ldap2zone.py

#!/usr/bin/env python
# coding: utf-8
# vim: set si ai et sw=4 sts=4 ts=4 ft=python:
#
# Copyright (c) 2015, Paul Tötterman <paul.totterman@iki.fi>
# Copyright (c) 2015, ZenRobotics Ltd.
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

"""Generate bind9 zone file from LDAP.

Usage:
    ldap2zone [options] [-z ZONE]...
    ldap2zone -h
    ldap2zone -V

Options:
    -h --help               Show this usage message.
    -V --version            Show version.
    -d --debug              Debug output.
    -v --verbose            Verbose output.
    -q --quiet              Less output.
    -l --ldap-conf CONF     Location of ldap.conf [default: /etc/ldap/ldap.conf]
    -H --uri URI            LDAP URI (from ldap.conf by default).
    -b --base BASE          LDAP search base (from ldap.conf by default).
    -D --binddn DN          LDAP bind DN.
    -p --bindpw PASS        LDAP bind password.
    -P --prompt-password    Prompt for LDAP bind password.
    -o --output-dir DIR     Output directory [default: .].
    -s --serial SERIAL      DNS zone serial (UNIX ts by default).
    -r --reverse            Output reverse DNS zones [default: false].
    -z --zone ZONE          DNS zones to process (from LDAP base by default).
"""

import docopt
import getpass
import ldap
import ldap.filter
import logging
import os
import re
import sys
import time

RECORDLINE = '%(name)s\t%(ttl)s\t%(type)s\t%(data)s\n'
ZONEFILE = 'db.%(zone)s'
REVERSEZONE = '%(third)s.%(second)s.%(first)s.in-addr.arpa'
RECORD_ATTRIBUTES = ['a6Record',
                     'aAAARecord',
                     'aFSDBRecord',
                     'aPLRecord',
                     'aRecord',
                     'cERTRecord',
                     'cNAMERecord',
                     'dHCIDRecord',
                     'dLVRecord',
                     'dNAMERecord',
                     'dNSKEYRecord',
                     'dSRecord',
                     'hINFORecord',
                     'hIPRecord',
                     'iPSECKEYRecord',
                     'kEYRecord',
                     'kXRecord',
                     'lOCRecord',
                     'mDRecord',
                     'mINFORecord',
                     'mXRecord',
                     'nAPTRRecord',
                     'nSEC3PARAMRecord',
                     'nSEC3Record',
                     'nSECRecord',
                     'nSRecord',
                     'nXTRecord',
                     'pTRRecord',
                     'rPRecord',
                     'rRSIGRecord',
                     'sIGRecord',
                     #'sOARecord', # special case
                     'sPFRecord',
                     'sRVRecord',
                     'sSHFPRecord',
                     'tARecord',
                     'tKEYRecord',
                     'tSIGRecord',
                     'tXTRecord']
SOA_ATTRIBUTES = {'sOANameServer': 'ns',
                  'sOAEmail':      'email',
                  'sOASerial':     'serial',
                  'sOARefresh':    'refresh',
                  'sOARetry':      'retry',
                  'sOAExpire':     'expire',
                  'sOANegCache':   'negcache',
                  'defaultTTL':    'dttl'} # doesn't actually belong here
SOA_DEFAULTS = {'refresh':  1200, # RFC1912
                'retry':    180,
                'expire':   1209600, # RFC1912
                'negcache': 60}
ZONEHEADER = '''\
; autogenerated bind zone file by ldap2zone.py
; vim: set ft=bindzone:
$ORIGIN %(zone)s.
$TTL\t%(ttl)s
'''


def parse_ldap_base(ldap_conf):
    """Parse LDAP base from ldap.conf(5)."""
    # pylint: disable-msg=W0141
    ldap_conf = open(ldap_conf, 'rb')
    pattern = re.compile(r'''^\s*[bB][aA][sS][eE]\s+(.+)\s*$''')
    matches = [pattern.search(x) for x in ldap_conf.readlines()]
    base = filter(None, matches)[0].group(1)
    return base


def get_ldap_base(conn, ldap_conf, persist={}):
    """Find out LDAP base."""
    # pylint: disable-msg=W0102,C0103
    if 'base' in persist:
        return persist['base']

    entries = conn.search_s('', ldap.SCOPE_BASE, 'objectClass=*', ('+',))
    attrs = entries[0][1]
    if len(attrs['namingContexts']) == 1:
        base = attrs['namingContexts'][0]
    else:
        base = parse_ldap_base(ldap_conf)

    persist['base'] = base
    return base


def write_record(ofile, values):
    """Output a single DNS record."""
    ofile.write(RECORDLINE % values)


def mtime2epoch(mtimestr):
    """Convert LDAP modifyTimestamp attribute value to unix epoch timestamp."""
    return int(time.mktime(time.strptime(mtimestr, '%Y%m%d%H%M%SZ')))


def attribute2type(attribute):
    """Convert LDAP attribute name to DNS record type."""
    return attribute.split('Record')[0].upper()


