[SCM] Samba Shared Repository - branch master updated
Amitay Isaacs
amitay at samba.org
Tue Feb 21 06:51:02 MST 2012
The branch, master has been updated
via 20b79c3 upgradedns: Upgrade DNS provision from BIND9_FLATFILE to AD based DNS
via 6daf04e s4-provision: dns: Add txt DNS record
via 5974492 s4-provision: dns: Do not re-calculate ntdsguid, use from names
via 9b9fdee s4-provision: dns: Refactor population of dns data code
via 1a70332 dlz_bind9: Fix the log message level
from 4bba5fc samba-tool: dns: Update the copyright
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 20b79c3ea382461c56ddc7433ccf8224c4391f80
Author: Amitay Isaacs <amitay at gmail.com>
Date: Tue Jan 31 15:37:12 2012 +1100
upgradedns: Upgrade DNS provision from BIND9_FLATFILE to AD based DNS
This script can be used to convert provision from BIND9_FLATFILE to
BIND9_DLZ or SAMBA_INTERNAL dns backends. In addition, the script
migrates the DNS data in zone file (if available).
Autobuild-User: Amitay Isaacs <amitay at samba.org>
Autobuild-Date: Tue Feb 21 14:50:10 CET 2012 on sn-devel-104
commit 6daf04eb6eb21734fbac24248009335cea935292
Author: Amitay Isaacs <amitay at gmail.com>
Date: Thu Feb 2 13:31:53 2012 +1100
s4-provision: dns: Add txt DNS record
commit 597449235e4835bb406d40c7574993200363997b
Author: Amitay Isaacs <amitay at gmail.com>
Date: Thu Feb 2 16:08:26 2012 +1100
s4-provision: dns: Do not re-calculate ntdsguid, use from names
commit 9b9fdeefb47f2657c9bb4c2f48318550da510209
Author: Amitay Isaacs <amitay at gmail.com>
Date: Tue Jan 31 15:33:54 2012 +1100
s4-provision: dns: Refactor population of dns data code
Code is split in 4 functions
- create_dns_legacy
- fill_dns_data_legacy
- create_dns_partitions
- fill_dns_data_partitions
This is useful to upgrade dns provision from file based DNS backend
to AD based DNS backend.
commit 1a70332f954bc1b72d5572f7c39fdc7f80ddcd72
Author: Amitay Isaacs <amitay at gmail.com>
Date: Thu Feb 2 09:27:28 2012 +1100
dlz_bind9: Fix the log message level
-----------------------------------------------------------------------
Summary of changes:
source4/dns_server/dlz_bind9.c | 10 +-
source4/scripting/bin/upgradedns | 404 ++++++++++++++++++++
source4/scripting/bin/wscript_build | 1 +
.../scripting/python/samba/provision/sambadns.py | 177 +++++----
source4/scripting/wscript_build | 8 +-
5 files changed, 523 insertions(+), 77 deletions(-)
create mode 100755 source4/scripting/bin/upgradedns
Changeset truncated at 500 lines:
diff --git a/source4/dns_server/dlz_bind9.c b/source4/dns_server/dlz_bind9.c
index 7bb7a34..34320e0 100644
--- a/source4/dns_server/dlz_bind9.c
+++ b/source4/dns_server/dlz_bind9.c
@@ -1453,7 +1453,7 @@ _PUBLIC_ isc_result_t dlz_addrdataset(const char *name, const char *rdatastr, vo
b9_reset_session_info(state);
talloc_free(rec);
if (result == ISC_R_SUCCESS) {
- state->log(ISC_LOG_ERROR, "samba_dlz: added %s %s", name, rdatastr);
+ state->log(ISC_LOG_INFO, "samba_dlz: added %s %s", name, rdatastr);
}
return result;
}
