ius/dnstools: comparison bin/update-serial

equal deleted inserted replaced

-:743fd7ffb7c3
+:0e966f19a616
 use File::Temp;
 use IO::File;
 use POSIX qw(strftime);
 use if $ENV{DEBUG} => "Smart::Comments";
 use DNStools::Config qw(get_config);
+use DNS::ZoneParse;
 sub uniq(@);
 sub zones(@);
 sub changed_zones();
 sub update_index($);
 sub unlink_unused_keys($);
 sub include_keys($);
 sub sign($);
 sub update_serial($);
-sub mk_zone_conf;
+sub mk_zone_conf($$);
 sub file_entry;
 sub server_reload;
+sub dnssec_enabled($$);
 my %config;
 my %opt;
 MAIN: {
 );
 }
 ) or pod2usage;
 # merge the config and the defined options from commandline
-%config = get_config("$ENV{DNSTOOLS_CONF}", "dnstools.conf",
+my @configs = ( "dnstools.conf", "$ENV{HOME}/.dnstools.conf",
-"$ENV{HOME}/.dnstools.conf", "/etc/dnstools.conf", \%opt);
+"/etc/dnstools.conf");
+unshift @configs, $ENV{DNSTOOLS_CONF} if defined $ENV{DNSTOOLS_CONF};
-our $bind_dir = $config{bind_dir};
+%config = get_config(@configs, \%opt);
-our $conf_dir = $config{zone_conf_dir};
 my @candidates = @ARGV ? zones(@ARGV) : changed_zones;
 push @candidates, update_index($config{indexzone});
 push @candidates, signature_expired($config{sign_alert_time});
 push @candidates, begin_rollover(@need_rollover);
 push @candidates, end_rollover(@done_rollover);
 foreach my $zone (uniq(@candidates)) {
+#        say "XXX: candidate $zone";
 update_serial($zone);
-sign($zone);
+sign($zone) if dnssec_enabled($zone, "$config{master_dir}/$config{indexzone}/$config{indexzone}");
-}
+#        say "XXX: $zone should be signed" if dnssec_enabled($zone, "$config{master_dir}/$config{indexzone}/$config{indexzone}");
-say "Need to ... file_entry, mk_zone_conf, server_reload";
+}
-exit;
+file_entry;
-file_entry;       # bearbeitet die file-eintraege der konfigurations-datei
+mk_zone_conf($config{bind_dir}, $config{zone_conf_dir});
-mk_zone_conf;     # konfiguration zusammenfuegen
+server_reload;
-server_reload;    # server neu laden
 }
 sub uniq(@) {
 say " * $zone: no .stamp file found";    # NOCH IN NEW_SERIAL PUSHEN
 push @r, $zone;
 next;
 }
-my $stamp_age = -M _;
+my $stamp_mtime = (stat _)[8];
-my $file_age  = -M "$_/$zone";
+my $stamp_mtime2 = (stat "$_/.stamp")[8];
+my $zone_file_mtime  = (stat "$_/$zone")[8] or die "Can't stat '$_/$zone': $!";
-next if $stamp_age <= $file_age;             # should be only <
+# TODO: do this here?
+my $kc_file_mtime = 0;
+$kc_file_mtime = (stat "$_/.keycounter")[8] or die "Can't stat '$_/.keycounter': $!" if -f "$_/.keycounter";
+#        say "XXX: zone: $zone | stamp_mtime: $stamp_mtime| stamp_mtime2: $stamp_mtime2 | zone_file_mtime: $zone_file_mtime | kc_file_mtime: $kc_file_mtime";
+next unless $stamp_mtime < $zone_file_mtime or $stamp_mtime < $kc_file_mtime;
 push @r, $zone;
 say " * $zone: zone file modified";
 }
 return @r;
 }
 sub update_serial($) {
 my $zone = shift;
+#    say "XXX: $zone: updating serial number";
 my $file = "$config{master_dir}/$zone/$zone";
 my $in   = IO::File->new($file) or die "Can't open $file: $!\n";
 my $out  = File::Temp->new(DIR => dirname $file)
 or die "Can't open tmpfile: $!\n";
 or die "Can't rename tmp to $file: $!\n";
 $serial =~ s/\s*//g;
 say " * $zone: serial incremented to $serial";
-open(my $stamp, ">", dirname($file) . "/.stamp");
+my ($atime, $utime) = (time) x 2;
-print $stamp time() . " " . localtime() . "\n";
+my $s = (dirname $file) . '/.stamp';
+utime $atime, $utime, $s or die "Can't 'utime $atime, $utime, $s': $!";
 say " * $zone: stamp aktualisiert";
+#    say " XXX $zone: stamp '$s' aktualisiert";
 }
 sub new_serial($) {
 my ($date, $cnt) = $_[0] =~ /(\d{8})(\d\d)/;
 ? sprintf "%s%02d", $date, $cnt + 1
 : "${now}00";
