOC_FREE(service
->confupdate
.subreq
);
111 ret
= ldb_search(service
->samdb
, tmp_ctx
, &res
, NULL
, LDB_SCOPE_SUBTREE
,
112 attrs
, "(&(primaryGroupID=%u)(objectClass=computer))",
114 if (ret
!= LDB_SUCCESS
) {
115 DEBUG(0,(__location__
": Unable to find DCs list - %s", ldb_errstring(service
->samdb
)));
116 talloc_free(tmp_ctx
);
120 path
= lp_parm_string(service
->task
->lp_ctx
, NULL
, "dnsupdate", "path");
122 path
= private_path(tmp_ctx
, service
->task
->lp_ctx
, "named.conf.update");
125 path_static
= lp_parm_string(service
->task
->lp_ctx
, NULL
, "dnsupdate", "extra_static_grant_rules");
126 if (path_static
== NULL
) {
127 path_static
= private_path(tmp_ctx
, service
->task
->lp_ctx
, "named.conf.update.static");
130 tmp_path
= talloc_asprintf(tmp_ctx
, "%s.tmp", path
);
131 if (path
== NULL
|| tmp_path
== NULL
|| path_static
== NULL
) {
132 DEBUG(0,(__location__
": Unable to get paths\n"));
133 talloc_free(tmp_ctx
);
137 static_policies
= file_load(path_static
, &size
, 0, tmp_ctx
);
140 fd
= open(tmp_path
, O_CREAT
|O_TRUNC
|O_WRONLY
, 0444);
142 DEBUG(1,(__location__
": Unable to open %s - %s\n", tmp_path
, strerror(errno
)));
143 talloc_free(tmp_ctx
);
147 dprintf(fd
, "/* this file is auto-generated - do not edit */\n");
148 dprintf(fd
, "update-policy {\n");
149 if( static_policies
!= NULL
) {
150 dprintf(fd
, "/* Start of static entries */\n");
151 dprintf(fd
, "%s\n",static_policies
);
152 dprintf(fd
, "/* End of static entries */\n");
154 dprintf(fd
, "\tgrant %s ms-self * A AAAA;\n", realm
);
155 dprintf(fd
, "\tgrant administrator@%s wildcard * A AAAA SRV CNAME TXT;\n", realm
);
157 for (i
=0; i
<res
->count
; i
++) {
158 const char *acctname
;
159 acctname
= ldb_msg_find_attr_as_string(res
->msgs
[i
],
160 "sAMAccountName", NULL
);
161 if (!acctname
) continue;
162 dprintf(fd
, "\tgrant %s@%s wildcard * A AAAA SRV CNAME;\n",
169 if (NT_STATUS_IS_OK(service
->confupdate
.status
) &&
170 file_compare(tmp_path
, path
) == true) {
172 talloc_free(tmp_ctx
);
176 if (rename(tmp_path
, path
) != 0) {
177 DEBUG(0,(__location__
": Failed to rename %s to %s - %s\n",
178 tmp_path
, path
, strerror(errno
)));
179 talloc_free(tmp_ctx
);
183 DEBUG(2,("Loading new DNS update grant rules\n"));
184 service
->confupdate
.subreq
= samba_runcmd_send(service
,
185 service
->task
->event_ctx
,
186 timeval_current_ofs(10, 0),
190 if (service
->confupdate
.subreq
== NULL
) {
191 DEBUG(0,(__location__
": samba_runcmd_send() failed with no memory\n"));
192 talloc_free(tmp_ctx
);
195 tevent_req_set_callback(service
->confupdate
.subreq
,
199 talloc_free(tmp_ctx
);
202 static NTSTATUS
dnsupdate_confupdate_schedule(struct dnsupdate_service
*service
);
205 called every 'dnsupdate:conf interval' seconds
207 static void dnsupdate_confupdate_handler_te(struct tevent_context
*ev
, struct tevent_timer
*te
,
208 struct timeval t
, void *ptr
)
210 struct dnsupdate_service
*service
= talloc_get_type(ptr
, struct dnsupdate_service
);
212 dnsupdate_rebuild(service
);
213 dnsupdate_confupdate_schedule(service
);
217 static NTSTATUS
dnsupdate_confupdate_schedule(struct dnsupdate_service
*service
)
219 service
->confupdate
.te
= tevent_add_timer(service
->task
->event_ctx
, service
,
220 timeval_current_ofs(service
->confupdate
.interval
, 0),
221 dnsupdate_confupdate_handler_te
, service
);
222 NT_STATUS_HAVE_NO_MEMORY(service
->confupdate
.te
);
228 called when dns update script has finished
230 static void dnsupdate_nameupdate_done(struct tevent_req
*subreq
)
232 struct dnsupdate_service
*service
= tevent_req_callback_data(subreq
,
233 struct dnsupdate_service
);
237 service
->nameupdate
.subreq
= NULL
;
239 ret
= samba_runcmd_recv(subreq
, &sys_errno
);
242 service
->nameupdate
.status
= map_nt_error_from_unix(sys_errno
);
244 service
->nameupdate
.status
= NT_STATUS_OK
;
247 if (!NT_STATUS_IS_OK(service
->nameupdate
.status
)) {
248 DEBUG(0,(__location__
": Failed DNS update - %s\n",
249 nt_errstr(service
->nameupdate
.status
)));
251 DEBUG(3,("Completed DNS update check OK\n"));
257 called when spn update script has finished
259 static void dnsupdate_spnupdate_done(struct tevent_req
*subreq
)
261 struct dnsupdate_service
*service
= tevent_req_callback_data(subreq
,
262 struct dnsupdate_service
);
266 service
->nameupdate
.spnreq
= NULL
;
268 ret
= samba_runcmd_recv(subreq
, &sys_errno
);
271 service
->nameupdate
.status
= map_nt_error_from_unix(sys_errno
);
273 service
->nameupdate
.status
= NT_STATUS_OK
;
276 if (!NT_STATUS_IS_OK(service
->nameupdate
.status
)) {
277 DEBUG(0,(__location__
": Failed SPN update - %s\n",
278 nt_errstr(service
->nameupdate
.status
)));
280 DEBUG(3,("Completed SPN update check OK\n"));
285 called every 'dnsupdate:name interval' seconds
287 static void dnsupdate_check_names(struct dnsupdate_service
*service
)
289 const char * const *dns_update_command
= lp_dns_update_command(service
->task
->lp_ctx
);
290 const char * const *spn_update_command
= lp_spn_update_command(service
->task
->lp_ctx
);
292 /* kill any existing child */
293 TALLOC_FREE(service
->nameupdate
.subreq
);
295 DEBUG(3,("Calling DNS name update script\n"));
296 service
->nameupdate
.subreq
= samba_runcmd_send(service
,
297 service
->task
->event_ctx
,
298 timeval_current_ofs(10, 0),
302 if (service
->nameupdate
.subreq
== NULL
) {
303 DEBUG(0,(__location__
": samba_runcmd_send() failed with no memory\n"));
306 tevent_req_set_callback(service
->nameupdate
.subreq
,
307 dnsupdate_nameupdate_done
,
310 DEBUG(3,("Calling SPN name update script\n"));
311 service
->nameupdate
.spnreq
= samba_runcmd_send(service
,
312 service
->task
->event_ctx
,
313 timeval_current_ofs(10, 0),
317 if (service
->nameupdate
.spnreq
== NULL
) {
318 DEBUG(0,(__location__
": samba_runcmd_send() failed with no memory\n"));
321 tevent_req_set_callback(service
->nameupdate
.spnreq
,
322 dnsupdate_spnupdate_done
,
326 static NTSTATUS
dnsupdate_nameupdate_schedule(struct dnsupdate_service
*service
);
329 called every 'dnsupdate:name interval' seconds
331 static void dnsupdate_nameupdate_handler_te(struct tevent_context
*ev
, struct tevent_timer
*te
,
332 struct timeval t
, void *ptr
)
334 struct dnsupdate_service
*service
= talloc_get_type(ptr
, struct dnsupdate_service
);
336 dnsupdate_check_names(service
);
337 dnsupdate_nameupdate_schedule(service
);
341 static NTSTATUS
dnsupdate_nameupdate_schedule(struct dnsupdate_service
*service
)
343 service
->nameupdate
.te
= tevent_add_timer(service
->task
->event_ctx
, service
,
344 timeval_current_ofs(service
->nameupdate
.interval
, 0),
345 dnsupdate_nameupdate_handler_te
, service
);
346 NT_STATUS_HAVE_NO_MEMORY(service
->nameupdate
.te
);
351 startup the dns update task
353 static void dnsupdate_task_init(struct task_server
*task
)
356 struct dnsupdate_service
*service
;
358 if (lp_server_role(task
->lp_ctx
) != ROLE_DOMAIN_CONTROLLER
) {
359 /* not useful for non-DC */
363 task_server_set_title(task
, "task[dnsupdate]");
365 service
= talloc_zero(task
, struct dnsupdate_service
);
367 task_server_terminate(task
, "dnsupdate_task_init: out of memory", true);
370 service
->task
= task
;
371 task
->private_data
= service
;
373 service
->system_session_info
= system_session(service
->task
->lp_ctx
);
374 if (!service
->system_session_info
) {
375 task_server_terminate(task
,
376 "dnsupdate: Failed to obtain server credentials\n",
381 service
->samdb
= samdb_connect(service
, service
->task
->event_ctx
, task
->lp_ctx
,
382 service
->system_session_info
);
383 if (!service
->samdb
) {
384 task_server_terminate(task
, "dnsupdate: Failed to connect to local samdb\n",
389 service
->confupdate
.interval
= lp_parm_int(task
->lp_ctx
, NULL
,
390 "dnsupdate", "config interval", 60); /* in seconds */
392 service
->nameupdate
.interval
= lp_parm_int(task
->lp_ctx
, NULL
,
393 "dnsupdate", "name interval", 600); /* in seconds */
395 dnsupdate_rebuild(service
);
396 status
= dnsupdate_confupdate_schedule(service
);
397 if (!NT_STATUS_IS_OK(status
)) {
398 task_server_terminate(task
, talloc_asprintf(task
,
399 "dnsupdate: Failed to confupdate schedule: %s\n",
400 nt_errstr(status
)), true);
404 dnsupdate_check_names(service
);
405 status
= dnsupdate_nameupdate_schedule(service
);
406 if (!NT_STATUS_IS_OK(status
)) {
407 task_server_terminate(task
, talloc_asprintf(task
,
408 "dnsupdate: Failed to nameupdate schedule: %s\n",
409 nt_errstr(status
)), true);
413 irpc_add_name(task
->msg_ctx
, "dnsupdate");
415 /* create the intial file */
416 dnsupdate_rebuild(service
);
421 register ourselves as a available server
423 NTSTATUS
server_service_dnsupdate_init(void)
425 return register_server_service("dnsupdate", dnsupdate_task_init
);