URL: https://github.com/SSSD/sssd/pull/5283
Author: joakim-tjernlund
Title: #5283: Add dyndns_auth_ptr support
Action: synchronized
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5283/head:pr5283
git checkout pr5283
From 487f3b552e6897a70572152228033d12b58a90ee Mon Sep 17 00:00:00 2001
From: Joakim Tjernlund <joakim.tjernl...@infinera.com>
Date: Sat, 15 Aug 2020 11:47:42 +0200
Subject: [PATCH] Add dyndns_auth_ptr support
Allows to specify auth method for DNS PTR updates.
Default to same as dyndns_auth.
---
src/config/cfg_rules.ini | 1 +
src/man/sssd-ad.5.xml | 15 +++++++++++++++
src/man/sssd-ipa.5.xml | 15 +++++++++++++++
src/providers/ad/ad_dyndns.c | 1 +
src/providers/ad/ad_opts.c | 1 +
src/providers/be_dyndns.c | 13 +++++++++++++
src/providers/be_dyndns.h | 2 ++
src/providers/ipa/ipa_dyndns.c | 1 +
src/providers/ipa/ipa_opts.c | 1 +
src/providers/ldap/sdap_dyndns.c | 5 ++++-
src/providers/ldap/sdap_dyndns.h | 1 +
11 files changed, 55 insertions(+), 1 deletion(-)
diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
index 2874ea048b..6347024278 100644
--- a/src/config/cfg_rules.ini
+++ b/src/config/cfg_rules.ini
@@ -421,6 +421,7 @@ option = dyndns_refresh_interval
option = dyndns_update_ptr
option = dyndns_force_tcp
option = dyndns_auth
+option = dyndns_auth_ptr
option = dyndns_server
# files provider specific options
diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index 5c2f465462..e4712e26d9 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -1165,6 +1165,21 @@ ad_gpo_map_deny = +my_pam_service
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>dyndns_auth_ptr (string)</term>
+ <listitem>
+ <para>
+ Whether the nsupdate utility should use GSS-TSIG
+ authentication for secure PTR updates with the DNS
+ server, insecure updates can be sent by setting
+ this option to 'none'.
+ </para>
+ <para>
+ Default: Same as dyndns_auth
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term>dyndns_server (string)</term>
<listitem>
diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml
index 0de866740a..7b630493da 100644
--- a/src/man/sssd-ipa.5.xml
+++ b/src/man/sssd-ipa.5.xml
@@ -214,6 +214,21 @@
</listitem>
</varlistentry>
+ <varlistentry>
+ <term>dyndns_auth_ptr (string)</term>
+ <listitem>
+ <para>
+ Whether the nsupdate utility should use GSS-TSIG
+ authentication for secure PTR updates with the DNS
+ server, insecure updates can be sent by setting
+ this option to 'none'.
+ </para>
+ <para>
+ Default: Same as dyndns_auth
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry>
<term>ipa_enable_dns_sites (boolean)</term>
<listitem>
diff --git a/src/providers/ad/ad_dyndns.c b/src/providers/ad/ad_dyndns.c
index 00e1d253ae..71ef16c0b5 100644
--- a/src/providers/ad/ad_dyndns.c
+++ b/src/providers/ad/ad_dyndns.c
@@ -238,6 +238,7 @@ static void ad_dyndns_update_connect_done(struct tevent_req *subreq)
ctx->dyndns_ctx->opts,
sdap_ctx,
ctx->dyndns_ctx->auth_type,
+ ctx->dyndns_ctx->auth_ptr_type,
dp_opt_get_string(ctx->dyndns_ctx->opts,
DP_OPT_DYNDNS_IFACE),
dp_opt_get_string(ctx->basic,
diff --git a/src/providers/ad/ad_opts.c b/src/providers/ad/ad_opts.c
index 25b1367731..b61de2838e 100644
--- a/src/providers/ad/ad_opts.c
+++ b/src/providers/ad/ad_opts.c
@@ -309,6 +309,7 @@ struct dp_option ad_dyndns_opts[] = {
{ "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
{ "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
{ "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
+ { "dyndns_auth_ptr", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
DP_OPTION_TERMINATOR
};
diff --git a/src/providers/be_dyndns.c b/src/providers/be_dyndns.c
index 54f3cc08a3..2de3b11bb7 100644
--- a/src/providers/be_dyndns.c
+++ b/src/providers/be_dyndns.c
@@ -1217,6 +1217,7 @@ static struct dp_option default_dyndns_opts[] = {
{ "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_FALSE },
{ "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
{ "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
+ { "dyndns_auth_ptr", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
