From 2247f7262ef1fe79b114e2ede10d022ba481e6f4 Mon Sep 17 00:00:00 2001 From: jeffrey forman Date: Sun, 17 Mar 2019 20:36:28 -0400 Subject: [PATCH] add main functionality for NSD in models. update the encrypt (save) and decrypt functions to be python3/dnspython friendly using bytestrings instead of expecting strings. statistic_port is now control_port. removed the validations from admin.py because the model fields now provide for validators of their data. add creds dir to the settings.py --- binder/admin.py | 21 +------ binder/migrations/0001_initial.py | 12 ++-- binder/models.py | 101 ++++++++++++++++++++++-------- binder/settings.py | 6 ++ 4 files changed, 90 insertions(+), 50 deletions(-) diff --git a/binder/admin.py b/binder/admin.py index 51c2b2a..f8829c7 100644 --- a/binder/admin.py +++ b/binder/admin.py @@ -5,27 +5,8 @@ from django.contrib import admin from django.forms import ModelForm, ValidationError -class BindServerAdminForm(ModelForm): - def clean_statistics_port(self): - port = self.cleaned_data["statistics_port"] - if port < 1 or port > 65535: - raise ValidationError("Invalid port number %(port)s. Please enter " - "a valid one between 1 and 65535.", - params={'port': port}) - return self.cleaned_data["statistics_port"] - - def clean_dns_port(self): - port = self.cleaned_data["dns_port"] - if port < 1 or port > 65535: - raise ValidationError("Invalid port number %(port)s. Please enter " - "a valid one between 1 and 65535.", - params={'port': port}) - return self.cleaned_data["dns_port"] - - class BindServerAdmin(admin.ModelAdmin): - form = BindServerAdminForm - list_display = ['hostname', 'statistics_port', 'default_transfer_key'] + list_display = ['hostname', 'server_type', 'control_port', 'default_transfer_key'] class KeyAdminForm(ModelForm): diff --git a/binder/migrations/0001_initial.py b/binder/migrations/0001_initial.py index e2bd559..c68eef0 100644 --- a/binder/migrations/0001_initial.py +++ b/binder/migrations/0001_initial.py @@ -1,5 +1,6 @@ -# Generated by Django 2.1.7 on 2019-02-14 01:37 +# Generated by Django 2.1.7 on 2019-03-18 00:13 +import django.core.validators from django.db import migrations, models import django.db.models.deletion @@ -17,8 +18,9 @@ class Migration(migrations.Migration): fields=[ ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), ('hostname', models.CharField(help_text='Host name or IP address of the BIND server.', max_length=255, unique=True)), - ('dns_port', models.IntegerField(default=53, help_text='The port where the BIND server is listening for DNS requests. binder especially uses that port for the dynamic zone updates. In most cases you should always leave it at the default port 53.', verbose_name='DNS port')), - ('statistics_port', models.IntegerField(help_text='Port where the BIND server is serving statistics on.')), + ('dns_port', models.IntegerField(default=53, help_text='The port where the DNS server is listening for DNS requests. binder especially uses that port for the dynamic zone updates. In most cases you should always leave it at the default port 53.', validators=[django.core.validators.MinValueValidator(1), django.core.validators.MaxValueValidator(65535)], verbose_name='DNS port')), + ('server_type', models.CharField(choices=[('BIND', 'Bind'), ('NSD', 'NSD')], default='BIND', help_text='DNS Server Type.', max_length=20)), + ('control_port', models.IntegerField(default=0, help_text='Port where the DNS server accepts remote statistic or control commands. 