source4/scripting/python/samba/provision/sambadns.py

   1 # Unix SMB/CIFS implementation.
   2 # backend code for provisioning DNS for a Samba4 server
   3 #
   4 # Copyright (C) Kai Blin <kai@samba.org> 2011
   5 # Copyright (C) Amitay Isaacs <amitay@gmail.com> 2011
   6 #
   7 # This program is free software; you can redistribute it and/or modify
   8 # it under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 3 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # This program is distributed in the hope that it will be useful,
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 #
  20
  21 """DNS-related provisioning"""
  22
  23 import os
  24 import uuid
  25 import ldb
  26 import samba
  27 from samba.ndr import ndr_pack, ndr_unpack
  28 from samba import read_and_sub_file
  29 from samba.dcerpc import dnsp, misc
  30 from samba.dsdb import (
  31     DS_DOMAIN_FUNCTION_2000,
  32     DS_DOMAIN_FUNCTION_2003,
  33     DS_DOMAIN_FUNCTION_2008,
  34     DS_DOMAIN_FUNCTION_2008_R2
  35     )
  36 from base64 import b64encode
  37
  38
  39 def add_ldif(ldb, ldif_file, subst_vars, controls=["relax:0"]):
  40     ldif_file_path = os.path.join(samba.param.setup_dir(), ldif_file)
  41     data = read_and_sub_file(ldif_file_path, subst_vars)
  42     ldb.add_ldif(data, controls)
  43
  44 def modify_ldif(ldb, ldif_file, subst_vars, controls=["relax:0"]):
  45     ldif_file_path = os.path.join(samba.param.setup_dir(), ldif_file)
  46     data = read_and_sub_file(ldif_file_path, subst_vars)
  47     ldb.modify_ldif(data, controls)
  48
  49 def setup_ldb(ldb, ldif_path, subst_vars):
  50     """Import a LDIF a file into a LDB handle, optionally substituting
  51     variables.
  52
  53     :note: Either all LDIF data will be added or none (using transactions).
  54
  55     :param ldb: LDB file to import into.
  56     :param ldif_path: Path to the LDIF file.
  57     :param subst_vars: Dictionary with substitution variables.
  58     """
  59     assert ldb is not None
  60     ldb.transaction_start()
  61     try:
  62         add_ldif(ldb, ldif_path, subst_vars)
  63     except Exception:
  64         ldb.transaction_cancel()
  65         raise
  66     else:
  67         ldb.transaction_commit()
  68
  69 def setup_path(file):
  70     """Return an absolute path to the provision tempate file specified by file"""
  71     return os.path.join(samba.param.setup_dir(), file)
  72
  73 def get_domainguid(samdb, domaindn):
  74     res = samdb.search(base=domaindn, scope=ldb.SCOPE_BASE, attrs=["objectGUID"])
  75     domainguid =  str(ndr_unpack(misc.GUID, res[0]["objectGUID"][0]))
  76     return domainguid
  77
  78 def get_ntdsguid(samdb, domaindn):
  79     configdn = samdb.get_config_basedn()
  80
  81     res1 = samdb.search(base="OU=Domain Controllers,%s" % domaindn, scope=ldb.SCOPE_ONELEVEL,
  82                         attrs=["dNSHostName"])
  83
  84     res2 = samdb.search(expression="serverReference=%s" % res1[0].dn, base=configdn)
  85
  86     res3 = samdb.search(base="CN=NTDS Settings,%s" % res2[0].dn, scope=ldb.SCOPE_BASE,
  87                         attrs=["objectGUID"])
  88     ntdsguid = str(ndr_unpack(misc.GUID, res3[0]["objectGUID"][0]))
  89     return ntdsguid
  90
  91
  92 class ARecord(dnsp.DnssrvRpcRecord):
  93     def __init__(self, ip_addr, serial=1, ttl=900, rank=dnsp.DNS_RANK_ZONE):
  94         super(ARecord, self).__init__()
  95         self.wType = dnsp.DNS_TYPE_A
