diff options
Diffstat (limited to 'ipapython/ipautil.py')
| -rw-r--r-- | ipapython/ipautil.py | 95 |
1 files changed, 93 insertions, 2 deletions
diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py index 160706fec..4cee81e64 100644 --- a/ipapython/ipautil.py +++ b/ipapython/ipautil.py @@ -41,7 +41,7 @@ import locale import collections from dns import resolver, rdatatype -from dns.exception import DNSException +from dns.exception import DNSException, Timeout import six from six.moves import input from six.moves import urllib @@ -52,6 +52,7 @@ from ipapython import config from ipaplatform.paths import paths from ipapython.dn import DN from ipapython.dnsutil import DNSName +from ipalib.util import normalize_zone SHARE_DIR = paths.USR_SHARE_IPA_DIR PLUGINS_SHARE_DIR = paths.IPA_PLUGINS @@ -244,7 +245,6 @@ def template_file(infilename, vars): with open(infilename) as f: return template_str(f.read(), vars) - def copy_template_file(infilename, outfilename, vars): """Copy a file, performing template substitutions""" txt = template_file(infilename, vars) @@ -1030,6 +1030,97 @@ def host_exists(host): else: return True + +def check_zone_overlap(zone, raise_on_timeout=True): + root_logger.info("Checking DNS domain %s, please wait ..." % zone) + if not isinstance(zone, DNSName): + zone = DNSName(zone).make_absolute() + + # automatic empty zones always exist so checking them is pointless, + # do not report them to avoid meaningless error messages + if is_auto_empty_zone(zone): + return + + try: + containing_zone = resolver.zone_for_name(zone) + except Timeout as e: + msg = ("DNS check for domain %s failed: %s. Please make sure that the " + "domain is properly delegated to this IPA server." % (zone, e)) + if raise_on_timeout: + raise ValueError(msg) + else: + root_logger.warning(msg) + return + + if containing_zone == zone: + try: + ns = [ans.to_text() for ans in resolver.query(zone, 'NS')] + except DNSException as e: + root_logger.debug("Failed to resolve nameserver(s) for domain" + " {0}: {1}".format(zone, e)) + ns = [] + + msg = u"DNS zone {0} already exists in DNS".format(zone) + if ns: + msg += u" and is handled by server(s): {0}".format(', '.join(ns)) + raise ValueError(msg) + + +def is_auto_empty_zone(zone): + assert isinstance(zone, DNSName) + + automatic_empty_zones = [DNSName(aez).make_absolute() for aez in [ + # RFC 1918 + "10.IN-ADDR.ARPA", "16.172.IN-ADDR.ARPA", "17.172.IN-ADDR.ARPA", + "18.172.IN-ADDR.ARPA", "19.172.IN-ADDR.ARPA", "20.172.IN-ADDR.ARPA", + "21.172.IN-ADDR.ARPA", "22.172.IN-ADDR.ARPA", "23.172.IN-ADDR.ARPA", + "24.172.IN-ADDR.ARPA", "25.172.IN-ADDR.ARPA", "26.172.IN-ADDR.ARPA", + "27.172.IN-ADDR.ARPA", "28.172.IN-ADDR.ARPA", "29.172.IN-ADDR.ARPA", + "30.172.IN-ADDR.ARPA", "31.172.IN-ADDR.ARPA", "168.192.IN-ADDR.ARPA", + # RFC 6598 + "64.100.IN-ADDR.ARPA", "65.100.IN-ADDR.ARPA", "66.100.IN-ADDR.ARPA", + "67.100.IN-ADDR.ARPA", "68.100.IN-ADDR.ARPA", "69.100.IN-ADDR.ARPA", + "70.100.IN-ADDR.ARPA", "71.100.IN-ADDR.ARPA", "72.100.IN-ADDR.ARPA", + "73.100.IN-ADDR.ARPA", "74.100.IN-ADDR.ARPA", "75.100.IN-ADDR.ARPA", + "76.100.IN-ADDR.ARPA", "77.100.IN-ADDR.ARPA", "78.100.IN-ADDR.ARPA", + "79.100.IN-ADDR.ARPA", "80.100.IN-ADDR.ARPA", "81.100.IN-ADDR.ARPA", + "82.100.IN-ADDR.ARPA", "83.100.IN-ADDR.ARPA", "84.100.IN-ADDR.ARPA", + "85.100.IN-ADDR.ARPA", "86.100.IN-ADDR.ARPA", "87.100.IN-ADDR.ARPA", + "88.100.IN-ADDR.ARPA", "89.100.IN-ADDR.ARPA", "90.100.IN-ADDR.ARPA", + "91.100.IN-ADDR.ARPA", "92.100.IN-ADDR.ARPA", "93.100.IN-ADDR.ARPA", + "94.100.IN-ADDR.ARPA", "95.100.IN-ADDR.ARPA", "96.100.IN-ADDR.ARPA", + "97.100.IN-ADDR.ARPA", "98.100.IN-ADDR.ARPA", "99.100.IN-ADDR.ARPA", + "100.100.IN-ADDR.ARPA", "101.100.IN-ADDR.ARPA", + "102.100.IN-ADDR.ARPA", "103.100.IN-ADDR.ARPA", + "104.100.IN-ADDR.ARPA", "105.100.IN-ADDR.ARPA", + "106.100.IN-ADDR.ARPA", "107.100.IN-ADDR.ARPA", + "108.100.IN-ADDR.ARPA", "109.100.IN-ADDR.ARPA", + "110.100.IN-ADDR.ARPA", "111.100.IN-ADDR.ARPA", + "112.100.IN-ADDR.ARPA", "113.100.IN-ADDR.ARPA", + "114.100.IN-ADDR.ARPA", "115.100.IN-ADDR.ARPA", + "116.100.IN-ADDR.ARPA", "117.100.IN-ADDR.ARPA", + "118.100.IN-ADDR.ARPA", "119.100.IN-ADDR.ARPA", + "120.100.IN-ADDR.ARPA", "121.100.IN-ADDR.ARPA", + "122.100.IN-ADDR.ARPA", "123.100.IN-ADDR.ARPA", + "124.100.IN-ADDR.ARPA", "125.100.IN-ADDR.ARPA", + "126.100.IN-ADDR.ARPA", "127.100.IN-ADDR.ARPA", + # RFC 5735 and RFC 5737 + "0.IN-ADDR.ARPA", "127.IN-ADDR.ARPA", "254.169.IN-ADDR.ARPA", + "2.0.192.IN-ADDR.ARPA", "100.51.198.IN-ADDR.ARPA", + "113.0.203.IN-ADDR.ARPA", "255.255.255.255.IN-ADDR.ARPA", + # Local IPv6 Unicast Addresses + "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA", + "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA", + # LOCALLY ASSIGNED LOCAL ADDRESS SCOPE + "D.F.IP6.ARPA", "8.E.F.IP6.ARPA", "9.E.F.IP6.ARPA", "A.E.F.IP6.ARPA", + "B.E.F.IP6.ARPA", + # Example Prefix, RFC 3849. + "8.B.D.0.1.0.0.2.IP6.ARPA", + # RFC 7534 + "EMPTY.AS112.ARPA", + ]] + return zone in automatic_empty_zones + def get_ipa_basedn(conn): """ Get base DN of IPA suffix in given LDAP server. |