8053 for BIND, 8952 for NSD.', validators=[django.core.validators.MinValueValidator(1), django.core.validators.MaxValueValidator(65535)])), ], options={ 'ordering': ['hostname'], @@ -29,7 +31,7 @@ class Migration(migrations.Migration): fields=[ ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')), ('name', models.CharField(help_text='A human readable name for the key to store, used for further references to the key.', max_length=255, unique=True)), - ('data', models.CharField(help_text='The private part of the TSIG key.', max_length=255)), + ('data', models.CharField(help_text='The TSIG key.', max_length=255)), ('algorithm', models.CharField(choices=[('HMAC-MD5.SIG-ALG.REG.INT', 'MD5'), ('hmac-sha1', 'SHA1'), ('hmac-sha256', 'SHA256'), ('hmac-sha384', 'SHA384'), ('hmac-sha512', 'SHA512')], help_text='The algorithm which has been used for the key.', max_length=255)), ], options={ @@ -39,6 +41,6 @@ class Migration(migrations.Migration): migrations.AddField( model_name='bindserver', name='default_transfer_key', - field=models.ForeignKey(blank=True, help_text='The default key to use for all actions with this DNS server as long as no other key is specified explicitly.', null=True, on_delete=django.db.models.deletion.CASCADE, to='binder.Key'), + field=models.ForeignKey(help_text='The default key to use for all actions with this DNS server.', null=True, on_delete=django.db.models.deletion.SET_NULL, to='binder.Key'), ), ] diff --git a/binder/models.py b/binder/models.py index 0bce6d3..bf7317d 100644 --- a/binder/models.py +++ b/binder/models.py @@ -1,6 +1,7 @@ ### Binder Models # Standard Imports +import base64 import binascii import socket @@ -10,12 +11,15 @@ from pybindxml import reader as bindreader import dns.exception import dns.query import dns.tsig +import dns.tsigkeyring import dns.zone # App Imports from binder import exceptions +from binder.backends import nsd from django.db import models from django.conf import settings +from django.core.validators import MinValueValidator, MaxValueValidator TSIG_ALGORITHMS = (('HMAC-MD5.SIG-ALG.REG.INT', 'MD5'), ('hmac-sha1', 'SHA1'), @@ -23,6 +27,11 @@ TSIG_ALGORITHMS = (('HMAC-MD5.SIG-ALG.REG.INT', 'MD5'), ('hmac-sha384', 'SHA384'), ('hmac-sha512', 'SHA512')) +DNS_BACKENDS = ( + ('BIND', 'Bind'), + ('NSD', 'NSD'), +) + class Key(models.Model): @@ -33,7 +42,7 @@ class Key(models.Model): help_text="A human readable name for the key to " "store, used for further references to the key.") data = models.CharField(max_length=255, - help_text="The private part of the TSIG key.") + help_text="The TSIG key.") algorithm = models.CharField(max_length=255, choices=TSIG_ALGORITHMS, help_text="The algorithm which has been used " @@ -42,23 +51,26 @@ class Key(models.Model): def __unicode__(self): return self.name + def __str__(self): + return self.name + class Meta: ordering = ["name"] + app_label = 'binder' def save(self, *args, **kwargs): f = Fernet(settings.FERNET_KEY) - crypted_key = f.encrypt(bytes(self.data, encoding="utf8")) - self.data = crypted_key + encrypted_text = f.encrypt(bytes(self.data, 'utf-8')) + self.data = encrypted_text super(Key, self).save(*args, **kwargs) def create_keyring(self): if self.name is None: return None - try: key_data = self.decrypt_keydata() keyring = dns.tsigkeyring.from_text({self.name: key_data}) - except (binascii.Error, err): + except binascii.Error as err: raise exceptions.KeyringException("Incorrect key data. Verify key: %s. Reason: %s" % (self.name, err)) return keyring @@ -68,18 +80,21 @@ class Key(models.Model): fernet_key=key else: fernet_key=settings.FERNET_KEY + try: f = Fernet(fernet_key) - decrypted_key = f.decrypt(bytes(self.data)) - except InvalidToken: + # self.data is returned as a string. so we need to re-convert it + # to a byte string with just the key, then decrypt it. + decrypted_key = f.decrypt(bytes(self.data[2:-1], 'utf-8')) + except InvalidToken as err: raise exceptions.KeyringException() - return decrypted_key + return str(decrypted_key)[2:-1] class BindServer(models.Model): - """Store DNS servers and attributes for referencing their statistics ports. + """Store DNS servers and attributes for referencing their control ports. Also reference FK for TSIG transfer keys, if