  96         self.rank = rank
  97         self.dwSerial = serial
  98         self.dwTtlSeconds = ttl
  99         self.data = ip_addr
 100
 101 class AAAARecord(dnsp.DnssrvRpcRecord):
 102     def __init__(self, ip6_addr, serial=1, ttl=900, rank=dnsp.DNS_RANK_ZONE):
 103         super(AAAARecord, self).__init__()
 104         self.wType = dnsp.DNS_TYPE_AAAA
 105         self.rank = rank
 106         self.dwSerial = serial
 107         self.dwTtlSeconds = ttl
 108         self.data = ip6_addr
 109
 110 class CNameRecord(dnsp.DnssrvRpcRecord):
 111     def __init__(self, cname, serial=1, ttl=900, rank=dnsp.DNS_RANK_ZONE):
 112         super(CNameRecord, self).__init__()
 113         self.wType = dnsp.DNS_TYPE_CNAME
 114         self.rank = rank
 115         self.dwSerial = serial
 116         self.dwTtlSeconds = ttl
 117         self.data = cname
 118
 119 class NSRecord(dnsp.DnssrvRpcRecord):
 120     def __init__(self, dns_server, serial=1, ttl=900, rank=dnsp.DNS_RANK_ZONE):
 121         super(NSRecord, self).__init__()
 122         self.wType = dnsp.DNS_TYPE_NS
 123         self.rank = rank
 124         self.dwSerial = serial
 125         self.dwTtlSeconds = ttl
 126         self.data = dns_server
 127
 128 class SOARecord(dnsp.DnssrvRpcRecord):
 129     def __init__(self, mname, rname, serial=1, refresh=900, retry=600,
 130                  expire=86400, minimum=3600, ttl=3600, rank=dnsp.DNS_RANK_ZONE):
 131         super(SOARecord, self).__init__()
 132         self.wType = dnsp.DNS_TYPE_SOA
 133         self.rank = rank
 134         self.dwSerial = serial
 135         self.dwTtlSeconds = ttl
 136         soa = dnsp.soa()
 137         soa.serial = serial
 138         soa.refresh = refresh
 139         soa.retry = retry
 140         soa.expire = expire
 141         soa.mname = mname
 142         soa.rname = rname
 143         self.data = soa
 144
 145 class SRVRecord(dnsp.DnssrvRpcRecord):
 146     def __init__(self, target, port, priority=0, weight=100, serial=1, ttl=900,
 147                 rank=dnsp.DNS_RANK_ZONE):
 148         super(SRVRecord, self).__init__()
 149         self.wType = dnsp.DNS_TYPE_SRV
 150         self.rank = rank
 151         self.dwSerial = serial
 152         self.dwTtlSeconds = ttl
 153         srv = dnsp.srv()
 154         srv.nameTarget = target
 155         srv.wPort = port
 156         srv.wPriority = priority
 157         srv.wWeight = weight
 158         self.data = srv
 159
 160
 161 def setup_dns_partitions(samdb, domaindn, forestdn, configdn, serverdn):
 162
 163     # FIXME: Default security descriptor for Domain-DNS objectCategory is different in
 164     #        our documentation from windows
 165
 166     domainzone_dn = "DC=DomainDnsZones,%s" % domaindn
 167     forestzone_dn = "DC=ForestDnsZones,%s" % forestdn
 168
 169     add_ldif(samdb, "provision_dnszones_partitions.ldif", {
 170         "DOMAINZONE_DN": domainzone_dn,
 171         "FORESTZONE_DN": forestzone_dn,
 172         })
 173
 174     domainzone_guid = get_domainguid(samdb, domainzone_dn)
 175     forestzone_guid = get_domainguid(samdb, forestzone_dn)
 176
 177     domainzone_guid = str(uuid.uuid4())
 178     forestzone_guid = str(uuid.uuid4())
 179
 180     domainzone_dns = ldb.Dn(samdb, domainzone_dn).canonical_ex_str().strip()
 181     forestzone_dns = ldb.Dn(samdb, forestzone_dn).canonical_ex_str().strip()
 182
 183     add_ldif(samdb, "provision_dnszones_add.ldif", {
 184         "DOMAINZONE_DN": domainzone_dn,
