diff options
Diffstat (limited to 'roles/dyndns/server/templates')
| -rw-r--r-- | roles/dyndns/server/templates/dyndns-regen.py.j2 | 109 | ||||
| -rwxr-xr-x | roles/dyndns/server/templates/dyndns.py.j2 | 67 | ||||
| -rw-r--r-- | roles/dyndns/server/templates/header.tmpl.j2 | 11 |
3 files changed, 148 insertions, 39 deletions
diff --git a/roles/dyndns/server/templates/dyndns-regen.py.j2 b/roles/dyndns/server/templates/dyndns-regen.py.j2 new file mode 100644 index 00000000..3611618d --- /dev/null +++ b/roles/dyndns/server/templates/dyndns-regen.py.j2 @@ -0,0 +1,109 @@ +#!/usr/bin/env python3 +# +# dyndns.py +# +# a simple ssh based dyndns updater for bind zone files +# +# Copyright (C) 2013 Christian Pointner <equinox@spreadspace.org> +# +# This file is part of dyndns.py. +# +# dyndns.py is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 2 of the License, or +# any later version. +# +# dyndns.py is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with dyndns.py. If not, see <http://www.gnu.org/licenses/>. +# + +import subprocess +import fcntl +import shutil +import hashlib +import tempfile +import sys +import os + +if len(sys.argv) != 2: + print("ERROR: the base-domain-name must be the sole parameter") + sys.exit(1) + + +domain = sys.argv[1] +base_d = '/var/lib/dyndns' +rndc = '/usr/sbin/rndc' + +digest_fn = os.path.join(base_d, 'digest.'+domain) +header_fn = os.path.join(base_d, 'header.'+domain) +records_fn = os.path.join(base_d, 'records.'+domain) +tmpl_fn = os.path.join(base_d, 'tmpl.'+domain) +serial_fn = os.path.join(base_d, 'serial.'+domain) +db_fn = os.path.join(base_d, 'db.'+domain) + +digest_fd = open(digest_fn, 'a+') +fcntl.flock(digest_fd, fcntl.LOCK_EX) +digest_fd.seek(0) + +h = hashlib.blake2b() +with open(tmpl_fn, 'wb+') as tmpl_fd: + with open(header_fn, 'rb') as header_fd: + shutil.copyfileobj(header_fd, tmpl_fd) + try: + with open(records_fn, 'rb') as records_fd: + shutil.copyfileobj(records_fd, tmpl_fd) + except FileNotFoundError: + pass + + tmpl_fd.seek(0) + while True: + data = tmpl_fd.read(64*1024) + if not data: + break + h.update(data) + +old_digest = digest_fd.readline().strip() +new_digest = h.hexdigest() +if old_digest == new_digest: + print("OK: already up to date.") + sys.exit(0) + +serial = 0 +with open(serial_fn, 'a+') as serial_fd: + serial_fd.seek(0) + serial = int(serial_fd.readline()) + 1 + serial_fd.truncate(0) + serial_fd.write(str(serial)+'\n') + +with tempfile.NamedTemporaryFile(dir=base_d, delete=False, mode='w') as out_fd: + with open(tmpl_fn, 'r') as tmpl_fd: + while True: + line = tmpl_fd.readline() + if not line: + break + line = line.replace('__SERIAL__', str(serial)) + out_fd.write(line) + os.chmod(out_fd.name, 0o644) + os.rename(out_fd.name, db_fn) + + +cmd = [rndc, 'reload', domain] +p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT) +rndc_output = '' +for line in p.stdout.readlines(): + rndc_output = rndc_output + line.decode('utf-8') + +r = p.wait() +if r != 0: + print("ERROR: rndc returned %d\n\n%s" % (r, rndc_output)) + sys.exit(1) + +digest_fd.truncate(0) +digest_fd.write(new_digest + '\n') + +print("OK: " + rndc_output) diff --git a/roles/dyndns/server/templates/dyndns.py.j2 b/roles/dyndns/server/templates/dyndns.py.j2 index eb5e7ab5..d6d396ce 100755 --- a/roles/dyndns/server/templates/dyndns.py.j2 +++ b/roles/dyndns/server/templates/dyndns.py.j2 @@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python3 # # dyndns.py # @@ -22,17 +22,16 @@ # along with dyndns.py. If not, see <http://www.gnu.org/licenses/>. # -from easyzone import easyzone -import subprocess - +import fcntl +import tempfile import sys import os import re # -domain = '{{ dyndns.domain }}.' -zonefile = '{{ dyndns.zone_file }}' -rndc = '/usr/sbin/rndc' +domain = '{{ dyndns.domain }}' +base_d = '/var/lib/dyndns' +records_fn = os.path.join(base_d, 'records.'