@@ -1543,7 +1543,7 @@ _PUBLIC_ isc_result_t dlz_subrdataset(const char *name, const char *rdatastr, vo
enum ndr_err_code ndr_err;
if (state->transaction_token != (void*)version) {
- state->log(ISC_LOG_INFO, "samba_dlz: bad transaction version");
+ state->log(ISC_LOG_ERROR, "samba_dlz: bad transaction version");
return ISC_R_FAILURE;
}
@@ -1553,7 +1553,7 @@ _PUBLIC_ isc_result_t dlz_subrdataset(const char *name, const char *rdatastr, vo
}
if (!b9_parse(state, rdatastr, rec)) {
- state->log(ISC_LOG_INFO, "samba_dlz: failed to parse rdataset '%s'", rdatastr);
+ state->log(ISC_LOG_ERROR, "samba_dlz: failed to parse rdataset '%s'", rdatastr);
talloc_free(rec);
return ISC_R_FAILURE;
}
@@ -1652,12 +1652,12 @@ _PUBLIC_ isc_result_t dlz_delrdataset(const char *name, const char *type, void *
bool found = false;
if (state->transaction_token != (void*)version) {
- state->log(ISC_LOG_INFO, "samba_dlz: bad transaction version");
+ state->log(ISC_LOG_ERROR, "samba_dlz: bad transaction version");
return ISC_R_FAILURE;
}
if (!b9_dns_type(type, &dns_type)) {
- state->log(ISC_LOG_INFO, "samba_dlz: bad dns type %s in delete", type);
+ state->log(ISC_LOG_ERROR, "samba_dlz: bad dns type %s in delete", type);
return ISC_R_FAILURE;
}
diff --git a/source4/scripting/bin/upgradedns b/source4/scripting/bin/upgradedns
new file mode 100755
index 0000000..234bfe8
--- /dev/null
+++ b/source4/scripting/bin/upgradedns
@@ -0,0 +1,404 @@
+#!/usr/bin/env python
+#
+# Unix SMB/CIFS implementation.
+# Copyright (C) Amitay Isaacs <amitay at gmail.com> 2012
+#
+# Upgrade DNS provision from BIND9_FLATFILE to BIND9_DLZ or SAMBA_INTERNAL
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+import os
+import optparse
+import logging
+import grp
+from base64 import b64encode
+
+sys.path.insert(0, 'bin/python')
+
+import ldb
+import samba
+from samba import param
+from samba.auth import system_session
+from samba.ndr import (
+ ndr_pack,
+ ndr_unpack )
+import samba.getopt as options
+from samba.upgradehelpers import (
+ get_paths,
+ get_ldbs )
+from samba.dsdb import DS_DOMAIN_FUNCTION_2003
+from samba.provision import (
+ find_provision_key_parameters,
+ interface_ips_v4,
+ interface_ips_v6 )
+from samba.provision.common import (
+ setup_path,
+ setup_add_ldif )
+from samba.provision.sambadns import (
+ ARecord,
+ AAAARecord,
+ CNameRecord,
+ NSRecord,
+ SOARecord,
+ SRVRecord,
+ TXTRecord,
+ get_dnsadmins_sid,
+ get_domainguid,
+ add_dns_accounts,
+ create_dns_partitions,
+ fill_dns_data_partitions,
+ create_dns_dir,
+ secretsdb_setup_dns,
+ create_samdb_copy,
+ create_named_conf,
+ create_named_txt )
+from samba.dcerpc import security
+
+samba.ensure_external_module("dns", "dnspython")
+import dns.zone, dns.rdatatype
+
+__docformat__ = 'restructuredText'
+
+
+def find_bind_gid():
+ """Find system group id for bind9
+ """
+ for name in ["bind", "named"]:
+ try:
+ return grp.getgrnam(name)[2]
+ except KeyError:
+ pass
+ return None
+
+
+def fix_names(pnames):
+ """Convert elements to strings from MessageElement
+ """
+ names = pnames
+ names.rootdn = pnames.rootdn[0]
