commit 9cfbd267b41da6f5e0b0617dd08353f288b16fb6 Author: Sven Luethi Date: Sat Oct 4 15:24:42 2025 +0200 new file: .github/workflows/python-publish.yml new file: .gitignore new file: LICENSE.md new file: MANIFEST.in new file: README.md new file: pylint.conf new file: pyproject.toml new file: requirements.txt new file: src/netbox_plugin_bind_provisioner/__init__.py new file: src/netbox_plugin_bind_provisioner/management/commands/bind-transfer-endpoint.py diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml new file mode 100644 index 0000000..82f8dbd --- /dev/null +++ b/.github/workflows/python-publish.yml @@ -0,0 +1,70 @@ +# This workflow will upload a Python Package to PyPI when a release is created +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Upload Python Package + +on: + release: + types: [published] + +permissions: + contents: read + +jobs: + release-build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: "3.x" + + - name: Build release distributions + run: | + # NOTE: put your own distribution build steps here. + python -m pip install build + python -m build + + - name: Upload distributions + uses: actions/upload-artifact@v4 + with: + name: release-dists + path: dist/ + + pypi-publish: + runs-on: ubuntu-latest + needs: + - release-build + permissions: + # IMPORTANT: this permission is mandatory for trusted publishing + id-token: write + + # Dedicated environments with protections for publishing are strongly recommended. + # For more information, see: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules + environment: + name: pypi + # OPTIONAL: uncomment and update to include your PyPI project URL in the deployment status: + # url: https://pypi.org/p/YOURPROJECT + # + # ALTERNATIVE: if your GitHub Release name is the PyPI project version string + # ALTERNATIVE: exactly, uncomment the following line instead: + # url: https://pypi.org/project/YOURPROJECT/${{ github.event.release.name }} + + steps: + - name: Retrieve release distributions + uses: actions/download-artifact@v4 + with: + name: release-dists + path: dist/ + + - name: Publish release distributions to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + with: + packages-dir: dist/ diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..8e78917 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +src/netbox_plugin_bind_provisioner.egg-info +dist/ diff --git a/LICENSE.md b/LICENSE.md new file mode 100644 index 0000000..d159169 --- /dev/null +++ b/LICENSE.md @@ -0,0 +1,339 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. diff --git a/MANIFEST.in b/MANIFEST.in new file mode 100644 index 0000000..f2c648a --- /dev/null +++ b/MANIFEST.in @@ -0,0 +1 @@ +recursive-include netbox_bind_provisioner *.py diff --git a/README.md b/README.md new file mode 100644 index 0000000..c180553 --- /dev/null +++ b/README.md @@ -0,0 +1,124 @@ +# Netbox Bind Provisioner +A Netbox Plugin that provides a minimal DNS Server for the automatic +provisioning of a Bind9 Server from Netbox DNS data (netbox-plugin-dns). + +## Plugin configuration +The plugin was re-worked; Instead of exporting zone files, it provides an +entire (though minimal) DNS Server that is fed directly from Netbox's DNS data. +The Server also provides specialized "catalog" zones that bind uses to +automatically discover new zones and remove deleted ones. The plugin supports +view as well as basic dns security using TSIG. + +To work correctly, each view needs a tsig key installed and the +bind-transfer-endpoint needs to be running as its own service in the background +via the `manage.py` command. Note that dnssec support will be implemented as +soon as bind9 has a mechanism to allow configuration of such via the Catalog +Zones mechanism. +``` +venv/bin/python3 netbox/netbox/manage.py bind-transfer-endpoint --port 5354 +``` + +### Parameters +Parameter | Description +--------- | -------------------------------------------------------- +--port | Port to listen on for requests (defaults to 5354) +--address | IP of interface to bind to (defaults to 0.0.0.0) + +``` +PLUGINS_CONFIG = { + "netbox_bind_provisioner": { + "tsig_keys": { + "key1name": { + "view": "public", + "keyname": "view1key", + "algorithm": "hmac-sha256", + "secret": "base64-encoded-secret" + }, + "key2name": { + "view": "private", + "keyname": "view2key", + "algorithm": "hmac-sha256", + "secret": "base64-encoded-secret" + } + }, + } +} +``` + +## Bind configuration +``` +options { + ... + ... + allow-update { none; }; + allow-query { any; }; + allow-recursion { none; }; + notify yes; + ... + ... +}; + +# ACLs + +acl public { + !10.0.0.0/8; + !172.16.0.0/12; + !192.168.0.0/16; + any; +}; + +acl private { + 10.0.0.0/8; + 172.16.0.0/12; + 192.168.0.0/16; +}; + +# Zone definitions + +view "public" { + key "key1name" { + algorithm hmac-sha256; + secret "base64-encoded-secret"; + }; + + match-clients { public; }; + + catalog-zones { + zone "catz" + default-masters { 127.0.0.1 port 5354 key "key1name"; } + zone-directory "/var/lib/bind/zones" + min-update-interval 1; + }; + + zone "catz" { + type slave; + file "/var/lib/bind/zones/catz_public"; + masters { 127.0.0.1 port 5354 key "key1name"; }; + notify no; + }; +}; + +view "private" { + key "key2name" { + algorithm hmac-sha256; + secret "base64-encoded-secret"; + }; + + match-clients { private; }; + + catalog-zones { + zone "catz" + default-masters { 127.0.0.1 port 5354 key "key2name"; } + zone-directory "/var/lib/bind/zones" + min-update-interval 1; + }; + + zone "catz" { + type slave; + file "/var/lib/bind/zones/catz_private"; + masters { 127.0.0.1 port 5354 key "key2name"; }; + notify no; + }; +}; +``` + diff --git a/pylint.conf b/pylint.conf new file mode 100644 index 0000000..73db7a3 --- /dev/null +++ b/pylint.conf @@ -0,0 +1,645 @@ +[MAIN] + +# Analyse import fallback blocks. This can be used to support both Python 2 and +# 3 compatible code, which means that the block might have code that exists +# only in one or another interpreter, leading to false positives when analysed. +analyse-fallback-blocks=no + +# Clear in-memory caches upon conclusion of linting. Useful if running pylint +# in a server-like mode. +clear-cache-post-run=no + +# Load and enable all available extensions. Use --list-extensions to see a list +# all available extensions. +#enable-all-extensions= + +# In error mode, messages with a category besides ERROR or FATAL are +# suppressed, and no reports are done by default. Error mode is compatible with +# disabling specific errors. +#errors-only= + +# Always