forked from dacut/bind53
/
bind53.py
377 lines (306 loc) · 11.7 KB
/
bind53.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
#!/usr/bin/env python
"""
Convert Route53 resource record sets to bind configuration.
"""
# pylint: disable=C0103,C0111,C0411,R0204,R0903,R0912,R0913,R0914
from __future__ import absolute_import, print_function
from getopt import getopt, GetoptError
from logging import basicConfig, getLogger, DEBUG, WARNING
from os import rename, unlink
from os.path import exists
from subprocess import PIPE, Popen
from sys import argv, exit as sys_exit, stderr, stdout
from time import asctime, sleep, time
from boto3.session import Session
from dns.resolver import NXDOMAIN, query as dns_query
from dns.rdatatype import A
from six.moves import cStringIO as StringIO
log = getLogger("bind53")
class DNSRecord(object):
"""
A record for a DNS name.
"""
def __init__(self, name, record_type, ttl, values=None):
super(DNSRecord, self).__init__()
self.name = name
self.record_type = record_type
self.ttl = ttl
self.values = set(values) if values is not None else set()
return
@property
def bind_config(self):
"""
Return the BIND configuration for this record.
"""
result = StringIO()
for value in self.values:
result.write("%-63s %7d IN %-7s " % (
self.name, self.ttl if self.ttl is not None else 60,
self.record_type))
if self.record_type == "SOA":
parts = value.split()
ns = parts[0]
email = parts[1]
soa_values = parts[2:]
result.write("%s %s (%s)" % (ns, email, " ".join(soa_values)))
elif self.record_type == "NS":
if "." in value and not value.endswith("."):
# Some Route 53 NS records are missing the terminating .
value += "."
result.write(value)
else:
result.write(value)
result.write("\n")
return result.getvalue()
def __repr__(self):
return "DNSRecord(name=%r, record_type=%r, ttl=%r, values=%r)" % (
self.name, self.record_type, self.ttl, self.values)
class DNSAliasRecord(DNSRecord):
"""
A Route53 alias record. This allows for ex-post-facto resolution of DNS
names.
"""
# Minimum number of seconds to wait for the next resolution
min_resolution_delay = 6
def __init__(self, name, ttl, target, pending_resolve_count=5,
next_resolution_time=0, values=None):
super(DNSAliasRecord, self).__init__(name, "A", ttl, values)
self.target = target
self.next_resolution_time = next_resolution_time
self.pending_resolve_count = pending_resolve_count
return
def resolve(self):
"""
Attempt to resolve this name once, following CNAME chains if necessary.
"""
ttl = self.min_resolution_delay
try:
log.debug("Query: %s", self.target)
answer = dns_query(self.target, rdtype=A, tcp=True)
log.debug("Answer: %s", answer)
for item in answer.rrset.items:
self.values.add(item.address)
log.debug("Resolved %s (%s): %s", self.name, self.target,
item.address)
ttl = max(ttl, answer.ttl)
if self.ttl is None:
self.ttl = answer.ttl
except NXDOMAIN as e:
log.warning("Failed to resolve %s (%s): %s", self.name,
self.target, e)
self.pending_resolve_count -= 1
self.next_resolution_time = time() + ttl
return
def __repr__(self):
return (("DNSAliasRecord(name=%r, ttl=%r, target=%r, "
"pending_resolve_count=%r, next_resolution_time=%r, "
"values=%r)") % (
self.name, self.ttl, self.target,
self.pending_resolve_count, self.next_resolution_time,
self.values))
def get_route53_records(zone_id, profile_name=None):
"""
Returns the Route53 records for a given hosted zone.
"""
session = Session(profile_name=profile_name)
r53 = session.client("route53")
hosted_zone = r53.get_hosted_zone(Id=zone_id)
zone_name = hosted_zone["HostedZone"]["Name"]
records = []
kw = {"HostedZoneId": zone_id, "MaxItems": "100"}
while True:
results = r53.list_resource_record_sets(**kw)
for rrs in results["ResourceRecordSets"]:
name = rrs["Name"]
query_type = rrs["Type"]
ttl = rrs.get("TTL")
if "ResourceRecords" in rrs:
values = [rs["Value"] for rs in rrs["ResourceRecords"]]
record = DNSRecord(name, query_type, ttl, values)
log.debug("Received Route53 record for %s: %s", name, values)
elif "AliasTarget" in rrs:
atgt = rrs["AliasTarget"]
target = atgt["DNSName"]
record = DNSAliasRecord(name, ttl, target)
log.debug("Received Route53 alias record for %s: %s",
name, target)
records.append(record)
if not results["IsTruncated"]:
break
kw["StartRecordName"] = results["NextRecordName"]
kw["StartRecordType"] = results["NextRecordType"]
if "NextRecordIdentifier" in results:
kw["StartRecordIdentifier"] = results["NextRecordIdentifier"]
else:
kw.pop("StartRecordIdentifier", None)
return zone_name, records
def resolve_alias_records(records):
"""
Resolve alias records until there are no more resolutions to be had.
"""
while len(records) > 0:
records.sort(key=lambda record: record.next_resolution_time,
reverse=True)
record = records.pop()
now = time()
if now < record.next_resolution_time:
sleep(record.next_resolution_time - now)
record.resolve()
if record.pending_resolve_count > 0:
records.append(record)
return
def process_zone(zone_id, output_filename, profile_name=None):
"""
Write the records for a hosted zone to a file.
