Commit Graph

178 Commits

Author SHA1 Message Date
Gabe
9a0aae0133 Fix typos in dns.py
https://fedorahosted.org/freeipa/ticket/4429

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-07-18 10:05:25 +02:00
Martin Basti
29951ada9f Non IDNA zonename should be normalized to lowercase
Before IDNA support zone was normalized.

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-04 09:26:49 +02:00
Martin Basti
21c829ffa5 Fix incompatible permission name *zone-del
Fixes ticket: https://fedorahosted.org/freeipa/ticket/4383

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-03 14:04:57 +02:00
Martin Basti
1c5fa1c28d Split dns docstring
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-03 10:32:09 +02:00
Martin Basti
d22d971575 Help for forward zones
Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-03 10:32:09 +02:00
Martin Basti
d18eea4578 Use documentation addresses in dns help
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-03 10:32:09 +02:00
Martin Basti
70224597a8 Add DNSSEC experimental support warning message
Ticket: https://fedorahosted.org/freeipa/ticket/4408
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-03 10:32:09 +02:00
Martin Basti
33cf958b98 Add warning about semantic change for zones
--forwarder have different semantic since
forward zones support.
Add warning if zone contains forwarders.

Ticket: https://fedorahosted.org/freeipa/ticket/3210#comment:16
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-03 10:32:08 +02:00
Martin Basti
30551a8aa3 Add NSEC3PARAM to zone settings
Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-02 14:54:41 +02:00
Martin Basti
ff7b44e3b0 Remove NSEC3PARAM record
Revert 5b95be802c

Ticket: https://fedorahosted.org/freeipa/ticket/4413
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-02 14:54:41 +02:00
Martin Basti
c655aa2832 Fix ACI in DNS
Added ACI for idnssecinlinesigning, dlvrecord, nsec3paramrecord,
tlsarecord

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-07-01 12:43:55 +02:00
Martin Basti
12cb31575c DNSSEC: add TLSA record type
Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-07-01 12:37:08 +02:00
Martin Basti
816007bdd9 Fix incompatible DNS permission
dns(forward)zone-add/remove-permission can work with permissions with
relative zone name

Ticket:https://fedorahosted.org/freeipa/ticket/4383

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-06-25 18:31:27 +02:00
Martin Basti
2229e89bbb Digest part in DLV/DS records allows only heaxadecimal characters
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-20 16:46:03 +02:00
Martin Basti
7cdc4178b0 DNSSEC: DLVRecord type added
Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-20 16:46:02 +02:00
Martin Basti
5b95be802c DNSSEC: added NSEC3PARAM record type
Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-20 15:41:40 +02:00
Martin Basti
48865aed5f DNSSEC: remove unsuported records
Removed SIG, NSEC, KEy, RRSIG records

Ticket: https://fedorahosted.org/freeipa/ticket/4328
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-20 15:41:39 +02:00
Martin Basti
727f5f3373 Create BASE zone class
Zones and forward zones have a lot of common code,
this patch remove duplications by creating a DNSBase
class and its subclasses

design: http://www.freeipa.org/page/V4/Forward_zones

Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-20 13:14:45 +02:00
Martin Basti
266015c3e2 Prevent commands to modify different type of a zone
Commands dnsforwardzone-* can modify only forward zones
Commands dnszone-* can modify only (master) zones
Commands dnsrecord-* can work only with master zones

design: http://www.freeipa.org/page/V4/Forward_zones

Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-20 13:14:45 +02:00
Martin Basti
49068ade92 Separate master and forward DNS zones
Forward zones are stored in idnsforwadzone objectclasses.

design: http://www.freeipa.org/page/V4/Forward_zones

Ticket: https://fedorahosted.org/freeipa/ticket/3210
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-20 13:14:45 +02:00
Petr Viktorin
853b6ef4ce Convert DNS default permissions to managed
Convert the existing default permissions.

The Read permission is split between Read DNS Entries and Read
DNS Configuration.

