4 # update our DNS names using TSIG-GSS
6 # Copyright (C) Andrew Tridgell 2010
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 3 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
28 # ensure we get messages out immediately, so they get in the samba logs,
29 # and don't get swallowed by a timeout
30 os
.environ
['PYTHONUNBUFFERED'] = '1'
32 # forcing GMT avoids a problem in some timezones with kerberos. Both MIT
33 # heimdal can get mutual authentication errors due to the 24 second difference
34 # between UTC and GMT when using some zone files (eg. the PDT zone from
36 os
.environ
["TZ"] = "GMT"
38 # Find right directory when running from source tree
39 sys
.path
.insert(0, "bin/python")
43 from samba
import getopt
as options
44 from ldb
import SCOPE_BASE
45 from samba
.auth
import system_session
46 from samba
.samdb
import SamDB
47 from samba
.dcerpc
import netlogon
, winbind
49 samba
.ensure_external_module("dns", "dnspython")
57 parser
= optparse
.OptionParser("samba_dnsupdate")
58 sambaopts
= options
.SambaOptions(parser
)
59 parser
.add_option_group(sambaopts
)
60 parser
.add_option_group(options
.VersionOptions(parser
))
61 parser
.add_option("--verbose", action
="store_true")
62 parser
.add_option("--all-names", action
="store_true")
63 parser
.add_option("--all-interfaces", action
="store_true")
64 parser
.add_option("--use-file", type="string", help="Use a file, rather than real DNS calls")
65 parser
.add_option("--update-list", type="string", help="Add DNS names from the given file")
66 parser
.add_option("--fail-immediately", action
='store_true', help="Exit on first failure")
67 parser
.add_option("--no-credentials", dest
='nocreds', action
='store_true', help="don't try and get credentials")
68 parser
.add_option("--no-substiutions", dest
='nosubs', action
='store_true', help="don't try and expands variables in file specified by --update-list")
73 opts
, args
= parser
.parse_args()
79 lp
= sambaopts
.get_loadparm()
81 domain
= lp
.get("realm")
82 host
= lp
.get("netbios name")
83 if opts
.all_interfaces
:
86 all_interfaces
= False
88 IPs
= samba
.interface_ips(lp
, all_interfaces
)
89 nsupdate_cmd
= lp
.get('nsupdate command')
92 print "No IP interfaces - skipping DNS updates"
100 # we don't want link local addresses for DNS updates
107 print "IPs: %s" % IPs
110 def get_credentials(lp
):
111 """# get credentials if we haven't got them already."""
112 from samba
import credentials
113 global ccachename
, creds
114 if creds
is not None:
116 creds
= credentials
.Credentials()
118 creds
.set_machine_account(lp
)
119 creds
.set_krb_forwardable(credentials
.NO_KRB_FORWARDABLE
)
120 (tmp_fd
, ccachename
) = tempfile
.mkstemp()
121 creds
.get_named_ccache(lp
, ccachename
)
124 class dnsobj(object):
125 """an object to hold a parsed DNS line"""
127 def __init__(self
, string_form
):
128 list = string_form
.split()
130 raise Exception("Invalid DNS entry %r" % string_form
)
134 self
.existing_port
= None
135 self
.existing_weight
= None
137 self
.name
= list[1].lower()
138 if self
.type == 'SRV':
140 raise Exception("Invalid DNS entry %r" % string_form
)
141 self
.dest
= list[2].lower()
143 elif self
.type in ['A', 'AAAA']:
144 self
.ip
= list[2] # usually $IP, which gets replaced
145 elif self
.type == 'CNAME':
146 self
.dest
= list[2].lower()
147 elif self
.type == 'NS':
148 self
.dest
= list[2].lower()
150 raise Exception("Received unexpected DNS reply of type %s" % self
.type)
154 return "%s %s %s" % (self
.type, self
.name
, self
.ip
)
156 return "%s %s %s" % (self
.type, self
.name
, self
.ip
)
158 return "%s %s %s %s" % (self
.type, self
.name
, self
.dest
, self
.port
)
159 if d
.type == "CNAME":
160 return "%s %s %s" % (self
.type, self
.name
, self
.dest
)
162 return "%s %s %s" % (self
.type, self
.name
, self
.dest
)
165 def parse_dns_line(line
, sub_vars
):
166 """parse a DNS line from."""