 185         "FORESTZONE_DN": forestzone_dn,
 186         "DOMAINZONE_GUID": domainzone_guid,
 187         "FORESTZONE_GUID": forestzone_guid,
 188         "DOMAINZONE_DNS": domainzone_dns,
 189         "FORESTZONE_DNS": forestzone_dns,
 190         "CONFIGDN": configdn,
 191         "SERVERDN": serverdn,
 192         })
 193
 194     modify_ldif(samdb, "provision_dnszones_modify.ldif", {
 195         "CONFIGDN": configdn,
 196         "SERVERDN": serverdn,
 197         "DOMAINZONE_DN": domainzone_dn,
 198         "FORESTZONE_DN": forestzone_dn,
 199     })
 200
 201
 202 def add_dns_accounts(samdb, domaindn):
 203     add_ldif(samdb, "provision_dns_accounts_add.ldif", {
 204         "DOMAINDN": domaindn,
 205         })
 206
 207 def add_dns_container(samdb, domaindn, prefix):
 208     # CN=MicrosoftDNS,<PREFIX>,<DOMAINDN>
 209     msg = ldb.Message(ldb.Dn(samdb, "CN=MicrosoftDNS,%s,%s" % (prefix, domaindn)))
 210     msg["objectClass"] = ["top", "container"]
 211     msg["displayName"] = ldb.MessageElement("DNS Servers", ldb.FLAG_MOD_ADD, "displayName")
 212     samdb.add(msg)
 213
 214
 215 def add_rootservers(samdb, domaindn, prefix):
 216     rootservers = {}
 217     rootservers["a.root-servers.net"] = "198.41.0.4"
 218     rootservers["b.root-servers.net"] = "192.228.79.201"
 219     rootservers["c.root-servers.net"] = "192.33.4.12"
 220     rootservers["d.root-servers.net"] = "128.8.10.90"
 221     rootservers["e.root-servers.net"] = "192.203.230.10"
 222     rootservers["f.root-servers.net"] = "192.5.5.241"
 223     rootservers["g.root-servers.net"] = "192.112.36.4"
 224     rootservers["h.root-servers.net"] = "128.63.2.53"
 225     rootservers["i.root-servers.net"] = "192.36.148.17"
 226     rootservers["j.root-servers.net"] = "192.58.128.30"
 227     rootservers["k.root-servers.net"] = "193.0.14.129"
 228     rootservers["l.root-servers.net"] = "199.7.83.42"
 229     rootservers["m.root-servers.net"] = "202.12.27.33"
 230
 231     rootservers_v6 = {}
 232     rootservers_v6["a.root-servers.net"] = "2001:503:ba3e::2:30"
 233     rootservers_v6["f.root-servers.net"] = "2001:500:2f::f"
 234     rootservers_v6["h.root-servers.net"] = "2001:500:1::803f:235"
 235     rootservers_v6["j.root-servers.net"] = "2001:503:c27::2:30"
 236     rootservers_v6["k.root-servers.net"] = "2001:7fd::1"
 237     rootservers_v6["m.root-servers.net"] = "2001:dc3::35"
 238
 239     container_dn = "DC=RootDNSServers,CN=MicrosoftDNS,%s,%s" % (prefix, domaindn)
 240
 241     # Add DC=RootDNSServers,CN=MicrosoftDNS,<PREFIX>,<DOMAINDN>
 242     msg = ldb.Message(ldb.Dn(samdb, container_dn))
 243     msg["objectClass"] = ["top", "dnsZone"]
 244     samdb.add(msg)
 245
 246     # Add DC=@,DC=RootDNSServers,CN=MicrosoftDNS,<PREFIX>,<DOMAINDN>
 247     record = []
 248     for rserver in rootservers:
 249         record.append(ndr_pack(NSRecord(rserver, serial=0, ttl=0, rank=dnsp.DNS_RANK_ROOT_HINT)))
 250
 251     msg = ldb.Message(ldb.Dn(samdb, "DC=@,%s" % container_dn))
 252     msg["objectClass"] = ["top", "dnsNode"]
 253     msg["dnsRecord"] = ldb.MessageElement(record, ldb.FLAG_MOD_ADD, "dnsRecord")
 254     samdb.add(msg)
 255
 256     # Add DC=<rootserver>,DC=RootDNSServers,CN=MicrosoftDNS,<PREFIX>,<DOMAINDN>
 257     for rserver in rootservers:
 258         record = [ndr_pack(ARecord(rootservers[rserver], serial=0, ttl=0, rank=dnsp.DNS_RANK_ROOT_HINT))]
 259         # Add AAAA record as well (How does W2K* add IPv6 records?)
