From 7fe63f823388648c671389e7146b91c2fec7b2ca Mon Sep 17 00:00:00 2001 From: Martin Kosek Date: Fri, 24 Feb 2012 16:23:52 +0100 Subject: Add SSHFP update policy for existing zones SSH public key support includes a feature to automatically add/update client SSH fingerprints in SSHFP records. However, the update won't work for zones created before this support was added as they don't allow clients to update SSHFP records in their update policies. This patch lets dns upgrade module extend the original policy to allow the SSHFP dynamic updates. It updates only original policy, we don't want it to overwrite custom user policies. https://fedorahosted.org/freeipa/ticket/2394 --- ipaserver/install/plugins/dns.py | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) (limited to 'ipaserver/install/plugins') diff --git a/ipaserver/install/plugins/dns.py b/ipaserver/install/plugins/dns.py index 6d72db43..04f6e2be 100644 --- a/ipaserver/install/plugins/dns.py +++ b/ipaserver/install/plugins/dns.py @@ -20,10 +20,13 @@ from ipaserver.install.plugins import MIDDLE from ipaserver.install.plugins.baseupdate import PostUpdate from ipaserver.install.plugins import baseupdate -from ipalib import api, errors +from ipalib import api, errors, util -class update_dnszone_acls(PostUpdate): +class update_dnszones(PostUpdate): """ + Update all zones to meet requirements in the new FreeIPA versions + + 1) AllowQuery and AllowTransfer Set AllowQuery and AllowTransfer ACLs in all zones that may be configured in an upgraded FreeIPA instance. @@ -34,6 +37,14 @@ class update_dnszone_acls(PostUpdate): This plugin disables the zone transfer by default so that it needs to be explicitly enabled by FreeIPA Administrator. + + 2) Update policy + SSH public key support includes a feature to automatically add/update + client SSH fingerprints in SSHFP records. However, the update won't + work for zones created before this support was added as they don't allow + clients to update SSHFP records in their update policies. + + This module extends the original policy to allow the SSHFP updates. """ order=MIDDLE @@ -41,7 +52,7 @@ class update_dnszone_acls(PostUpdate): ldap = self.obj.backend try: - zones = api.Command.dnszone_find()['result'] + zones = api.Command.dnszone_find(all=True)['result'] except errors.NotFound: self.log.info('No DNS zone to update found') return (False, False, []) @@ -56,10 +67,14 @@ class update_dnszone_acls(PostUpdate): # do not open zone transfers by default update['idnsallowtransfer'] = u'none;' + old_policy = util.gen_dns_update_policy(api.env.realm, ('A', 'AAAA')) + if zone.get('idnsupdatepolicy', [''])[0] == old_policy: + update['idnsupdatepolicy'] = util.gen_dns_update_policy(\ + api.env.realm) + if update: api.Command.dnszone_mod(zone[u'idnsname'][0], **update) - return (False, False, []) -api.register(update_dnszone_acls) +api.register(update_dnszones) -- cgit