xcat-core/xCAT-server/lib/xcat/plugins/dns.pm
2010-03-16 20:40:36 +00:00

559 lines
21 KiB
Perl

package xCAT_plugin::dns;
use Getopt::Long;
use Net::DNS;
use xCAT::Table;
use Sys::Hostname;
use Socket;
use strict;
#This is a rewrite of DNS management using nsupdate rather than direct zone mangling
my $callback;
sub handled_commands
{
return {"makedns" => "dns"};
}
sub get_reverse_zone_for_entity {
my $ctx = shift;
my $node = shift;
my $net;
if ($ctx->{hoststab} and $ctx->{hoststab}->{$node} and $ctx->{hoststab}->{$node}->[0]->{ip}) {
$node = $ctx->{hoststab}->{$node}->[0]->{ip};
}
my $tvar;
if ($tvar = inet_aton($node)) { #This is an assignment, we are testing and storing the value in one shot
$tvar = unpack("N",$tvar);
foreach my $net (keys %{$ctx->{nets}}) {
if ($ctx->{nets}->{$net}->{netn} == ($tvar & $ctx->{nets}->{$net}->{mask})) {
my $maskstr = unpack("B32",pack("N",$ctx->{nets}->{$net}->{mask}));
my $maskcount = ($maskstr =~ tr/1//);
$maskcount+=((8-($maskcount%8))%8); #round to the next octet
my $newmask = 2**$maskcount -1 << (32 - $maskcount);
my $rev = inet_ntoa(pack("N",($tvar & $newmask)));
my @zone;
my @orig=split /\./,$rev;
while ($maskcount) {
$maskcount-=8;
unshift(@zone,(shift @orig));
}
$rev = join('.',@zone);
$rev .= '.IN-ADDR.ARPA';
return $rev;
}
}
}
}
sub process_request {
my $request = shift;
my $callback = shift;
my $ctx = {};
my @nodes;
my $hadargs=0;
my $allnodes;
my $zapfiles;
if ($request->{arg}) {
$hadargs=1;
@ARGV=@{$request->{arg}};
if (!GetOptions(
'a|all' => \$allnodes,
'n|new' => \$zapfiles,
)) {
sendmsg([1,"TODO: makedns Usage message"]);
return;
}
}
if ($request->{node}) { #we have a noderange to process
@nodes = @{$request->{node}};
} elsif ($allnodes) {
#read all nodelist specified nodes
} else {
#legacy behavior, read from /etc/hosts
my $hostsfile;
open($hostsfile,"<","/etc/hosts");
my @contents = <$hostsfile>;
close($hostsfile);
my $addr;
my $name;
my $canonical;
my $aliasstr;
my @aliases;
my $names;
foreach (@contents) {
s/#.*//; #strip comments;
s/^[ \t]*//; #remove leading whitespace
next unless ($_); #skip empty lines
($addr,$names) = split /[ \t]+/,$_,2;
if ($addr !~ /^\d+\.\d+\.\d+\.\d+$/) {
sendmsg("Ignoring line $_ in /etc/hosts, only IPv4 format entries are supported currently");
next;
}
unless ($canonical =~ /^[a-z0-9- \t\n]$/i) {
sendmsg("Ignoring line $_ in /etc/hosts, names contain invalid characters (valid characters include a through z, numbers and the '-', but not '_'");
next;
}
($canonical,$aliasstr) = split /[ \t]+/,$names,2;
if ($aliasstr) {
@aliases= split /[ \t]+/,$aliasstr;
} else {
@aliases = ();
}
}
}
my $hoststab = xCAT::Table->new('hosts',-create=>0);
if ($hoststab) {
$ctx->{hoststab} = $hoststab->getNodesAttribs(\@nodes,['ip']);
}
$ctx->{nodes} = \@nodes;
my $networkstab = xCAT::Table->new('networks',-create=>0);
unless ($networkstab) { sendmsg([1,'Unable to enumerate networks, try to run makenetworks']); }
my @networks = $networkstab->getAllAttribs('net','mask');
foreach (@networks) {
my $maskn = unpack("N",inet_aton($_->{mask}));
$ctx->{nets}->{$_->{net}}->{mask} = $maskn;
$ctx->{nets}->{$_->{net}}->{netn} = unpack("N",inet_aton($_->{net}));
}
my $passtab = xCAT::Table->new('passwd');
