#include "lib/events/events.h"
#include "dsdb/samdb/samdb.h"
#include "dsdb/common/util.h"
+#include "auth/auth.h"
#include "auth/session.h"
#include "auth/gensec/gensec.h"
+#include "librpc/gen_ndr/security.h"
+#include "auth/credentials/credentials.h"
+#include "system/kerberos.h"
+#include "auth/kerberos/kerberos.h"
#include "gen_ndr/ndr_dnsp.h"
-#include "lib/cmdline/popt_common.h"
-#include "lib/cmdline/popt_credentials.h"
-#include "ldb_module.h"
+#include "gen_ndr/server_id.h"
+#include "messaging/messaging.h"
#include "dlz_minimal.h"
+
+struct b9_options {
+ const char *url;
+};
+
struct dlz_bind9_data {
+ struct b9_options options;
struct ldb_context *samdb;
struct tevent_context *ev_ctx;
struct loadparm_context *lp;
int *transaction_token;
uint32_t soa_serial;
+ /* Used for dynamic update */
+ struct smb_krb5_context *smb_krb5_ctx;
+
/* helper functions from the dlz_dlopen driver */
void (*log)(int level, const char *fmt, ...);
isc_result_t (*putrr)(dns_sdlzlookup_t *handle, const char *type,
static const char *zone_prefixes[] = {
"CN=MicrosoftDNS,DC=DomainDnsZones",
"CN=MicrosoftDNS,DC=ForestDnsZones",
+ "CN=MicrosoftDNS,CN=System",
NULL
};
/*
see if a DNS type is single valued
*/
-static enum dns_record_type b9_dns_type(const char *type)
+static bool b9_dns_type(const char *type, enum dns_record_type *dtype)
{
int i;
for (i=0; i<ARRAY_SIZE(dns_typemap); i++) {
if (strcasecmp(dns_typemap[i].typestr, type) == 0) {
- return dns_typemap[i].dns_type;
+ *dtype = dns_typemap[i].dns_type;
+ return true;
}
}
- return DNS_TYPE_ZERO;
+ return false;
}
return result;
}
-struct b9_options {
- const char *url;
-};
-
/*
parse options
*/
unsigned int argc, char *argv[],
struct b9_options *options)
{
- int opt;
- poptContext pc;
- struct poptOption long_options[] = {
- { "url", 'H', POPT_ARG_STRING, &options->url, 0, "database URL", "URL" },
- { NULL }
- };
- struct poptOption **popt_options;
- int ret;
-
- fault_setup_disable();
-
- popt_options = ldb_module_popt_options(state->samdb);
- (*popt_options) = long_options;
-
- ret = ldb_modules_hook(state->samdb, LDB_MODULE_HOOK_CMDLINE_OPTIONS);
- if (ret != LDB_SUCCESS) {
- state->log(ISC_LOG_ERROR, "dlz samba: failed cmdline hook");
- return ISC_R_FAILURE;
- }
-
- pc = poptGetContext("dlz_bind9", argc, (const char **)argv, *popt_options,
- POPT_CONTEXT_KEEP_FIRST);
-
- while ((opt = poptGetNextOpt(pc)) != -1) {
- switch (opt) {
- default:
- state->log(ISC_LOG_ERROR, "dlz samba: Invalid option %s: %s",
- poptBadOption(pc, 0), poptStrerror(opt));
- return ISC_R_FAILURE;
+ if (argc == 2) {
+ options->url = talloc_strdup(state, argv[1]);
+ if (options->url == NULL) {
+ return ISC_R_NOMEMORY;
}
- }
-
- ret = ldb_modules_hook(state->samdb, LDB_MODULE_HOOK_CMDLINE_PRECONNECT);
- if (ret != LDB_SUCCESS) {
- state->log(ISC_LOG_ERROR, "dlz samba: failed cmdline preconnect");
- return ISC_R_FAILURE;
+ state->log(ISC_LOG_INFO, "samba_dlz: Using samdb URL %s", options->url);
}
return ISC_R_SUCCESS;
va_list ap;
isc_result_t result;
TALLOC_CTX *tmp_ctx;
- int ret;
struct ldb_dn *dn;
- struct b9_options options;
-
- ZERO_STRUCT(options);
+ NTSTATUS nt_status;
state = talloc_zero(NULL, struct dlz_bind9_data);
if (state == NULL) {
goto failed;
}
- state->samdb = ldb_init(state, state->ev_ctx);
- if (state->samdb == NULL) {
- state->log(ISC_LOG_ERROR, "samba_dlz: Failed to create ldb");
- result = ISC_R_FAILURE;
- goto failed;
- }
-
- result = parse_options(state, argc, argv, &options);
