From 88096745d1ef1798854e0c8319b5ae015f045fe3 Mon Sep 17 00:00:00 2001

From: Alexander Bokovoy <abokovoy@redhat.com>

Date: Wed, 1 May 2019 09:24:24 +0300

Subject: [PATCH] Move recognition of a templated attribute to

 ldap_attribute_to_rdatatype

When substitution of a templated entry attribute fails, we need to fall

back to a static definition of the attribute from the same entry. This

means, however, that ldap_attribute_to_rdatatype() will attempt to parse

an attribute value anyway and will be confused by the templating prefix,

thus reporting in named's logs:

unsupported operation: object class in resource record template DN

'idnsname=$NAME,idnsname=$ZONE.,cn=dns,$BASEDN' changed:

rndc reload might be necessary

Move recognition of a template attribute name to

ldap_attribute_to_rdatatype() so that a proper attribute class is

correctly derived and ignore templated attribute in the fallback code

if case that template expansion is failed.

Resolves: rhbz#1705072

---

 src/ldap_convert.c | 33 +++++++++++++++++++++++++--------

 src/ldap_convert.h |  2 ++

 src/ldap_helper.c  | 21 ++++++++++++++-------

 3 files changed, 41 insertions(+), 15 deletions(-)

diff --git a/src/ldap_convert.c b/src/ldap_convert.c

index 002a679..6e24c81 100644

--- a/src/ldap_convert.c

+++ b/src/ldap_convert.c

@@ -372,23 +372,40 @@ ldap_attribute_to_rdatatype(const char *ldap_attribute, dns_rdatatype_t *rdtype)

 {

 	isc_result_t result;

 	unsigned len;

+	const char *attribute = NULL;

 	isc_consttextregion_t region;

 	len = strlen(ldap_attribute);

 	if (len <= LDAP_RDATATYPE_SUFFIX_LEN)

 		return ISC_R_UNEXPECTEDEND;

+

+	/* Before looking up rdtype, we need to see if rdtype is

+	 * an LDAP subtype (type;subtype) and if so, strip one of

+	 * the known prefixes. We also need to remove 'record' suffix

+	 * if it exists. The resulting rdtype text name should have no

+	 * 'extra' details: A, AAAA, CNAME, etc. */

+	attribute = ldap_attribute;

+

+	/* Does attribute name start with with TEMPLATE_PREFIX? */

+	if (strncasecmp(LDAP_RDATATYPE_TEMPLATE_PREFIX,

+			ldap_attribute,

+			LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN) == 0) {

+		attribute = ldap_attribute + LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN;

+		len -= LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN;

+	/* Does attribute name start with with UNKNOWN_PREFIX? */

+	} else if (strncasecmp(LDAP_RDATATYPE_UNKNOWN_PREFIX,

+			       ldap_attribute,

+			       LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN) == 0) {

+		attribute = ldap_attribute + LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN;

+		len -= LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN;

+	}

+

 	/* Does attribute name end with RECORD_SUFFIX? */

-	if (strcasecmp(ldap_attribute + len - LDAP_RDATATYPE_SUFFIX_LEN,

+	if (strcasecmp(attribute + len - LDAP_RDATATYPE_SUFFIX_LEN,

 		       LDAP_RDATATYPE_SUFFIX) == 0) {

-		region.base = ldap_attribute;

+		region.base = attribute;

 		region.length = len - LDAP_RDATATYPE_SUFFIX_LEN;

-	/* Does attribute name start with with UNKNOWN_PREFIX? */

-	} else if (strncasecmp(ldap_attribute,

-			      LDAP_RDATATYPE_UNKNOWN_PREFIX,

-			      LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN) == 0) {

-		region.base = ldap_attribute + LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN;

-		region.length = len - LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN;