return a 0 (non-error) status code, even if lint errors are found. +# This is primarily useful in continuous integration scripts. +#exit-zero= + +# A comma-separated list of package or module names from where C extensions may +# be loaded. Extensions are loading into the active Python interpreter and may +# run arbitrary code. +extension-pkg-allow-list= + +# A comma-separated list of package or module names from where C extensions may +# be loaded. Extensions are loading into the active Python interpreter and may +# run arbitrary code. (This is an alternative name to extension-pkg-allow-list +# for backward compatibility.) +extension-pkg-whitelist= + +# Return non-zero exit code if any of these messages/categories are detected, +# even if score is above --fail-under value. Syntax same as enable. Messages +# specified are enabled, while categories only check already-enabled messages. +fail-on= + +# Specify a score threshold under which the program will exit with error. +fail-under=10 + +# Interpret the stdin as a python script, whose filename needs to be passed as +# the module_or_package argument. +#from-stdin= + +# Files or directories to be skipped. They should be base names, not paths. +ignore=CVS + +# Add files or directories matching the regular expressions patterns to the +# ignore-list. The regex matches against paths and can be in Posix or Windows +# format. Because '\\' represents the directory delimiter on Windows systems, +# it can't be used as an escape character. +ignore-paths= + +# Files or directories matching the regular expression patterns are skipped. +# The regex matches against base names, not paths. The default value ignores +# Emacs file locks +ignore-patterns=^\.# + +# List of module names for which member attributes should not be checked and +# will not be imported (useful for modules/projects where namespaces are +# manipulated during runtime and thus existing member attributes cannot be +# deduced by static analysis). It supports qualified module names, as well as +# Unix pattern matching. +ignored-modules= + +# Python code to execute, usually for sys.path manipulation such as +# pygtk.require(). +#init-hook= + +# Use multiple processes to speed up Pylint. Specifying 0 will auto-detect the +# number of processors available to use, and will cap the count on Windows to +# avoid hangs. +jobs=1 + +# Control the amount of potential inferred values when inferring a single +# object. This can help the performance when dealing with large functions or +# complex, nested conditions. +limit-inference-results=100 + +# List of plugins (as comma separated values of python module names) to load, +# usually to register additional checkers. +load-plugins= + +# Pickle collected data for later comparisons. +persistent=yes + +# Resolve imports to .pyi stubs if available. May reduce no-member messages and +# increase not-an-iterable messages. +prefer-stubs=no + +# Minimum Python version to use for version dependent checks. Will default to +# the version used to run pylint. +py-version=3.13 + +# Discover python modules and packages in the file system subtree. +recursive=no + +# Add paths to the list of the source roots. Supports globbing patterns. The +# source root is an absolute path or a path relative to the current working +# directory used to determine a package namespace for modules located under the +# source root. +source-roots= + +# When enabled, pylint would attempt to guess common misconfiguration and emit +# user-friendly hints instead of false-positive error messages. +suggestion-mode=yes + +# Allow loading of arbitrary C extensions. Extensions are imported into the +# active Python interpreter and may run arbitrary code. +unsafe-load-any-extension=no + +# In verbose mode, extra non-checker-related info will be displayed. +#verbose= + + +[BASIC] + +# Naming style matching correct argument names. +#argument-naming-style=snake_case +argument-naming-style=camelCase + +# Regular expression matching correct argument names. Overrides argument- +# naming-style. If left empty, argument names will be checked with the set +# naming style. +#argument-rgx= + +# Naming style matching correct attribute names. +attr-naming-style=snake_case + +# Regular expression matching correct attribute names. Overrides attr-naming- +# style. If left empty, attribute names will be checked with the set naming +# style. +#attr-rgx= + +# Bad variable names which should always be refused, separated by a comma. +bad-names=foo, + bar, + baz, + toto, + tutu, + tata + +# Bad variable names regexes, separated by a comma. If names match any regex, +# they will always be refused +bad-names-rgxs= + +# Naming style matching correct class attribute names. +class-attribute-naming-style=any + +# Regular expression matching correct class attribute names. Overrides class- +# attribute-naming-style. If left empty, class attribute names will be checked +# with the set naming style. +#class-attribute-rgx= + +# Naming style matching correct class constant names. +class-const-naming-style=UPPER_CASE + +# Regular expression matching correct class constant names. Overrides class- +# const-naming-style. If left empty, class constant names will be checked with +# the set naming style. +#class-const-rgx= + +# Naming style matching correct class names. +class-naming-style=PascalCase + +# Regular expression matching correct class names. Overrides class-naming- +# style. If left empty, class names will be checked with the set naming style. +#class-rgx= + +# Naming style matching correct constant names. +const-naming-style=UPPER_CASE + +# Regular expression matching correct constant names. Overrides const-naming- +# style. If left empty, constant names will be checked with the set naming +# style. +#const-rgx= + +# Minimum line length for functions/classes that require docstrings, shorter +# ones are exempt. +docstring-min-length=-1 + +# Naming style matching correct function names. +function-naming-style=camelCase + +# Regular expression matching correct function names. Overrides function- +# naming-style. If left empty, function names will be checked with the set +# naming style. +#function-rgx= + +# Good variable names which should always be accepted, separated by a comma. +good-names=i, + j, + k, + ex, + Run, + _ + +# Good variable names regexes, separated by a comma. If names match any regex, +# they will always be accepted +good-names-rgxs= + +# Include a hint for the correct naming format with invalid-name. +include-naming-hint=no + +# Naming style matching correct inline iteration names. +inlinevar-naming-style=any + +# Regular expression matching correct inline iteration names. Overrides +# inlinevar-naming-style. If left empty, inline iteration names will be checked +# with the set naming style. +#inlinevar-rgx= + +# Naming style matching correct method names. +method-naming-style=camelCase + +# Regular expression matching correct method names. Overrides method-naming- +# style. If left empty, method names will be checked with the set naming style. +#method-rgx= + +# Naming style matching correct module names. +module-naming-style=snake_case + +# Regular expression matching correct module names. Overrides module-naming- +# style. If left empty, module names will be checked with the set naming style. +#module-rgx= + +# Colon-delimited sets of names that determine each other's naming style when +# the name regexes allow several styles. +name-group= + +# Regular expression which should only match function or class names that do +# not require a docstring. +no-docstring-rgx=^_ + +# List of decorators that produce properties, such as abc.abstractproperty. Add +# to this list to register other decorators that produce valid properties. +# These decorators are taken in consideration only for invalid-name. +property-classes=abc.abstractproperty + +# Regular expression matching correct type alias names. If left empty, type +# alias names will be checked with the set naming style. +#typealias-rgx= + +# Regular expression matching correct type variable names. If left empty, type +# variable names will be checked with the set naming style. +#typevar-rgx= + +# Naming style matching correct variable names. +variable-naming-style=snake_case + +# Regular expression matching correct variable names. Overrides variable- +# naming-style. If left empty, variable names will be checked with the set +# naming style. +#variable-rgx= + + +[CLASSES] + +# Warn about protected attribute access inside special methods +check-protected-access-in-special-methods=no + +# List of method names used to declare (i.e. assign) instance attributes. +defining-attr-methods=__init__, + __new__, + setUp, + asyncSetUp, + __post_init__ + +# List of member names, which should be excluded from the protected access +# warning. +exclude-protected=_asdict,_fields,_replace,_source,_make,os._exit + +# List of valid names for the first argument in a class method. +valid-classmethod-first-arg=cls + +# List of valid names for the first argument in a metaclass class method. +valid-metaclass-classmethod-first-arg=mcs + + +[DESIGN] + +# List of regular expressions of class ancestor names to ignore when counting +# public methods (see R0903) +exclude-too-few-public-methods= + +# List of qualified class names to ignore when counting class parents (see +# R0901) +ignored-parents= + +# Maximum number of arguments for function / method. +max-args=5 + +# Maximum number of attributes for a class (see R0902). +max-attributes=7 + +# Maximum number of boolean expressions in an if statement (see R0916). +max-bool-expr=5 + +# Maximum number of branch for function / method body. +max-branches=12 + +# Maximum number of locals for function / method body. +max-locals=15 + +# Maximum number of parents for a class (see R0901). +max-parents=7 + +# Maximum number of public methods for a class (see R0904). +max-public-methods=20 + +# Maximum number of return / yield for function / method body. +max-returns=6 + +# Maximum number of statements in function / method body. +max-statements=50 + +# Minimum number of public methods for a class (see R0903). +min-public-methods=2 + + +[EXCEPTIONS] + +# Exceptions that will emit a warning when caught. +overgeneral-exceptions=builtins.BaseException,builtins.Exception + + +[FORMAT] + +# Expected format of line ending, e.g. empty (any line ending), LF or CRLF. +expected-line-ending-format= + +# Regexp for a line that is allowed to be longer than the limit. +ignore-long-lines=^\s*(# )??$ + +# Number of spaces of indent required inside a hanging or continued line. +indent-after-paren=4 + +# String used as indentation unit. This is usually " " (4 spaces) or "\t" (1 +# tab). +indent-string=' ' + +# Maximum number of characters on a single line. +max-line-length=120 + +# Maximum number of lines in a module. +max-module-lines=1000 + +# Allow the body of a class to be on the same line as the declaration if body +# contains single statement. +single-line-class-stmt=no + +# Allow the body of an if to be on the same line as the test if there is no +# else. +single-line-if-stmt=no + + +[IMPORTS] + +# List of modules that can be imported at any level, not just the top level +# one. +allow-any-import-level= + +# Allow explicit reexports by alias from a package __init__. +allow-reexport-from-package=no + +# Allow wildcard imports from modules that define __all__. +allow-wildcard-with-all=no + +# Deprecated modules which should not be used, separated by a comma. +deprecated-modules= + +# Output a graph (.gv or any supported image format) of external dependencies +# to the given file (report RP0402 must not be disabled). +ext-import-graph= + +# Output a graph (.gv or any supported image format) of all (i.e. internal and +# external) dependencies to the given file (report RP0402 must not be +# disabled). +import-graph= + +# Output a graph (.gv or any supported image format) of internal dependencies +# to the given file (report RP0402 must not be disabled). +int-import-graph= + +# Force import order to recognize a module as part of the standard +# compatibility libraries. +known-standard-library= + +# Force import order to recognize a module as part of a third party library. +known-third-party=enchant + +# Couples of modules and preferred modules, separated by a comma. +preferred-modules= + + +[LOGGING] + +# The type of string formatting that logging methods do. `old` means using % +# formatting, `new` is for `{}` formatting. +logging-format-style=old + +# Logging modules to check that the string format arguments are in logging +# function parameter format. +logging-modules=logging + + +[MESSAGES CONTROL] + +# Only show warnings with the listed confidence levels. Leave empty to show +# all. Valid levels: HIGH, CONTROL_FLOW, INFERENCE, INFERENCE_FAILURE, +# UNDEFINED. +confidence=HIGH, + CONTROL_FLOW, + INFERENCE, + INFERENCE_FAILURE, + UNDEFINED + +# Disable the message, report, category or checker with the given id(s). You +# can either give multiple identifiers separated by comma (,) or put this +# option multiple times (only on the command line, not in the configuration +# file where it should appear only once). You can also use "--disable=all" to +# disable everything first and then re-enable specific checks. For example, if +# you want to run only the similarities checker, you can use "--disable=all +# --enable=similarities". If you want to run only the classes checker, but have +# no Warning level messages displayed, use "--disable=all --enable=classes +# --disable=W". +disable=raw-checker-failed, + bad-inline-option, + locally-disabled, + file-ignored, + suppressed-message, + useless-suppression, + deprecated-pragma, + use-symbolic-message-instead, + use-implicit-booleaness-not-comparison-to-string, + use-implicit-booleaness-not-comparison-to-zero + +# Enable the message, report, category or checker with the given id(s). You can +# either give multiple identifier separated by comma (,) or put this option +# multiple time (only on the command line, not in the configuration file where +# it should appear only once). See also the "--disable" option for examples. +enable= + + +[METHOD_ARGS] + +# List of qualified names (i.e., library.method) which require a timeout +# parameter e.g. 'requests.api.get,requests.api.post' +timeout-methods=requests.api.delete,requests.api.get,requests.api.head,requests.api.options,requests.api.patch,requests.api.post,requests.api.put,requests.api.request + + +[MISCELLANEOUS] + +# List of note tags to take in consideration, separated by a comma. +notes=FIXME, + XXX, + TODO + +# Regular expression of note tags to take in consideration. +notes-rgx= + + +[REFACTORING] + +# Maximum number of nested blocks for function / method body +max-nested-blocks=5 + +# Complete name of functions that never returns. When checking for +# inconsistent-return-statements if a never returning function is called then +# it will be considered as an explicit return statement and no message will be +# printed. +never-returning-functions=sys.exit,argparse.parse_error + +# Let 'consider-using-join' be raised when the separator to join on would be +# non-empty (resulting in expected fixes of the type: ``"- " + " - +# ".join(items)``) +suggest-join-with-non-empty-separator=yes + + +[REPORTS] + +# Python expression which should return a score less than or equal to 10. You +# have access to the variables 'fatal', 'error', 'warning', 'refactor', +# 'convention', and 'info' which contain the number of messages in each +# category, as well as 'statement' which is the total number of statements +# analyzed. This score is used by the global evaluation report (RP0004). +evaluation=max(0, 0 if fatal else 10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)) + +# Template used to display messages. This is a python new-style format string +# used to format the message information. See doc for all details. +msg-template= + +# Set the output format. Available formats are: text, parseable, colorized, +# json2 (improved json format), json (old json format) and msvs (visual +# studio). You can also give a reporter class, e.g. +# mypackage.mymodule.MyReporterClass. +#output-format= + +# Tells whether to display a full report or only the messages. +reports=no + +# Activate the evaluation score. +score=yes + + +[SIMILARITIES] + +# Comments are removed from the similarity computation +ignore-comments=yes + +# Docstrings are removed from the similarity computation +ignore-docstrings=yes + +# Imports are removed from the similarity computation +ignore-imports=yes + +# Signatures are removed from the similarity computation +ignore-signatures=yes + +# Minimum lines number of a similarity. +min-similarity-lines=4 + + +[SPELLING] + +# Limits count of emitted suggestions for spelling mistakes. +max-spelling-suggestions=4 + +# Spelling dictionary name. No available dictionaries : You need to install +# both the python package and the system dependency for enchant to work. +spelling-dict= + +# List of comma separated words that should be considered directives if they +# appear at the beginning of a comment and should not be checked. +spelling-ignore-comment-directives=fmt: on,fmt: off,noqa:,noqa,nosec,isort:skip,mypy: + +# List of comma separated words that should not be checked. +spelling-ignore-words= + +# A path to a file that contains the private dictionary; one word per line. +spelling-private-dict-file= + +# Tells whether to store unknown words to the private dictionary (see the +# --spelling-private-dict-file option) instead of raising a message. +spelling-store-unknown-words=no + + +[STRING] + +# This flag controls whether inconsistent-quotes generates a warning when the +# character used as a quote delimiter is used inconsistently within a module. +check-quote-consistency=no + +# This flag controls whether the implicit-str-concat should generate a warning +# on implicit string concatenation in sequences defined over several lines. +check-str-concat-over-line-jumps=no + + +[TYPECHECK] + +# List of decorators that produce context managers, such as +# contextlib.contextmanager. Add to this list to register other decorators that +# produce valid context managers. +contextmanager-decorators=contextlib.contextmanager + +# List of members which are set dynamically and missed by pylint inference +# system, and so shouldn't trigger E1101 when accessed. Python regular +# expressions are accepted. +generated-members= + +# Tells whether to warn about missing members when the owner of the attribute +# is inferred to be None. +ignore-none=yes + +# This flag controls whether pylint should warn about no-member and similar +# checks whenever an opaque object is returned when inferring. The inference +# can return multiple potential results while evaluating a Python object, but +# some branches might not be evaluated, which results in partial inference. In +# that case, it might be useful to still emit no-member and other checks for +# the rest of the inferred objects. +ignore-on-opaque-inference=yes + +# List of symbolic message names to ignore for Mixin members. +ignored-checks-for-mixins=no-member, + not-async-context-manager, + not-context-manager, + attribute-defined-outside-init + +# List of class names for which member attributes should not be checked (useful +# for classes with dynamically set attributes). This supports the use of +# qualified names. +ignored-classes=optparse.Values,thread._local,_thread._local,argparse.Namespace + +# Show a hint with possible names when a member name was not found. The aspect +# of finding the hint is based on edit distance. +missing-member-hint=yes + +# The minimum edit distance a name should have in order to be considered a +# similar match for a missing member name. +missing-member-hint-distance=1 + +# The total number of similar names that should be taken in consideration when +# showing a hint for a missing member. +missing-member-max-choices=1 + +# Regex pattern to define which classes are considered mixins. +mixin-class-rgx=.