 260         #if rserver in rootservers_v6:
 261         #    record.append(ndr_pack(AAAARecord(rootservers_v6[rserver], serial=0, ttl=0)))
 262         msg = ldb.Message(ldb.Dn(samdb, "DC=%s,%s" % (rserver, container_dn)))
 263         msg["objectClass"] = ["top", "dnsNode"]
 264         msg["dnsRecord"] = ldb.MessageElement(record, ldb.FLAG_MOD_ADD, "dnsRecord")
 265         samdb.add(msg)
 266
 267 def add_at_record(samdb, container_dn, prefix, hostname, dnsdomain, hostip, hostip6):
 268
 269     fqdn_hostname = "%s.%s" % (hostname, dnsdomain)
 270
 271     at_records = []
 272
 273     # SOA record
 274     at_soa_record = SOARecord(fqdn_hostname, "hostmaster.%s" % dnsdomain)
 275     at_records.append(ndr_pack(at_soa_record))
 276
 277     # NS record
 278     at_ns_record = NSRecord(fqdn_hostname)
 279     at_records.append(ndr_pack(at_ns_record))
 280
 281     if hostip is not None:
 282         # A record
 283         at_a_record = ARecord(hostip)
 284         at_records.append(ndr_pack(at_a_record))
 285
 286     if hostip6 is not None:
 287         # AAAA record
 288         at_aaaa_record = AAAARecord(hostip6)
 289         at_records.append(ndr_pack(at_aaaa_record))
 290
 291     msg = ldb.Message(ldb.Dn(samdb, "DC=@,%s" % container_dn))
 292     msg["objectClass"] = ["top", "dnsNode"]
 293     msg["dnsRecord"] = ldb.MessageElement(at_records, ldb.FLAG_MOD_ADD, "dnsRecord")
 294     samdb.add(msg)
 295
 296 def add_srv_record(samdb, container_dn, prefix, host, port):
 297     srv_record = SRVRecord(host, port)
 298     msg = ldb.Message(ldb.Dn(samdb, "%s,%s" % (prefix, container_dn)))
 299     msg["objectClass"] = ["top", "dnsNode"]
 300     msg["dnsRecord"] = ldb.MessageElement(ndr_pack(srv_record), ldb.FLAG_MOD_ADD, "dnsRecord")
 301     samdb.add(msg)
 302
 303 def add_ns_record(samdb, container_dn, prefix, host):
 304     ns_record = NSRecord(host)
 305     msg = ldb.Message(ldb.Dn(samdb, "%s,%s" % (prefix, container_dn)))
 306     msg["objectClass"] = ["top", "dnsNode"]
 307     msg["dnsRecord"] = ldb.MessageElement(ndr_pack(ns_record), ldb.FLAG_MOD_ADD, "dnsRecord")
 308     samdb.add(msg)
 309
 310 def add_ns_glue_record(samdb, container_dn, prefix, host):
 311     ns_record = NSRecord(host, rank=dnsp.DNS_RANK_NS_GLUE)
 312     msg = ldb.Message(ldb.Dn(samdb, "%s,%s" % (prefix, container_dn)))
 313     msg["objectClass"] = ["top", "dnsNode"]
 314     msg["dnsRecord"] = ldb.MessageElement(ndr_pack(ns_record), ldb.FLAG_MOD_ADD, "dnsRecord")
 315     samdb.add(msg)
 316
 317 def add_cname_record(samdb, container_dn, prefix, host):
 318     cname_record = CNameRecord(host)
 319     msg = ldb.Message(ldb.Dn(samdb, "%s,%s" % (prefix, container_dn)))
 320     msg["objectClass"] = ["top", "dnsNode"]
 321     msg["dnsRecord"] = ldb.MessageElement(ndr_pack(cname_record), ldb.FLAG_MOD_ADD, "dnsRecord")
 322     samdb.add(msg)
 323
 324 def add_host_record(samdb, container_dn, prefix, hostip, hostip6):
 325     host_records = []