+ names.domaindn = pnames.domaindn[0]
+ names.configdn = pnames.configdn[0]
+ names.schemadn = pnames.schemadn[0]
+ names.wheel_gid = pnames.wheel_gid[0]
+ names.serverdn = str(pnames.serverdn)
+ return names
+
+
+def convert_dns_rdata(rdata, serial=1):
+ """Convert resource records in dnsRecord format
+ """
+ if rdata.rdtype == dns.rdatatype.A:
+ rec = ARecord(rdata.address, serial=serial)
+ elif rdata.rdtype == dns.rdatatype.AAAA:
+ rec = AAAARecord(rdata.address, serial=serial)
+ elif rdata.rdtype == dns.rdatatype.CNAME:
+ rec = CNameRecord(rdata.target.to_text(), serial=serial)
+ elif rdata.rdtype == dns.rdatatype.NS:
+ rec = NSRecord(rdata.target.to_text(), serial=serial)
+ elif rdata.rdtype == dns.rdatatype.SRV:
+ rec = SRVRecord(rdata.target.to_text(), int(rdata.port),
+ priority=int(rdata.priority), weight=int(rdata.weight),
+ serial=serial)
+ elif rdata.rdtype == dns.rdatatype.TXT:
+ rec = TXTRecord(rdata.to_text(relativize=False), serial=serial)
+ elif rdata.rdtype == dns.rdatatype.SOA:
+ rec = SOARecord(rdata.mname.to_text(), rdata.rname.to_text(),
+ serial=int(rdata.serial),
+ refresh=int(rdata.refresh), retry=int(rdata.retry),
+ expire=int(rdata.expire), minimum=int(rdata.minimum))
+ else:
+ rec = None
+ return rec
+
+
+def import_zone_data(samdb, logger, zone, serial, domaindn, forestdn,
+ dnsdomain, dnsforest):
+ """Insert zone data in DNS partitions
+ """
+ labels = dnsdomain.split('.')
+ labels.append('')
+ domain_root = dns.name.Name(labels)
+ domain_prefix = "DC=%s,CN=MicrosoftDNS,DC=DomainDnsZones,%s" % (dnsdomain,
+ domaindn)
+
+ tmp = "_msdcs.%s" % dnsforest
+ labels = tmp.split('.')
+ labels.append('')
+ forest_root = dns.name.Name(labels)
+ dnsmsdcs = "_msdcs.%s" % dnsforest
+ forest_prefix = "DC=%s,CN=MicrosoftDNS,DC=ForestDnsZones,%s" % (dnsmsdcs,
+ forestdn)
+
+ # Extract @ record
+ at_record = zone.get_node(domain_root)
+ zone.delete_node(domain_root)
+
+ # SOA record
+ rdset = at_record.get_rdataset(dns.rdataclass.IN, dns.rdatatype.SOA)
+ soa_rec = ndr_pack(convert_dns_rdata(rdset[0]))
+ at_record.delete_rdataset(dns.rdataclass.IN, dns.rdatatype.SOA)
+
+ # NS record
+ rdset = at_record.get_rdataset(dns.rdataclass.IN, dns.rdatatype.NS)
+ ns_rec = ndr_pack(convert_dns_rdata(rdset[0]))
+ at_record.delete_rdataset(dns.rdataclass.IN, dns.rdatatype.NS)
+
+ # A/AAAA records
+ ip_recs = []
+ for rdset in at_record:
+ for r in rdset:
+ rec = convert_dns_rdata(r)
+ ip_recs.append(ndr_pack(rec))
+
+ # Add @ record for domain
+ dns_rec = [soa_rec, ns_rec] + ip_recs
+ msg = ldb.Message(ldb.Dn(samdb, 'DC=@,%s' % domain_prefix))
+ msg["objectClass"] = ["top", "dnsNode"]
+ msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
+ "dnsRecord")
+ try:
+ samdb.add(msg)
+ except Exception:
+ logger.error("Failed to add @ record for domain")
+ raise
+ logger.debug("Added @ record for domain")
+
+ # Add @ record for forest
+ dns_rec = [soa_rec, ns_rec]
+ msg = ldb.Message(ldb.Dn(samdb, 'DC=@,%s' % forest_prefix))
+ msg["objectClass"] = ["top", "dnsNode"]
+ msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
+ "dnsRecord")
+ try:
+ samdb.add(msg)
+ except Exception:
+ logger.error("Failed to add @ record for forest")
+ raise
+ logger.debug("Added @ record for forest")
+
+ # Add remaining records in domain and forest
+ for node in zone.nodes:
+ name = node.relativize(forest_root).to_text()
+ if name == node.to_text():
+ name = node.relativize(domain_root).to_text()
+ dn = "DC=%s,%s" % (name, domain_prefix)
+ fqdn = "%s.%s" % (name, dnsdomain)
+ else:
+ dn = "DC=%s,%s" % (name, forest_prefix)
+ fqdn = "%s.%s" % (name, dnsmsdcs)
+
+ dns_rec = []
+ for rdataset in zone.nodes[node]:
+ for rdata in rdataset:
+ rec = convert_dns_rdata(rdata, serial)
+ if not rec:
+ logger.warn("Unsupported record type (%s) for %s, ignoring" %
+ dns.rdatatype.to_text(rdata.rdatatype), name)
+ else:
+ dns_rec.append(ndr_pack(rec))
+
+ msg = ldb.Message(ldb.Dn(samdb, dn))
+ msg["objectClass"] = ["top", "dnsNode"]
+ msg["dnsRecord"] = ldb.MessageElement(dns_rec, ldb.FLAG_MOD_ADD,
+ "dnsRecord")
+ try:
+ samdb.add(msg)
+ except Exception:
+ logger.error("Failed to add DNS record %s" % (fqdn))
+ raise
+ logger.debug("Added DNS record %s" % (fqdn))
+
+
+# dnsprovision creates application partitions for AD based DNS mainly if the existing
+# provision was created using earlier snapshots of samba4 which did not have support
+# for DNS partitions
+
+if __name__ == '__main__':
+
+ # Setup command line parser
+ parser = optparse.OptionParser("upgradedns [options]")
+ sambaopts = options.SambaOptions(parser)
+ credopts = options.CredentialsOptions(parser)
+
+ parser.add_option_group(options.VersionOptions(parser))
+ parser.add_option_group(sambaopts)
+ parser.add_option_group(credopts)
+
+ parser.add_option("--dns-backend", type="choice", metavar="<BIND9_DLZ|SAMBA_INTERNAL>",
+ choices=["SAMBA_INTERNAL", "BIND9_DLZ"], default="BIND9_DLZ",
+ help="The DNS server backend, default BIND9_DLZ")
+ parser.add_option("--migrate", type="choice", metavar="<yes|no>",
+ choices=["yes","no"], default="yes",
+ help="Migrate existing zone data, default yes")
+ parser.add_option("--verbose", help="Be verbose", action="store_true")
+
+ opts = parser.parse_args()[0]
+
+ if opts.dns_backend is None:
+ opts.dns_backend = 'DLZ_BIND9'
+
+ if opts.migrate:
+ autofill = False
+ else:
+ autofill = True
+
+ # Set up logger
+ logger = logging.getLogger("upgradedns")
+ logger.addHandler(logging.StreamHandler(sys.stdout))
+ logger.setLevel(logging.INFO)
+ if opts.verbose:
+ logger.setLevel(logging.DEBUG)
+
+ lp = sambaopts.get_loadparm()
+ lp.load(lp.configfile)
+ creds = credopts.get_credentials(lp)
+
+ logger.info("Reading domain information")
+ paths = get_paths(param, smbconf=lp.configfile)
+ paths.bind_gid = find_bind_gid()
+ ldbs = get_ldbs(paths, creds, system_session(), lp)
+ pnames = find_provision_key_parameters(ldbs.sam, ldbs.secrets, ldbs.idmap,
+ paths, lp.configfile, lp)
+ names = fix_names(pnames)
+
+ if names.domainlevel < DS_DOMAIN_FUNCTION_2003:
+ logger.error("Cannot create AD based DNS for OS level < 2003")
+ sys.exit(1)
+
+ logger.info("Looking up IPv4 addresses")
+ hostip = interface_ips_v4(lp)
+ try:
+ hostip.remove('127.0.0.1')
+ except ValueError:
+ pass
+ if not hostip:
+ logger.error("No IPv4 addresses found")
+ sys.exit(1)
+ else:
+ hostip = hostip[0]
+ logger.debug("IPv4 addresses: %s" % hostip)
+
+ logger.info("Looking up IPv6 addresses")
+ hostip6 = interface_ips_v6(lp, linklocal=False)
+ if not hostip6:
+ hostip6 = None
+ else:
+ hostip6 = hostip6[0]
+ logger.debug("IPv6 addresses: %s" % hostip6)
+
+ domaindn = names.domaindn
+ forestdn = names.rootdn
+
+ dnsdomain = names.dnsdomain.lower()
+ dnsforest = dnsdomain
+
+ site = names.sitename
+ hostname = names.hostname
+ dnsname = '%s.%s' % (hostname, dnsdomain)
+
+ domainsid = names.domainsid
+ domainguid = names.domainguid
+ ntdsguid = names.ntdsguid
+
+ # Check for DNS accounts and create them if required
+ try:
+ msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
+ expression='(sAMAccountName=DnsAdmins)',
+ attrs=['objectSid'])
+ dnsadmins_sid = ndr_unpack(security.dom_sid, msg[0]['objectSid'][0])
+ except Exception, e:
+ logger.info("Adding DNS accounts")
+ add_dns_accounts(ldbs.sam, domaindn)
+ dnsadmins_sid = get_dnsadmins_sid(ldbs.sam, domaindn)
+
+ # Import dns records from zone file
+ if os.path.exists(paths.dns):
+ logger.info("Reading records from zone file %s" % paths.dns)
+ try:
+ zone = dns.zone.from_file(paths.dns, relativize=False)
+ rrset = zone.get_rdataset("%s." % dnsdomain, dns.rdatatype.SOA)
+ serial = int(rrset[0].serial)
+ except Exception, e:
+ logger.warn("Error parsing DNS data from '%s' (%s)" % (paths.dns, str(e)))
+ logger.warn("DNS records will be automatically created")
+ autofill = True
+ else:
+ logger.info("No zone file %s" % paths.dns)
+ logger.warn("DNS records will be automatically created")
+ autofill = True
+
+ # Fill DNS information
+ logger.info("Creating DNS partitions")
+ create_dns_partitions(ldbs.sam, domainsid, names, domaindn, forestdn,
+ dnsadmins_sid)
+
+ logger.info("Populating DNS partitions")
+ fill_dns_data_partitions(ldbs.sam, domainsid, site, domaindn, forestdn,
+ dnsdomain, dnsforest, hostname, hostip, hostip6,
+ domainguid, ntdsguid, dnsadmins_sid,
+ autofill=autofill)
+
+ if not autofill:
+ logger.info("Importing records from zone file")
+ import_zone_data(ldbs.sam, logger, zone, serial, domaindn, forestdn,
+ dnsdomain, dnsforest)
+
+ if opts.dns_backend == "BIND9_DLZ":
+ create_dns_dir(logger, paths)
+
+ # Check if dns-HOSTNAME account exists and create it if required
+ try:
+ dn = 'samAccountName=dns-%s,CN=Principals' % hostname
+ msg = ldbs.secrets.search(expression='(dn=%s)' % dn, attrs=['secret'])
+ dnssecret = msg[0]['secret'][0]
+ except Exception:
+ logger.info("Creating DNS account for BIND9")
+
+ try:
+ msg = ldbs.sam.search(base=domaindn, scope=ldb.SCOPE_DEFAULT,
+ expression='(sAMAccountName=dns-%s)' % (hostname),
+ attrs=['clearTextPassword'])
+ dn = msg[0].dn
+ ldbs.sam.delete(dn)
+ except Exception:
+ pass
+
+ dnspass = samba.generate_random_password(128, 255)
+ setup_add_ldif(ldbs.sam, setup_path("provision_dns_add_samba.ldif"), {
+ "DNSDOMAIN": dnsdomain,
+ "DOMAINDN": domaindn,
+ "DNSPASS_B64": b64encode(dnspass.encode('utf-16-le')),
+ "HOSTNAME" : hostname,
+ "DNSNAME" : dnsname }
+ )
+
+ secretsdb_setup_dns(ldbs.secrets, names,
+ paths.private_dir, realm=names.realm,
+ dnsdomain=names.dnsdomain,
+ dns_keytab_path=paths.dns_keytab, dnspass=dnspass)
+
+ # Setup a copy of SAM for BIND9
+ create_samdb_copy(ldbs.sam, logger, paths, names, domainsid,
+ domainguid)
+
+ create_named_conf(paths, names.realm, dnsdomain, opts.dns_backend)
+
+ create_named_txt(paths.namedtxt, names.realm, dnsdomain, dnsname,
+ paths.private_dir, paths.dns_keytab)
+ logger.info("See %s for an example configuration include file for BIND", paths.namedconf)
+ logger.info("and %s for further documentation required for secure DNS "
+ "updates", paths.namedtxt)
+
+ logger.info("Finished upgrading DNS")
diff --git a/source4/scripting/bin/wscript_build b/source4/scripting/bin/wscript_build
index ad83894..65e9c58 100644
--- a/source4/scripting/bin/wscript_build
+++ b/source4/scripting/bin/wscript_build
@@ -5,3 +5,4 @@ bld.SAMBA_SCRIPT('samba_spnupdate', pattern='samba_spnupdate', installdir='.')
bld.SAMBA_SCRIPT('samba_kcc', pattern='samba_kcc', installdir='.')
bld.SAMBA_SCRIPT('upgradeprovision', pattern='upgradeprovision', installdir='.')
bld.SAMBA_SCRIPT('samba-tool', pattern='samba-tool', installdir='.')
+bld.SAMBA_SCRIPT('upgradedns', pattern='upgradedns', installdir='.')
diff --git a/source4/scripting/python/samba/provision/sambadns.py b/source4/scripting/python/samba/provision/sambadns.py
index 4805294..e8bb752 100644
--- a/source4/scripting/python/samba/provision/sambadns.py
+++ b/source4/scripting/python/samba/provision/sambadns.py
@@ -54,19 +54,6 @@ def get_domainguid(samdb, domaindn):
domainguid = str(ndr_unpack(misc.GUID, res[0]["objectGUID"][0]))
return domainguid
-def get_ntdsguid(samdb, domaindn):
- configdn = samdb.get_config_basedn()
-
- res1 = samdb.search(base="OU=Domain Controllers,%s" % domaindn, scope=ldb.SCOPE_ONELEVEL,
- attrs=["dNSHostName"])
-
- res2 = samdb.search(expression="serverReference=%s" % res1[0].dn, base=configdn)
-
- res3 = samdb.search(base="CN=NTDS Settings,%s" % res2[0].dn, scope=ldb.SCOPE_BASE,
- attrs=["objectGUID"])
- ntdsguid = str(ndr_unpack(misc.GUID, res3[0]["objectGUID"][0]))
- return ntdsguid
-
def get_dnsadmins_sid(samdb, domaindn):
res = samdb.search(base="CN=DnsAdmins,CN=Users,%s" % domaindn, scope=ldb.SCOPE_BASE,
attrs=["objectSid"])
@@ -141,6 +128,15 @@ class SRVRecord(dnsp.DnssrvRpcRecord):
srv.wWeight = weight
self.data = srv
+class TXTRecord(dnsp.DnssrvRpcRecord):
+ def __init__(self, txt, serial=1, ttl=900, rank=dnsp.DNS_RANK_ZONE):
+ super(TXTRecord, self).__init__()
+ self.wType = dnsp.DNS_TYPE_TXT
+ self.rank = rank
+ self.dwSerial = serial
+ self.dwTtlSeconds = ttl
--
Samba Shared Repository
More information about the samba-cvs
mailing list