mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
dns: do not add (forward)zone if it is already resolvable.
Check if the zone user wants to add is already resolvable and refuse to create it if yes. --skip-overlap-check and --force options suppress this check. https://fedorahosted.org/freeipa/ticket/5087 Reviewed-By: Petr Spacek <pspacek@redhat.com>
This commit is contained in:
David Kupka
Tomas Babej
parent
5886f87f97
commit
6c107d819c
7
API.txt
7
API.txt
@ -959,7 +959,7 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: PrimaryKey('value', None, None)
|
||||
command: dnsforwardzone_add
|
||||
args: 1,8,3
|
||||
args: 1,9,3
|
||||
arg: DNSNameParam('idnsname', attribute=True, cli_name='name', multivalue=False, only_absolute=True, primary_key=True, required=True)
|
||||
option: Str('addattr*', cli_name='addattr', exclude='webui')
|
||||
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
||||
@ -968,6 +968,7 @@ option: StrEnum('idnsforwardpolicy', attribute=True, cli_name='forward_policy',
|
||||
option: Str('name_from_ip', attribute=False, cli_name='name_from_ip', multivalue=False, required=False)
|
||||
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
||||
option: Str('setattr*', cli_name='setattr', exclude='webui')
|
||||
option: Flag('skip_overlap_check', autofill=True, default=False)
|
||||
option: Str('version?', exclude='webui')
|
||||
output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
@ -1366,7 +1367,7 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: PrimaryKey('value', None, None)
|
||||
command: dnszone_add
|
||||
args: 1,26,3
|
||||
args: 1,28,3
|
||||
arg: DNSNameParam('idnsname', attribute=True, cli_name='name', multivalue=False, only_absolute=True, primary_key=True, required=True)
|
||||
option: Str('addattr*', cli_name='addattr', exclude='webui')
|
||||
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
||||
@ -1393,6 +1394,8 @@ option: Str('name_from_ip', attribute=False, cli_name='name_from_ip', multivalue
|
||||
option: Str('nsec3paramrecord', attribute=True, cli_name='nsec3param_rec', multivalue=False, pattern='^\\d+ \\d+ \\d+ (([0-9a-fA-F]{2})+|-)$', required=False)
|
||||
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
||||
option: Str('setattr*', cli_name='setattr', exclude='webui')
|
||||
option: Flag('skip_nameserver_check', autofill=True, default=False)
|
||||
option: Flag('skip_overlap_check', autofill=True, default=False)
|
||||
option: Str('version?', exclude='webui')
|
||||
output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
|
||||
2
VERSION
2
VERSION
@ -90,5 +90,5 @@ IPA_DATA_VERSION=20100614120000
|
||||
# #
|
||||
########################################################
|
||||
IPA_API_VERSION_MAJOR=2
|
||||
IPA_API_VERSION_MINOR=162
|
||||
IPA_API_VERSION_MINOR=163
|
||||
# Last change: jcholast - replica install: add remote connection check over API
|
||||
|
||||
@ -53,8 +53,7 @@ from ipalib.util import (normalize_zonemgr,
|
||||
validate_dnssec_zone_forwarder_step1,
|
||||
validate_dnssec_zone_forwarder_step2,
|
||||
verify_host_resolvable)
|
||||
|
||||
from ipapython.ipautil import CheckedIPAddress
|
||||
from ipapython.ipautil import CheckedIPAddress, check_zone_overlap
|
||||
from ipapython.dnsutil import DNSName
|
||||
|
||||
if six.PY3:
|
||||
@ -2121,6 +2120,13 @@ class DNSZoneBase(LDAPObject):
|
||||
|
||||
class DNSZoneBase_add(LDAPCreate):
|
||||
|
||||
takes_options = LDAPCreate.takes_options + (
|
||||
Flag('skip_overlap_check',
|
||||
doc=_('Force DNS zone creation even if it will overlap with '
|
||||
'an existing zone.')