+ result = parse_options(state, argc, argv, &state->options);
if (result != ISC_R_SUCCESS) {
goto failed;
}
goto failed;
}
- if (options.url == NULL) {
- options.url = talloc_asprintf(tmp_ctx, "ldapi://%s",
- private_path(tmp_ctx, state->lp, "ldap_priv/ldapi"));
- if (options.url == NULL) {
+ if (smb_krb5_init_context(state, state->ev_ctx, state->lp, &state->smb_krb5_ctx) != 0) {
+ result = ISC_R_NOMEMORY;
+ goto failed;
+ }
+
+ nt_status = gensec_init();
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ if (state->options.url == NULL) {
+ state->options.url = lpcfg_private_path(state, state->lp, "dns/sam.ldb");
+ if (state->options.url == NULL) {
result = ISC_R_NOMEMORY;
goto failed;
}
}
- ret = ldb_connect(state->samdb, options.url, 0, NULL);
- if (ret == -1) {
- state->log(ISC_LOG_ERROR, "samba_dlz: Failed to connect to %s - %s",
- options.url, ldb_errstring(state->samdb));
- result = ISC_R_FAILURE;
- goto failed;
- }
+ /* Do not install samba signal handlers */
+ fault_setup_disable();
- ret = ldb_modules_hook(state->samdb, LDB_MODULE_HOOK_CMDLINE_POSTCONNECT);
- if (ret != LDB_SUCCESS) {
- state->log(ISC_LOG_ERROR, "samba_dlz: Failed postconnect for %s - %s",
- options.url, ldb_errstring(state->samdb));
+ state->samdb = samdb_connect_url(state, state->ev_ctx, state->lp,
+ system_session(state->lp), 0, state->options.url);
+ if (state->samdb == NULL) {
+ state->log(ISC_LOG_ERROR, "samba_dlz: Failed to connect to %s",
+ state->options.url);
result = ISC_R_FAILURE;
goto failed;
}
dn = ldb_get_default_basedn(state->samdb);
if (dn == NULL) {
state->log(ISC_LOG_ERROR, "samba_dlz: Unable to get basedn for %s - %s",
- options.url, ldb_errstring(state->samdb));
+ state->options.url, ldb_errstring(state->samdb));
result = ISC_R_FAILURE;
goto failed;
}
for (j=0; j<res->count; j++) {
isc_result_t result;
const char *zone = ldb_msg_find_attr_as_string(res->msgs[j], "name", NULL);
+ struct ldb_dn *zone_dn;
+
if (zone == NULL) {
continue;
}
- if (!b9_has_soa(state, dn, zone)) {
+ zone_dn = ldb_dn_copy(tmp_ctx, dn);
+ if (zone_dn == NULL) {
+ talloc_free(tmp_ctx);
+ return ISC_R_NOMEMORY;
+ }
+
+ if (!b9_has_soa(state, zone_dn, zone)) {
continue;
}
result = state->writeable_zone(view, zone);
return ISC_R_SUCCESS;
}
+static char *strlower(char *str)
+{
+ int i;
+
+ for (i=0; i<strlen(str); i++) {
+ str[i] = (char) tolower(str[i]);
+ }
+
+ return str;
+}
+
/*
authorize a zone update
*/
void *dbdata)
{
struct dlz_bind9_data *state = talloc_get_type_abort(dbdata, struct dlz_bind9_data);
+ TALLOC_CTX *tmp_ctx;
+ DATA_BLOB ap_req;
+ struct cli_credentials *server_credentials;
+ char *keytab_name, *username;
+ bool ret;
+ int ldb_ret;
+ NTSTATUS nt_status;
+ struct gensec_security *gensec_ctx;
+ struct auth_session_info *session_info;
+ struct ldb_dn *dn;
+ isc_result_t result;
+ struct ldb_result *res;
+ const char * attrs[] = { NULL };
+ uint32_t access_mask;
- state->log(ISC_LOG_INFO, "samba_dlz: allowing update of signer=%s name=%s tcpaddr=%s type=%s key=%s keydatalen=%u",
- signer, name, tcpaddr, type, key, keydatalen);
+ tmp_ctx = talloc_new(NULL);
+ if (tmp_ctx == NULL) {
+ state->log(ISC_LOG_ERROR, "samba_dlz: no memory");
+ return false;
+ }
+
+ ap_req = data_blob_const(keydata, keydatalen);
+ server_credentials = cli_credentials_init(tmp_ctx);
+ if (!server_credentials) {
+ state->log(ISC_LOG_ERROR, "samba_dlz: failed to init server credentials");