 326     if hostip:
 327         a_record = ARecord(hostip)
 328         host_records.append(ndr_pack(a_record))
 329     if hostip6:
 330         aaaa_record = AAAARecord(hostip6)
 331         host_records.append(ndr_pack(aaaa_record))
 332     if host_records:
 333         msg = ldb.Message(ldb.Dn(samdb, "%s,%s" % (prefix, container_dn)))
 334         msg["objectClass"] = ["top", "dnsNode"]
 335         msg["dnsRecord"] = ldb.MessageElement(host_records, ldb.FLAG_MOD_ADD, "dnsRecord")
 336         samdb.add(msg)
 337
 338 def add_domain_record(samdb, domaindn, prefix, dnsdomain):
 339     # DC=<DNSDOMAIN>,CN=MicrosoftDNS,<PREFIX>,<DOMAINDN>
 340     msg = ldb.Message(ldb.Dn(samdb, "DC=%s,CN=MicrosoftDNS,%s,%s" % (dnsdomain, prefix, domaindn)))
 341     msg["objectClass"] = ["top", "dnsZone"]
 342     samdb.add(msg)
 343
 344 def add_msdcs_record(samdb, forestdn, prefix, dnsforest):
 345     # DC=_msdcs.<DNSFOREST>,CN=MicrosoftDNS,<PREFIX>,<FORESTDN>
 346     msg = ldb.Message(ldb.Dn(samdb, "DC=_msdcs.%s,CN=MicrosoftDNS,%s,%s" %
 347                                     (dnsforest, prefix, forestdn)))
 348     msg["objectClass"] = ["top", "dnsZone"]
 349     samdb.add(msg)
 350
 351
 352 def add_dc_domain_records(samdb, domaindn, prefix, site, dnsdomain, hostname, hostip, hostip6):
 353
 354     fqdn_hostname = "%s.%s" % (hostname, dnsdomain)
 355
 356     # Set up domain container - DC=<DNSDOMAIN>,CN=MicrosoftDNS,<PREFIX>,<DOMAINDN>
 357     domain_container_dn = ldb.Dn(samdb, "DC=%s,CN=MicrosoftDNS,%s,%s" %
 358                                     (dnsdomain, prefix, domaindn))
 359
 360     # DC=@ record
 361     add_at_record(samdb, domain_container_dn, "DC=@", hostname, dnsdomain, hostip, hostip6)
 362
 363     # DC=<HOSTNAME> record
 364     add_host_record(samdb, domain_container_dn, "DC=%s" % hostname, hostip, hostip6)
 365
 366     # DC=_kerberos._tcp record
 367     add_srv_record(samdb, domain_container_dn, "DC=_kerberos._tcp", fqdn_hostname, 88)
 368
 369     # DC=_kerberos._tcp.<SITENAME>._sites record
 370     add_srv_record(samdb, domain_container_dn, "DC=_kerberos._tcp.%s._sites" % site,
 371                     fqdn_hostname, 88)
 372
 373     # DC=_kerberos._udp record
 374     add_srv_record(samdb, domain_container_dn, "DC=_kerberos._udp", fqdn_hostname, 88)
 375
 376     # DC=_kpasswd._tcp record
 377     add_srv_record(samdb, domain_container_dn, "DC=_kpasswd._tcp", fqdn_hostname, 464)
 378
 379     # DC=_kpasswd._udp record
 380     add_srv_record(samdb, domain_container_dn, "DC=_kpasswd._udp", fqdn_hostname, 464)
 381
 382     # DC=_ldap._tcp record
 383     add_srv_record(samdb, domain_container_dn, "DC=_ldap._tcp", fqdn_hostname, 389)
 384
 385     # DC=_ldap._tcp.<SITENAME>._sites record
 386     add_srv_record(samdb, domain_container_dn, "DC=_ldap._tcp.%s._sites" % site,
 387                     fqdn_hostname, 389)
 388
 389     # FIXME: The number of SRV records depend on the various roles this DC has.