|
||||
),
|
||||
)
|
||||
|
||||
has_output_params = LDAPCreate.has_output_params + dnszone_output_params
|
||||
|
||||
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
|
||||
@ -2140,6 +2146,12 @@ class DNSZoneBase_add(LDAPCreate):
|
||||
|
||||
entry_attrs['idnszoneactive'] = 'TRUE'
|
||||
|
||||
if not options['skip_overlap_check']:
|
||||
try:
|
||||
check_zone_overlap(keys[-1])
|
||||
except ValueError as e:
|
||||
raise errors.InvocationError(e.message)
|
||||
|
||||
return dn
|
||||
|
||||
|
||||
@ -2696,8 +2708,13 @@ class dnszone_add(DNSZoneBase_add):
|
||||
|
||||
takes_options = DNSZoneBase_add.takes_options + (
|
||||
Flag('force',
|
||||
label=_('Force'),
|
||||
doc=_('Force DNS zone creation even if nameserver is not resolvable.'),
|
||||
doc=_('Force DNS zone creation even if nameserver is not '
|
||||
'resolvable. (Deprecated)'),
|
||||
),
|
||||
|
||||
Flag('skip_nameserver_check',
|
||||
doc=_('Force DNS zone creation even if nameserver is not '
|
||||
'resolvable.'),
|
||||
),
|
||||
|
||||
# Deprecated
|
||||
@ -2721,6 +2738,9 @@ class dnszone_add(DNSZoneBase_add):
|
||||
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
|
||||
assert isinstance(dn, DN)
|
||||
|
||||
if options.get('force'):
|
||||
options['skip_nameserver_check'] = True
|
||||
|
||||
dn = super(dnszone_add, self).pre_callback(
|
||||
ldap, dn, entry_attrs, attrs_list, *keys, **options)
|
||||
|
||||
@ -2736,7 +2756,7 @@ class dnszone_add(DNSZoneBase_add):
|
||||
error=_("Nameserver for reverse zone cannot be a relative DNS name"))
|
||||
|
||||
# verify if user specified server is resolvable
|
||||
if not options['force']:
|
||||
if not options['skip_nameserver_check']:
|
||||
check_ns_rec_resolvable(keys[0], entry_attrs['idnssoamname'],
|
||||
self.log)
|
||||
# show warning about --name-server option
|
||||
|
||||
@ -41,7 +41,7 @@ import locale
|
||||
import collections
|
||||
|
||||
from dns import resolver, rdatatype
|
||||
from dns.exception import DNSException
|
||||
from dns.exception import DNSException, Timeout
|
||||
import six
|
||||
from six.moves import input
|
||||
from six.moves import urllib
|
||||
@ -52,6 +52,7 @@ from ipapython import config
|
||||
from ipaplatform.paths import paths
|
||||
from ipapython.dn import DN
|
||||
from ipapython.dnsutil import DNSName
|
||||
from ipalib.util import normalize_zone
|
||||
|
||||
SHARE_DIR = paths.USR_SHARE_IPA_DIR
|
||||
PLUGINS_SHARE_DIR = paths.IPA_PLUGINS
|
||||
@ -244,7 +245,6 @@ def template_file(infilename, vars):
|
||||
with open(infilename) as f:
|
||||
return template_str(f.read(), vars)
|
||||
|
||||
|
||||
def copy_template_file(infilename, outfilename, vars):
|
||||
"""Copy a file, performing template substitutions"""
|
||||
txt = template_file(infilename, vars)
|
||||
@ -1030,6 +1030,97 @@ def host_exists(host):
|
||||
else:
|
||||
return True
|
||||
|
||||
|
||||
def check_zone_overlap(zone, raise_on_timeout=True):
|
||||
root_logger.info("Checking DNS domain %s, please wait ..." % zone)
|
||||
if not isinstance(zone, DNSName):
|
||||
zone = DNSName(zone).make_absolute()
|
||||
|
||||
# automatic empty zones always exist so checking them is pointless,
|
||||
# do not report them to avoid meaningless error messages
|
||||
if is_auto_empty_zone(zone):
|
||||
return
|
||||
|
||||
try:
|
||||
containing_zone = resolver.zone_for_name(zone)
|
||||
except Timeout as e:
|
||||
msg = ("DNS check for domain %s failed: %s. Please make sure that the "
|
||||
"domain is properly delegated to this IPA server." % (zone, e))
|
||||
if raise_on_timeout:
|
||||
raise ValueError(msg)
|
||||
else:
|
||||
root_logger.warning(msg)
|
||||
return
|
||||
|