167 if line
.startswith("SRV _ldap._tcp.pdc._msdcs.") and not samdb
.am_pdc():
169 print "Skipping PDC entry (%s) as we are not a PDC" % line
171 subline
= samba
.substitute_var(line
, sub_vars
)
172 return dnsobj(subline
)
175 def hostname_match(h1
, h2
):
176 """see if two hostnames match."""
179 return h1
.lower().rstrip('.') == h2
.lower().rstrip('.')
182 def check_dns_name(d
):
183 """check that a DNS entry exists."""
184 normalised_name
= d
.name
.rstrip('.') + '.'
186 print "Looking for DNS entry %s as %s" % (d
, normalised_name
)
188 if opts
.use_file
is not None:
190 dns_file
= open(opts
.use_file
, "r")
194 for line
in dns_file
:
196 if line
== '' or line
[0] == "#":
198 if line
.lower() == str(d
).lower():
202 resolver
= dns
.resolver
.Resolver()
204 # we need to lookup the nameserver for the parent domain,
205 # and use that to check the NS record
206 parent_domain
= '.'.join(normalised_name
.split('.')[1:])
208 ans
= resolver
.query(parent_domain
, 'NS')
209 except dns
.exception
.DNSException
:
211 print "Failed to find parent NS for %s" % d
214 for i
in range(len(ans
)):
216 ns
= resolver
.query(str(ans
[i
]), 'A')
217 except dns
.exception
.DNSException
:
219 for j
in range(len(ns
)):
220 nameservers
.add(str(ns
[j
]))
221 d
.nameservers
= list(nameservers
)
224 if getattr(d
, 'nameservers', None):
225 resolver
.nameservers
= list(d
.nameservers
)
226 ans
= resolver
.query(normalised_name
, d
.type)
227 except dns
.exception
.DNSException
:
229 print "Failed to find DNS entry %s" % d
231 if d
.type in ['A', 'AAAA']:
232 # we need to be sure that our IP is there
234 if str(rdata
) == str(d
.ip
):
236 elif d
.type == 'CNAME':
237 for i
in range(len(ans
)):
238 if hostname_match(ans
[i
].target
, d
.dest
):
241 for i
in range(len(ans
)):
242 if hostname_match(ans
[i
].target
, d
.dest
):
244 elif d
.type == 'SRV':
247 print "Checking %s against %s" % (rdata
, d
)
248 if hostname_match(rdata
.target
, d
.dest
):
249 if str(rdata
.port
) == str(d
.port
):
252 d
.existing_port
= str(rdata
.port
)
253 d
.existing_weight
= str(rdata
.weight
)
256 print "Failed to find matching DNS entry %s" % d
261 def get_subst_vars(samdb
):
262 """get the list of substitution vars."""
266 vars['DNSDOMAIN'] = samdb
.domain_dns_name()
267 vars['DNSFOREST'] = samdb
.forest_dns_name()
268 vars['HOSTNAME'] = samdb
.host_dns_name()
269 vars['NTDSGUID'] = samdb
.get_ntds_GUID()
270 vars['SITE'] = samdb
.server_site_name()
271 res
= samdb
.search(base
=samdb
.get_default_basedn(), scope
=SCOPE_BASE
, attrs
=["objectGUID"])
272 guid
= samdb
.schema_format_value("objectGUID", res
[0]['objectGUID'][0])
273 vars['DOMAINGUID'] = guid
274 am_rodc
= samdb
.am_rodc()
279 def call_nsupdate(d
):
280 """call nsupdate for an entry."""