 390     #        _gc and _msdcs records are added if the we are the forest dc and not subdomain dc
 391     #
 392     # Assumption: current DC is GC and add all the entries
 393
 394     # DC=_gc._tcp record
 395     add_srv_record(samdb, domain_container_dn, "DC=_gc._tcp", fqdn_hostname, 3268)
 396
 397     # DC=_gc._tcp.<SITENAME>,_sites record
 398     add_srv_record(samdb, domain_container_dn, "DC=_gc._tcp.%s._sites" % site, fqdn_hostname, 3268)
 399
 400     # DC=_msdcs record
 401     add_ns_glue_record(samdb, domain_container_dn, "DC=_msdcs", fqdn_hostname)
 402
 403     # FIXME: Following entries are added only if DomainDnsZones and ForestDnsZones partitions
 404     #        are created
 405     #
 406     # Assumption: Additional entries won't hurt on os_level = 2000
 407
 408     # DC=_ldap._tcp.<SITENAME>._sites.DomainDnsZones
 409     add_srv_record(samdb, domain_container_dn, "DC=_ldap._tcp.%s._sites.DomainDnsZones" % site,
 410                     fqdn_hostname, 389)
 411
 412     # DC=_ldap._tcp.<SITENAME>._sites.ForestDnsZones
 413     add_srv_record(samdb, domain_container_dn, "DC=_ldap._tcp.%s._sites.ForestDnsZones" % site,
 414                     fqdn_hostname, 389)
 415
 416     # DC=_ldap._tcp.DomainDnsZones
 417     add_srv_record(samdb, domain_container_dn, "DC=_ldap._tcp.DomainDnsZones",
 418                     fqdn_hostname, 389)
 419
 420     # DC=_ldap._tcp.ForestDnsZones
 421     add_srv_record(samdb, domain_container_dn, "DC=_ldap._tcp.ForestDnsZones",
 422                     fqdn_hostname, 389)
 423
 424     # DC=DomainDnsZones
 425     add_host_record(samdb, domain_container_dn, "DC=DomainDnsZones", hostip, hostip6)
 426
 427     # DC=ForestDnsZones
 428     add_host_record(samdb, domain_container_dn, "DC=ForestDnsZones", hostip, hostip6)
 429
 430
 431 def add_dc_msdcs_records(samdb, forestdn, prefix, site, dnsforest, hostname,
 432                             hostip, hostip6, domainguid, ntdsguid):
 433
 434     fqdn_hostname = "%s.%s" % (hostname, dnsforest)
 435
 436     # Set up forest container - DC=<DNSDOMAIN>,CN=MicrosoftDNS,<PREFIX>,<DOMAINDN>
 437     forest_container_dn = ldb.Dn(samdb, "DC=_msdcs.%s,CN=MicrosoftDNS,%s,%s" %
 438                                     (dnsforest, prefix, forestdn))
 439
 440     # DC=@ record
 441     add_at_record(samdb, forest_container_dn, "DC=@", hostname, dnsforest, None, None)
 442
 443     # DC=_kerberos._tcp.dc record
 444     add_srv_record(samdb, forest_container_dn, "DC=_kerberos._tcp.dc", fqdn_hostname, 88)
 445
 446     # DC=_kerberos._tcp.<SITENAME>._sites.dc record
 447     add_srv_record(samdb, forest_container_dn, "DC=_kerberos._tcp.%s._sites.dc" % site,
 448                     fqdn_hostname, 88)
 449
 450     # DC=_ldap._tcp.dc record
 451     add_srv_record(samdb, forest_container_dn, "DC=_ldap._tcp.dc", fqdn_hostname, 389)
 452
 453     # DC=_ldap._tcp.<SITENAME>._sites.dc record
 454     add_srv_record(samdb, forest_container_dn, "DC=_ldap._tcp.%s._sites.dc" % site,
 455                     fqdn_hostname, 389)
 456
 457     # DC=_ldap._tcp.<SITENAME>._sites.gc record
 458     add_srv_record(samdb, forest_container_dn, "DC=_ldap._tcp.%s._sites.gc" % site,
 459                     fqdn_hostname, 3268)
 460
 461     # DC=_ldap._tcp.gc record
 462     add_srv_record(samdb, forest_container_dn, "DC=_ldap._tcp.gc", fqdn_hostname, 3268)
