diff options
| -rw-r--r-- | API.txt | 7 | ||||
| -rw-r--r-- | VERSION | 2 | ||||
| -rw-r--r-- | ipalib/plugins/dns.py | 30 | ||||
| -rw-r--r-- | ipapython/ipautil.py | 95 |
4 files changed, 124 insertions, 10 deletions
@@ -959,7 +959,7 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None) output: PrimaryKey('value', None, None) command: dnsforwardzone_add -args: 1,8,3 +args: 1,9,3 arg: DNSNameParam('idnsname', attribute=True, cli_name='name', multivalue=False, only_absolute=True, primary_key=True, required=True) option: Str('addattr*', cli_name='addattr', exclude='webui') option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui') @@ -968,6 +968,7 @@ option: StrEnum('idnsforwardpolicy', attribute=True, cli_name='forward_policy', option: Str('name_from_ip', attribute=False, cli_name='name_from_ip', multivalue=False, required=False) option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui') option: Str('setattr*', cli_name='setattr', exclude='webui') +option: Flag('skip_overlap_check', autofill=True, default=False) option: Str('version?', exclude='webui') output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None)) output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None) @@ -1366,7 +1367,7 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None) output: PrimaryKey('value', None, None) command: dnszone_add -args: 1,26,3 +args: 1,28,3 arg: DNSNameParam('idnsname', attribute=True, cli_name='name', multivalue=False, only_absolute=True, primary_key=True, required=True) option: Str('addattr*', cli_name='addattr', exclude='webui') option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui') @@ -1393,6 +1394,8 @@ option: Str('name_from_ip', attribute=False, cli_name='name_from_ip', multivalue option: Str('nsec3paramrecord', attribute=True, cli_name='nsec3param_rec', multivalue=False, pattern='^\\d+ \\d+ \\d+ (([0-9a-fA-F]{2})+|-)$', required=False) option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui') option: Str('setattr*', cli_name='setattr', exclude='webui') +option: Flag('skip_nameserver_check', autofill=True, default=False) +option: Flag('skip_overlap_check', autofill=True, default=False) option: Str('version?', exclude='webui') output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None)) output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None) @@ -90,5 +90,5 @@ IPA_DATA_VERSION=20100614120000 # # ######################################################## IPA_API_VERSION_MAJOR=2 -IPA_API_VERSION_MINOR=162 +IPA_API_VERSION_MINOR=163 # Last change: jcholast - replica install: add remote connection check over API diff --git a/ipalib/plugins/dns.py b/ipalib/plugins/dns.py index 67947360e..60c992026 100644 --- a/ipalib/plugins/dns.py +++ b/ipalib/plugins/dns.py @@ -53,8 +53,7 @@ from ipalib.util import (normalize_zonemgr, validate_dnssec_zone_forwarder_step1, validate_dnssec_zone_forwarder_step2, verify_host_resolvable) - -from ipapython.ipautil import CheckedIPAddress +from ipapython.ipautil import CheckedIPAddress, check_zone_overlap from ipapython.dnsutil import DNSName if six.PY3: @@ -2121,6 +2120,13 @@ class DNSZoneBase(LDAPObject): class DNSZoneBase_add(LDAPCreate): + takes_options = LDAPCreate.takes_options + ( + Flag('skip_overlap_check', + doc=_('Force