From b280fc0d8287e9bee25516eddc1a6670691c24a1 Mon Sep 17 00:00:00 2001

From: Jakub Hrozek <jhrozek@redhat.com>

Date: Sun, 6 Jul 2014 22:53:27 +0200

Subject: [PATCH 84/90] DYNDNS: Add a new option dyndns_server

Some environments use a different DNS server than identity server. For

these environments, it would be useful to be able to override the DNS

server used to perform DNS updates.

This patch adds a new option dyndns_server that, if set, would be used

to hardcode a DNS server address into the nsupdate message.

Reviewed-by: Pavel Reichl <preichl@redhat.com>

(cherry picked from commit 8145ab51b05aa86b2f1a21b49383f55e50b0a2e3)

---

 src/config/SSSDConfig/__init__.py.in |  1 +

 src/config/SSSDConfigTest.py         |  2 ++

 src/config/etc/sssd.api.conf         |  1 +

 src/man/sssd-ad.5.xml                | 20 ++++++++++++++++++++

 src/man/sssd-ipa.5.xml               | 19 +++++++++++++++++++

 src/providers/ad/ad_opts.h           |  1 +

 src/providers/dp_dyndns.c            |  1 +

 src/providers/dp_dyndns.h            |  1 +

 src/providers/ipa/ipa_opts.h         |  1 +

 src/providers/ldap/sdap_dyndns.c     |  7 +++++++

 10 files changed, 54 insertions(+)

diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in

index fed2682f121103cefa27e689b29ce29b7d28f968..a7cd1dd243a53e7038dc69628475c76ccdd93260 100644

--- a/src/config/SSSDConfig/__init__.py.in

+++ b/src/config/SSSDConfig/__init__.py.in

@@ -148,6 +148,7 @@ option_strings = {

     'dyndns_update_ptr' : _("Whether the provider should explicitly update the PTR record as well"),

     'dyndns_force_tcp' : _("Whether the nsupdate utility should default to using TCP"),

     'dyndns_auth' : _("What kind of authentication should be used to perform the DNS update"),

+    'dyndns_server' : _("Override the DNS server used to perform the DNS update"),

     'subdomain_enumerate' : _('Control enumeration of trusted domains'),

     'subdomain_refresh_interval' : _('How often should subdomains list be refreshed'),

     'subdomain_inherit' : _('List of options that should be inherited into a subdomain'),

diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py

index 1d6107ceac1bde7acbfd2682cc144a4ef0881311..166ecd0ff0f5cfb38eefb1711e4ac5dd9f805d43 100755

--- a/src/config/SSSDConfigTest.py

+++ b/src/config/SSSDConfigTest.py

@@ -527,6 +527,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):

             'dyndns_update_ptr',

             'dyndns_force_tcp',

             'dyndns_auth',

+            'dyndns_server',

             'subdomain_enumerate',

             'override_gid',

             'case_sensitive',

@@ -891,6 +892,7 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):

             'dyndns_update_ptr',

             'dyndns_force_tcp',

             'dyndns_auth',

+            'dyndns_server',

             'subdomain_enumerate',

             'override_gid',

             'case_sensitive',

diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf

index 2e5b02e3e30c13f805e172eab481f7501f57bb05..f28054860205831b0452e409c109e3c62aa8d28a 100644

--- a/src/config/etc/sssd.api.conf

+++ b/src/config/etc/sssd.api.conf

@@ -155,6 +155,7 @@ dyndns_refresh_interval = int, None, false

 dyndns_update_ptr = bool, None, false

 dyndns_force_tcp = bool, None, false

 dyndns_auth = str, None, false

+dyndns_server = str, None, false

 # Special providers

 [provider/permit]

diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml

index 3cbc10520098372d984d00425d03832d002d6672..7ccd29794a89fa6b69b744a47da04f908efc7ef9 100644

--- a/src/man/sssd-ad.5.xml

+++ b/src/man/sssd-ad.5.xml

@@ -812,6 +812,26 @@ ad_gpo_map_deny = +my_pam_service

                     </listitem>

                 </varlistentry>

+                <varlistentry>

+                    <term>dyndns_server (string)</term>

+                    <listitem>

+                        <para>

+                            The DNS server to use when performing a DNS

+                            update. In most setups, it's recommended to leave

+                            this option unset.

+                        </para>

+                        <para>

+                            Setting this option makes sense for environments

+                            where the DNS server is different from the identity

+                            server.