 463
 464     # DC=_ldap._tcp.pdc record
 465     add_srv_record(samdb, forest_container_dn, "DC=_ldap._tcp.pdc", fqdn_hostname, 389)
 466
 467     # DC=gc record
 468     add_host_record(samdb, forest_container_dn, "DC=gc", hostip, hostip6)
 469
 470     # DC=_ldap._tcp.<DOMAINGUID>.domains record
 471     add_srv_record(samdb, forest_container_dn, "DC=_ldap._tcp.%s.domains" % domainguid,
 472                     fqdn_hostname, 389)
 473
 474     # DC=<NTDSGUID>
 475     add_cname_record(samdb, forest_container_dn, "DC=%s" % ntdsguid, fqdn_hostname)
 476
 477
 478 def secretsdb_setup_dns(secretsdb, names, private_dir, realm,
 479                         dnsdomain, dns_keytab_path, dnspass):
 480     """Add DNS specific bits to a secrets database.
 481
 482     :param secretsdb: Ldb Handle to the secrets database
 483     :param names: Names shortcut
 484     :param machinepass: Machine password
 485     """
 486     try:
 487         os.unlink(os.path.join(private_dir, dns_keytab_path))
 488     except OSError:
 489         pass
 490
 491     setup_ldb(secretsdb, setup_path("secrets_dns.ldif"), {
 492             "REALM": realm,
 493             "DNSDOMAIN": dnsdomain,
 494             "DNS_KEYTAB": dns_keytab_path,
 495             "DNSPASS_B64": b64encode(dnspass),
 496             "HOSTNAME": names.hostname,
 497             "DNSNAME" : '%s.%s' % (
 498                 names.netbiosname.lower(), names.dnsdomain.lower())
 499             })
 500
 501
 502 def is_valid_dns_backend(dns_backend):
 503         return dns_backend in ("BIND9_FLATFILE", "BIND9_DLZ", "SAMBA_INTERNAL", "NONE")
 504
 505
 506 def is_valid_os_level(os_level):
 507     return DS_DOMAIN_FUNCTION_2000 <= os_level <= DS_DOMAIN_FUNCTION_2008_R2
 508
 509
 510 def setup_ad_dns(samdb, secretsdb, names, paths, logger, dns_backend, os_level,
 511                  dnspass=None, hostip=None, hostip6=None):
 512     """Provision DNS information (assuming GC role)
 513
 514     :param samdb: LDB object connected to sam.ldb file
 515     :param secretsdb: LDB object connected to secrets.ldb file
 516     :param names: Names shortcut
 517     :param paths: Paths shortcut
 518     :param logger: Logger object
 519     :param dns_backend: Type of DNS backend
 520     :param os_level: Functional level (treated as os level)
 521     :param dnspass: Password for bind's DNS account
 522     :param hostip: IPv4 address
 523     :param hostip6: IPv6 address
 524     """
 525
 526     if not is_valid_dns_backend(dns_backend):
 527         raise Exception("Invalid dns backend: %r" % dns_backend)
 528
 529     if not is_valid_os_level(os_level):
 530         raise Exception("Invalid os level: %r" % os_level)
 531
 532     if dns_backend is "NONE":
 533         logger.info("No DNS backend set, not configuring DNS")
 534         return
 535
 536     # If dns_backend is BIND9_FLATFILE
 537     #   Populate only CN=MicrosoftDNS,CN=System,<DOMAINDN>
 538     #
 539     # If dns_backend is SAMBA_INTERNAL or BIND9_DLZ
 540     #   Populate DNS partitions
 541
 542     # If os_level < 2003 (DS_DOMAIN_FUNCTION_2000)
 543     #   All dns records are in CN=MicrosoftDNS,CN=System,<DOMAINDN>
 544     #
 545     # If os_level >= 2003 (DS_DOMAIN_FUNCTION_2003, DS_DOMAIN_FUNCTION_2008,
 546     #                        DS_DOMAIN_FUNCTION_2008_R2)
 547     #   Root server records are in CN=MicrosoftDNS,CN=System,<DOMAINDN>