*[Mm]ixin + +# List of decorators that change the signature of a decorated function. +signature-mutators= + + +[VARIABLES] + +# List of additional names supposed to be defined in builtins. Remember that +# you should avoid defining new builtins when possible. +additional-builtins= + +# Tells whether unused global variables should be treated as a violation. +allow-global-unused-variables=yes + +# List of names allowed to shadow builtins +allowed-redefined-builtins= + +# List of strings which can identify a callback function by name. A callback +# name must start or end with one of those strings. +callbacks=cb_, + _cb + +# A regular expression matching the name of dummy variables (i.e. expected to +# not be used). +dummy-variables-rgx=_+$|(_[a-zA-Z0-9_]*[a-zA-Z0-9]+?$)|dummy|^ignored_|^unused_ + +# Argument names that match this expression will be ignored. +ignored-argument-names=_.*|^ignored_|^unused_ + +# Tells whether we should check for unused import in __init__ files. +init-import=no + +# List of qualified module names which can have objects that can redefine +# builtins. +redefining-builtins-modules=six.moves,past.builtins,future.builtins,builtins,io diff --git a/pyproject.toml b/pyproject.toml new file mode 100644 index 0000000..f7a9aa2 --- /dev/null +++ b/pyproject.toml @@ -0,0 +1,27 @@ +[build-system] +requires = ["setuptools>=61", "wheel"] +build-backend = "setuptools.build_meta" + +[project] +name = "netbox-plugin-bind-provisioner" +dynamic = ["version"] +description = "A Bind provisioning plugin that uses netbox_dns for its data source" +authors = [ + { name = "Sven Luethi" }, +] +license = { text = "GPL-2.0" } +readme = "README.md" +requires-python = ">=3.7" +dependencies = ["netbox-plugin-dns"] + +[tool.setuptools] +include-package-data = true +zip-safe = false +package-dir = { "" = "src" } + +[tool.setuptools.packages.find] +where = ["src"] + +[tool.setuptools.dynamic] +version = { attr = "netbox_plugin_bind_provisioner.__version__" } + diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..fc920ff --- /dev/null +++ b/requirements.txt @@ -0,0 +1 @@ +netbox-plugin-dns>=1.2.0 diff --git a/src/netbox_plugin_bind_provisioner/__init__.py b/src/netbox_plugin_bind_provisioner/__init__.py new file mode 100644 index 0000000..c0922bd --- /dev/null +++ b/src/netbox_plugin_bind_provisioner/__init__.py @@ -0,0 +1,55 @@ +import logging +from netbox.plugins import PluginConfig +from django.db import models +from django.utils.translation import gettext_lazy as _ +from django.dispatch import receiver +from django.conf import settings + +__version__ = "0.9.2" + +logger = logging.getLogger(__name__) + +logging.basicConfig( + level=logging.DEBUG, # Log level (DEBUG, INFO, WARNING, ERROR, CRITICAL) + format="%(asctime)s [%(levelname)s] %(name)s: %(message)s", # Log format + datefmt="%Y-%m-%d %H:%M:%S", # Date format for timestamps +) + + +class BindProvisionerConfig(PluginConfig): + name = "netbox_bind_provisioner" + verbose_name = "Netbox Bind Provisioner" + description = "Provisions Zones to a Bind Server configured as hidden master" + version = __version__ + author = "Sven Luethi" + author_email = "sven.luethi@everyware.ch" + base_url = "bind_provisioner" + + def ready(self): + self.settings = settings.PLUGINS_CONFIG.get(self.name, None) + if not self.settings: + raise RuntimeError( + f"{self.name}: Plugin {self.verbose_name} failed to initialize due to missing settings. Terminating Netbox." + ) + + # from . import bind, rndc + # + # if not bind.zoneDirWritable(): + # BIND_ZONE_DIR = settings.get("BIND_ZONE_DIR") + # logger.error(f"Bind's zone file directory {BIND_ZONE_DIR} is not writable.") + # raise RuntimeError( + # "Plugin initialization failed due to failed writable-zone-directory healthcheck." + # ) + # if not rndc.tsigKeyFileAccessible(): + # RNDC_KEY_FILE = settings.get("RNDC_KEY_FILE") + # logger.error(f"The RNDC key file {RNDC_KEY_FILE} is inaccessible.") + # raise RuntimeError( + # "Plugin initialization failed due to failed rndc-key-accessible healthcheck." + # ) + # + # # Import signal callbacks from signals.py (With @receiver decorations) + # from . import signals + + +config = BindProvisionerConfig +default_app_config = ".apps.NetboxBindProvisionerConfig" diff --git a/src/netbox_plugin_bind_provisioner/management/commands/bind-transfer-endpoint.py b/src/netbox_plugin_bind_provisioner/management/commands/bind-transfer-endpoint.py new file mode 100644 index 0000000..f7ce1ab --- /dev/null +++ b/src/netbox_plugin_bind_provisioner/management/commands/bind-transfer-endpoint.py @@ -0,0 +1,688 @@ +import logging +import socketserver +import os +import threading +import dns.query +import dns.message +import dns.tsigkeyring +import dns.name +import dns.zone +import dns.rdatatype +import dns.rdataclass +import dns.rdtypes +import dns.exception +import dns.renderer + +# from hashlib import sha256 +from django.core.management.base import BaseCommand +from django.conf import settings +from django.utils import timezone +from netbox_dns.models import Zone, Record, View +from netbox_dns.choices import ZoneStatusChoices, RecordStatusChoices +from datetime import datetime + +logger = logging.getLogger('bind-transfer-endpoint') + +class CatalogZoneAssembler(): + lock = threading.Lock() + _serial_max = 0xFFFFFFFF + _serial = 1 + _serial_file = None + _previous_last_zone_update = None + + # Following function loads the last serial from file. No return value + # but it sets the setting "catalog_serial" or terminates the plugin on failure. + @classmethod + def initCatalogZoneSerial(cls, serial_file): + """ + Load a 32-bit unsigned int serial from a text file. + If the file doesn't exist, initialize it with 1. + Returns the serial as an int. + """ + cls._serial_file = serial_file + + if not os.path.exists(cls._serial_file): + try: + with open(cls._serial_file, "w") as f: + f.write(f"{cls._serial}\n") + return + except OSError as e: + raise RuntimeError( + f"Failed to initialize serial file {cls._serial_file}: {e}" + ) + else: + try: + with