mirror/stackexchange-dnscontrol
1
0
Fork 0
mirror of https://github.com/StackExchange/dnscontrol.git synced 2024-05-11 05:55:12 +00:00
Code Issues Releases Activity

BIND: Implement AutoDNSSEC (#648)

Browse Source 
There's a philosophy issue here around what is the Bind output meant to
do.  Since AFAIK we're not integrating into Bind's catalog zones or the
like, we're just targeting the zonefiles, we're not in a position to do
_anything_ relating to registrar options such as setting up DS glue.

So at one level, enabling AutoDNSSEC for Bind is a lie. But without
this, folks can't target a Bind zone as a secondary provider for their
domain, to get debug dumps of the zone output, because the checks for
"Can" block it.  So I think this commit achieves a happy compromise: we
write a comment into the Bind zonefile, indicating that DNSSEC was
requested.

Actually: we add support for arbitrary zone comments to be written into
a zonefile via a slightly ugly "can be `nil`" parameter.  We then write
in a generation timestamp comment, and if AutoDNSSEC was requested we
then write that in too.
This commit is contained in:
Phil Pennock
2020-02-22 13:27:24 -05:00
committed by GitHub
parent 7384743f6d
commit 3c41a39252
6 changed files with 41 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
providers/bind/bindProvider.go
View File

@ -3,7 +3,7 @@ package bind
/*
bind -
Generate zonefiles suitiable for BIND.
Generate zonefiles suitable for BIND.
The zonefiles are read and written to the directory -bind_dir
@ -21,6 +21,7 @@ import (
"os"
"path/filepath"
"strings"
"time"
"github.com/miekg/dns"
@ -38,6 +39,7 @@ var features = providers.DocumentationNotes{
providers.CanUseSSHFP: providers.Can(),
providers.CanUseTLSA: providers.Can(),
providers.CanUseTXTMulti: providers.Can(),
providers.CanAutoDNSSEC: providers.Can("Just writes out a comment indicating DNSSEC was requested"),
providers.CantUseNOPURGE: providers.Cannot(),
providers.DocCreateDomains: providers.Can("Driver just maintains list of zone files. It should automatically add missing ones."),
providers.DocDualHost: providers.Can(),
@ -214,10 +216,19 @@ func (c *Bind) GetDomainCorrections(dc *models.DomainConfig) ([]*models.Correcti
// foundDiffRecords < foundRecords
// diff.Inc...(foundDiffRecords, expectedDiffRecords )
comments := make([]string, 0, 5)
comments = append(comments,
fmt.Sprintf("generated with dnscontrol %s", time.Now().Format(time.RFC3339)),
)
foundRecords, err := c.GetZoneRecords(dc.Name)
if err != nil {
return nil, err
}
if dc.AutoDNSSEC {
comments = append(comments, "Automatic DNSSEC signing requested")
}
// Normalize
models.PostProcessRecords(foundRecords)
@ -262,7 +273,10 @@ func (c *Bind) GetDomainCorrections(dc *models.DomainConfig) ([]*models.Correcti
if err != nil {
log.Fatalf("Could not create zonefile: %v", err)
}
err = prettyzone.WriteZoneFileRC(zf, dc.Records, dc.Name)
// Beware that if there are any fake types, then they will
// be commented out on write, but we don't reverse that when
// reading, so there will be a diff on every invocation.
err = prettyzone.WriteZoneFileRC(zf, dc.Records, dc.Name, comments)
if err != nil {
log.Fatalf("WriteZoneFile error: %v\n", err)