281 global ccachename
, nsupdate_cmd
, krb5conf
284 print "Calling nsupdate for %s" % d
286 if opts
.use_file
is not None:
288 rfile
= open(opts
.use_file
, 'r+')
291 rfile
= open(opts
.use_file
, 'w+')
292 # Open it for reading again, in case someone else got to it first
293 rfile
= open(opts
.use_file
, 'r+')
294 fcntl
.lockf(rfile
, fcntl
.LOCK_EX
)
295 (file_dir
, file_name
) = os
.path
.split(opts
.use_file
)
296 (tmp_fd
, tmpfile
) = tempfile
.mkstemp(dir=file_dir
, prefix
=file_name
, suffix
="XXXXXX")
297 wfile
= os
.fdopen(tmp_fd
, 'a')
301 wfile
.write(str(d
)+"\n")
302 os
.rename(tmpfile
, opts
.use_file
)
303 fcntl
.lockf(rfile
, fcntl
.LOCK_UN
)
306 normalised_name
= d
.name
.rstrip('.') + '.'
308 (tmp_fd
, tmpfile
) = tempfile
.mkstemp()
309 f
= os
.fdopen(tmp_fd
, 'w')
310 if getattr(d
, 'nameservers', None):
311 f
.write('server %s\n' % d
.nameservers
[0])
313 f
.write("update add %s %u A %s\n" % (normalised_name
, default_ttl
, d
.ip
))
315 f
.write("update add %s %u AAAA %s\n" % (normalised_name
, default_ttl
, d
.ip
))
317 if d
.existing_port
is not None:
318 f
.write("update delete %s SRV 0 %s %s %s\n" % (normalised_name
, d
.existing_weight
,
319 d
.existing_port
, d
.dest
))
320 f
.write("update add %s %u SRV 0 100 %s %s\n" % (normalised_name
, default_ttl
, d
.port
, d
.dest
))
321 if d
.type == "CNAME":
322 f
.write("update add %s %u CNAME %s\n" % (normalised_name
, default_ttl
, d
.dest
))
324 f
.write("update add %s %u NS %s\n" % (normalised_name
, default_ttl
, d
.dest
))
332 os
.environ
["KRB5CCNAME"] = ccachename
334 cmd
= nsupdate_cmd
[:]
338 env
["KRB5_CONFIG"] = krb5conf
340 env
["KRB5CCNAME"] = ccachename
341 ret
= subprocess
.call(cmd
, shell
=False, env
=env
)
343 if opts
.fail_immediately
:
345 print("Failed update with %s" % tmpfile
)
347 error_count
= error_count
+ 1
349 print("Failed nsupdate: %d" % ret
)
350 except Exception, estr
:
351 if opts
.fail_immediately
:
353 error_count
= error_count
+ 1
355 print("Failed nsupdate: %s : %s" % (str(d
), estr
))
360 def rodc_dns_update(d
, t
):
361 '''a single DNS update via the RODC netlogon call'''
365 print "Calling netlogon RODC update for %s" % d
368 netlogon
.NlDnsLdapAtSite
: netlogon
.NlDnsInfoTypeNone
,
369 netlogon
.NlDnsGcAtSite
: netlogon
.NlDnsDomainNameAlias
,
370 netlogon
.NlDnsDsaCname
: netlogon
.NlDnsDomainNameAlias
,
371 netlogon
.NlDnsKdcAtSite
: netlogon
.NlDnsInfoTypeNone
,
372 netlogon
.NlDnsDcAtSite
: netlogon
.NlDnsInfoTypeNone
,
373 netlogon
.NlDnsRfc1510KdcAtSite
: netlogon
.NlDnsInfoTypeNone
,
374 netlogon
.NlDnsGenericGcAtSite
: netlogon
.NlDnsDomainNameAlias
377 w
= winbind
.winbind("irpc:winbind_server", lp
)
378 dns_names
= netlogon
.NL_DNS_NAME_INFO_ARRAY()
380 name
= netlogon
.NL_DNS_NAME_INFO()
382 name
.dns_domain_info_type
= typemap
[t
]
385 if d
.port
is not None:
386 name
.port
= int(d
.port
)
387 name
.dns_register
= True
388 dns_names
.names
= [ name
]
389 site_name
= sub_vars
['SITE'].decode('utf-8')
394 ret_names
= w
.DsrUpdateReadOnlyServerDnsRecords(site_name
, default_ttl
, dns_names
)
395 if ret_names
.names
[0].status
!= 0:
396 print("Failed to set DNS entry: %s (status %u)" % (d
, ret_names
.names
[0].status
))
397 error_count
= error_count
+ 1
398 except RuntimeError, reason
:
399 print("Error setting DNS entry of type %u: %s: %s" % (t
, d
, reason
))
400 error_count
= error_count
+ 1
402 if error_count
!= 0 and opts
.fail_immediately
:
406 def call_rodc_update(d
):
407 '''RODCs need to use the netlogon API for nsupdate'''
410 # we expect failure for 3268 if we aren't a GC
411 if d
.port
is not None and int(d
.port
) == 3268:
414 # map the DNS request to a netlogon update type
416 netlogon
.NlDnsLdapAtSite
: '_ldap._tcp.${SITE}._sites.${DNSDOMAIN}',
417 netlogon
.NlDnsGcAtSite
: '_ldap._tcp.${SITE}._sites.gc._msdcs.${DNSDOMAIN}',
418 netlogon
.NlDnsDsaCname
: '${NTDSGUID}._msdcs.${DNSFOREST}',
419 netlogon
.NlDnsKdcAtSite
: '_kerberos._tcp.${SITE}._sites.dc._msdcs.${DNSDOMAIN}',
420 netlogon
.NlDnsDcAtSite
: '_ldap._tcp.${SITE}._sites.dc._msdcs.${DNSDOMAIN}',
421 netlogon
.NlDnsRfc1510KdcAtSite
: '_kerberos._tcp.${SITE}._sites.${DNSDOMAIN}',
422 netlogon
.NlDnsGenericGcAtSite
: '_gc._tcp.${SITE}._sites.${DNSFOREST}'
426 subname
= samba
.substitute_var(map[t
], sub_vars
)
427 if subname
.lower() == d
.name
.lower():
428 # found a match - do the update
429 rodc_dns_update(d
, t
)
432 print("Unable to map to netlogon DNS update: %s" % d
)
435 # get the list of DNS entries we should have
437 dns_update_list
= opts
.update_list
439 dns_update_list
= lp
.private_path('dns_update_list')
441 # use our private krb5.conf to avoid problems with the wrong domain
442 # bind9 nsupdate wants the default domain set
443 krb5conf
= lp
.private_path('krb5.conf')
444 os
.environ
['KRB5_CONFIG'] = krb5conf
446 file = open(dns_update_list
, "r")
451 samdb
= SamDB(url
=lp
.samdb_url(), session_info
=system_session(), lp
=lp
)
453 # get the substitution dictionary
454 sub_vars
= get_subst_vars(samdb
)
456 # build up a list of update commands to pass to nsupdate
462 # read each line, and check that the DNS name exists
465 if line
== '' or line
[0] == "#":
467 d
= parse_dns_line(line
, sub_vars
)
470 if d
.type == 'A' and len(IP4s
) == 0:
472 if d
.type == 'AAAA' and len(IP6s
) == 0:
474 if str(d
) not in dup_set
:
478 # now expand the entries, if any are A record with ip set to $IP
479 # then replace with multiple entries, one for each interface IP
485 for i
in range(len(IP4s
)-1):
491 for i
in range(len(IP6s
)-1):
496 # now check if the entries already exist on the DNS server
498 if opts
.all_names
or not check_dns_name(d
):
499 update_list
.append(d
)
501 if len(update_list
) == 0:
503 print "No DNS updates needed"
510 # ask nsupdate to add entries as needed
511 for d
in update_list
:
513 if d
.name
.lower() == domain
.lower():
515 if not d
.type in [ 'A', 'AAAA' ]:
522 # delete the ccache if we created it
523 if ccachename
is not None:
524 os
.unlink(ccachename
)
527 print("Failed update of %u entries" % error_count
)
528 sys
.exit(error_count
)