open(cls._serial_file, "r") as f: + value = int(f.read().strip()) + + if 0 < value <= cls._serial_max: + cls._serial = value + else: + raise ValueError(f"Serial value out of 32-bit range: {value}") + except (OSError, ValueError) as e: + raise RuntimeError(f"Failed to read serial from {cls._serial_file}: {e}") + + @classmethod + def incrementCatalogZoneSerial(cls): + """ + Increments the in-memory catalog serial and saves it to file. + Updates _serial. + """ + if 0 < cls._serial < cls._serial_max: + cls._serial += 1 + else: + logger.warn( + f"Failed to incremenet catalog serial {cls._serial}. Will overflow serial back to 1." + ) + cls._serial = 1 + + try: + with open(cls._serial_file, "w") as f: + f.write(f"{cls._serial}\n") + except OSError as e: + logger.error(f"Failed to write updated serial to {cls._serial_file}: {e}") + + @classmethod + def createCatalogZone(cls, view_name, soa_only=False): + # Synchronize following across threads as TCP and UDP listener both use it. + with cls.lock: + #cls = self.__class__ + #datestamp = datetime.now().strftime("%y%m%d") + #latest_zone = Zone.objects.filter().order_by("-last_updated").first() + latest_zone = Zone.objects.filter(status=ZoneStatusChoices.STATUS_ACTIVE).order_by('-last_updated').first() + + last_zone_update = getattr(latest_zone, 'last_updated', None) + + # Check if there was a zone updated since last call + # If no zone was found previously then this will be false since (None != None) = False + if cls._previous_last_zone_update != last_zone_update: + if last_zone_update is not None: + logger.debug( + f"Zone {latest_zone.name} was updated in view {latest_zone.view.name}" + ) + # Setting previous last zone update for next iteration: + cls._previous_last_zone_update = last_zone_update + cls.incrementCatalogZoneSerial() + # If there was no update, do nothing. + #else: + # logger.debug(f"No need to update serial for catalog zone") + + # Zone origin + origin = dns.name.from_text("catz", dns.name.root) + + # Create a new empty zone + zone = dns.zone.Zone(origin) + zone.rdclass = dns.rdataclass.IN + + # get zones from netbox + nb_zones = Zone.objects.filter( + view__name=view_name, status=ZoneStatusChoices.STATUS_ACTIVE + ) + + ptr_base = dns.name.from_text("zones", origin) + + for nb_zone in nb_zones: + ttl = nb_zone.soa_ttl + qname = dns.name.from_text(nb_zone.name, dns.name.root) + # zone_id = sha256(qname.to_text().encode()).hexdigest()[0:63] + zone_id = str(nb_zone.id) + + # Create PTR record + ptr_name = dns.name.from_text(zone_id, ptr_base) + assert ptr_name.is_subdomain(origin) + rdata = dns.rdata.from_text( + dns.rdataclass.IN, dns.rdatatype.PTR, qname.to_text() + ) + rdataset = zone.find_rdataset(ptr_name, dns.rdatatype.PTR, create=True) + rdataset.add(rdata, ttl) + + # Configure DNSSec Policy for member Zone if DNSSec is enabled + if nb_zone.dnssec_policy: + # Configure policy + rid = dns.name.from_text(f"policy.dnssec", ptr_name) + rdata = dns.rdata.from_text( + dns.rdataclass.IN, dns.rdatatype.TXT, nb_zone.dnssec_policy.name + ) + rdataset = zone.find_rdataset(rid, dns.rdatatype.TXT, create=True) + rdataset.add(rdata, ttl) + + # Configure dnssec status for member zone + status = str(1 if nb_zone.dnssec_policy else 0) + rid = dns.name.from_text(f"enabled.dnssec", ptr_name) + rdata = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.TXT, status) + rdataset = zone.find_rdataset(rid, dns.rdatatype.TXT, create=True) + rdataset.add(rdata, ttl) + + # SOA Record components + ttl = 3600 + rclass = dns.rdataclass.IN + rtype = dns.rdatatype.SOA + mname = dns.name.root # dns.name.from_text("invalid.", origin) + rname = dns.name.root # dns.name.from_text("contact.master.", origin) + serial = cls._serial + refresh = 60 + retry = 10 + expire = 1209600 + minimum = 86400 + + # Create SOA rdata object + soa_rdata = dns.rdata.from_text( + rclass, + rtype, + f"{mname} {rname} {serial} {refresh} {retry} {expire} {minimum}", + ) + + # Create Rdataset and add the RDATA to it + soa_rdataset = dns.rdataset.Rdataset(rclass, rtype) + soa_rdataset.add(soa_rdata, ttl) + + # Add to the origin node in the zone + node = zone.find_node(origin, create=True) + node.rdatasets.append(soa_rdataset) + + + # NS record for catz. + ns_name = dns.name.from_text("invalid", dns.name.root) + ns_rdata = dns.rdata.from_text( + dns.rdataclass.IN, dns.rdatatype.NS, str(ns_name) + ) + ns_rdataset = dns.rdataset.Rdataset(dns.rdataclass.IN, dns.rdatatype.NS) + ns_rdataset.add(ns_rdata, 86400) + + # Add to node (catz. is the origin) + ns_node = zone.find_node(origin, create=True) + ns_node.rdatasets.append(ns_rdataset) + + # TXT record for version.catz. + version_name = dns.name.from_text( + "version", origin + ) # relative to origin "catz." + txt_rdata = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.TXT, '"2"') + + txt_rdataset = dns.rdataset.Rdataset(dns.rdataclass.IN, dns.rdatatype.TXT) + txt_rdataset.add(txt_rdata, 86400) + + # Add to node version.catz. + txt_node = zone.find_node(version_name, create=True) + txt_node.rdatasets.append(txt_rdataset) + + return zone + + +class DNSBaseRequestHandler(socketserver.BaseRequestHandler): + # getZoneFromNB rewritten + def getZoneFromNB(self, zone_name, view_name, soa_only=False): + # Find the zone + try: + nb_zone = Zone.objects.get( + name=zone_name, view=view_name, status=ZoneStatusChoices.STATUS_ACTIVE + ) + except Zone.DoesNotExist: + return None + + # Build DNS zone + zone = dns.zone.Zone(zone_name, dns.name.root) + zone.rdclass = dns.rdataclass.IN + + nb_records = Record.objects.filter( + zone=nb_zone, status=RecordStatusChoices.STATUS_ACTIVE + ) + + rdatasets_dict = {} + + for record in nb_records: + rdtype = dns.rdatatype.from_text(record.type) + if not record.name: + name = zone.origin + elif record.name.endswith("."): + name = dns.name.from_text(record.name) + else: + name = dns.name.from_text(record.name, origin=zone.origin) + + # If the record has no TTL, use the zone default + ttl = record.ttl or nb_zone.default_ttl + + rdata = dns.rdata.from_text( + dns.rdataclass.IN, + rdtype, + record.value, + relativize=False, + origin=zone.origin, + ) + + # Initialize rdataset if it doesn't exist for this name and type + if name not in rdatasets_dict: + rdatasets_dict[name] = {} + if rdtype not in rdatasets_dict[name]: + rdatasets_dict[name][rdtype] = dns.rdataset.Rdataset(dns.rdataclass.IN, rdtype) + + # Add the rdata to the appropriate rdataset + rdatasets_dict[name][rdtype].add(rdata, ttl) + + # Now, add all rdatasets to the zone + for name, rdtypes