my $pent = $passtab->getAttribs({key=>'omapi',username=>'xcat_key'},['password']);
if ($pent and $pent->{password}) {
$ctx->{privkey} = $pent->{password};
} #do not warn/error here yet, if we can't generate or extract, we'll know later
my $sitetab = xCAT::Table->new('site');
my $stab = $sitetab->getAttribs({key=>'domain'},['value']);
unless ($stab and $stab->{value}) {
sendmsg([1,"domain not defined in site table"]);
return;
}
$ctx->{domain} = $stab->{value};
$stab = $sitetab->getAttribs({key=>'forwarders'},['value']);
if ($stab and $stab->{value}) {
my @forwarders = split /[ ,]/,$stab->{value};
$ctx->{forwarders}=\@forwarders;
}
$ctx->{zonestotouch}->{$ctx->{domain}}=1;
foreach (@nodes) {
$ctx->{revzones}->{$_} = get_reverse_zone_for_entity($ctx,$_);
$ctx->{zonestotouch}->{$ctx->{revzones}->{$_}}=1;
}
use Data::Dumper;
if (1) { #TODO: function to detect and return 1 if the master server is DNS SOA for all the zones we care about
#here, we are examining local files to assure that our key is in named.conf, the zones we care about are there, and that if
#active directory is in use, allow the domain controllers to update specific zones
$stab =$sitetab->getAttribs({key=>'directoryprovider'},['value']);
if ($stab and $stab->{value} and $stab->{value} eq 'activedirectory') {
$stab =$sitetab->getAttribs({key=>'directoryservers'},['value']);
if ($stab and $stab->{value} and $stab->{value}) {
my @dservers = split /[ ,]/,$stab->{value};
$ctx->{adservers} = \@dservers;
$ctx->{adzones} = {
"_msdcs.". $ctx->{domain} => 1,
"_sites.". $ctx->{domain} => 1,
"_tcp.". $ctx->{domain} => 1,
"_udp.". $ctx->{domain} => 1,
};
}
}
$stab =$sitetab->getAttribs({key=>'dnsupdaters'},['value']); #allow unsecure updates from these
if ($stab and $stab->{value} and $stab->{value}) {
my @nservers = split /[ ,]/,$stab->{value};
$ctx->{dnsupdaters} = \@nservers;
}
if ($zapfiles) { #here, we unlink all the existing files to start fresh
}
#We manipulate local namedconf
$ctx->{dbdir} = get_dbdir();
update_namedconf($ctx);
update_zones($ctx);
if ($ctx->{restartneeded}) {
system("/sbin/service named start");
system("/sbin/service named reload");
}
} else {
unless ($ctx->{privkey}) {
sendmsg([1,"Unable to update DNS due to lack of credentials in passwd to communicate with remote server"]);
}
}
#now we stick to Net::DNS style updates, with TSIG if possible. TODO: kerberized (i.e. Windows) DNS server support, maybe needing to use nsupdate -g....
$ctx->{resolver} = Net::DNS::Resolver->new();
add_records($ctx);
}
sub get_dbdir {
if (-d "/var/named") {
return "/var/named/";
} elsif (-d "/var/lib/named") {
return "/var/lib/named/";
} else {
use File::Path;
mkpath "/var/named/";
return "/var/named/";
}
}
sub update_zones {
my $ctx = shift;
my $currzone;
my $dbdir = $ctx->{dbdir};
my $domain = $ctx->{domain};
my $name = hostname;
my $node = $name;
unless ($domain =~ /^\./) {
$domain = '.'.$domain;
}
unless ($name =~ /\./) {
$name .= $domain;
}
unless ($name =~ /\.\z/) {
$name .= '.';
}
my $ip=$node;
if ($ctx->{hoststab} and $ctx->{hoststab}->{$node} and $ctx->{hoststab}->{$node}->[0]->{ip}) {
$ip = $ctx->{hoststab}->{$node}->[0]->{ip};
} else {
unless ($ip = inet_aton($ip)) {
print "Unable to find an IP for $node in hosts table or via system lookup (i.e. /etc/hosts";
