+++ /dev/null
-From 1d97835f07fd5142187629941422f87b33015414 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <tridge@samba.org>
-Date: Wed, 17 Feb 2010 10:47:59 +1100
-Subject: [PATCH 1/5] leave the question section in update responses.
-
-This fixes TSIG-GSS updates from windows7 and w2k8r2, which require
-the question to be included in the initial refusal for the unsigned
-update.
----
- lib/dns/message.c | 3 ++-
- 1 files changed, 2 insertions(+), 1 deletions(-)
-
-diff --git a/lib/dns/message.c b/lib/dns/message.c
-index b541635..ae4965f 100644
---- a/lib/dns/message.c
-+++ b/lib/dns/message.c
-@@ -2474,7 +2474,8 @@ dns_message_reply(dns_message_t *msg, isc_boolean_t want_question_section) {
- if (!msg->header_ok)
- return (DNS_R_FORMERR);
- if (msg->opcode != dns_opcode_query &&
-- msg->opcode != dns_opcode_notify)
-+ msg->opcode != dns_opcode_notify &&
-+ msg->opcode != dns_opcode_update)
- want_question_section = ISC_FALSE;
- if (want_question_section) {
- if (!msg->question_ok)
---
-1.6.3.3
-
+++ /dev/null
-From 31059dee4a706bb4f25f3dccaae7616451eabd8b Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <tridge@samba.org>
-Date: Wed, 17 Feb 2010 10:59:42 +1100
-Subject: [PATCH 2/5] prevent a valgrind uninitialised memory warning
-
-epoll uses a union, so to prevent passing uninitialised data in a
-syscall we need to zero it before use.
----
- lib/isc/unix/socket.c | 2 ++
- 1 files changed, 2 insertions(+), 0 deletions(-)
-
-diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
-index d09fe51..4796ee4 100644
---- a/lib/isc/unix/socket.c
-+++ b/lib/isc/unix/socket.c
-@@ -652,6 +652,7 @@ watch_fd(isc_socketmgr_t *manager, int fd, int msg) {
- event.events = EPOLLIN;
- else
- event.events = EPOLLOUT;
-+ memset(&event.data, 0, sizeof(event.data));
- event.data.fd = fd;
- if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_ADD, fd, &event) == -1 &&
- errno != EEXIST) {
-@@ -719,6 +720,7 @@ unwatch_fd(isc_socketmgr_t *manager, int fd, int msg) {
- event.events = EPOLLIN;
- else
- event.events = EPOLLOUT;
-+ memset(&event.data, 0, sizeof(event.data));
- event.data.fd = fd;
- if (epoll_ctl(manager->epoll_fd, EPOLL_CTL_DEL, fd, &event) == -1 &&
- errno != ENOENT) {
---
-1.6.3.3
-
+++ /dev/null
-From ec22ed6c9797dbdcd820e352167bef8500ca00c6 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <tridge@samba.org>
-Date: Wed, 17 Feb 2010 12:20:35 +1100
-Subject: [PATCH 3/5] don't compress TSIG names
-
-windows DNS servers will refuse TSIG-GSS requests with compressed
-names
----
- bin/nsupdate/nsupdate.c | 4 ++++
- lib/dns/message.c | 2 ++
- lib/dns/tsig.c | 3 +++
- 3 files changed, 9 insertions(+), 0 deletions(-)
-
-diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 6cf4cf4..f7ce6db 100644
---- a/bin/nsupdate/nsupdate.c
-+++ b/bin/nsupdate/nsupdate.c
-@@ -1985,6 +1985,10 @@ send_update(dns_name_t *zonename, isc_sockaddr_t *master,
- fprintf(stderr, "Sending update to %s\n", addrbuf);
- }
-
-+ /* windows doesn't like the tsig name to be compressed */
-+ if (updatemsg->tsigname)
-+ updatemsg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
-+
- result = dns_request_createvia3(requestmgr, updatemsg, srcaddr,
- master, options, tsigkey, timeout,
- udp_timeout, udp_retries, global_task,
-diff --git a/lib/dns/message.c b/lib/dns/message.c
-index ae4965f..cb4528f 100644
---- a/lib/dns/message.c
-+++ b/lib/dns/message.c
-@@ -1531,6 +1531,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
- } else if (rdtype == dns_rdatatype_tsig && msg->tsig == NULL) {
- msg->tsig = rdataset;
- msg->tsigname = name;
-+ /* TSIG names should not be compressed */
-+ msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
- rdataset = NULL;
- free_rdataset = ISC_FALSE;
- free_name = ISC_FALSE;
-diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
-index 74a7af3..3223942 100644
---- a/lib/dns/tsig.c
-+++ b/lib/dns/tsig.c
-@@ -889,6 +889,9 @@ dns_tsig_sign(dns_message_t *msg) {
- msg->tsig = dataset;
- msg->tsigname = owner;
-
-+ /* windows does not like the tsig name being compressed */
-+ msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
-+
- return (ISC_R_SUCCESS);
-
- cleanup_rdatalist:
---
-1.6.3.3
-
+++ /dev/null
-From c73ceb48ffc518e171d1d40b82ae2b5f603fe038 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <tridge@samba.org>
-Date: Wed, 17 Feb 2010 15:27:44 +1100
-Subject: [PATCH 4/5] If tkey-gssapi initialisation fails, then heck for the most common
- configuration errors so that the admin doesn't spend all day trying to
- work out why the config is broken.