def entry2cn(entry):
    """Figure out a suitable reverse mapping for an entry."""
    # pylint: disable-msg=C0103
    dn = entry[0]
    rdns = [rdn.split('=') for rdn in dn.split(',')]
    cns = [v for k, v in rdns if k in ('relativeDomainName', 'cn')]

    attrs = entry[1]
    zone = attrs['zoneName'][0]

    if cns:
        if len(cns) > 1:
            logging.warn('multiple "cns" for %s, picking first: %s', dn, cns)
        return '%s.%s' % (cns[0], zone)

    if 'relativeDomainName' in attrs:
        rdns = [rdn for rdn in attrs['relativeDomainName'] if rdn != '@']
        if rdns:
            if len(rdns) > 1:
                logging.warn('multiple "rdns" for %s, picking first: %s', dn,
                             rdns)
            return '%s.%s' % (rdns[0], zone)

    if 'cn' in attrs:
        logging.warn('multiple "cn"s for %s, picking first: %s', dn,
                     attrs['cn'])
        return '%s.%s' % (attrs['cn'][0], zone)

    logging.warn('no suitable cns or rdns for %s, picking %s', dn, zone)
    return zone


def add_reverses(reverse_maps, entry):
    """Add the reverses implied by entry."""
    # pylint: disable-msg=C0103
    def add_reverse(ip, cn):
        """Add a single reverse."""
        parts = ip.split('.')
        reverse_map = reverse_maps
        for part in parts[:3]:
            if part not in reverse_map:
                reverse_map[part] = {}
            reverse_map = reverse_map[part]
        if parts[3] not in reverse_map:
            reverse_map[parts[3]] = cn
        else:
            logging.warn('multiple reverses for IP %s: %s %s', ip,
                         reverse_map[parts[3]], cn)

    cn = entry2cn(entry)
    attrs = entry[1]
    ips = []

    for attr in ('aRecord', 'ipHostNumber'):
        if attr in attrs:
            ips += attrs[attr]

    for ip in ips:
        add_reverse(ip, cn)


def build_soa(zone_entry):
    """Return SOA record based on existing values in zone entry or guesses.

    >>> sorted(build_soa({'relativeDomainName': (None, ['@']),
    ...         'sOARecord': (None,
    ...             ['ns.example.com. hostmaster.example.com. '
    ...              '(1 600 300 3600 60)'])}).items())
    ... # doctest: +NORMALIZE_WHITESPACE
    [('data', 'ns.example.com. hostmaster.example.com. (1 600 300 3600 60)'),
     ('name', '@'), ('ttl', ''), ('type', 'SOA')]
    >>> sorted(build_soa({'sOANameServer': (None, ['ns.example.com.']),
    ...         'sOAEmail': (None, ['hostmaster.example.com.']),
    ...         'sOASerial': (None, ['1']),}).items())
    ... # doctest: +NORMALIZE_WHITESPACE
    [('data',
      'ns.example.com. hostmaster.example.com. (1 1200 180 1209600 60)'),
     ('name', '@'), ('ttl', ''), ('type', 'SOA')]
    """
    if 'sOARecord' in zone_entry:
        return {'name': zone_entry['relativeDomainName'][1][0],
                'ttl': '',
                'type': attribute2type('sOARecord'),
                'data': zone_entry['sOARecord'][1][0]}

    soa_values = SOA_DEFAULTS.copy()
    for attr in SOA_ATTRIBUTES.keys():
        if attr in zone_entry:
            soa_values[SOA_ATTRIBUTES[attr]] = zone_entry[attr][1][0]

    return {'name': '@',
            'ttl':  '',
            'type': 'SOA',
            'data': ('%(ns)s %(email)s (%(serial)s %(refresh)s %(retry)s '
                     '%(expire)s %(negcache)s)' % soa_values)}


def write_reverse_zones(reverse_maps, serial, nameserver, email, outdir):
    """Write reverse zones based on the extracted reverse maps."""
    zones = []

    for first in reverse_maps:
        for second in reverse_maps[first]:
            for third in reverse_maps[first][second]:
                zone = REVERSEZONE % {'first': first,
                                      'second': second,
                                      'third': third}
                zones.append(zone)

                zonefile = ZONEFILE % {'zone': zone}

                with open(os.path.join(outdir, zonefile), 'w') as ofile:
                    ofile.write(ZONEHEADER % {'zone': zone, 'ttl': 60})
                    write_record(ofile, build_soa(
                        {'sOANameServer': (None, [nameserver]),
                         'sOASerial': (None, [serial]),
                         'sOAEmail': (None, [email])}))
                    write_record(ofile, {'name': '@',
                                         'ttl': '',
                                         'type': 'NS',
                                         'data': nameserver})
                    for fourth in reverse_maps[first][second][third]:
                        data = ('%s.' %
                                reverse_maps[first][second][third][fourth])
                        write_record(ofile,
                                     {'name': fourth,
                                      'ttl': '',
                                      'type': 'PTR',
                                      'data': data})