sendmsg([1,"Unable to find an IP for $node in hosts table or via system lookup (i.e. /etc/hosts"]);
next;
}
$ip = inet_ntoa($ip);
}
my @neededzones = keys %{$ctx->{zonestotouch}};
push @neededzones,keys %{$ctx->{adzones}};
my ($sec, $min, $hour, $mday, $mon, $year, $rest) = localtime(time);
my $serial = ($mday * 100) + (($mon + 1) * 10000) + (($year + 1900) * 1000000);
foreach $currzone (@neededzones) {
if ($currzone =~ /IN-ADDR\.ARPA/) {
$currzone =~ s/\.IN-ADDR\.ARPA.*//;
my @octets = split/\./,$currzone;
$currzone = join('.',reverse(@octets));
}
unless (-f $dbdir."/db.$currzone") {
my $zonehdl;
open($zonehdl,">",$dbdir."/db.$currzone");
print $zonehdl '$TTL 86400'."\n";
print $zonehdl '@ IN SOA '.$name." root.$name ( $serial 10800 3600 604800 86400 )\n";
print $zonehdl " IN NS $name\n";
if ($name =~ /$currzone/) { #Must guarantee an A record for the DNS server
print $zonehdl "$name IN A $ip\n";
}
close($zonehdl);
$ctx->{restartneeded}=1;
}
}
}
sub update_namedconf {
my $ctx = shift;
my $namedlocation = '/etc/named.conf';
my $nameconf;
my @newnamed;
my $gotoptions=0;
my $gotkey=0;
my %didzones;
if (-r $namedlocation) {
my @currnamed=();
open($nameconf,"<",$namedlocation);
@currnamed=<$nameconf>;
close($nameconf);
my $i = 0;
for ($i=0;$i<scalar(@currnamed);$i++) {
my $line = $currnamed[$i];
if ($line =~ /^options +\{/) {
$gotoptions=1;
my $skip=0;
do {
if ($ctx->{forwarders} and $line =~ /forwarders {/) {
push @newnamed,"\tforwarders \{\n";
$skip=1;
foreach (@{$ctx->{forwarders}}) {
push @newnamed,"\t\t".$_.";\n";
}
push @newnamed,"\t};\n";
} elsif ($skip) {
if ($line =~ /};/) {
$skip = 0;
}
} else {
push @newnamed,$line;
}
$i++;
$line = $currnamed[$i];
} while ($line !~ /^\};/);
push @newnamed,$line;
} elsif ($line =~ /^zone "([^"]*)" in \{/) {
my $currzone = $1;
if ($ctx->{zonestotouch}->{$currzone} or $ctx->{adzones}->{$currzone}) {
$didzones{$currzone}=1;
my @candidate = ($line);
my $needreplace=1;
do {
$i++;
$line = $currnamed[$i];
push @candidate,$line;
if ($line =~ /key xcat_key/) {
$needreplace=0;
}
} while ($line !~ /^\};/); #skip the old file zone
unless ($needreplace) {
push @newnamed,@candidate;
next;
}
$ctx->{restartneeded}=1;
push @newnamed,"zone \"$currzone\" in {\n","\ttype master;\n","\tallow-update {\n","\t\tkey xcat_key;\n";
my @list;
if (not $ctx->{adzones}->{$currzone}) {
if ($ctx->{dnsupdaters}) {
@list = @{$ctx->{dnsupdaters}};
}
} else {
if ($ctx->{adservers}) {
@list = @{$ctx->{adservers}};
}
}
foreach (@list) {
push @newnamed,"\t\t$_;\n";
}
if ($currzone =~ /IN-ADDR\.ARPA/) {
my $net = $currzone;
$net =~ s/.IN-ADDR\.ARPA.*//;
my @octets = split/\./,$net;
$net = join('.',reverse(@octets));
push @newnamed,"\t};\n","\tfile \"db.$net\";\n","};\n";
} else {
push @newnamed,"\t};\n","\tfile \"db.$currzone\";\n","};\n";
}
} else {
push @newnamed,$line;
do {
$i++;
$line = $currnamed[$i];
push @newnamed,$line;
} while ($line !~ /^\};/);
}
} elsif ($line =~ /^key xcat_key/) {
$gotkey=1;
if ($ctx->{privkey}) {
#for now, assume the field is correct
#push @newnamed,"key xcat_key {\n","\talgorithm hmac-md5;\n","\tsecret \"".$ctx->{privkey}."\";\n","};\n\n";
push @newnamed,$line;
do {
$i++;
$line = $currnamed[$i];