"""
zone_name, records = get_route53_records(zone_id, profile_name=profile_name)
if len(records) == 0:
log.error("No records for zone %s; will not write zone file.",
zone_name)
return False
# Find the SOA record
soa_records = [r for r in records if r.record_type == "SOA"]
if len(soa_records) == 0:
raise ValueError(
"No SOA record for zone %s; will not write zone file." % zone_name)
if len(soa_records) > 1:
raise ValueError("Multiple SOA records for zone %s; will not write "
"zone file." % zone_name)
alias_records = [r for r in records if isinstance(r, DNSAliasRecord)]
resolve_alias_records(alias_records)
if output_filename:
fd = open(output_filename % {"zone_name": zone_name}, "w")
else:
fd = stdout
fd.write("$ORIGIN %s\n" % zone_name)
# Write the SOA record first
fd.write(soa_records[0].bind_config)
for r in records:
if r.record_type == "SOA":
# Already printed; skip it.
continue
fd.write(r.bind_config)
if fd is not stdout:
fd.close()
return zone_name
def update_bind_config(bind_config, zone_names, output_filename):
if exists(bind_config):
old_bind_config = bind_config + ".old"
if exists(old_bind_config):
unlink(old_bind_config)
rename(bind_config, old_bind_config)
with open(bind_config, "w") as fd:
fd.write('# Generated by bind53 at %s\n' % asctime())
for zone_name in zone_names:
zone_filename = output_filename % {"zone_name": zone_name}
fd.write('zone "%s" IN {\n' % zone_name)
fd.write(' type master;\n')
fd.write(' file "%s";\n' % zone_filename)
fd.write('};\n\n')
def kick_named():
proc = Popen(["/sbin/service", "named", "reload"], stdout=PIPE, stderr=PIPE)
out, err = proc.communicate()
if out:
for line in out.split("\n"):
log.debug("/sbin/service named reload stdout: %s", line)
if err:
for line in err.split("\n"):
log.warning("/sbin/service named reload stderr: %s", line)
if proc.returncode == 0:
return
proc = Popen(["/sbin/service", "named", "restart"], stdout=PIPE,
stderr=PIPE)
out, err = proc.communicate()
if out:
for line in out.split("\n"):
log.debug("/sbin/service named restart stdout: %s", line)
if err:
for line in err.split("\n"):
log.warning("/sbin/service named restart stderr: %s", line)
if proc.returncode != 0:
raise ValueError(err)
def main(args):
"""
Main entrypoint.
"""
profile_name = None
output_filename = None
bind_config = "/etc/bind53.conf"
kick = False
zone_names = []
basicConfig(format="%(asctime)s %(levelname)s %(name)s "
"%(filename)s:%(lineno)d: %(message)s",
level=DEBUG,
stream=stderr)
getLogger("boto").setLevel(WARNING)
getLogger("botocore").setLevel(WARNING)
try:
opts, args = getopt(
args, "c:hko:p:",
["bind-config=", "named-config=", "help", "kick", "output=",
"profile="])
except GetoptError as e:
print(e, file=stderr)
usage()
return 1
for opt, val in opts:
if opt in ("-c", "--bind-config", "--named-config",):
bind_config = val
elif opt in ("-h", "--help",):
usage(stdout)
return 0
elif opt in ("-k", "--kick",):
kick = True
elif opt in ("-o", "--output",):
output_filename = val
elif opt in ("-p", "--profile",):
profile_name = val
if len(args) == 0:
print("Missing zone id.", file=stderr)
usage()
return 1
errors = 0
for zone_id in args:
log.info("Processing hosted zone %s", zone_id)
try:
zone_name = process_zone(zone_id, output_filename, profile_name)
zone_names.append(zone_name)
except Exception as e: # pylint: disable=W0703
log.error("Failed to process hosted zone %s: %s", zone_id, e,
exc_info=True)
errors += 1
if not errors:
try:
update_bind_config(bind_config, zone_names, output_filename)
if kick:
kick_named()
except Exception as e: # pylint: disable=W0703
log.error("Failed to restart named: %s", e, exc_info=True)
errors += 1
if errors:
log.error("%d error(s) encountered.", errors)
else:
log.info("No errors encountered.")
return min(errors, 127)
def usage(fd=stderr):
"Print usage information."
fd.write("""\
Usage: %(argv0)s [options] <zone_id> [<zone_id> ...]
Convert Route 53 hosted zones to BIND zone files.
Options:
-c <filename> | --bind-config <filename> | --named-config <filename>
The BIND configuration file to edit. Defaults to /etc/bind53.conf.
-h | --help
Print this usage information.
-k | --kick
Restart the BIND server after writing the zone files. This is done
only if no errors are encountered.
-o <filename> | --output <filename>
Write output to the given file. Defaults to stdout.
This may contain %%(zone_name)s, which will be replaced with the
zone name.
-p <name> | --profile <name>
Use the specified AWS CLI/Boto profile for access/secret keys.
""" % {"argv0": argv[0]})
if __name__ == "__main__":
sys_exit(main(argv[1:]))