Part of the work for: https://fedorahosted.org/freeipa/ticket/4346

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-06-18 14:45:50 +02:00
Petr Spacek
91d3d4d7b2 Fix --ttl description for DNS zones
TTL specified in idnsZone object class affects all records at zone apex,
not only SOA record.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-06-12 09:57:58 +02:00
Nathaniel McCallum
255cbb4976 Update all remaining plugins to the new Registry API
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-06-11 09:24:22 +02:00
Martin Basti
fa21899529 PTR record target can be relative
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:33 +02:00
Martin Basti
dafd162ae5 _domain_name_validatord moved from DNS to realmdomains
Validator is no more used in dns plugin

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
5b88b39499 Modified record and zone class to support IDN
* Records data are always returned as string
* Attributes idnsname, idnssoamname, idnssoarname are returned as
* DNSName, with
  option --raw as string
* option --raw returns all IDN domains punycoded

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
a4d3d01f3f Modified records and zone parameters to use DNSNameParam
* Zone is stored as an absolute name (ipa never support relative
* zonenames)
* compatible with relative zone names as was before
* PTR target can be relative domain name

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
b964d2130a Modified dns related global functions
* Modified functions to use DNSName type
* Removed unused functions

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Martin Basti
e70f88c696 Modified has_output attributes
Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Petr Viktorin
8b7daf675e dns: Add idnsSecInlineSigning attribute, add --dnssec option to zone
Part of the work for: https://fedorahosted.org/freeipa/ticket/3801

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-05-28 15:58:24 +02:00
Jan Cholasta
4314d02fbf Allow primary keys to use different type than unicode.
Also return list of primary keys instead of a single unicode CSV value from
LDAPDelete-based commands.

This introduces a new capability 'primary_key_types' for backward
compatibility with old clients.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Petr Spacek
34fc447c00 Add wait_for_dns option to default.conf.
This option makes record changes in DNS tree synchronous.
IPA calls will wait until new data are visible over DNS protocol
or until timeout.

It is intended only for testing. It should prevent tests from
failing if there is bigger delay between changes in LDAP and DNS.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-04 11:56:34 +02:00
Petr Viktorin
78b657b02d Add permission_filter_objectclasses for explicit type filters
Part of the work for: https://fedorahosted.org/freeipa/ticket/4074

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-02-20 13:11:41 +01:00
Petr Spacek
2af96d1c0b Fix regular expression for LOC records in DNS.
- Fractional parts of integers are not mandatory.
- Expressions containing only size or only size + horizontal precision
  are allowed.
- N/S/W/E handling was fixed.

See RFC 1876 section 3 for details.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-02-18 15:51:11 +01:00
Martin Basti
8ede71fd84 DNS classless support for reverse domains
Now users can add reverse zones in classless form:
0/25.1.168.192.in-addr.arpa.
0-25.1.168.192.in-addr.arpa.

128/25 NS ns.example.com.
10 CNAME 10.128/25.1.168.192.in-addr.arpa.

Ticket: https://fedorahosted.org/freeipa/ticket/4143
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-02-11 17:21:11 +01:00
Martin Basti
1adeb68182 PTR records can be added without specify FQDN zone name
Now adding PTR records will accept zones both with and without end dot.

Ticket: https://fedorahosted.org/freeipa/ticket/4151
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-02-11 16:33:53 +01:00
Jan Cholasta
c2bd6f365d Convert remaining frontend code to LDAPEntry API. 2014-01-24 20:38:15 +01:00
Martin Kosek
894cb7b8f0 Remove missing VERSION warning in dnsrecord-mod
dnsrecord-mod may call dnsrecord-delentry command when all records
are deleted. However, the version was not passwd to delentry and
it resulted in a warning.

https://fedorahosted.org/freeipa/ticket/4120
2014-01-17 09:29:52 +01:00
Petr Viktorin
d7ee87cfa1 Rewrite the Permission plugin
Ticket: https://fedorahosted.org/freeipa/ticket/3566
Design: http://www.freeipa.org/page/V3/Permissions_V2
2013-12-13 15:08:52 +01:00
Tomas Babej
69394bab5a Remove support for IPA deployments with no persistent search
Drops the code from ipa-server-install, ipa-dns-install and the
BindInstance itself. Also changed ipa-upgradeconfig script so
that it does not set zone_refresh to 0 on upgrades, as the option
is deprecated.