push @newnamed,$line;
} while ($line !~ /^\};/);
} else {
push @newnamed,$line;
while ($line !~ /^\};/) { #skip the old file zone
if ($line =~ /secret \"([^"]*)\"/) {
my $passtab = xCAT::Table->new("passwd",-create=>1);
$passtab->setAttribs({key=>"omapi",user=>"xcat_key"},{password=>$1});
}
$i++;
$line = $currnamed[$i];
push @newnamed,$line;
}
}
} else {
push @newnamed,$line;
}
}
}
unless ($gotoptions) {
push @newnamed,"options {\n","\tdirectory \"".$ctx->{dbdir}."\";\n";
if ($ctx->{forwarders}) {
push @newnamed,"\tforwarders {\n";
foreach (@{$ctx->{forwarders}}) {
push @newnamed,"\t\t$_;\n";
}
push @newnamed,"\t};\n";
}
push @newnamed,"};\n\n";
open($nameconf,"<",$namedlocation);
}
unless ($gotkey) {
unless ($ctx->{privkey}) { #need to generate one
$ctx->{privkey} = encode_base64(genpassword(32));
}
push @newnamed,"key xcat_key {\n","\talgorithm hmac-md5;\n","\tsecret \"".$ctx->{privkey}."\";\n","};\n\n";
$ctx->{restartneeded}=1;
}
my $zone;
foreach $zone (keys %{$ctx->{zonestotouch}}) {
if ($didzones{$zone}) { next; }
$ctx->{restartneeded}=1; #have to add a zone, a restart will be needed
push @newnamed,"zone \"$zone\" in {\n","\ttype master;\n","\tallow-update {\n","\t\tkey xcat_key;\n";
foreach (@{$ctx->{dnsupdaters}}) {
push @newnamed,"\t\t$_;\n";
}
if ($zone =~ /IN-ADDR\.ARPA/) {
my $net = $zone;
$net =~ s/.IN-ADDR\.ARPA.*//;
my @octets = split/\./,$net;
$net = join('.',reverse(@octets));
push @newnamed,"\t};\n","\tfile \"db.$net\";\n","};\n";
} else {
push @newnamed,"\t};\n","\tfile \"db.$zone\";\n","};\n";
}
}
foreach $zone (keys %{$ctx->{adzones}}) {
if ($didzones{$zone}) { next; }
$ctx->{restartneeded}=1; #have to add a zone, a restart will be needed
push @newnamed,"zone \"$zone\" in {\n","\ttype master;\n","\tallow-update {\n","\t\tkey xcat_key;\n";
foreach (@{$ctx->{adservers}}) {
push @newnamed,"\t\t$_;\n";
}
push @newnamed,"\t};\n","\tfile \"db.$zone\";\n","};\n\n";
}
my $newnameconf;
open($newnameconf,">",$namedlocation);
for my $l (@newnamed) { print $newnameconf $l; }
close($newnameconf);
}
sub add_records {
my $ctx = shift;
unless ($ctx->{privkey}) {
my $passtab = xCAT::Table->new('passwd');
my $pent = $passtab->getAttribs({key=>'omapi',username=>'xcat_key'},['password']);
if ($pent and $pent->{password}) {
$ctx->{privkey} = $pent->{password};
} else {
sendmsg([1,"Unable to find omapi key in passwd table"]);
}
}
my $node;
my $ip;
my $domain = $ctx->{domain}; # store off for lazy typing and possible local mangling
unless ($domain =~ /^\./) { $domain = '.'.$domain; } #example.com becomes .example.com for consistency
$ctx->{nsmap} = {}; #will store a map to known NS records to avoid needless redundant queries to sort nodes into domains
$ctx->{updatesbyzone}={}; #sort all updates into their respective zones for bulk update for fewer DNS transactions
foreach $node (@{$ctx->{nodes}}) {
$ip = $node;
my $name = $node;
unless ($name =~ /$domain/) { $name .= $domain } # $name needs to represent fqdn, but must preserve $node as a nodename for cfg lookup
#if (domaintab->{$node}->[0]->{domain) { $domain = domaintab->{$node}->[0]->{domain) }
#above is TODO draft of how multi-domain support could come into play
if ($ctx->{hoststab} and $ctx->{hoststab}->{$node} and $ctx->{hoststab}->{$node}->[0]->{ip}) {