in rdatasets_dict.items(): + for rdtype, rdataset in rdtypes.items(): + # Ensure rdataset has the same rdclass as the zone + if rdataset.rdclass != zone.rdclass: + raise ValueError(f"rdataset rdclass {rdataset.rdclass} does not match zone rdclass {zone.rdclass}") + + # Check if the rdataset has any rdata before creating an RRset + if not rdataset: + logger.debug(f"Skipping empty rdataset for {name} {rdtype}") + continue # Skip empty rdataset + + # Replace the rdataset for the given name and type + zone.replace_rdataset(name, rdataset) + + return zone + + + + def denyRequest(self, query, rcode: dns.rcode = dns.rcode.REFUSED): + response = dns.message.make_response(query) + response.set_rcode(rcode) + wire = response.to_wire(multi=False) + length = len(wire).to_bytes(2, byteorder="big") + self.request.sendall(length + wire) + + + def denyRequestBadTSIG(self, wire, tsig_error: dns.rcode): + # Use empty keyring to parse TSIG without validating + query = dns.message.from_wire(wire, keyring={}, ignore_trailing=True, continue_on_error=True) + + # Make a response + response = dns.message.make_response(query) + response.set_rcode(dns.rcode.REFUSED) + + if query.had_tsig: + # Add TSIG with BADKEY, but do not sign (no MAC) + response.use_tsig( + keyring={}, # empty; we're not signing + keyname=query.keyname, + tsig_error=tsig_error + ) + self.denyRequest(query) + + +class UDPRequestHandler(DNSBaseRequestHandler): + def handle(self): + data, sock = self.request + peer = self.client_address[0] + query = None + + try: + query = dns.message.from_wire( + data, + keyring=self.server.keyring, + continue_on_error=True, + ignore_trailing=True + ) + except Exception as e: + logger.error("Error parsing query:", e) + return + + # Create a response + response = dns.message.make_response(query) + + # Set the Authoritative Answer flag + response.flags |= dns.flags.AA + + question = query.question[0] + + # Get the queried record name and type: + qname = question.name + qtype = question.rdtype + dname = qname.to_text().rstrip(".") + + # Only process SOA queries + if qtype != dns.rdatatype.SOA: + logger.warning(f"Request denied from {peer}: Request was not SOA (Type: {qtype})") + self.denyRequest(query) + return + + # Identify TSIG key used + key_name = query.keyname.canonicalize().to_text() if query.keyname else None + if not key_name: + logger.warning(f"Request denied from {peer}: No TSIG key used") + self.denyRequest(query) + return + + # Check if key matches a view + nb_view = self.server.tsig_view_map.get(key_name) + if not nb_view: + logger.warning(f"Request denied from {peer}: {key_name} does not match a view") + self.denyRequestBadTSIG(wire, dns.rcode.BADKEY) + return + + # Check if catalog zone + if dname == "catz": + zone = CatalogZoneAssembler.createCatalogZone(nb_view.name, soa_only=True) + # If generic zone, retreive from NB + else: + zone = self.getZoneFromNB(dname, nb_view, soa_only=True) + # When zone was not found, let client know + if not zone: + logger.warning(f"Zone {nb_view.name}/{dname} not found in NB") + self.denyRequest(query) + return + + # Retrieve the existing SOA record from the Zone + soa_rdataset = zone.get_rdataset(zone.origin, dns.rdatatype.SOA) + + # We assume that the SOA rdataset has at least one record (it usually does). + soa_rdata = soa_rdataset[0] # Get the first SOA record + + # Now, create the rrset from the soa_rdata + #rrset = dns.rrset.from_rdata(dname, soa_rdataset.ttl, soa_rdata) + rrset = dns.rrset.from_rdata(zone.origin, soa_rdataset.ttl, soa_rdata) + + # Append the rrset to the response's answer section + response.answer.append(rrset) + + # TSIG response + if query.had_tsig: + # If key was found in DB + if query.keyname in self.server.keyring: + response.use_tsig(self.server.keyring, keyname=query.keyname, original_id=query.id) + else: + # If key is unknown + response.set_rcode(dns.rcode.REFUSED) + # Generate new key for keyname provided + #keyname = query.keyname + #b64 = base64.b64encode(urandom(32)).decode("ascii") + #newkey = dns.tsigkeyring.from_text({ keyname: b64 }) + response.use_tsig(self.server.keyring, keyname=query.keyname, tsig_error=dns.rcode.BADKEY) + + # Send back the response + response_wire = response.to_wire(max_size=512) + sock.sendto(response_wire, self.client_address) + logger.debug(f"{peer} SOA {nb_view.name}/{dname}") + + +class TCPRequestHandler(DNSBaseRequestHandler): + def handle(self): + MAX_WIRE = 65535 + # MAX_WIRE = 2000 # For testing fragmentation + RESERVED_TSIG = 300 + # create a var for setting the client ip in log messages + peer = self.client_address[0] + + try: + # Receive the entire message.... + sock = self.request # TCP socket + # Read 2-byte length prefix + length_data = sock.recv(2) + if len(length_data) < 2: + return + length = int.from_bytes(length_data, byteorder="big") + wire = b"" + while len(wire) < length: + chunk = sock.recv(length - len(wire)) + if not chunk: + return # connection closed + wire += chunk + + # Parse the query + query = None + try: + query = dns.message.from_wire(wire, keyring=self.server.keyring) + # If TSIG signature doesnt match our key, refuse query: + except dns.tsig.BadSignature as e: + logger.warning(f"Request denied from {peer} failed TSIG verification: {e}") + self.denyRequestBadTSIG(wire, dns.rcode.BADSIG) + return + # If TSIG Key used is not in our list, refuse query: + except dns.message.UnknownTSIGKey as e: + logger.warning(f"Request denied from {peer} with bad TSIG key: {e}") + self.denyRequestBadTSIG(wire, dns.rcode.BADKEY) + return + + # If there was no question in the query, refuse + if len(query.question) != 1: + self.denyRequest(query) + return + + # Get the queried record name and type: + qname = query.question[0].name + qtype = query.question[0].rdtype + + dname = qname.to_text().rstrip(".") + + # Only process AXFR queries + if qtype != dns.rdatatype.AXFR: + #if qtype != dns.rdatatype.AXFR or qtype != dns.rdatatype.SOA: + logger.warning(f"Request denied from {peer}: Request was not AXFR (Type: {qtype})") + self.denyRequest(query) + return + + # Identify TSIG key used + key_name = query.keyname.canonicalize().to_text() if query.keyname else None + if not key_name: + logger.warning(f"Request denied from {peer}: No TSIG key used") + self.denyRequest(query) + return + + # Check if the key matches a view + nb_view = self.server.tsig_view_map.get(key_name) + if not nb_view: + logger.warning(f"Request denied from {peer}: {key_name} does not match a view") + self.denyRequest(query) + return + + # Check