def build_zone(conn, base, zone, reverse_maps, serial=None):
    """Build zone information from LDAP."""
    query_attrs = RECORD_ATTRIBUTES + SOA_ATTRIBUTES.keys() + [
        'relativeDomainName', 'zoneName', 'modifyTimestamp', 'dNSTTL',
        'defaultTTL']
    filterstr = ldap.filter.filter_format('(&(objectClass=dNSRecord)'
                                          '(zoneName=%s))', (zone,))
    entries = conn.search_s(base, ldap.SCOPE_SUBTREE, filterstr, query_attrs)
    epochs = [mtime2epoch(e[1]['modifyTimestamp'][0]) for e in entries]
    unified_entries = {}
    unified_entries['@'] = {}
    unified_entries['@']['sOASerial'] = (None, [serial or max([0]+epochs)])

    for entry in entries:
        attrs = entry[1]
        for name in attrs['relativeDomainName']:
            if not name in unified_entries:
                unified_entries[name] = {}
            unified_attrs = unified_entries[name]
            for attr in RECORD_ATTRIBUTES + SOA_ATTRIBUTES.keys():
                ttl = None
                if 'dNSTTL' in attrs:
                    ttl = attrs['dNSTTL'][0]
                if attr in attrs:
                    unified_attrs[attr] = (ttl, attrs[attr])

        add_reverses(reverse_maps, entry)

    return unified_entries


def write_zonefile(zone, unified_entries, outdir):
    """Write a single zonefile to outdir."""
    zone_entry = unified_entries['@']

    default_ttl = 60
    if 'defaultTTL' in zone_entry:
        default_ttl = zone_entry['defaultTTL'][1][0]

    zonefile = ZONEFILE % {'zone': zone}

    with open(os.path.join(outdir, zonefile), 'w') as ofile:
        ofile.write(ZONEHEADER % {'zone': zone, 'ttl': default_ttl})

        write_record(ofile, build_soa(zone_entry))

        for name in unified_entries:
            attrs = unified_entries[name]
            ttl = ''

            if 'dNSTTL' in attrs and attrs['dNSTTL'][0] != default_ttl:
                ttl = attrs['dNSTTL'][0]
            for attr in RECORD_ATTRIBUTES:
                if attr in attrs:
                    if (attrs[attr][0] is not None and
                        attrs[attr][0] != default_ttl):
                        ttl = attrs[attr][0]
                    for value in attrs[attr][1]:
                        write_record(ofile,
                                      {'name': name,
                                       'ttl':  ttl,
                                       'type': attribute2type(attr),
                                       'data': value})


def generate_zonefiles(conn, base, zones, outdir, serial=None, reverse=False):
    """Generates the zonefiles from LDAP. Does the actual work."""
    # pylint: disable-msg=C0103,R0912,R0914
    reverse_maps = {}

    if not os.path.exists(outdir):
        os.makedirs(outdir)

    max_serial = 0
    rzone_ns = None
    rzone_email = None

    for zone in zones:
        unified_entries = build_zone(conn, base, zone, reverse_maps, serial)

        zone_serial = unified_entries['@']['sOASerial'][1][0]
        max_serial = zone_serial if zone_serial > max_serial else max_serial

        email = unified_entries['@']['sOAEmail'][1][0]
        if rzone_email is not None and rzone_email != email:
            logging.warn('Zones with different emails, picking %s', email)
        rzone_email = email

        nameserver = unified_entries['@']['sOANameServer'][1][0]
        if rzone_ns is not None and rzone_ns != nameserver:
            logging.warn('Zones with different nameservers, picking %s',
                         nameserver)
        rzone_ns = nameserver

        write_zonefile(zone, unified_entries, outdir)

    if serial is None:
        serial = max_serial

    if reverse:
        write_reverse_zones(reverse_maps, serial, rzone_ns, rzone_email, outdir)


def main():
    """The main function."""
    opts = docopt.docopt(__doc__, version='0.1.0')

    loglevel = logging.WARNING

    if opts['--debug']:
        loglevel = logging.DEBUG
    elif opts['--verbose']:
        loglevel = logging.INFO
    elif opts['--quiet']:
        loglevel = logging.ERROR

    logging.basicConfig(format='%(asctime)s %(levelname)-8s %(message)s',
                        level=loglevel, stream=sys.stderr)

    if opts['--prompt-password']:
        opts['--bindpw'] = getpass.getpass()

    uri = opts['--uri'] if opts['--uri'] else ldap.get_option(ldap.OPT_URI)

    conn = ldap.initialize(uri)

    base = opts['--base'] if opts['--base'] else ('ou=Hosts,%s' %
            get_ldap_base(conn, opts['--ldap-conf']))

    # pylint: disable-msg=C0103
    dn = [rdn.split('=') for rdn in base.split(',')]
    dcs = [v for k, v in dn if k == 'dc']
    zones = ['.'.join(dcs)]

    if opts['--zone']:
        zones = opts['--zone']

    if opts['--binddn']:
        conn.simple_bind_s(opts['--binddn'], opts['--bindpw'])

    generate_zonefiles(conn, base, zones, outdir=opts['--output-dir'],
                       serial=opts['--serial'], reverse=opts['--reverse'])


if __name__ == '__main__':
    main()