https://fedorahosted.org/freeipa/ticket/3632
2013-08-09 12:14:42 +02:00
Tomas Babej
89ffaf411d Add prompt_param method to avoid code duplication
Extracted common code from ipalib/plugins/cli.py and
ipalib/plugins/dns.py that provided way to prompt user
for the value of specific attribute.

Added prompt_param method to Command class in ipalib/frontend.py

Done as part of https://fedorahosted.org/freeipa/ticket/3602
2013-06-05 12:50:29 +02:00
Ana Krivokapic
c5bfeb1ed0 Prompt for nameserver IP address in dnszone-add
Prompt for nameserver IP address in interactive mode of dnszone-add.

Add a corresponding field to dnszone creation dialog in the web UI.

This parameter is required if and only if:
* New zone is a forward zone
* Nameserver is defined inside the new zone

Add a new unit test to cover this functionality.

https://fedorahosted.org/freeipa/ticket/3603
2013-05-16 11:01:33 +02:00
Tomas Babej
2973128cf0 Allow underscore in record targets
Makes record target validation less strict and allows underscore.
This is requirement for IPA sites.

https://fedorahosted.org/freeipa/ticket/3550
2013-04-25 12:45:54 +02:00
Ana Krivokapic
a730b6e7b5 Integrate realmdomains with IPA DNS
Add an entry to realmdomains when a DNS zone is added to IPA.
Delete the related entry from realmdomains when the DNS zone is deleted
from IPA.

Add _kerberos TXT record to DNS zone when a new realmdomain is added.
Delete _kerberos TXT record from DNS zone when realmdomain is deleted.

Add unit tests to cover new functionality.

https://fedorahosted.org/freeipa/ticket/3544
2013-04-16 15:50:24 +02:00
Ana Krivokapic
c0cdba78b0 Add missing summary message to dnszone_del
https://fedorahosted.org/freeipa/ticket/3503
2013-04-11 15:58:14 +02:00
Ana Krivokapic
ff52c25ae2 Fix output for some CLI commands
Fix output of dnsrecord_del: it now uses output.standard_delete
and excludes --all and --raw flags.
Fix output of sudorule_{add,remove}_option: they now use
output.standard_entry and include --all and --raw flags.

https://fedorahosted.org/freeipa/ticket/3503
2013-04-11 15:57:45 +02:00
Martin Kosek
30a1bc1f09 Improve DNAME record validation
Extend DNS RR conflict check and forbid DNAME+NS combination unless
it is done in root DNS zone record.

Add tests to verify this enforced check.

https://fedorahosted.org/freeipa/ticket/3449
2013-04-02 17:11:57 +02:00
Martin Kosek
42c401a877 Improve CNAME record validation
Refactor DNS RR conflict validator so that it is better extensible in
the future. Also check that there is only one CNAME defined for
a DNS record.

PTR+CNAME record combination is no longer allowed as we found out it
does not make sense to have this combination.

https://fedorahosted.org/freeipa/ticket/3450
2013-04-02 17:11:52 +02:00
Martin Kosek
322458b5b2 Fix structured DNS record output
Recent LDAP refactoring replaced entry_attrs regular dict with
normalized keys (i.e. lowercase) with LDAPEntry instance which keys
may not be normalized. This broke CND command output when
--structured and --all options were used.

Force lowercase normalization of the LDAPEntry keys in DNS plugin
structured format postprocessing. Also add a missing test for
DNS record structured output.

https://fedorahosted.org/freeipa/ticket/3526
2013-03-22 15:10:03 +01:00
Jan Cholasta
5b2e0e2ba5 Remove DN normalization from the baseldap plugin. 2013-03-01 16:59:47 +01:00