Skip to content

Commit 0498958

Browse files
author
A. Täffner
committed
addad update. Currently nothing is working :p
Supposed behaviour just committing to have a point to roll back ICoE
1 parent 01be2e6 commit 0498958

File tree

1 file changed

+61
-17
lines changed

1 file changed

+61
-17
lines changed

‎server/plugins-available/bind_plugin.inc.php‎

Lines changed: 61 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -76,8 +76,8 @@ function onLoad() {
7676

7777
}
7878

79-
//* This creates DNSSEC-Keys but does NOT actually sign the zone.
80-
function soa_dnssec_create(&$data) {
79+
//* This creates DNSSEC-Keys and calls soa_dnssec_update.
80+
function soa_dnssec_create($data) {
8181
global $app, $conf;
8282

8383
//* Load libraries
@@ -86,35 +86,79 @@ function soa_dnssec_create(&$data) {
8686
//* load the server configuration options
8787
$dns_config = $app->getconf->get_server_config($conf["server_id"], 'dns');
8888

89+
$domain = substr($data['new']['origin'], 0, strlen($data['new']['origin'])-1);
90+
if (!file_exists($dns_config['bind_zonefiles_dir'].'/'.$domain)) return false;
91+
8992
//* Check Entropy
9093
if (file_get_contents('/proc/sys/kernel/random/entropy_avail') < 400) {
91-
if($dns_config['disable_bind_log'] === 'y') {
92-
$app->log('DNSSEC ERROR: We are low on entropy. Not generating new Keys for '.$data['new']['origin'].'. Please consider installing package haveged.', LOGLEVEL_DEBUG);
93-
} else {
94-
$app->log('DNSSEC ERROR: We are low on entropy. Not generating new Keys for '.$data['new']['origin'].'. Please consider installing package haveged.', LOGLEVEL_WARN);
95-
}
94+
$app->log('DNSSEC ERROR: We are low on entropy. Not generating new Keys for '.$domain.'. Please consider installing package haveged.', LOGLEVEL_WARN);
9695
return false;
9796
}
9897

9998
//* Verify that we do not already have keys (overwriting-protection)
10099
//TODO : change this when distribution information has been integrated into server record
101-
if (file_exists($dns_config['bind_zonefiles_dir'].'/dsset-'.$data['new']['origin'].'.')) {
100+
if (file_exists($dns_config['bind_zonefiles_dir'].'/dsset-'.$domain.'.')) {
102101
return $this->soa_dnssec_update($data);
103102
}
104103

105104
//Do some magic...
106-
exec('cd '.escapeshellargs($dns_config['bind_zonefiles_dir']).';'.
107-
'dnssec-keygen -a NSEC3RSASHA1 -b 2048 -n ZONE '.escapeshellargs($data['new']['origin']).';'.
108-
'dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE '.escapeshellargs($data['new']['origin']));
105+
exec('cd '.escapeshellcmd($dns_config['bind_zonefiles_dir']).';'.
106+
'/usr/sbin/dnssec-keygen -a NSEC3RSASHA1 -b 2048 -n ZONE '.escapeshellcmd($domain).';'.
107+
'/usr/sbin/dnssec-keygen -f KSK -a NSEC3RSASHA1 -b 4096 -n ZONE '.escapeshellcmd($domain));
108+
109+
$this->soa_dnssec_update($data, true); //Now sign the zone
110+
111+
$dnssecdata = "DS-Records:\n".file_get_contents($dns_config['bind_zonefiles_dir'].'/dsset-'.$domain.'.');
112+
opendir($dns_config['bind_zonefiles_dir']);
113+
$dnssecdata .= "\n------------------------------------\n\nDNSKEY-Records:\n";
114+
foreach (glob('K'.$domain.'*.key') as $keyfile) {
115+
$dnssecdata .= file_get_contents($keyfile)."\n\n";
116+
}
117+
118+
$app->db->query('UPDATE dns_soa SET dnssec_info=\''.$dnssecdata.'\' WHERE id='.$data['new']['id']);
119+
}
120+
121+
function soa_dnssec_update($data, $new=false) {
122+
global $app, $conf;
123+
124+
//* Load libraries
125+
$app->uses("getconf,tpl");
126+
127+
$domain = substr($data['new']['origin'], 0, strlen($data['new']['origin'])-1);
128+
if (!file_exists($dns_config['bind_zonefiles_dir'].'/'.$domain)) return false;
129+
130+
//* load the server configuration options
131+
$dns_config = $app->getconf->get_server_config($conf["server_id"], 'dns');
132+
133+
//* Check Entropy
134+
if (file_get_contents('/proc/sys/kernel/random/entropy_avail') < 200) {
135+
$app->log('DNSSEC ERROR: We are low on entropy. This could cause server script to fail. Please consider installing package haveged.', LOGLEVEL_ERR);
136+
return false;
137+
}
138+
139+
if (!$new && !file_exists($dns_config['bind_zonefiles_dir'].'/dsset-'.$domain.'.')) return $this->soa_dnssec_create($data);
140+
141+
//TODO : change this when distribution information has been integrated into server record
142+
$filespre = (file_exists('/etc/gentoo-release')) ? 'pri/' : 'pri.';
143+
144+
$dbdata = $app->db->queryOneRecord('SELECT id,serial FROM dns_soa WHERE id='.$data['new']['id']);
145+
$newserial = exec('cd '.escapeshellcmd($dns_config['bind_zonefiles_dir']).';'.
146+
'/usr/sbin/named-checkzone '.escapeshellcmd($domain).' '.escapeshellcmd($dns_config['bind_zonefiles_dir']).'/'.$filespre.escapeshellcmd($domain).' | egrep -ho \'[0-9]{10}\'');
109147

