1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
#!/usr/bin/env python3
#
# dyndns.py
#
# a simple ssh based dyndns updater for bind zone files
#
# Copyright (C) 2013 Christian Pointner <equinox@spreadspace.org>
#
# This file is part of dyndns.py.
#
# dyndns.py is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 2 of the License, or
# any later version.
#
# dyndns.py is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with dyndns.py. If not, see <http://www.gnu.org/licenses/>.
#
import fcntl
import tempfile
import sys
import os
import re
#
domain = '{{ dyndns.domain }}'
base_d = '/var/lib/dyndns'
records_fn = os.path.join(base_d, 'records.'+domain)
#
# this is from: https://gist.github.com/dfee/6ed3a4b05cfe7a6faf40a2102408d5d8
IPV4SEG = r'(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])'
IPV4ADDR = r'(?:(?:' + IPV4SEG + r'\.){3,3}' + IPV4SEG + r')'
IPV6SEG = r'(?:(?:[0-9a-fA-F]){1,4})'
IPV6GROUPS = (
r'(?:' + IPV6SEG + r':){7,7}' + IPV6SEG, # 1:2:3:4:5:6:7:8
r'(?:' + IPV6SEG + r':){1,7}:', # 1:: 1:2:3:4:5:6:7::
r'(?:' + IPV6SEG + r':){1,6}:' + IPV6SEG, # 1::8 1:2:3:4:5:6::8 1:2:3:4:5:6::8
r'(?:' + IPV6SEG + r':){1,5}(?::' + IPV6SEG + r'){1,2}', # 1::7:8 1:2:3:4:5::7:8 1:2:3:4:5::8
r'(?:' + IPV6SEG + r':){1,4}(?::' + IPV6SEG + r'){1,3}', # 1::6:7:8 1:2:3:4::6:7:8 1:2:3:4::8
r'(?:' + IPV6SEG + r':){1,3}(?::' + IPV6SEG + r'){1,4}', # 1::5:6:7:8 1:2:3::5:6:7:8 1:2:3::8
r'(?:' + IPV6SEG + r':){1,2}(?::' + IPV6SEG + r'){1,5}', # 1::4:5:6:7:8 1:2::4:5:6:7:8 1:2::8
IPV6SEG + r':(?:(?::' + IPV6SEG + r'){1,6})', # 1::3:4:5:6:7:8 1::3:4:5:6:7:8 1::8
r':(?:(?::' + IPV6SEG + r'){1,7}|:)', # ::2:3:4:5:6:7:8 ::2:3:4:5:6:7:8 ::8 ::
r'fe80:(?::' + IPV6SEG + r'){0,4}%[0-9a-zA-Z]{1,}', # fe80::7:8%eth0 fe80::7:8%1 (link-local IPv6 addresses with zone index)
r'::(?:ffff(?::0{1,4}){0,1}:){0,1}[^\s:]' + IPV4ADDR,
# ::255.255.255.255 ::ffff:255.255.255.255 ::ffff:0:255.255.255.255 (IPv4-mapped IPv6 addresses and IPv4-translated addresses)
r'(?:' + IPV6SEG + r':){1,4}:[^\s:]' + IPV4ADDR, # 2001:db8:3:4::192.0.2.33 64:ff9b::192.0.2.33 (IPv4-Embedded IPv6 Address)
)
IPV6ADDR = '|'.join(['(?:{})'.format(g) for g in IPV6GROUPS[::-1]]) # Reverse rows for greedy match
#
#
# add this to the authorized key file of a system user
# the user needs to be a member of the bind group and must
# have write permissions to the zone file
# no-agent-forwarding,no-port-forwarding,no-pty,no-X11-forwarding,no-user-rc,command="/usr/local/bin/dyndns.py <allowed names>" ssh-rsa ...
#
if ('SSH_CLIENT' in os.environ) and ('SSH_ORIGINAL_COMMAND' in os.environ):
sshclient = os.environ['SSH_CLIENT']
sshcmd = os.environ['SSH_ORIGINAL_COMMAND']
else:
print("ERROR: not an SSH connection or no name given")
sys.exit(1)
record_name = sshcmd.split()[0]
if record_name not in set(sys.argv[1:]):
print("ERROR: you are not allowed to update '%s'" % record_name)
sys.exit(1)
ip = sshclient.split()[0]
record_type = ''
if re.match(IPV4ADDR, ip):
record_type = 'A'
if re.match(IPV6ADDR, ip):
record_type = 'AAAA'
if record_type == '':
print("ERROR: not a valid IPv4/IPv6 address")
sys.exit(1)
new_record = f'{record_name:<20} {{ dyndns.soa.default_ttl }} IN {record_type:<5} {ip}'
records_fd = open(records_fn, 'a+')
fcntl.flock(records_fd, fcntl.LOCK_EX)
records_fd.seek(0)
records = records_fd.readlines()
records_fd.truncate(0)
for record in records:
tmp = record.split()
if tmp[0] != record_name or tmp[3] != record_type:
records_fd.write(record)
else:
records_fd.write(new_record + '\n')
records_fd.flush()
os.fsync(records_fd)
os.execl('/usr/local/bin/dyndns-regen.py', '/usr/local/bin/dyndns-regen.py', domain)
|