+domain) # # this is from: https://gist.github.com/dfee/6ed3a4b05cfe7a6faf40a2102408d5d8 @@ -51,7 +50,7 @@ IPV6GROUPS = ( r':(?:(?::' + IPV6SEG + r'){1,7}|:)', # ::2:3:4:5:6:7:8 ::2:3:4:5:6:7:8 ::8 :: r'fe80:(?::' + IPV6SEG + r'){0,4}%[0-9a-zA-Z]{1,}', # fe80::7:8%eth0 fe80::7:8%1 (link-local IPv6 addresses with zone index) r'::(?:ffff(?::0{1,4}){0,1}:){0,1}[^\s:]' + IPV4ADDR, - # ::255.255.255.255 ::ffff:255.255.255.255 ::ffff:0:255.255.255.255 (IPv4-mapped IPv6 addresses and IPv4-translated addresses) + # ::255.255.255.255 ::ffff:255.255.255.255 ::ffff:0:255.255.255.255 (IPv4-mapped IPv6 addresses and IPv4-translated addresses) r'(?:' + IPV6SEG + r':){1,4}:[^\s:]' + IPV4ADDR, # 2001:db8:3:4::192.0.2.33 64:ff9b::192.0.2.33 (IPv4-Embedded IPv6 Address) ) IPV6ADDR = '|'.join(['(?:{})'.format(g) for g in IPV6GROUPS[::-1]]) # Reverse rows for greedy match @@ -69,12 +68,12 @@ if ('SSH_CLIENT' in os.environ) and ('SSH_ORIGINAL_COMMAND' in os.environ): sshclient = os.environ['SSH_CLIENT'] sshcmd = os.environ['SSH_ORIGINAL_COMMAND'] else: - sys.stdout.write("Error: not an SSH connection\n") + print("ERROR: not an SSH connection or no name given") sys.exit(1) -name = sshcmd.split()[0] -if name not in set(sys.argv[1:]): - sys.stdout.write("Error: you are not allowed to update '%s'\n" % name) +record_name = sshcmd.split()[0] +if record_name not in set(sys.argv[1:]): + print("ERROR: you are not allowed to update '%s'" % record_name) sys.exit(1) ip = sshclient.split()[0] @@ -82,35 +81,25 @@ record_type = '' if re.match(IPV4ADDR, ip): record_type = 'A' if re.match(IPV6ADDR, ip): -# record_type = 'AAAA' - sys.stdout.write("Error: Sorry no IPv6 support yet!\n") - sys.exit(1) + record_type = 'AAAA' if record_type == '': - sys.stdout.write("Error: not a valid IPv4/IPv6 address\n") + print("ERROR: not a valid IPv4/IPv6 address") sys.exit(1) -name = name + '.' + domain -zone = easyzone.zone_from_file(domain, zonefile) -zone.add_name(name) -records = zone.names[name].records(record_type, create=True, ttl=60) -for item in records.get_items(): - if item == ip: - sys.stdout.write("Ok: nothing changed\n") - sys.exit(0) - - records.delete(item) +new_record = f'{record_name:<20} {{ dyndns.soa.default_ttl }} IN {record_type:<5} {ip}' -records.add(ip) -zone.save(autoserial=True) +records_fd = open(records_fn, 'a+') +fcntl.flock(records_fd, fcntl.LOCK_EX) +records_fd.seek(0) +records = records_fd.readlines() +records_fd.truncate(0) +for record in records: + tmp = record.split() + if tmp[0] != record_name or tmp[3] != record_type: + records_fd.write(record) + else: + records_fd.write(new_record + '\n') -cmd = [rndc, 'reload', domain] -p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT) -output = '' -for line in p.stdout.readlines(): - output = output + line - -r = p.wait() -if r != 0: - sys.stdout.write("Error: rndc returned %d\n\n%s" % (r, output)) -else: - sys.stdout.write("Ok: " + output) +records_fd.flush() +os.fsync(records_fd) +os.execl('/usr/local/bin/dyndns-regen.py', '/usr/local/bin/dyndns-regen.py', domain) diff --git a/roles/dyndns/server/templates/header.tmpl.j2 b/roles/dyndns/server/templates/header.tmpl.j2 new file mode 100644 index 00000000..e1d557d1 --- /dev/null +++ b/roles/dyndns/server/templates/header.tmpl.j2 @@ -0,0 +1,11 @@ +$origin {{ dyndns.domain }}. +@ {{ dyndns.soa.ttl }} IN SOA {{ dyndns.soa.mname }}. {{ dyndns.soa.rname }}. __SERIAL__ {{ dyndns.soa.refresh }} {{ dyndns.soa.retry }} {{ dyndns.soa.expire }} {{ dyndns.soa.default_ttl }} + +; *************************** +; static records +{% for record in dyndns.static_records %} +{{ record }} +{% endfor %} + +; *************************** +; dynamic records |