3 # update our DNS names using TSIG-GSS
5 # Copyright (C) Andrew Tridgell 2010
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
26 # ensure we get messages out immediately, so they get in the samba logs,
27 # and don't get swallowed by a timeout
28 os
.putenv('PYTHONUNBUFFERED', '1')
30 # Find right directory when running from source tree
31 sys
.path
.insert(0, "bin/python")
35 from samba
import getopt
as options
36 from ldb
import SCOPE_BASE
37 from samba
.auth
import system_session
38 from samba
.samdb
import SamDB
40 samba
.ensure_external_module("dns", "dnspython")
41 import dns
.resolver
as resolver
45 parser
= optparse
.OptionParser("samba_dnsupdate")
46 sambaopts
= options
.SambaOptions(parser
)
47 parser
.add_option_group(sambaopts
)
48 parser
.add_option_group(options
.VersionOptions(parser
))
49 parser
.add_option("--verbose", action
="store_true")
50 parser
.add_option("--all-interfaces", action
="store_true")
51 parser
.add_option("--use-file", type="string", help="Use a file, rather than real DNS calls")
56 opts
, args
= parser
.parse_args()
62 lp
= sambaopts
.get_loadparm()
64 domain
= lp
.get("realm")
65 host
= lp
.get("netbios name")
66 if opts
.all_interfaces
:
69 all_interfaces
= False
71 IPs
= samba
.interface_ips(lp
, all_interfaces
)
72 nsupdate_cmd
= lp
.get('nsupdate command')
75 print "No IP interfaces - skipping DNS updates"
80 ########################################################
81 # get credentials if we haven't got them already
82 def get_credentials(lp
):
83 from samba
.credentials
import Credentials
84 global ccachename
, creds
89 creds
.set_machine_account(lp
)
90 (tmp_fd
, ccachename
) = tempfile
.mkstemp()
91 creds
.get_named_ccache(lp
, ccachename
)
94 #############################################
95 # an object to hold a parsed DNS line
97 def __init__(self
, string_form
):
98 list = string_form
.split()
102 self
.existing_port
= None
103 self
.existing_weight
= None
106 if self
.type == 'SRV':
109 elif self
.type == 'A':
110 self
.ip
= list[2] # usually $IP, which gets replaced
111 elif self
.type == 'CNAME':
114 print "Received unexpected DNS reply of type %s" % self
.type
118 if d
.type == "A": return "%s %s %s" % (self
.type, self
.name
, self
.ip
)
119 if d
.type == "SRV": return "%s %s %s %s" % (self
.type, self
.name
, self
.dest
, self
.port
)
120 if d
.type == "CNAME": return "%s %s %s" % (self
.type, self
.name
, self
.dest
)
123 ################################################
124 # parse a DNS line from
125 def parse_dns_line(line
, sub_vars
):
126 subline
= samba
.substitute_var(line
, sub_vars
)
130 ############################################
131 # see if two hostnames match
132 def hostname_match(h1
, h2
):
135 return h1
.lower().rstrip('.') == h2
.lower().rstrip('.')
138 ############################################
139 # check that a DNS entry exists
140 def check_dns_name(d
):
141 normalised_name
= d
.name
.rstrip('.') + '.'
143 print "Looking for DNS entry %s as %s" % (d
, normalised_name
)
145 if opts
.use_file
is not None:
147 dns_file
= open(opts
.use_file
, "r")
151 for line
in dns_file
:
153 if line
== '' or line
[0] == "#":
155 if line
.lower() == str(d
).lower():
160 ans
= resolver
.query(normalised_name
, d
.type)
161 except resolver
.NXDOMAIN
:
164 # we need to be sure that our IP is there
166 if str(rdata
) == str(d
.ip
):
168 if d
.type == 'CNAME':
169 for i
in range(len(ans
)):
170 if hostname_match(ans
[i
].target
, d
.dest
):
175 print "Checking %s against %s" % (rdata
, d
)
176 if hostname_match(rdata
.target
, d
.dest
):
177 if str(rdata
.port
) == str(d
.port
):
180 d
.existing_port
= str(rdata
.port
)
181 d
.existing_weight
= str(rdata
.weight
)
183 print "Failed to find DNS entry %s" % d
188 ###########################################
189 # get the list of substitution vars
190 def get_subst_vars():
194 samdb
= SamDB(url
=lp
.get("sam database"), session_info
=system_session(),
197 vars['DNSDOMAIN'] = lp
.get('realm').lower()
198 vars['HOSTNAME'] = lp
.get('netbios name').lower() + "." + vars['DNSDOMAIN']
199 vars['NTDSGUID'] = samdb
.get_ntds_GUID()
200 vars['SITE'] = samdb
.server_site_name()
201 res
= samdb
.search(base
=None, scope
=SCOPE_BASE
, attrs
=["objectGUID"])
202 guid
= samdb
.schema_format_value("objectGUID", res
[0]['objectGUID'][0])
203 vars['DOMAINGUID'] = guid
207 ############################################
208 # call nsupdate for an entry
209 def call_nsupdate(d
):
210 global ccachename
, nsupdate_cmd
213 print "Calling nsupdate for %s" % d
215 if opts
.use_file
is not None:
216 wfile
= open(opts
.use_file
, 'a')
217 fcntl
.lockf(wfile
, fcntl
.LOCK_EX
)
218 wfile
.write(str(d
)+"\n")
219 fcntl
.lockf(wfile
, fcntl
.LOCK_UN
)
222 (tmp_fd
, tmpfile
) = tempfile
.mkstemp()
223 f
= os
.fdopen(tmp_fd
, 'w')
225 f
.write("update add %s %u A %s\n" % (d
.name
, default_ttl
, d
.ip
))
227 if d
.existing_port
is not None:
228 f
.write("update delete %s SRV 0 %s %s %s\n" % (d
.name
, d
.existing_weight
,
229 d
.existing_port
, d
.dest
))
230 f
.write("update add %s %u SRV 0 100 %s %s\n" % (d
.name
, default_ttl
, d
.port
, d
.dest
))
231 if d
.type == "CNAME":
232 f
.write("update add %s %u CNAME %s\n" % (d
.name
, default_ttl
, d
.dest
))
238 os
.putenv("KRB5CCNAME", ccachename
)
239 os
.system("%s %s" % (nsupdate_cmd
, tmpfile
))
243 # get the list of DNS entries we should have
244 dns_update_list
= lp
.private_path('dns_update_list')
246 file = open(dns_update_list
, "r")
248 # get the substitution dictionary
249 sub_vars
= get_subst_vars()
251 # build up a list of update commands to pass to nsupdate
255 # read each line, and check that the DNS name exists
258 if line
== '' or line
[0] == "#":
260 d
= parse_dns_line(line
, sub_vars
)
263 # now expand the entries, if any are A record with ip set to $IP
264 # then replace with multiple entries, one for each interface IP
266 if d
.type == 'A' and d
.ip
== "$IP":
268 for i
in range(len(IPs
)-1):
273 # now check if the entries already exist on the DNS server
275 if not check_dns_name(d
):
276 update_list
.append(d
)
278 if len(update_list
) == 0:
280 print "No DNS updates needed"
286 # ask nsupdate to add entries as needed
287 for d
in update_list
:
290 # delete the ccache if we created it
291 if ccachename
is not None:
292 os
.unlink(ccachename
)