 	} else

 		return ISC_R_UNEXPECTED;

diff --git a/src/ldap_convert.h b/src/ldap_convert.h

index 47ac947..fcd575b 100644

--- a/src/ldap_convert.h

+++ b/src/ldap_convert.h

@@ -17,6 +17,8 @@

 #define LDAP_RDATATYPE_SUFFIX_LEN	(sizeof(LDAP_RDATATYPE_SUFFIX) - 1)

 #define LDAP_RDATATYPE_UNKNOWN_PREFIX	"UnknownRecord;"

 #define LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN	(sizeof(LDAP_RDATATYPE_UNKNOWN_PREFIX) - 1)

+#define LDAP_RDATATYPE_TEMPLATE_PREFIX "idnsTemplateAttribute;"

+#define LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN	(sizeof(LDAP_RDATATYPE_TEMPLATE_PREFIX) - 1)

 /*

  * Convert LDAP DN 'dn', to dns_name_t 'target'. 'target' needs to be

diff --git a/src/ldap_helper.c b/src/ldap_helper.c

index 8b486ae..7f70ee3 100644

--- a/src/ldap_helper.c

+++ b/src/ldap_helper.c

@@ -2396,7 +2396,7 @@ ldap_substitute_rr_template(isc_mem_t *mctx, const settings_set_t * set,

 		result = setting_find(setting_name, set, isc_boolean_true,

 				      isc_boolean_true, &setting);

 		if (result != ISC_R_SUCCESS) {

-			log_debug(3, "setting '%s' is not defined so it "

+			log_debug(5, "setting '%s' is not defined so it "

 				  "cannot be substituted into template '%s'",

 				  setting_name, str_buf(orig_val));

 			CLEANUP_WITH(ISC_R_IGNORE);

@@ -2459,23 +2459,22 @@ ldap_parse_rrentry_template(isc_mem_t *mctx, ldap_entry_t *entry,

 	dns_rdatatype_t rdtype;

 	dns_rdatalist_t *rdlist = NULL;

 	isc_boolean_t did_something = ISC_FALSE;

-	static const char prefix[] = "idnsTemplateAttribute;";

-	static const char prefix_len = sizeof(prefix) - 1;

 	CHECK(str_new(mctx, &orig_val));

 	rdclass = ldap_entry_getrdclass(entry);

 	ttl = ldap_entry_getttl(entry, settings);

 	while ((attr = ldap_entry_nextattr(entry)) != NULL) {

-		if (strncasecmp(prefix, attr->name, prefix_len) != 0)

+		if (strncasecmp(LDAP_RDATATYPE_TEMPLATE_PREFIX,

+				attr->name,

+				LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN) != 0)

 			continue;

-		result = ldap_attribute_to_rdatatype(attr->name + prefix_len,

-						     &rdtype);

+		result = ldap_attribute_to_rdatatype(attr->name, &rdtype);

 		if (result != ISC_R_SUCCESS) {

 			log_bug("%s: substitution into '%s' is not supported",

 				ldap_entry_logname(entry),

-				attr->name + prefix_len);

+				attr->name + LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN);

 			continue;

 		}

@@ -2559,6 +2558,14 @@ ldap_parse_rrentry(isc_mem_t *mctx, ldap_entry_t *entry, dns_name_t *origin,

 	for (result = ldap_entry_firstrdtype(entry, &attr, &rdtype);

 	     result == ISC_R_SUCCESS;

 	     result = ldap_entry_nextrdtype(entry, &attr, &rdtype)) {

+		/* If we reached this point and found a template attribute,

+		 * skip it because it was not translated above due to missing

+		 * defaults or some other errors. */

+		if (((entry->class & LDAP_ENTRYCLASS_TEMPLATE) != 0) &&

+		    strncasecmp(LDAP_RDATATYPE_TEMPLATE_PREFIX,

+				attr->name,

+				LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN) == 0)

+			continue;

 		CHECK(findrdatatype_or_create(mctx, rdatalist, rdclass,

 					      rdtype, ttl, &rdlist));

-- 

2.21.0