From 88096745d1ef1798854e0c8319b5ae015f045fe3 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Wed, 1 May 2019 09:24:24 +0300
Subject: [PATCH] Move recognition of a templated attribute to
ldap_attribute_to_rdatatype
When substitution of a templated entry attribute fails, we need to fall
back to a static definition of the attribute from the same entry. This
means, however, that ldap_attribute_to_rdatatype() will attempt to parse
an attribute value anyway and will be confused by the templating prefix,
thus reporting in named's logs:
unsupported operation: object class in resource record template DN
'idnsname=$NAME,idnsname=$ZONE.,cn=dns,$BASEDN' changed:
rndc reload might be necessary
Move recognition of a template attribute name to
ldap_attribute_to_rdatatype() so that a proper attribute class is
correctly derived and ignore templated attribute in the fallback code
if case that template expansion is failed.
Resolves: rhbz#1705072
---
src/ldap_convert.c | 33 +++++++++++++++++++++++++--------
src/ldap_convert.h | 2 ++
src/ldap_helper.c | 21 ++++++++++++++-------
3 files changed, 41 insertions(+), 15 deletions(-)
diff --git a/src/ldap_convert.c b/src/ldap_convert.c
index 002a679..6e24c81 100644
--- a/src/ldap_convert.c
+++ b/src/ldap_convert.c
@@ -372,23 +372,40 @@ ldap_attribute_to_rdatatype(const char *ldap_attribute, dns_rdatatype_t *rdtype)
{
isc_result_t result;
unsigned len;
+ const char *attribute = NULL;
isc_consttextregion_t region;
len = strlen(ldap_attribute);
if (len <= LDAP_RDATATYPE_SUFFIX_LEN)
return ISC_R_UNEXPECTEDEND;
+
+ /* Before looking up rdtype, we need to see if rdtype is
+ * an LDAP subtype (type;subtype) and if so, strip one of
+ * the known prefixes. We also need to remove 'record' suffix
+ * if it exists. The resulting rdtype text name should have no
+ * 'extra' details: A, AAAA, CNAME, etc. */
+ attribute = ldap_attribute;
+
+ /* Does attribute name start with with TEMPLATE_PREFIX? */
+ if (strncasecmp(LDAP_RDATATYPE_TEMPLATE_PREFIX,
+ ldap_attribute,
+ LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN) == 0) {
+ attribute = ldap_attribute + LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN;
+ len -= LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN;
+ /* Does attribute name start with with UNKNOWN_PREFIX? */
+ } else if (strncasecmp(LDAP_RDATATYPE_UNKNOWN_PREFIX,
+ ldap_attribute,
+ LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN) == 0) {
+ attribute = ldap_attribute + LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN;
+ len -= LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN;
+ }
+
/* Does attribute name end with RECORD_SUFFIX? */
- if (strcasecmp(ldap_attribute + len - LDAP_RDATATYPE_SUFFIX_LEN,
+ if (strcasecmp(attribute + len - LDAP_RDATATYPE_SUFFIX_LEN,
LDAP_RDATATYPE_SUFFIX) == 0) {
- region.base = ldap_attribute;
+ region.base = attribute;
region.length = len - LDAP_RDATATYPE_SUFFIX_LEN;
- /* Does attribute name start with with UNKNOWN_PREFIX? */
- } else if (strncasecmp(ldap_attribute,
- LDAP_RDATATYPE_UNKNOWN_PREFIX,
- LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN) == 0) {
- region.base = ldap_attribute + LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN;
- region.length = len - LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN;
} else
return ISC_R_UNEXPECTED;
diff --git a/src/ldap_convert.h b/src/ldap_convert.h
index 47ac947..fcd575b 100644
--- a/src/ldap_convert.h
+++ b/src/ldap_convert.h
@@ -17,6 +17,8 @@
#define LDAP_RDATATYPE_SUFFIX_LEN (sizeof(LDAP_RDATATYPE_SUFFIX) - 1)
#define LDAP_RDATATYPE_UNKNOWN_PREFIX "UnknownRecord;"
#define LDAP_RDATATYPE_UNKNOWN_PREFIX_LEN (sizeof(LDAP_RDATATYPE_UNKNOWN_PREFIX) - 1)
+#define LDAP_RDATATYPE_TEMPLATE_PREFIX "idnsTemplateAttribute;"
+#define LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN (sizeof(LDAP_RDATATYPE_TEMPLATE_PREFIX) - 1)
/*
* Convert LDAP DN 'dn', to dns_name_t 'target'. 'target' needs to be
diff --git a/src/ldap_helper.c b/src/ldap_helper.c
index 8b486ae..7f70ee3 100644
--- a/src/ldap_helper.c
+++ b/src/ldap_helper.c
@@ -2396,7 +2396,7 @@ ldap_substitute_rr_template(isc_mem_t *mctx, const settings_set_t * set,
result = setting_find(setting_name, set, isc_boolean_true,
isc_boolean_true, &setting);
if (result != ISC_R_SUCCESS) {
- log_debug(3, "setting '%s' is not defined so it "
+ log_debug(5, "setting '%s' is not defined so it "
"cannot be substituted into template '%s'",
setting_name, str_buf(orig_val));
CLEANUP_WITH(ISC_R_IGNORE);
@@ -2459,23 +2459,22 @@ ldap_parse_rrentry_template(isc_mem_t *mctx, ldap_entry_t *entry,
dns_rdatatype_t rdtype;
dns_rdatalist_t *rdlist = NULL;
isc_boolean_t did_something = ISC_FALSE;
- static const char prefix[] = "idnsTemplateAttribute;";
- static const char prefix_len = sizeof(prefix) - 1;
CHECK(str_new(mctx, &orig_val));
rdclass = ldap_entry_getrdclass(entry);
ttl = ldap_entry_getttl(entry, settings);
while ((attr = ldap_entry_nextattr(entry)) != NULL) {
- if (strncasecmp(prefix, attr->name, prefix_len) != 0)
+ if (strncasecmp(LDAP_RDATATYPE_TEMPLATE_PREFIX,
+ attr->name,
+ LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN) != 0)
continue;
- result = ldap_attribute_to_rdatatype(attr->name + prefix_len,
- &rdtype);
+ result = ldap_attribute_to_rdatatype(attr->name, &rdtype);
if (result != ISC_R_SUCCESS) {
log_bug("%s: substitution into '%s' is not supported",
ldap_entry_logname(entry),
- attr->name + prefix_len);
+ attr->name + LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN);
continue;
}
@@ -2559,6 +2558,14 @@ ldap_parse_rrentry(isc_mem_t *mctx, ldap_entry_t *entry, dns_name_t *origin,
for (result = ldap_entry_firstrdtype(entry, &attr, &rdtype);
result == ISC_R_SUCCESS;
result = ldap_entry_nextrdtype(entry, &attr, &rdtype)) {
+ /* If we reached this point and found a template attribute,
+ * skip it because it was not translated above due to missing
+ * defaults or some other errors. */
+ if (((entry->class & LDAP_ENTRYCLASS_TEMPLATE) != 0) &&
+ strncasecmp(LDAP_RDATATYPE_TEMPLATE_PREFIX,
+ attr->name,
+ LDAP_RDATATYPE_TEMPLATE_PREFIX_LEN) == 0)
+ continue;
CHECK(findrdatatype_or_create(mctx, rdatalist, rdclass,
rdtype, ttl, &rdlist));
--
2.21.0