 548     #   Domain records are in CN=MicrosoftDNS,CN=System,<DOMAINDN>
 549     #   Domain records are in CN=MicrosoftDNS,DC=DomainDnsZones,<DOMAINDN>
 550     #   Forest records are in CN=MicrosoftDNS,DC=ForestDnsZones,<DOMAINDN>
 551
 552     domaindn = names.domaindn
 553     forestdn = samdb.get_root_basedn().get_linearized()
 554
 555     dnsdomain = names.dnsdomain.lower()
 556     dnsforest = dnsdomain
 557
 558     hostname = names.netbiosname.lower()
 559     site = names.sitename
 560
 561     domainguid = get_domainguid(samdb, domaindn)
 562     ntdsguid = get_ntdsguid(samdb, domaindn)
 563
 564     # Add dns accounts (DnsAdmins, DnsUpdateProxy) in domain
 565     logger.info("Adding DNS accounts")
 566     add_dns_accounts(samdb, domaindn)
 567
 568     logger.info("Populating CN=MicrosoftDNS,CN=System,%s" % domaindn)
 569
 570     # Set up MicrosoftDNS container
 571     add_dns_container(samdb, domaindn, "CN=System")
 572
 573     # Add root servers
 574     add_rootservers(samdb, domaindn, "CN=System")
 575
 576     if os_level == DS_DOMAIN_FUNCTION_2000:
 577
 578         # Add domain record
 579         add_domain_record(samdb, domaindn, "CN=System", dnsdomain)
 580
 581         # Add DNS records for a DC in domain
 582         add_dc_domain_records(samdb, domaindn, "CN=System", site, dnsdomain,
 583                                 hostname, hostip, hostip6)
 584
 585     elif dns_backend in ("SAMBA_INTERNAL", "BIND9_DLZ") and \
 586             os_level >= DS_DOMAIN_FUNCTION_2003:
 587
 588         # Set up additional partitions (DomainDnsZones, ForstDnsZones)
 589         logger.info("Creating DomainDnsZones and ForestDnsZones partitions")
 590         setup_dns_partitions(samdb, domaindn, forestdn, names.configdn, names.serverdn)
 591
 592         ##### Set up DC=DomainDnsZones,<DOMAINDN>
 593         logger.info("Populating DomainDnsZones partition")
 594
 595         # Set up MicrosoftDNS container
 596         add_dns_container(samdb, domaindn, "DC=DomainDnsZones")
 597
 598         # Add rootserver records
 599         add_rootservers(samdb, domaindn, "DC=DomainDnsZones")
 600
 601         # Add domain record
 602         add_domain_record(samdb, domaindn, "DC=DomainDnsZones", dnsdomain)
 603
 604         # Add DNS records for a DC in domain
 605         add_dc_domain_records(samdb, domaindn, "DC=DomainDnsZones", site, dnsdomain,
 606                                 hostname, hostip, hostip6)
 607
 608         ##### Set up DC=ForestDnsZones,<DOMAINDN>
 609         logger.info("Populating ForestDnsZones partition")
 610
 611         # Set up MicrosoftDNS container
 612         add_dns_container(samdb, forestdn, "DC=ForestDnsZones")
 613
 614         # Add _msdcs record
 615         add_msdcs_record(samdb, forestdn, "DC=ForestDnsZones", dnsforest)
 616
 617         # Add DNS records for a DC in forest
 618         add_dc_msdcs_records(samdb, forestdn, "DC=ForestDnsZones", site, dnsforest,
 619                                 hostname, hostip, hostip6, domainguid, ntdsguid)
 620
 621     if dns_backend.startswith("BIND9_"):
 622         secretsdb_setup_dns(secretsdb, names,
 623                             paths.private_dir, realm=names.realm,
 624                             dnsdomain=names.dnsdomain,
 625                             dns_keytab_path=paths.dns_keytab, dnspass=dnspass)