#!/usr/bin/env python3
#
# dyndns.py
#
# a simple ssh based dyndns updater for bind zone files
#
# Copyright (C) 2013 Christian Pointner <equinox@spreadspace.org>
#
# This file is part of dyndns.py.
#
# dyndns.py is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 2 of the License, or
# any later version.
#
# dyndns.py is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with dyndns.py. If not, see <http://www.gnu.org/licenses/>.
#

import fcntl
import tempfile
import sys
import os
import re

#
domain = '{{ dyndns.domain }}'
base_d = '/var/lib/dyndns'
records_fn = os.path.join(base_d, 'records.'+domain)

#
# this is from: https://gist.github.com/dfee/6ed3a4b05cfe7a6faf40a2102408d5d8
IPV4SEG = r'(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])'
IPV4ADDR = r'(?:(?:' + IPV4SEG + r'\.){3,3}' + IPV4SEG + r')'
IPV6SEG = r'(?:(?:[0-9a-fA-F]){1,4})'
IPV6GROUPS = (
    r'(?:' + IPV6SEG + r':){7,7}' + IPV6SEG,                  # 1:2:3:4:5:6:7:8
    r'(?:' + IPV6SEG + r':){1,7}:',                           # 1::                                 1:2:3:4:5:6:7::
    r'(?:' + IPV6SEG + r':){1,6}:' + IPV6SEG,                 # 1::8               1:2:3:4:5:6::8   1:2:3:4:5:6::8
    r'(?:' + IPV6SEG + r':){1,5}(?::' + IPV6SEG + r'){1,2}',  # 1::7:8             1:2:3:4:5::7:8   1:2:3:4:5::8
    r'(?:' + IPV6SEG + r':){1,4}(?::' + IPV6SEG + r'){1,3}',  # 1::6:7:8           1:2:3:4::6:7:8   1:2:3:4::8
    r'(?:' + IPV6SEG + r':){1,3}(?::' + IPV6SEG + r'){1,4}',  # 1::5:6:7:8         1:2:3::5:6:7:8   1:2:3::8
    r'(?:' + IPV6SEG + r':){1,2}(?::' + IPV6SEG + r'){1,5}',  # 1::4:5:6:7:8       1:2::4:5:6:7:8   1:2::8
    IPV6SEG + r':(?:(?::' + IPV6SEG + r'){1,6})',             # 1::3:4:5:6:7:8     1::3:4:5:6:7:8   1::8
    r':(?:(?::' + IPV6SEG + r'){1,7}|:)',                     # ::2:3:4:5:6:7:8    ::2:3:4:5:6:7:8  ::8       ::
    r'fe80:(?::' + IPV6SEG + r'){0,4}%[0-9a-zA-Z]{1,}',       # fe80::7:8%eth0     fe80::7:8%1  (link-local IPv6 addresses with zone index)
    r'::(?:ffff(?::0{1,4}){0,1}:){0,1}[^\s:]' + IPV4ADDR,
    # ::255.255.255.255  ::ffff:255.255.255.255  ::ffff:0:255.255.255.255 (IPv4-mapped IPv6 addresses and IPv4-translated addresses)
    r'(?:' + IPV6SEG + r':){1,4}:[^\s:]' + IPV4ADDR,          # 2001:db8:3:4::192.0.2.33  64:ff9b::192.0.2.33 (IPv4-Embedded IPv6 Address)
)
IPV6ADDR = '|'.join(['(?:{})'.format(g) for g in IPV6GROUPS[::-1]])  # Reverse rows for greedy match
#

#
# add this to the authorized key file of a system user
# the user needs to be a member of the bind group and must
# have write permissions to the zone file

# no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding,no-user-rc,command="/usr/local/bin/dyndns.py <allowed names>" ssh-rsa ...
#

if ('SSH_CLIENT' in os.environ) and ('SSH_ORIGINAL_COMMAND' in os.environ):
    sshclient = os.environ['SSH_CLIENT']
    sshcmd = os.environ['SSH_ORIGINAL_COMMAND']
else:
    print("ERROR: not an SSH connection or no name given")
    sys.exit(1)

record_name = sshcmd.split()[0]
if record_name not in set(sys.argv[1:]):
    print("ERROR: you are not allowed to update '%s'" % record_name)
    sys.exit(1)

ip = sshclient.split()[0]
record_type = ''
if re.match(IPV4ADDR, ip):
    record_type = 'A'
if re.match(IPV6ADDR, ip):
    record_type = 'AAAA'
if record_type == '':
    print("ERROR: not a valid IPv4/IPv6 address")
    sys.exit(1)

new_record = f'{record_name:<20}  {{ dyndns.soa.default_ttl }}  IN  {record_type:<5}  {ip}'

records_fd = open(records_fn, 'a+')
fcntl.flock(records_fd, fcntl.LOCK_EX)
records_fd.seek(0)
records = records_fd.readlines()
records_fd.truncate(0)
for record in records:
    tmp = record.split()
    if tmp[0] != record_name or tmp[3] != record_type:
        records_fd.write(record)
    else:
        records_fd.write(new_record + '\n')

records_fd.flush()
os.fsync(records_fd)
os.execl('/usr/local/bin/dyndns-regen.py', '/usr/local/bin/dyndns-regen.py', domain)