110-
$dnssecdata = "DS-Records:\n\r".file_get_contents($dns_config['bind_zonefiles_dir'].'/dsset-'.$data['new']['origin'].'.');
111148
opendir($dns_config['bind_zonefiles_dir']);
112-
$dnssecdata .= "\n\r------------------------------------\n\r\n\rDNSKEY-Records:\n\r";
113-
foreach (glob('K'.$data['new']['origin'].'*.key') as $keyfile) {
114-
$dnssecdata .= file_get_contents($keyfile)."\n\r\n\r";
149+
$includeline=array();
150+
$zonefile = file_get_contents(escapeshellcmd($dns_config['bind_zonefiles_dir']).'/'.$filespre.escapeshellcmd($domain));
151+
$keycount=0;
152+
foreach (glob('K'.$domain.'*.key') as $keyfile) {
153+
$includeline = '$INCLUDE '.$keyfile;
154+
if (!preg_match('/'.$line.'/', $zonefile)) $zonefile .= "\n".$includeline."\n";
155+
$keycount++;
115156
}
157+
if ($keycount > 2) $app->log('DNSSEC Warning: There are more than 2 keyfiles for zone '.$domain, LOGLEVEL_WARN);
158+
file_put_contents($dns_config['bind_zonefiles_dir'].'/'.$filespre.$domain, $zonefile);
116159

117-
$app->db->datalogUpdate('dns_soa', array('dnssec_info' => $dnssecdata), 'id', $data['new']['id']);
160+
exec('cd '.escapeshellcmd($dns_config['bind_zonefiles_dir']).';'.
161+
'/usr/sbin/dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) -N increment -o '.escapeshellcmd($domain).' -t '.$filespre.escapeshellcmd($domain));
118162
}
119163

120164
function soa_insert($event_name, $data) {
@@ -201,7 +245,7 @@ function soa_update($event_name, $data) {
201245
$filename = $dns_config['bind_zonefiles_dir'].'/pri.'.str_replace("/", "_", substr($data['old']['origin'], 0, -1));
202246
}
203247
if(is_file($filename.'.signed')) unlink($filename.'.signed');
204-
} else if ($data['new']['dnssec_wanted'] == 'Y') exec('/usr/local/ispconfig/server/scripts/dnssec-update.sh '.escapeshellcmd($data['new']['origin']));
248+
} else if ($data['new']['dnssec_wanted'] == 'Y') $this->soa_dnssec_update($data);
205249
// END DNSSEC
206250

207251
//* rebuild the named.conf file if the origin has changed or when the origin is inserted.

0 commit comments

Comments
 (0)