Skip to content

ad: add zone creation check to the AD DNS class - #281

Closed
danlavu wants to merge 1 commit into
SSSD:masterfrom
danlavu:fix/ad-dns-zone-activation-race
Closed

danlavu wants to merge 1 commit into
SSSD:masterfrom
danlavu:fix/ad-dns-zone-activation-race

Conversation

@danlavu

@danlavu danlavu commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

There is an undocumented hard coded 60 second limit that causes a race condition with freshly created zones.

AI: Claude Sonnet 4.6

@danlavu
danlavu requested a review from spoore1 October 6, 2026 00:39
spoore1
spoore1 previously approved these changes Oct 6, 2026

@spoore1 spoore1 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I ran it against AD locally and relevant tests pass:

tests/test_dyndns.py::test_dyndns__update_is_set_to_true (ad) PASSED                              [  3%]
tests/test_dyndns.py::test_dyndns__update_is_set_to_false (ad) PASSED                             [  7%]
tests/test_dyndns.py::test_dyndns__update_with_address_filtering[dyndns_iface = eth0] (ad) PASSED [ 11%]
tests/test_dyndns.py::test_dyndns__update_with_address_filtering[dyndns_iface = eth0, dummy0] (ad) PASSED [ 14%]
tests/test_dyndns.py::test_dyndns__update_configured_ttl_value (ad) PASSED                        [ 18%]
tests/test_dyndns.py::test_dyndns__update_over_tcp_only (ad) PASSED                               [ 22%]
tests/test_dyndns.py::test_dyndns__update_authentication_mechanism[dyndns_auth = None] (ad) PASSED [ 25%]
tests/test_dyndns.py::test_dyndns__update_authentication_mechanism[dyndns_auth = GSS-TSIG] (ad) PASSED [ 29%]
tests/test_dyndns.py::test_dyndns__update_does_not_contain_use_after_free_bugs (ad) PASSED        [ 33%]

@spoore1
spoore1 self-requested a review October 6, 2026 17:58
@danlavu
danlavu force-pushed the fix/ad-dns-zone-activation-race branch from 57c2acd to 3314ec2 Compare October 6, 2026 17:58
There is an undocumented hard coded 60 second limit that causes a race
condition with freshly created zones.

Verifies zone readiness via Resolve-DnsName (a real DNS protocol query)
instead of Get-DnsServerResourceRecord (a management-API check), since
the management API can report the zone as registered before the DNS
service is actually answering authoritatively for it, which is what
nsupdate relies on during its own SOA discovery.

AI: Claude Sonnet 4.6
Co-authored-by: Cursor <cursoragent@cursor.com>
@danlavu
danlavu force-pushed the fix/ad-dns-zone-activation-race branch from 3314ec2 to f0aeb51 Compare October 6, 2026 18:21
@danlavu danlavu closed this Oct 6, 2026
@danlavu

danlavu commented Oct 6, 2026

Copy link
Copy Markdown
Contributor Author

This isn't the issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants