Merge branch 'master' into dns-status

Conflicts:
	install/sql/incremental/upd_dev_collection.sql
	server/plugins-available/bind_plugin.inc.php

Author: A. Täffner

TODO.txt

@@ -13,6 +13,9 @@ Installer
 --------------------------------------
 
 - Add a function to let a server join a existing installation.
+- Add Package haveged to requirements (at least if entropy is low) as it raises available entropy significantly which is very needed for DNSSEC Key-generation
+	If it is not installed and entropy is low generating dnssec-keys lasts minutes (and would time out the server thus is not done) and new signing keys are not generated.
+	If there are no keys the zones can not be signed and will only be availableas a unsigned copy.
 
 Uninstaller
 --------------------------------------
@@ -26,13 +29,6 @@ Server
 Mail module
 --------------------------------------
 
-- Show mail statistics in the interface. The mail statistics are stored
-  in the database table mail_traffic and are collected by the file
-  server/cron_daily.php
--- For Courier this works but not Dovecot. Maybe the intention needs
-	reviewed as some clients think this should be the number of emails
-	and not the size of the emails.  (I agree that size is important)
-		lathama
 
 Administration module
 --------------------------------------
@@ -87,6 +83,7 @@ Remoting framework
 Interface
 --------------------------------------
 - Enhance the paging in lists (e.g. like this: [1 2 3 4 ... 10])
+- DNS: Add Checkbox to switch dnssec_wanted between Y and N to templates and/or wizard. I recommend doing it in the wizard though.
 
 General tasks
 --------------------------------------

install/dist/conf/centos70.conf.php

@@ -144,7 +144,7 @@
 
 //* Amavisd
 $conf['amavis']['installed'] = false; // will be detected automatically during installation
-$conf['amavis']['config_dir'] = '/etc';
+$conf['amavis']['config_dir'] = '/etc/amavisd';
 $conf['amavis']['init_script'] = 'amavisd';
 
 //* ClamAV

install/lib/installer_base.lib.php

@@ -1469,6 +1469,27 @@ public function configure_powerdns() {
 
 
 	}
+	
+	//** writes bind configuration files
+	public function process_bind_file($configfile, $target='/', $absolute=false) {
+		global $conf;
+
+		if ($absolute) $full_file_name = $target.$configfile;
+		else $full_file_name = $conf['ispconfig_install_dir'].$target.$configfile;
+		
+		//* Backup exiting file
+		if(is_file($full_file_name)) {
+			copy($full_file_name, $config_dir.$configfile.'~');
+		}
+		$content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/'.$configfile.'.master', 'tpl/'.$configfile.'.master');
+		$content = str_replace('{mysql_server_ispconfig_user}', $conf['mysql']['ispconfig_user'], $content);
+		$content = str_replace('{mysql_server_ispconfig_password}', $conf['mysql']['ispconfig_password'], $content);
+		$content = str_replace('{mysql_server_ispconfig_database}', $conf['mysql']['database'], $content);
+		$content = str_replace('{mysql_server_ip}', $conf['mysql']['ip'], $content);
+		$content = str_replace('{ispconfig_install_dir}', $conf['ispconfig_install_dir'], $content);
+		$content = str_replace('{dnssec_conffile}', $conf['ispconfig_install_dir'].'/server/scripts/dnssec-config.sh', $content);
+		wf($full_file_name, $content);
+	}
 
 	public function configure_bind() {
 		global $conf;
@@ -1481,13 +1502,15 @@ public function configure_bind() {
 
 		//* Create the slave subdirectory
 		$content .= 'slave';
-		if(!@is_dir($content)) mkdir($content, 2770, true);
+		if(!@is_dir($content)) mkdir($content, 02770, true);
 
 		//* Chown the slave subdirectory to $conf['bind']['bind_user']
 		chown($content, $conf['bind']['bind_user']);
 		chgrp($content, $conf['bind']['bind_group']);
-		chmod($content, 2770);
-
+		chmod($content, 02770);
+		
+		//* Install scripts for dnssec implementation
+		$this->process_bind_file('named.conf.options', '/etc/bind/', true); //TODO replace hardcoded path
 	}
 
 
@@ -2822,4 +2845,4 @@ protected function insert_db_credentials($tContents) {
 
 }
 
-?>
+?>

install/sql/incremental/upd_dev_collection.sql

@@ -204,5 +204,15 @@ CREATE TABLE `ftp_traffic` (
 ALTER TABLE `mail_forwarding` ADD COLUMN `allow_send_as` ENUM('n','y') NOT NULL DEFAULT 'n' AFTER `active`;
 UPDATE `mail_forwarding` SET `allow_send_as` = 'y' WHERE `type` = 'alias';
 
+--- DNSSEC-Implementation by dark alex
+--- TODO: Review and resolve conflicts if more has been done in that column
+ALTER TABLE `dns_rr` CHANGE COLUMN `type` `type` ENUM('A','AAAA','ALIAS','CNAME','DS','HINFO','LOC','MX','NAPTR','NS','PTR','RP','SRV','TXT','TLSA','DNSKEY') NULL DEFAULT NULL AFTER `name`;
+
+ALTER TABLE `dns_soa`
+	ADD COLUMN `dnssec_initialized` ENUM('Y','N') NOT NULL DEFAULT 'N',
+	ADD COLUMN `dnssec_wanted` ENUM('Y','N') NOT NULL DEFAULT 'N',
+	ADD COLUMN `dnssec_last_signed` BIGINT NOT NULL DEFAULT '0',
+	ADD COLUMN `dnssec_info` TEXT NULL;
+
 ALTER TABLE `dns_soa` ADD COLUMN `status` enum('OK','ERROR','PENDING') NOT NULL DEFAULT 'OK' AFTER `active`;
 ALTER TABLE `dns_soa` ADD COLUMN `status_txt` text AFTER `status`;

install/sql/ispconfig3.sql

@@ -478,7 +478,7 @@ CREATE TABLE `dns_rr` (
   `server_id` int(11) NOT NULL default '1',
   `zone` int(11) unsigned NOT NULL DEFAULT '0',
   `name` varchar(255) NOT NULL DEFAULT '',
-  `type` enum('A','AAAA','ALIAS','CNAME','HINFO','MX','NAPTR','NS','PTR','RP','SRV','TXT') default NULL,
+  `type` enum('A','AAAA','ALIAS','CNAME','DS','HINFO','LOC','MX','NAPTR','NS','PTR','RP','SRV','TXT','TLSA','DNSKEY') default NULL,
   `data` TEXT NOT NULL DEFAULT '',
   `aux` int(11) unsigned NOT NULL default '0',
   `ttl` int(11) unsigned NOT NULL default '3600',
@@ -541,6 +541,10 @@ CREATE TABLE `dns_soa` (
   `xfer` varchar(255) NOT NULL DEFAULT '',
   `also_notify` varchar(255) default NULL,
   `update_acl` varchar(255) default NULL,
+  `dnssec_initialized` ENUM('Y','N') NOT NULL DEFAULT 'N',
+  `dnssec_wanted` ENUM('Y','N') NOT NULL DEFAULT 'N',
+  `dnssec_last_signed` BIGINT NOT NULL DEFAULT '0',
+  `dnssec_info` TEXT NULL,
   PRIMARY KEY  (`id`),
   UNIQUE KEY `origin` (`origin`),
   KEY `active` (`active`)

install/tpl/named.conf.options.master

@@ -0,0 +1,28 @@
+options {
+	directory "/var/cache/bind";
+
+	// If there is a firewall between you and nameservers you want
+	// to talk to, you may need to fix the firewall to allow multiple
+	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+	// If your ISP provided one or more IP addresses for stable 
+	// nameservers, you probably want to use them as forwarders.  
+	// Uncomment the following block, and insert the addresses replacing 
+	// the all-0's placeholder.
+
+	// forwarders {
+	// 	0.0.0.0;
+	// };
+
+	//========================================================================
+	// If BIND logs error messages about the root key being expired,
+	// you will need to update your keys.  See https://www.isc.org/bind-keys
+	//========================================================================
+	dnssec-enable yes;
+	dnssec-validation yes;
+	dnssec-lookaside auto;
+
+	auth-nxdomain no;    # conform to RFC1035
+	listen-on-v6 { any; };
+};
+

interface/lib/classes/tform_base.inc.php

@@ -974,16 +974,21 @@ function validateField($field_name, $field_value, $validators) {
 					}
 				}
 			case 'ISEMAIL':
-				if(function_exists('filter_var')) {
-					if(filter_var($field_value, FILTER_VALIDATE_EMAIL) === false) {
-						$errmsg = $validator['errmsg'];
-						if(isset($this->wordbook[$errmsg])) {
-							$this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
-						} else {
-							$this->errorMessage .= $errmsg."<br />\r\n";
+				if($validator['allowempty'] != 'y') $validator['allowempty'] = 'n';
+				if($validator['allowempty'] == 'y' && $field_value == '') {
+					//* Do nothing
+				} else {
+					if(function_exists('filter_var')) {
+						if(filter_var($field_value, FILTER_VALIDATE_EMAIL) === false) {
+							$errmsg = $validator['errmsg'];
+							if(isset($this->wordbook[$errmsg])) {
+								$this->errorMessage .= $this->wordbook[$errmsg]."<br />\r\n";
+							} else {
+								$this->errorMessage .= $errmsg."<br />\r\n";
+							}
 						}
-					}
-				} else $this->errorMessage .= "function filter_var missing <br />\r\n";
+					} else $this->errorMessage .= "function filter_var missing <br />\r\n";
+				}
 				break;
 			case 'ISINT':
 				if(function_exists('filter_var') && $field_value < 2147483647) {

interface/web/client/form/client.tform.php

@@ -501,7 +501,7 @@
 					'type' => 'TOLOWER')
 			),
 			'validators' => array (
-				0 => array ( 'type' => 'ISEMAIL', 'errmsg'=> 'email_error_isemail'),
+				0 => array ( 'type' => 'ISEMAIL', 'allowempty' => 'y', 'errmsg'=> 'email_error_isemail'),
 			),
 			'default' => '',
 			'value'  => '',

interface/web/client/form/reseller.tform.php

@@ -499,7 +499,7 @@
 					'type' => 'TOLOWER')
 			),
 			'validators' => array (
-				0 => array ( 'type' => 'ISEMAIL', 'errmsg'=> 'paypal_email_error_isemail'),
+				0 => array ( 'type' => 'ISEMAIL', 'allowempty' => 'y', 'errmsg'=> 'paypal_email_error_isemail'),
 			),
 			'default' => '',
 			'value'  => '',

interface/web/dns/dns_ds_edit.php

@@ -0,0 +1,53 @@
+<?php
+
+/*
+Copyright (c) 2007, Till Brehm, projektfarm Gmbh
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright notice,
+      this list of conditions and the following disclaimer in the documentation
+      and/or other materials provided with the distribution.
+    * Neither the name of ISPConfig nor the names of its contributors
+      may be used to endorse or promote products derived from this software without
+      specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+/******************************************
+* Begin Form configuration
+******************************************/
+
+$tform_def_file = "form/dns_ds.tform.php";
+
+/******************************************
+* End Form configuration
+******************************************/
+
+require_once '../../lib/config.inc.php';
+require_once '../../lib/app.inc.php';
+require_once './dns_edit_base.php';
+
+// Loading classes
+class page_action extends dns_page_action {
+
+}
+
+$page = new page_action;
+$page->onLoad();
+
+?>