#!/usr/bin/env python3

#

# Copyright 2011-2020 Hakan Lindqvist <dnstools@qw.se>

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

#

#

# ddns-edit-zone.py is a tool for doing "traditional" editing of

# DNS zone data via dynamic updates (RFC 2136).

#

# This tool will fetch the existing zone contents via AXFR (RFC 1034),

# save it to a regular "master" zone file (RFC 1035) which it opens in

# your editor of choice.

# When said editor exits the updated file will be read and a dynamic

# update generated based on the diff compared to the original file

# contents.

# By default this dynamic update also includes the original SOA value

# in the prerequisite section as a safeguard in case of conflicting

# changes.

#

# Notes:

# * If you update the SOA you must also update its serial manually.

# * You can not set different TTLs for records with the same owner

# and rrtype combination (same RRset).

# * Use absolute names if specifying a new $ORIGIN value, currently (1.9.4)

# dnspython does not appear to handle relative names for new origin

# values correctly and affected records may end up out of zone(?).

#

# Prerequisites:

# 1) A TSIG key that allows you to perform AXFR and dynamic updates of

# your zone.

# 2) The TSIG key must be provided in the form of a file with a single

# KEY record (what dnssec-keygen(8) generates).

# Alternatively the bind9 session key file can be used.

# 3) Python 3

# 4) Dnspython (http://www.dnspython.org/)

# 5) Click (https://click.palletsprojects.com/en/7.x/)

#

#

# Project home: https://github.com/hlindqvist/dnstools

#

import sys

import os.path

import tempfile

import subprocess

import re

import dns.query

import dns.zone

import dns.update

import dns.tsigkeyring

import dns.name

import dns.rcode

import dns.exception

import click

def get_tsig_algorithm_name(algo):

return algorithms.get(algo)

def get_default_editor():

return (os.environ.get('DNSEDITOR') or os.environ.get('VISUAL') or

os.environ.get('EDITOR') or 'vi')

def get_default_session_key_path():

return (os.environ.get("BIND_SESSION_KEY_PATH") or

"/var/run/named/session.key")

def read_tsig_key_from_file(filename):

return read_tsig_key_from_configfile(filename)

def read_tsig_key_from_keyfile(filename):

return [keyring, keyalgo]

def read_tsig_key_from_session(filename):

return read_tsig_key_from_configfile(filename)

def read_tsig_key_from_configfile(filename):

return [keyring, keyalgo]

def read_zone_via_axfr(serveraddress, zonename, keyring, keyalgo, timeout):

relativize=False)

def read_zone_from_file(filename, zonename):

return dns.zone.from_file(filename, origin=zonename, relativize=False)

def write_zone_to_file(zone_file, zone, absolute_names):

zone.to_file(zone_file, sorted=True, relativize=(not absolute_names))

def get_zone_diff(original_zone, updated_zone):

return [added, removed]

def get_single_record(rdatas, rdtype):

return records[0]

def remove_dnssec_from_zone(zone, only_remove_sigs):

zone.delete_rdataset(record[0], dns.rdatatype.DNSKEY)

def generate_update_from_diff(zonename, added, removed, oldsoa,

return update

def send_query(query, serveraddress, timeout):

return dns.query.tcp(query, serveraddress, timeout=timeout)

def print_rr_diff(added, removed):

print(rr[3] + " " + make_rr_string(rr))

def verbose_print(header, obj):

print("-" * 20)

def cleanup_and_exit(filename, success, rcode=None):

exit(0 if success else 1000 + rcode)

@click.command()

@click.option("-a", "--absolute-names", default=False, is_flag=True,

help="use absolute names instead of names relative to zone apex")

@click.option("-S", "--include-dnssec-nonsigs", default=False, is_flag=True,

help="include NSEC3PARAM/DNSKEY records when editing")

@click.option("-s", "--include-dnssec", default=False, is_flag=True,

help="include RRSIG/NSEC/NSEC3/NSEC3PARAM/DNSKEY records when "

"editing")

@click.option("-c", "--force-conflicts", default=False, is_flag=True,

help="apply local changes even if zone has been updated while "

"editing")

@click.option("-t", "--timeout", type=float, default=10,

help="query timeout (in seconds)", show_default=True)

@click.option("-l", "--use-session-key", default=False, is_flag=True,

help="use bind9 session key")

@click.option("--session-key-path",

default=get_default_session_key_path(),

help="override path to bind9 session key, also picked up from "

"environment BIND_SESSION_KEY_PATH", show_default=True,

type=click.Path(exists=False))

@click.option("-q", "--quiet", default=False, is_flag=True,

help="do not print status messages")

@click.option("-v", "--verbose", default=False, is_flag=True,

help="print verbose messages suitable for troubleshooting")

@click.option("--dry-run", default=False, help="do not actually send update")

@click.argument('nameserver')

@click.argument('zonename')

@click.argument('keyfile', type=click.Path(exists=True), default=None,

required=False)

def main(absolute_names, include_dnssec_nonsigs, include_dnssec,

response.rcode())

if (__name__ == "__main__"):

main()