+                        </para>

+                        <para>

+                            Default: None (let nsupdate choose the server)

+                        </para>

+                    </listitem>

+                </varlistentry>

+

+

                 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/override_homedir.xml" />

                 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/homedir_substring.xml" />

diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml

index 2e985991fde10827aff0e7c8e67f29a009683450..871c41607b97bd24fe5feaa282258def0fd0cc8b 100644

--- a/src/man/sssd-ipa.5.xml

+++ b/src/man/sssd-ipa.5.xml

@@ -263,6 +263,25 @@

                 </varlistentry>

                 <varlistentry>

+                    <term>dyndns_server (string)</term>

+                    <listitem>

+                        <para>

+                            The DNS server to use when performing a DNS

+                            update. In most setups, it's recommended to leave

+                            this option unset.

+                        </para>

+                        <para>

+                            Setting this option makes sense for environments

+                            where the DNS server is different from the identity

+                            server.

+                        </para>

+                        <para>

+                            Default: None (let nsupdate choose the server)

+                        </para>

+                    </listitem>

+                </varlistentry>

+

+                <varlistentry>

                     <term>ipa_hbac_search_base (string)</term>

                     <listitem>

                         <para>

diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h

index d685edcb44c771b0afc7a232a82c21fc9d1c89f9..00586a7ada63ad4c89630e9589d3ff75d1726703 100644

--- a/src/providers/ad/ad_opts.h

+++ b/src/providers/ad/ad_opts.h

@@ -275,6 +275,7 @@ struct dp_option ad_dyndns_opts[] = {

     { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },

     { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },

     { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },

+    { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },

     DP_OPTION_TERMINATOR

 };

diff --git a/src/providers/dp_dyndns.c b/src/providers/dp_dyndns.c

index c254d78936f412626db0533f559350de57017618..9a726bd431854342993212ce0a9759b86069cd5e 100644

--- a/src/providers/dp_dyndns.c

+++ b/src/providers/dp_dyndns.c

@@ -1180,6 +1180,7 @@ static struct dp_option default_dyndns_opts[] = {

     { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_FALSE },

     { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },

     { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },

+    { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },

     DP_OPTION_TERMINATOR

 };

diff --git a/src/providers/dp_dyndns.h b/src/providers/dp_dyndns.h

index a8a20ec6f8a1a63cd8c85aaec3f54f9fddb42049..3cc8d122646590365a3fb6dafa6a0f699b620ad9 100644

--- a/src/providers/dp_dyndns.h

+++ b/src/providers/dp_dyndns.h

@@ -55,6 +55,7 @@ enum dp_dyndns_opts {

     DP_OPT_DYNDNS_UPDATE_PTR,

     DP_OPT_DYNDNS_FORCE_TCP,

     DP_OPT_DYNDNS_AUTH,

+    DP_OPT_DYNDNS_SERVER,

     DP_OPT_DYNDNS /* attrs counter */

 };

diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h

index f6c40dddbb58cd8af1079a351137422083e26cfe..78949e3ddec95f7f4303eab905bbbf6ec14ed6ae 100644

--- a/src/providers/ipa/ipa_opts.h

+++ b/src/providers/ipa/ipa_opts.h

@@ -62,6 +62,7 @@ struct dp_option ipa_dyndns_opts[] = {

     { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },

     { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },

     { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },

+    { "dyndns_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },

     DP_OPTION_TERMINATOR

 };

diff --git a/src/providers/ldap/sdap_dyndns.c b/src/providers/ldap/sdap_dyndns.c

index a463a2fce08f42b325010cd37c501ef23aee173f..01f4f17226f1b7dd417699403b425c571b780c3a 100644

--- a/src/providers/ldap/sdap_dyndns.c

+++ b/src/providers/ldap/sdap_dyndns.c

@@ -92,6 +92,7 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,

     struct tevent_req *req;

     struct tevent_req *subreq;

     struct sdap_dyndns_update_state *state;

+    const char *conf_servername;

     req = tevent_req_create(mem_ctx, &state, struct sdap_dyndns_update_state);

     if (req == NULL) {

@@ -111,6 +112,12 @@ sdap_dyndns_update_send(TALLOC_CTX *mem_ctx,

     state->auth_type = auth_type;

     state->pass_num = 0;

+    conf_servername = dp_opt_get_string(opts, DP_OPT_DYNDNS_SERVER);

+    if (conf_servername != NULL) {

+        state->servername = conf_servername;

+        state->use_server_with_nsupdate = true;

+    }

+

     if (ifname) {

        /* Unless one family is restricted, just replace all

         * address families during the update

-- 

2.4.3