if catalog zone + if dname == "catz": + #zone = self.createCatalogZone(str(nb_view)) + zone = CatalogZoneAssembler.createCatalogZone(nb_view.name) + else: + zone = self.getZoneFromNB(dname, nb_view) + + # When zone was not found, let client know + if not zone: + logger.warning(f"Zone {dname} not found in view {nb_view.name}") + self.denyRequest(query) + return + + # 1. Prepare SOA + RRsets (identical to your code) + soa_rrset = None + rrsets = [] + for name, rdataset in zone.iterate_rdatasets(): + if not name.is_absolute(): + name = name.concatenate(zone.origin) + rrset = dns.rrset.from_rdata_list(name, rdataset.ttl, rdataset) + if rdataset.rdtype == dns.rdatatype.SOA and soa_rrset is None: + soa_rrset = rrset + else: + rrsets.append(rrset) + + if soa_rrset is None: + logger.error(f"Zone {dname} has no SOA — aborting AXFR") + return + + rrsets.insert(0, soa_rrset) # Opening SOA + rrsets.append(soa_rrset) # Closing SOA + + # 2. Create a Renderer for the first message + r = dns.renderer.Renderer( + id=query.id, flags=(dns.flags.QR | dns.flags.AA), max_size=MAX_WIRE, origin=None + ) + r.add_question( + query.question[0].name, + query.question[0].rdtype, + query.question[0].rdclass, + ) + + # 3. Loop through RRsets + tsig_ctx = None + for rrset in rrsets: + # logger.debug(f"Iterating over rrset {rrset}. tsig_ctx: {tsig_ctx}") + try: + # logger.debug(f"Adding {rrset} to renderer object") + r.add_rrset(dns.renderer.ANSWER, rrset) + if r.max_size - len(r.output.getvalue()) < RESERVED_TSIG: + raise dns.exception.TooBig("TSIG wont fit") + except dns.exception.TooBig: + # TSIG chain previous message + r.write_header() + tsig_ctx = r.add_multi_tsig( + ctx=tsig_ctx, + secret=self.server.keyring[query.keyname], + keyname=query.keyname, + fudge=300, + id=query.id, + tsig_error=0, + other_data=b"", + request_mac=r.mac if tsig_ctx else query.mac, + ) + wire = r.get_wire() + self.request.sendall(len(wire).to_bytes(2, "big") + wire) + + # Start new renderer + r = dns.renderer.Renderer( + id=query.id, flags=(dns.flags.QR | dns.flags.AA), max_size=MAX_WIRE, origin=None + ) + r.add_question( + query.question[0].name, + query.question[0].rdtype, + query.question[0].rdclass, + ) + r.add_rrset(dns.renderer.ANSWER, rrset) + + # 4. Final message with terminating TSIG + r.write_header() + # logger.debug(f"Final message. tsig_ctx: {tsig_ctx}") + tsig_ctx = r.add_multi_tsig( + ctx=tsig_ctx, + secret=self.server.keyring[query.keyname], + keyname=query.keyname, + fudge=300, + id=query.id, + tsig_error=0, + other_data=b"", + # request_mac=r.mac if tsig_ctx else None, + request_mac=r.mac if tsig_ctx else query.mac, + ) + wire = r.get_wire() + self.request.sendall(len(wire).to_bytes(2, "big") + wire) + + #logger.debug(f"Zone transfer request for {nb_view.name}/{dname} from {peer}") + logger.debug(f"{peer} AXFR {nb_view.name}/{dname}") + + except Exception as e: + logger.error(f"Error handling request from {peer}: {e}") + import traceback + traceback.print_exc() + + + +class TCPDNSServer(socketserver.TCPServer): + allow_reuse_address = True + + def __init__(self, server_address, handler_class, keyring, tsig_view_map): + super().__init__(server_address, handler_class) + self.keyring = keyring + self.tsig_view_map = tsig_view_map + + + +class UDPDNSServer(socketserver.UDPServer): + allow_reuse_address = True + + def __init__(self, server_address, handler_class, keyring, tsig_view_map): + super().__init__(server_address, handler_class) + self.keyring = keyring + self.tsig_view_map = tsig_view_map + + + +class Command(BaseCommand): + help = "Run a minimal AXFR DNS server using NetBox DNS plugin data" + + def loadSettings(self): + self.settings = settings.PLUGINS_CONFIG.get("netbox_bind_provisioner", None) + if not self.settings: + raise RuntimeError( + "Command failed to initialize due to missing settings. Terminating Netbox." + ) + + self.tsig_keys = self.settings.get("tsig_keys", None) + if not self.tsig_keys: + raise RuntimeError( + "tsig_keys variable not set in plugin settings." + ) + + def loadCatalogZoneSettings(self): + serial_file = self.settings.get("catalog_serial_file", None) + if not serial_file: + raise RuntimeError( + "catalog_serial_file variable not set in plugin settings." + ) + else: + CatalogZoneAssembler.initCatalogZoneSerial(serial_file) + + def loadTSIGKeySettings(self): + # Load TSIG keys and map them to views + self.keyring = {} + self.tsig_view_map = {} + + for view_name, data in self.tsig_keys.items(): + raw_key_name = data.get("keyname") + secret = data.get("secret") + algorithm_str = data.get("algorithm", "hmac-sha256") + + if not raw_key_name or not secret: + logger.error( + f"Skipping TSIG key for view {view_name}: missing keyname or secret." + ) + continue + + try: + nb_view = View.objects.get(name=view_name) + except View.DoesNotExist: + logger.error( + f"Skipping TSIG key {raw_key_name}: view '{view_name}' not found." + ) + continue + + # Normalize key name to absolute DNS name + key_name_obj = dns.name.from_text(raw_key_name, origin=None).canonicalize() + if not key_name_obj.is_absolute(): + key_name_obj = key_name_obj.concatenate(dns.name.root) + key_name_str = key_name_obj.to_text() # Will always include trailing do + + self.keyring[key_name_obj] = dns.tsig.Key( + name=key_name_obj, secret=secret, algorithm=algorithm_str + ) + self.tsig_view_map[key_name_str] = nb_view + logger.debug(f"Loaded TSIG key: {key_name_str} (view: {nb_view.name})") + + if not self.keyring: + msg = "No TSIG keys found in database." + logger.critical(msg) + raise RuntimeError(msg) + + def add_arguments(self, parser): + parser.add_argument('--port', type=int, default=5354, help='Port number to listen on') + parser.add_argument('--address', type=str, default="0.0.0.0", help='IP to bind to') + + def handle(self, *args, **options): + # Load parameters + port = options['port'] + address = options['address'] + # Initialize settings + self.loadSettings() + self.loadCatalogZoneSettings() + self.loadTSIGKeySettings() + + udp_server = UDPDNSServer((address, port), UDPRequestHandler, self.keyring, self.tsig_view_map) + tcp_server = TCPDNSServer((address, port), TCPRequestHandler, self.keyring, self.tsig_view_map) + + def run_udp_server(server): + logger.debug(f"SOA endpoint listening on {address} udp/{port}") + server.serve_forever() + + udp_thread = threading.Thread(target=run_udp_server, args=(udp_server,), daemon=True) + udp_thread.start() + + logger.debug(f"AXFR endpoint listening on {address} tcp/{port}") + tcp_server.serve_forever() +