required. """ @@ -87,21 +102,38 @@ class BindServer(models.Model): hostname = models.CharField(max_length=255, unique=True, help_text="Host name or IP address of the BIND server.") + dns_port = models.IntegerField(default=53, verbose_name="DNS port", - help_text="The port where the BIND server is listening for DNS " + validators=[ + MinValueValidator(1), + MaxValueValidator(65535), + ], + help_text="The port where the DNS server is listening for DNS " "requests. binder especially uses that port for the dynamic " "zone updates. In most cases you should always leave it at the " "default port 53.") - statistics_port = models.IntegerField(help_text="Port where the BIND server is serving " - "statistics on.") + + server_type = models.CharField( + help_text="DNS Server Type.", + choices=DNS_BACKENDS, + default='BIND', + max_length=20) + + control_port = models.IntegerField( + default=0, + validators=[ + MinValueValidator(1), + MaxValueValidator(65535), + ], + help_text="Port where the DNS server accepts remote statistic or control commands. " + "8053 for BIND, 8952 for NSD.") + default_transfer_key = models.ForeignKey(Key, + on_delete=models.SET_NULL, null=True, - blank=True, - on_delete=models.CASCADE, help_text="The default key to use for all actions " - "with this DNS server as long as no other key is " - "specified explicitly.") + "with this DNS server.") def __unicode__(self): return self.hostname @@ -111,6 +143,14 @@ class BindServer(models.Model): class Meta: ordering = ["hostname"] + app_label = 'binder' + + def save(self, *args, **kwargs): + if self.server_type == 'NSD': + server = nsd.NSDServer(hostname=self.hostname, control_port=self.control_port) + server.write_config() + super().save(*args, **kwargs) + def list_zones(self): """List the DNS zones and attributes. @@ -123,9 +163,18 @@ class BindServer(models.Model): String zone_class, String zone_serial } """ - zone_data = bindreader.BindXmlReader(host=self.hostname, port=self.statistics_port) - zone_data.get_stats() - return zone_data + if self.server_type == "BIND": + # TODO: just return stats from get_stats call. This is probably not used + # anywhere else. + zone_data = bindreader.BindXmlReader(host=self.hostname, port=self.control_port) + zone_data.get_stats() + return zone_data + elif self.server_type == "NSD": + zone_data = nsd.NSDServer(hostname=self.hostname, + control_port=self.control_port) + zone_dict = zone_data.get_zone_list() + return zone_dict + def list_zone_records(self, zone_name): """List all records in a specific zone. @@ -148,11 +197,13 @@ class BindServer(models.Model): algorithm = transfer_key.algorithm try: - zone = dns.zone.from_xfr(dns.query.xfr(self.hostname, - zone_name, - port=self.dns_port, - keyring=keyring, - keyalgorithm=algorithm)) + xfr = dns.query.xfr( + self.hostname, + zone_name, + port=self.dns_port, + keyring=keyring, + keyalgorithm=algorithm) + zone = dns.zone.from_xfr(xfr) except dns.tsig.PeerBadKey: # The incorrect TSIG key was selected for transfers. raise exceptions.TransferException("Unable to list zone records because of a TSIG key mismatch.") @@ -165,7 +216,7 @@ class BindServer(models.Model): raise exceptions.TransferException("Unable to perform AXFR to list zone records. Did you forget to specify a default transfer key?") names = zone.nodes.keys() - names.sort() + sorted(names) record_array = [] for current_name in names: current_record = zone[current_name].to_text(current_name) diff --git a/binder/settings.py b/binder/settings.py index 9fb0cf4..1bdbd29 100644 --- a/binder/settings.py +++ b/binder/settings.py @@ -180,3 +180,9 @@ try: from local_settings import * except ImportError: pass + + +# Base directory where credentials are to be stored. +# For NSD, a subdirectory under CREDS_DIR should be created with th e +# appropriate certificates for nsd-control to execute. +CREDS_DIR = "/creds"