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ cli_credentials_set_krb5_context(server_credentials, state->smb_krb5_ctx);
+ cli_credentials_set_conf(server_credentials, state->lp);
+
+ username = talloc_asprintf(tmp_ctx, "dns-%s", lpcfg_netbios_name(state->lp));
+ username = strlower(username);
+ cli_credentials_set_username(server_credentials, username, CRED_SPECIFIED);
+ talloc_free(username);
+
+ keytab_name = talloc_asprintf(tmp_ctx, "file:%s/dns.keytab",
+ lpcfg_private_dir(state->lp));
+ ret = cli_credentials_set_keytab_name(server_credentials, state->lp, keytab_name,
+ CRED_SPECIFIED);
+ talloc_free(keytab_name);
+ if (ret != 0) {
+ state->log(ISC_LOG_ERROR, "samba_dlz: failed to obtain server credentials for %s",
+ username);
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ nt_status = gensec_server_start(tmp_ctx,
+ lpcfg_gensec_settings(tmp_ctx, state->lp),
+ NULL, &gensec_ctx);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ state->log(ISC_LOG_ERROR, "samba_dlz: failed to start gensec server");
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ gensec_set_credentials(gensec_ctx, server_credentials);
+ gensec_set_target_service(gensec_ctx, "dns");
+
+ nt_status = gensec_start_mech_by_name(gensec_ctx, "spnego");
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ state->log(ISC_LOG_ERROR, "samba_dlz: failed to start spnego");
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ nt_status = gensec_update(gensec_ctx, tmp_ctx, state->ev_ctx, ap_req, &ap_req);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ state->log(ISC_LOG_ERROR, "samba_dlz: spnego update failed");
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ nt_status = gensec_session_info(gensec_ctx, tmp_ctx, &session_info);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ state->log(ISC_LOG_ERROR, "samba_dlz: failed to create session info");
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ /* Get the DN from name */
+ result = b9_find_name_dn(state, name, tmp_ctx, &dn);
+ if (result != ISC_R_SUCCESS) {
+ state->log(ISC_LOG_ERROR, "samba_dlz: failed to find name %s", name);
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ /* make sure the dn exists, or find parent dn in case new object is being added */
+ ldb_ret = ldb_search(state->samdb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,
+ attrs, "objectClass=dnsNode");
+ if (ldb_ret == LDB_ERR_NO_SUCH_OBJECT) {
+ ldb_dn_remove_child_components(dn, 1);
+ access_mask = SEC_ADS_CREATE_CHILD;
+ talloc_free(res);
+ } else if (ldb_ret == LDB_SUCCESS) {
+ access_mask = SEC_STD_REQUIRED | SEC_ADS_SELF_WRITE;
+ talloc_free(res);
+ } else {
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ /* Do ACL check */
+ ldb_ret = dsdb_check_access_on_dn(state->samdb, tmp_ctx, dn,
+ session_info->security_token,
+ access_mask, NULL);
+ if (ldb_ret != LDB_SUCCESS) {
+ state->log(ISC_LOG_INFO,
+ "samba_dlz: disallowing update of signer=%s name=%s type=%s error=%s",
+ signer, name, type, ldb_strerror(ldb_ret));
+ talloc_free(tmp_ctx);
+ return false;
+ }
+
+ state->log(ISC_LOG_INFO, "samba_dlz: allowing update of signer=%s name=%s tcpaddr=%s type=%s key=%s",
+ signer, name, tcpaddr, type, key);
+
+ talloc_free(tmp_ctx);
return true;
}
return ISC_R_FAILURE;
}
- dns_type = b9_dns_type(type);
- if (dns_type == DNS_TYPE_ZERO) {
+ if (!b9_dns_type(type, &dns_type)) {
state->log(ISC_LOG_INFO, "samba_dlz: bad dns type %s in delete", type);
return ISC_R_FAILURE;
}
git.samba.org / kai / samba.git / blobdiff