-
----
- lib/dns/gssapictx.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
- 1 files changed, 48 insertions(+), 0 deletions(-)
-
-diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
-index 11eadb9..879393c 100644
---- a/lib/dns/gssapictx.c
-+++ b/lib/dns/gssapictx.c
-@@ -66,6 +66,7 @@
- * we include SPNEGO's OID.
- */
- #if defined(GSSAPI)
-+#include <krb5/krb5.h>
-
- static unsigned char krb5_mech_oid_bytes[] = {
- 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x01, 0x02, 0x02
-@@ -191,6 +192,50 @@ log_cred(const gss_cred_id_t cred) {
- }
- #endif
-
-+#ifdef GSSAPI
-+/*
-+ * check for the most common configuration errors.
-+ *
-+ * The errors checked for are:
-+ * - tkey-gssapi-credential doesn't start with DNS/
-+ * - the default realm in /etc/krb5.conf and the
-+ * tkey-gssapi-credential bind config option don't match
-+ */
-+static void dst_gssapi_check_config(const char *gss_name)
-+{
-+ const char *p;
-+ krb5_context krb5_ctx;
-+ char *krb5_realm = NULL;
-+
-+ if (strncasecmp(gss_name, "DNS/", 4) != 0) {
-+ gss_log(ISC_LOG_ERROR, "tkey-gssapi-credential (%s) should start with 'DNS/'");
-+ return;
-+ }
-+
-+ if (krb5_init_context(&krb5_ctx) != 0) {
-+ gss_log(ISC_LOG_ERROR, "Unable to initialise krb5 context");
-+ return;
-+ }
-+ if (krb5_get_default_realm(krb5_ctx, &krb5_realm) != 0) {
-+ gss_log(ISC_LOG_ERROR, "Unable to get krb5 default realm");
-+ krb5_free_context(krb5_ctx);
-+ return;
-+ }
-+ if (!(p = strchr(gss_name, '/'))) {
-+ gss_log(ISC_LOG_ERROR, "badly formatted tkey-gssapi-credentials (%s)", gss_name);
-+ krb5_free_context(krb5_ctx);
-+ return;
-+ }
-+ if (strcasecmp(p+1, krb5_realm) != 0) {
-+ gss_log(ISC_LOG_ERROR,"default realm from krb5.conf (%s) does not match tkey-gssapi-credential (%s)",
-+ krb5_realm, gss_name);
-+ krb5_free_context(krb5_ctx);
-+ return;
-+ }
-+ krb5_free_context(krb5_ctx);
-+}
-+#endif
-+
- isc_result_t
- dst_gssapi_acquirecred(dns_name_t *name, isc_boolean_t initiate,
- gss_cred_id_t *cred)
-@@ -223,6 +268,8 @@ dst_gssapi_acquirecred(dns_name_t *name, isc_boolean_t initiate,
- gret = gss_import_name(&minor, &gnamebuf,
- GSS_C_NO_OID, &gname);
- if (gret != GSS_S_COMPLETE) {
-+ dst_gssapi_check_config((char *)array);
-+
- gss_log(3, "failed gss_import_name: %s",
- gss_error_tostring(gret, minor, buf,
- sizeof(buf)));
-@@ -254,6 +301,7 @@ dst_gssapi_acquirecred(dns_name_t *name, isc_boolean_t initiate,
- initiate ? "initiate" : "accept",
- (char *)gnamebuf.value,
- gss_error_tostring(gret, minor, buf, sizeof(buf)));
-+ dst_gssapi_check_config((char *)array);
- return (ISC_R_FAILURE);
- }
-
---
-1.6.3.3
-
+++ /dev/null
-From 0f6a49d9fb4a3b9f917ee9caed3a94e44db045a5 Mon Sep 17 00:00:00 2001
-From: Andrew Tridgell <tridge@samba.org>
-Date: Wed, 17 Feb 2010 15:28:51 +1100
-Subject: [PATCH 5/5] windows doesn't return valid GSSAPI sequence numbers on its
- TSIG-GSS DNS update replies
-
----
- lib/dns/gssapictx.c | 5 ++++-
- 1 files changed, 4 insertions(+), 1 deletions(-)
-
-diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
-index 879393c..69b66c5 100644
---- a/lib/dns/gssapictx.c
-+++ b/lib/dns/gssapictx.c
-@@ -536,8 +536,11 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
- gintokenp = NULL;
- }
-
-+ /* note that we don't set GSS_C_SEQUENCE_FLAG as Windows DNS
-+ * servers don't like it
-+ */
- flags = GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG |
-- GSS_C_SEQUENCE_FLAG | GSS_C_INTEG_FLAG;
-+ GSS_C_INTEG_FLAG;
-
- gret = gss_init_sec_context(&minor, GSS_C_NO_CREDENTIAL, gssctx,
- gname, GSS_SPNEGO_MECHANISM, flags,
---
-1.6.3.3
-
+++ /dev/null
-NOTE! These patches are now incorporated in bind9 releases from
-9.7.2RC1 and onwards. You no longer need a patched version of bind9 to
-work with krb5 DNS updates and Samba4.
-
----------------------------------
-
-These patches fix the TSIG-GSS dynamic DNS updates in bind9 to allow
-dynamic updates to work with recent windows versions.
-
-The patches were developed against bind9 version 9.6.1, and were
-tested on Ubuntu Karmic.
git.samba.org / kai / samba-autobuild / .git / commitdiff