DNS zone creation even if it will overlap with ' + 'an existing zone.') + ), + ) + has_output_params = LDAPCreate.has_output_params + dnszone_output_params def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options): @@ -2140,6 +2146,12 @@ class DNSZoneBase_add(LDAPCreate): entry_attrs['idnszoneactive'] = 'TRUE' + if not options['skip_overlap_check']: + try: + check_zone_overlap(keys[-1]) + except ValueError as e: + raise errors.InvocationError(e.message) + return dn @@ -2696,8 +2708,13 @@ class dnszone_add(DNSZoneBase_add): takes_options = DNSZoneBase_add.takes_options + ( Flag('force', - label=_('Force'), - doc=_('Force DNS zone creation even if nameserver is not resolvable.'), + doc=_('Force DNS zone creation even if nameserver is not ' + 'resolvable. (Deprecated)'), + ), + + Flag('skip_nameserver_check', + doc=_('Force DNS zone creation even if nameserver is not ' + 'resolvable.'), ), # Deprecated @@ -2721,6 +2738,9 @@ class dnszone_add(DNSZoneBase_add): def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options): assert isinstance(dn, DN) + if options.get('force'): + options['skip_nameserver_check'] = True + dn = super(dnszone_add, self).pre_callback( ldap, dn, entry_attrs, attrs_list, *keys, **options) @@ -2736,7 +2756,7 @@ class dnszone_add(DNSZoneBase_add): error=_("Nameserver for reverse zone cannot be a relative DNS name")) # verify if user specified server is resolvable - if not options['force']: + if not options['skip_nameserver_check']: check_ns_rec_resolvable(keys[0], entry_attrs['idnssoamname'], self.log) # show warning about --name-server option diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py index 160706fec..4cee81e64 100644 --- a/ipapython/ipautil.py +++ b/ipapython/ipautil.py @@ -41,7 +41,7 @@ import locale import collections from dns import resolver, rdatatype -from dns.exception import DNSException +from dns.exception import DNSException, Timeout import six from six.moves import input from six.moves import urllib @@ -52,6 +52,7 @@ from ipapython import config from ipaplatform.paths import paths from ipapython.dn import DN from ipapython.dnsutil import DNSName +from ipalib.util import normalize_zone SHARE_DIR = paths.USR_SHARE_IPA_DIR PLUGINS_SHARE_DIR = paths.IPA_PLUGINS @@ -244,7 +245,6 @@ def template_file(infilename, vars): with open(infilename) as f: return template_str(f.read(), vars) - def copy_template_file(infilename, outfilename, vars): """Copy a file, performing template substitutions""" txt = template_file(infilename, vars) @@ -1030,6 +1030,97 @@ def host_exists(host): else: return True + +def check_zone_overlap(zone, raise_on_timeout=True): + root_logger.info("Checking DNS domain %s, please wait ..." % zone) + if not isinstance(zone, DNSName): + zone = DNSName(zone).make_absolute() + + # automatic empty zones always exist so checking them is pointless, + # do not report them to avoid meaningless error messages + if is_auto_empty_zone(zone): + return + + try: + containing_zone = resolver.zone_for_name(zone) + except Timeout as e: + msg = ("DNS check for domain %s failed: %s. Please make sure that the " + "domain is properly delegated to this IPA server." % (zone, e)) + if raise_on_timeout: + raise ValueError(msg) + else: + root_logger.warning(msg) + return + + if containing_zone == zone: + try: + ns = [ans.to_text() for ans in resolver.query(zone, 'NS')] + except DNSException as e: + root_logger.debug("Failed to resolve nameserver(s) for domain" + " {0}: {1}".format(zone, e)) + ns = [] + + msg = u"DNS zone {0} already exists in DNS".format(zone) + if ns: + msg += u" and is handled by server(s): {0}".format(', '.join(ns)) + raise ValueError(msg) + + +def is_auto_empty_zone(zone): + assert isinstance(zone, DNSName) + + automatic_empty_zones = [DNSName(aez).make_absolute() for aez in [ + # RFC 1918 + "10.IN-ADDR.ARPA", "16.172.IN-ADDR.ARPA", "17.172.IN-ADDR.ARPA", + "18.172.IN-ADDR.ARPA", "19.172.IN-ADDR.ARPA", "20.172.IN-ADDR.ARPA", + "21.172.IN-ADDR.ARPA", "22.172.IN-ADDR.ARPA", "23.172.IN-ADDR.ARPA", + "24.172.IN-ADDR.ARPA", "25.172.IN-ADDR.ARPA", "26.172.IN-ADDR.ARPA", + "27.172.IN-ADDR.ARPA", "28.172.IN-ADDR.ARPA", "29.172.IN-ADDR.ARPA", + "30.172.IN-ADDR.ARPA", "31.172.IN-ADDR.ARPA", "168.192.IN-ADDR.ARPA", + # RFC 6598 + "64.100.IN-ADDR.ARPA", "65.100.IN-ADDR.ARPA", "66.100.IN-ADDR.ARPA", + "67.100.IN-ADDR.ARPA", "68.100.IN-ADDR.ARPA", "69.100.IN-ADDR.ARPA", + "70.100.IN-ADDR.ARPA", "71.100.IN-ADDR.ARPA", "72.100.IN-ADDR.ARPA", + "73.100.IN-ADDR.ARPA", "74.100.IN-ADDR.ARPA", "75.100.IN-ADDR.ARPA", + "76.100.IN-ADDR.ARPA", "77.100.IN-ADDR.ARPA", "78.100.IN-ADDR.ARPA", + "79.100.IN-ADDR.ARPA", "80.100.IN-ADDR.ARPA", "81.100.IN-ADDR.ARPA", + "82.100.IN-ADDR.ARPA", "83.100.IN-ADDR.ARPA", "84.100.IN-ADDR.ARPA", + "85.100.IN-ADDR.ARPA", "86.100.IN-ADDR.ARPA", "87.100.IN-ADDR.ARPA", + "88.100.IN-ADDR.ARPA", "89.100.IN-ADDR.ARPA", "90.100.IN-ADDR.ARPA", + "91.100.IN-ADDR.ARPA", "92.100.IN-ADDR.ARPA", "93.100.IN-ADDR.ARPA", + "94.100.IN-ADDR.ARPA", "95.100.IN-ADDR.ARPA", "96.100.IN-ADDR.ARPA", + "97.100.IN-ADDR.ARPA", "98.100.IN-ADDR.ARPA", "99.100.IN-ADDR.ARPA", + "100.100.IN-ADDR.ARPA", "101.100.IN-ADDR.ARPA", + "102.100.IN-ADDR.ARPA", "103.100.IN-ADDR.ARPA", + "104.100.IN-ADDR.ARPA", "105.100.IN-ADDR.ARPA", + "106.100.IN-ADDR.ARPA", "107.100.IN-ADDR.ARPA", + "108.100.IN-ADDR.ARPA", "109.100.IN-ADDR.ARPA", + "110.100.IN-ADDR.ARPA", "111.100.IN-ADDR.ARPA", + "112.100.IN-ADDR.ARPA", "113.100.IN-ADDR.ARPA", + "114.100.IN-ADDR.ARPA", "115.100.IN-ADDR.ARPA", + "116.100.IN-ADDR.ARPA", "117.100.IN-ADDR.ARPA", + "118.100.IN-ADDR.ARPA", "119.100.IN-ADDR.ARPA", + "120.100.IN-ADDR.ARPA", "121.100.IN-ADDR.ARPA", + "122.100.IN-ADDR.ARPA", "123.100.IN-ADDR.ARPA", + "124.100.IN-ADDR.ARPA", "125.100.IN-ADDR.ARPA", + "126.100.IN-ADDR.ARPA", "127.100.IN-ADDR.ARPA", + # RFC 5735 and RFC 5737 + "0.IN-ADDR.ARPA", "127.IN-ADDR.ARPA", "254.169.IN-ADDR.ARPA", + "2.0.192.IN-ADDR.ARPA", "100.51.198.IN-ADDR.ARPA", + "113.0.203.IN-ADDR.ARPA", "255.255.255.255.IN-ADDR.ARPA", + # Local IPv6 Unicast Addresses + "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA", + "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA", + # LOCALLY ASSIGNED LOCAL ADDRESS SCOPE + "D.F.IP6.ARPA", "8.E.F.IP6.ARPA", "9.E.F.IP6.ARPA", "A.E.F.IP6.ARPA", + "B.E.F.IP6.ARPA", + # Example Prefix, RFC 3849. + "8.B.D.0.1.0.0.2.IP6.ARPA", + # RFC 7534 + "EMPTY.AS112.ARPA", + ]] + return zone in automatic_empty_zones + def get_ipa_basedn(conn): """ Get base DN of IPA suffix in given LDAP server. |