Bug 39081 – dlz_bind9 plugin ignores Forest+DomainDnsZones if Windows-2000 zone exists

Bug 39081 - dlz_bind9 plugin ignores Forest+DomainDnsZones if Windows-2000 zone exists


Summary:	dlz_bind9 plugin ignores Forest+DomainDnsZones if Windows-2000 zone exists

Status:	RESOLVED WONTFIX

Product:	UCS
Classification:	Unclassified
Component:	Samba4
Version:	UCS 4.2
Hardware:	Other Linux

Importance:	P3 normal (vote)
Target Milestone:	---
Assigned To:	Arvid Requate
QA Contact:

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2015-08-04 17:33 CEST by Arvid Requate
Modified:	2017-04-24 13:52 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	Bug Report
What type of bug is this?:	2: Improvement: Would be a product improvement
Who will be affected by this bug?:	2: Will only affect a few installed domains
How will those affected feel about the bug?:	2: A Pain – users won’t like this once they notice it
User Pain:	0.046
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	Troubleshooting
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2015-08-04 17:33:40 CEST

The Samba4 dlz_bind9 plugin ignores DomainDnsZones and ForestDnsZones if a Windows-2000 compatible zone exists. A "Windows-2000 compatible" zone is one located below CN=MicrosoftDNS,CN=System,$samba4_ldap_base.

This behavior was introduced by our dlz_bind9 patch. Since AD supports any of the three DNS locations (Forest-wide, Domain-wide and Windows-2000 compatible) in Active Directory, we should probably also allow this. Otherwise an Admin could be surprised to DoS his normal domain DNS zone just by accidentally adding some DNS zone with "Windows-2000 compatible" mode. With native AD this is easily possible by using the DNS MMC snapin, I haven't tested this snapin against Samba4 yet.

Comment 1 Arvid Requate

2015-08-18 19:37:35 CEST

While fixing Bug 39139 I have adjusted this already slightly to get the behavior desired for Bug 34184: Now dlz_bind9 ignores

* duplicate zones (it takes the first it finds), this behavior is unchanged

* and above that it now only ignores the zones with _msdcs.* if a partition has been found in the "Windows-2000 compatible" position (i.e. on the domain partition of the Samba/Active Directory).

So, it now only ignores Zones whose names start with "_msdcs." in this case, not all zones. This _msdcs sub-zone is a special case which still needs to be ignored in updated installations (see Bug 34184).

So, this Bug is not that relevant any longer in case the other two get released.