||||
if containing_zone == zone:
|
||||
try:
|
||||
ns = [ans.to_text() for ans in resolver.query(zone, 'NS')]
|
||||
except DNSException as e:
|
||||
root_logger.debug("Failed to resolve nameserver(s) for domain"
|
||||
" {0}: {1}".format(zone, e))
|
||||
ns = []
|
||||
|
||||
msg = u"DNS zone {0} already exists in DNS".format(zone)
|
||||
if ns:
|
||||
msg += u" and is handled by server(s): {0}".format(', '.join(ns))
|
||||
raise ValueError(msg)
|
||||
|
||||
|
||||
def is_auto_empty_zone(zone):
|
||||
assert isinstance(zone, DNSName)
|
||||
|
||||
automatic_empty_zones = [DNSName(aez).make_absolute() for aez in [
|
||||
# RFC 1918
|
||||
"10.IN-ADDR.ARPA", "16.172.IN-ADDR.ARPA", "17.172.IN-ADDR.ARPA",
|
||||
"18.172.IN-ADDR.ARPA", "19.172.IN-ADDR.ARPA", "20.172.IN-ADDR.ARPA",
|
||||
"21.172.IN-ADDR.ARPA", "22.172.IN-ADDR.ARPA", "23.172.IN-ADDR.ARPA",
|
||||
"24.172.IN-ADDR.ARPA", "25.172.IN-ADDR.ARPA", "26.172.IN-ADDR.ARPA",
|
||||
"27.172.IN-ADDR.ARPA", "28.172.IN-ADDR.ARPA", "29.172.IN-ADDR.ARPA",
|
||||
"30.172.IN-ADDR.ARPA", "31.172.IN-ADDR.ARPA", "168.192.IN-ADDR.ARPA",
|
||||
# RFC 6598
|
||||
"64.100.IN-ADDR.ARPA", "65.100.IN-ADDR.ARPA", "66.100.IN-ADDR.ARPA",
|
||||
"67.100.IN-ADDR.ARPA", "68.100.IN-ADDR.ARPA", "69.100.IN-ADDR.ARPA",
|
||||
"70.100.IN-ADDR.ARPA", "71.100.IN-ADDR.ARPA", "72.100.IN-ADDR.ARPA",
|
||||
"73.100.IN-ADDR.ARPA", "74.100.IN-ADDR.ARPA", "75.100.IN-ADDR.ARPA",
|
||||
"76.100.IN-ADDR.ARPA", "77.100.IN-ADDR.ARPA", "78.100.IN-ADDR.ARPA",
|
||||
"79.100.IN-ADDR.ARPA", "80.100.IN-ADDR.ARPA", "81.100.IN-ADDR.ARPA",
|
||||
"82.100.IN-ADDR.ARPA", "83.100.IN-ADDR.ARPA", "84.100.IN-ADDR.ARPA",
|
||||
"85.100.IN-ADDR.ARPA", "86.100.IN-ADDR.ARPA", "87.100.IN-ADDR.ARPA",
|
||||
"88.100.IN-ADDR.ARPA", "89.100.IN-ADDR.ARPA", "90.100.IN-ADDR.ARPA",
|
||||
"91.100.IN-ADDR.ARPA", "92.100.IN-ADDR.ARPA", "93.100.IN-ADDR.ARPA",
|
||||
"94.100.IN-ADDR.ARPA", "95.100.IN-ADDR.ARPA", "96.100.IN-ADDR.ARPA",
|
||||
"97.100.IN-ADDR.ARPA", "98.100.IN-ADDR.ARPA", "99.100.IN-ADDR.ARPA",
|
||||
"100.100.IN-ADDR.ARPA", "101.100.IN-ADDR.ARPA",
|
||||
"102.100.IN-ADDR.ARPA", "103.100.IN-ADDR.ARPA",
|
||||
"104.100.IN-ADDR.ARPA", "105.100.IN-ADDR.ARPA",
|
||||
"106.100.IN-ADDR.ARPA", "107.100.IN-ADDR.ARPA",
|
||||
"108.100.IN-ADDR.ARPA", "109.100.IN-ADDR.ARPA",
|
||||
"110.100.IN-ADDR.ARPA", "111.100.IN-ADDR.ARPA",
|
||||
"112.100.IN-ADDR.ARPA", "113.100.IN-ADDR.ARPA",
|
||||
"114.100.IN-ADDR.ARPA", "115.100.IN-ADDR.ARPA",
|
||||
"116.100.IN-ADDR.ARPA", "117.100.IN-ADDR.ARPA",
|
||||
"118.100.IN-ADDR.ARPA", "119.100.IN-ADDR.ARPA",
|
||||
"120.100.IN-ADDR.ARPA", "121.100.IN-ADDR.ARPA",
|
||||
"122.100.IN-ADDR.ARPA", "123.100.IN-ADDR.ARPA",
|
||||
"124.100.IN-ADDR.ARPA", "125.100.IN-ADDR.ARPA",
|
||||
"126.100.IN-ADDR.ARPA", "127.100.IN-ADDR.ARPA",
|
||||
# RFC 5735 and RFC 5737
|
||||
"0.IN-ADDR.ARPA", "127.IN-ADDR.ARPA", "254.169.IN-ADDR.ARPA",
|
||||
"2.0.192.IN-ADDR.ARPA", "100.51.198.IN-ADDR.ARPA",
|
||||
"113.0.203.IN-ADDR.ARPA", "255.255.255.255.IN-ADDR.ARPA",
|
||||
# Local IPv6 Unicast Addresses
|
||||
"0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA",
|
||||
"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA",
|
||||
# LOCALLY ASSIGNED LOCAL ADDRESS SCOPE
|
||||
"D.F.IP6.ARPA", "8.E.F.IP6.ARPA", "9.E.F.IP6.ARPA", "A.E.F.IP6.ARPA",
|
||||
"B.E.F.IP6.ARPA",
|
||||
# Example Prefix, RFC 3849.
|
||||
"8.B.D.0.1.0.0.2.IP6.ARPA",
|
||||
# RFC 7534
|
||||
"EMPTY.AS112.ARPA",
|
||||
]]
|
||||
return zone in automatic_empty_zones
|
||||
|
||||
def get_ipa_basedn(conn):
|
||||
"""
|
||||
Get base DN of IPA suffix in given LDAP server.
|
||||
|
||||
Loading…
Reference in New Issue
Block a user