$ip = $ctx->{hoststab}->{$node}->[0]->{ip};
} else {
unless ($ip = inet_aton($ip)) {
sendmsg([1,"Unable to find an IP for $node in hosts table or via system lookup (i.e. /etc/hosts"]);
next;
}
$ip = inet_ntoa($ip);
}
$ctx->{currip}=$ip;
#time to update, A and PTR records, IPv6 still TODO
$ip = join('.',reverse(split(/\./,$ip)));
$ip .= '.IN-ADDR.ARPA.';
#ok, now it is time to identify which zones should actually hold the forward (A) and reverse (PTR) records and a nameserver to handle the request
my $revzone = $ip;
$ctx->{currnode}=$node;
$ctx->{currname}=$name;
$ctx->{currrevname}=$ip;
find_nameserver_for_dns($ctx,$revzone);
find_nameserver_for_dns($ctx,$domain);
}
my $zone;
foreach $zone (keys %{$ctx->{updatesbyzone}}) {
my $resolver = Net::DNS::Resolver->new(nameservers=>[$ctx->{nsmap}->{$zone}]);
my $update = Net::DNS::Update->new($zone);
foreach (@{$ctx->{updatesbyzone}->{$zone}}) {
$update->push(update=>rr_add($_));
}
$update->sign_tsig("xcat_key",$ctx->{privkey});
my $reply = $resolver->send($update);
print Dumper($reply);
}
}
sub find_nameserver_for_dns {
my $ctx = shift;
my $zone = shift;
my $node = $ctx->{currnode};
my $ip = $ctx->{currip};
my $rname = $ctx->{currrevname};
my $name = $ctx->{currname};
unless ($name =~ /\.\z/) { $name .= '.' }
my $rrcontent = "$name IN A $ip";
if ($zone =~ /IN-ADDR.ARPA/) { #reverse style
$rrcontent = "$rname IN PTR $name";
}
while ($zone) {
unless (defined $ctx->{nsmap}->{$zone}) { #ok, we already thought about this zone and made a decision
print $zone."\n";
my $reply = $ctx->{resolver}->query($zone,'NS');
if ($reply) {
foreach my $record ($reply->answer) {
$ctx->{nsmap}->{$zone} = $record->nsdname;
}
} else {
$ctx->{nsmap}->{$zone} = 0;
}
}
if ($ctx->{nsmap}->{$zone}) { #we have a nameserver for this zone, therefore this zone is one to update
if ($ctx->{updatesbyzone}->{$zone}) { #attach to existing list of updates
push @{$ctx->{updatesbyzone}->{$zone}},$rrcontent;
} else { #create a new list.
$ctx->{updatesbyzone}->{$zone} = [ $rrcontent ];
}
last;
} else { #we have it defined, but zero, means search higher domains. Possible to shortcut further by pointing to the right domain, maybe later
$zone =~ s/^[^\.]*\.//; #strip all up to and including first dot
unless ($zone) {
sendmsg([1,"Unable to find reverse lookup zone to hold $ip"],$node);
last;
}
}
}
}
sub sendmsg {
# my $callback = $output_handler;
my $text = shift;
my $node = shift;
my $descr;
my $rc;
if (ref $text eq 'HASH') {
die "not right now";
} elsif (ref $text eq 'ARRAY') {
$rc = $text->[0];
$text = $text->[1];
}
if ($text =~ /:/) {
($descr,$text) = split /:/,$text,2;
}
$text =~ s/^ *//;
$text =~ s/ *$//;
my $msg;
my $curptr;
if ($node) {
$msg->{node}=[{name => [$node]}];
$curptr=$msg->{node}->[0];
} else {
$msg = {};
$curptr = $msg;
}
if ($rc) {
$curptr->{errorcode}=[$rc];
$curptr->{error}=[$text];
$curptr=$curptr->{error}->[0];
if (defined $node) {
$allerrornodes{$node}=1;
}
} else {
$curptr->{data}=[{contents=>[$text]}];
$curptr=$curptr->{data}->[0];
if ($descr) { $curptr->{desc}=[$descr]; }
}
# print $outfd freeze([$msg]);
# print $outfd "\nENDOFFREEZE6sK4ci\n";
# yield;
# waitforack($outfd);
$callback->($msg);
}