DP_OPTION_TERMINATOR
@@ -1254,6 +1255,18 @@ be_nsupdate_init(TALLOC_CTX *mem_ctx, struct be_ctx *be_ctx,
return EINVAL;
}
+ strauth = dp_opt_get_string(ctx->opts, DP_OPT_DYNDNS_AUTH_PTR);
+ if (strauth == NULL) {
+ ctx->auth_ptr_type = ctx->auth_type;
+ } else if (strcasecmp(strauth, "gss-tsig") == 0) {
+ ctx->auth_ptr_type = BE_NSUPDATE_AUTH_GSS_TSIG;
+ } else if (strcasecmp(strauth, "none") == 0) {
+ ctx->auth_ptr_type = BE_NSUPDATE_AUTH_NONE;
+ } else {
+ DEBUG(SSSDBG_OP_FAILURE, "Unknown dyndns ptr auth type %s\n", strauth);
+ return EINVAL;
+ }
+
*_ctx = ctx;
return ERR_OK;
}
diff --git a/src/providers/be_dyndns.h b/src/providers/be_dyndns.h
index c8c48d9b09..2967519b47 100644
--- a/src/providers/be_dyndns.h
+++ b/src/providers/be_dyndns.h
@@ -39,6 +39,7 @@ enum be_nsupdate_auth {
struct be_nsupdate_ctx {
struct dp_option *opts;
enum be_nsupdate_auth auth_type;
+ enum be_nsupdate_auth auth_ptr_type;
time_t last_refresh;
bool timer_in_progress;
@@ -56,6 +57,7 @@ enum dp_dyndns_opts {
DP_OPT_DYNDNS_UPDATE_PTR,
DP_OPT_DYNDNS_FORCE_TCP,
DP_OPT_DYNDNS_AUTH,
+ DP_OPT_DYNDNS_AUTH_PTR,
DP_OPT_DYNDNS_SERVER,
DP_OPT_DYNDNS /* attrs counter */
diff --git a/src/providers/ipa/ipa_dyndns.c b/src/providers/ipa/ipa_dyndns.c
index 9404ea9cb9..76167eb918 100644
--- a/src/providers/ipa/ipa_dyndns.c
+++ b/src/providers/ipa/ipa_dyndns.c
@@ -213,6 +213,7 @@ ipa_dyndns_update_connect_done(struct tevent_req *subreq)
ctx->dyndns_ctx->opts,
sdap_ctx,
ctx->dyndns_ctx->auth_type,
+ ctx->dyndns_ctx->auth_ptr_type,
dp_opt_get_string(ctx->dyndns_ctx->opts,
DP_OPT_DYNDNS_IFACE),
dp_opt_get_string(ctx->basic,
diff --git a/src/providers/ipa/ipa_opts.c b/src/providers/ipa/ipa_opts.c
index d0e23d5c5a..9ebcc85297 100644
--- a/src/providers/ipa/ipa_opts.c
+++ b/src/providers/ipa/ipa_opts.c
@@ -63,6 +63,7 @@ struct dp_option ipa_dyndns_opts[] = {
{ "dyndns_update_ptr", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
{ "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
{ "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
+ { "dyndns_auth_ptr", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
DP_OPTION_TERMINATOR
};
diff --git a/src/providers/ldap/sdap_dyndns.c b/src/providers/ldap/sdap_dyndns.c
index 01c4b405b4..3535fb4265 100644
--- a/src/providers/ldap/sdap_dyndns.c
+++ b/src/providers/ldap/sdap_dyndns.c
@@ -59,6 +59,7 @@ struct sdap_dyndns_update_state {
bool update_ptr;
bool check_diff;
enum be_nsupdate_auth auth_type;
+ enum be_nsupdate_auth auth_ptr_type;
bool fallback_mode;
char *update_msg;
};
@@ -89,6 +90,7 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,
struct dp_option *opts,
struct sdap_id_ctx *sdap_ctx,
enum be_nsupdate_auth auth_type,
+ enum be_nsupdate_auth auth_ptr_type,
const char *ifname,
const char *hostname,
const char *realm,
@@ -117,6 +119,7 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,
state->ev = ev;
state->opts = opts;
state->auth_type = auth_type;
+ state->auth_ptr_type = auth_ptr_type;
/* fallback servername is overridden by user option */
conf_servername = dp_opt_get_string(opts, DP_OPT_DYNDNS_SERVER);
@@ -432,7 +435,7 @@ sdap_dyndns_update_ptr_step(struct tevent_req *req)
}
/* Fork a child process to perform the DNS update */
- subreq = be_nsupdate_send(state, state->ev, state->auth_type,
+ subreq = be_nsupdate_send(state, state->ev, state->auth_ptr_type,
state->update_msg,
dp_opt_get_bool(state->opts,
DP_OPT_DYNDNS_FORCE_TCP));
diff --git a/src/providers/ldap/sdap_dyndns.h b/src/providers/ldap/sdap_dyndns.h
index c66e265944..5fb3667390 100644
--- a/src/providers/ldap/sdap_dyndns.h
+++ b/src/providers/ldap/sdap_dyndns.h
@@ -37,6 +37,7 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,
struct dp_option *opts,
struct sdap_id_ctx *sdap_ctx,
enum be_nsupdate_auth auth_type,
+ enum be_nsupdate_auth auth_ptr_type,
const char *ifname,
const char *hostname,
const char *realm,
_______________________________________________
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org