 }
-sub mk_zone_conf {
+sub mk_zone_conf($$) {
 # erzeugt eine named.conf-datei aus den entsprechenden vorlagen.
-our $bind_dir;
+my ($bind_dir, $conf_dir) = @_;
-our $conf_dir;
 open(TO, ">$bind_dir/named.conf.zones")
 or die "$bind_dir/named.conf.zones: $!\n";
 while (<$conf_dir/*>) {
 open(FROM, "$_") or die "$_: $! \n";
 close(TO);
 print "** zonekonfiguration erzeugt\n";
 }
 sub update_index($) {
 my $indexzone = shift;
 my @iz;
 {
 }
 for my $dir (glob "$config{master_dir}/*") {
 my $zone = basename($dir);
 my $info = -e ("$dir/.keycounter") ? "sec-on" : "sec-off";
-push @iz, join "::", "\t\tIN TXT\t\t\"ZONE", $zone, $info;
+push @iz, join "::", "\t\tIN TXT\t\t\"ZONE", $zone, $info . '"';
 }
 {
 my $fh = File::Temp->new(DIR => "$config{master_dir}/$indexzone")
 or die "Can't create tmpdir: $!\n";
 print $fh join "\n" => @iz, "";
 rename($fh->filename => "$config{master_dir}/$indexzone/$indexzone")
 or die "Can't rename "
 . $fh->filename
 . " to $config{master_dir}/$indexzone/$indexzone: $!\n";
+$fh->unlink_on_destroy(0);
 }
 say "** index-zone aktualisiert";
 return $indexzone;
 }
 sub file_entry {
 # prueft jede domain, die ein verzeichnis in $config{master_dir} hat, ob sie
 # dnssec nutzt.
 # passt die eintraege in $config_file falls noetig an.
-our $conf_dir;
+my $cd = $config{zone_conf_dir};
+my $md = $config{master_dir};
-while (glob "$config{master_dir}/*") {
-s#($config{master_dir}/)(.*)#$2#;
+while (glob "$md/*") {
-my $zone      = $_;
+m#($md/)(.*)#;
-my $zone_file = "$config{master_dir}/$zone/$zone";
+my $z  = $2;
-my $conf_file = "$conf_dir/$zone";
+my $cf = "$cd/$z";
-my @c_content;
+my $de = dnssec_enabled $z, "$md/$config{indexzone}/$config{indexzone}";
+my $suf = $de ? '.signed' : '';
-unless (-f "$conf_file") {
+# TODO: assuming that paths in $md and in zone config snippets match somehow
-die "$conf_file: $! \n";
+my $zp = "$z/$z$suf";
+my $zf = "$md/$z/$z$suf";
+my ($files, $changed) = (0, 0);
+my $czf;
+open C, "+<$cf" or die "Cant't open '$cf': $!";
+my @lines = <C>; # TODO: deal with race condition?
+my ($mode, $uid, $gid, $atime, $mtime) = (stat C)[2, 4, 5, 8, 9] or die "Can't stat: $!";
+$mode &= 07777;
+for (@lines) {
+next unless /^\s*file\s+"([^"]*)"\s*;\s*$/;
+$czf = $1;
+$files++;
+$_ = qq(\tfile "$zf";) and $changed++ unless $czf =~ m#\Q$z/$z$suf\E$#;
 }
-if (-e "$config{master_dir}/$zone/.keycounter") {
+die "Multiple file statements found in '$cf' (maybe inside multiline comments)" if $files > 1;
-open(FILE, "<$conf_file") or die "$conf_file: $!\n";
+return unless $changed;
-@c_content = <FILE>;
-close(FILE);
+# file statement in config snippet doesnt match, so we make a backup first and write a new config
-for (@c_content) {
+my $cb = "$cf.bak";
-if (m{(.*)($zone_file)(";)}) {
+open B, ">$cb" or die "Can't open '$cb': $!";
-print
+print B @lines;
-" * zonekonfiguration aktualisiert ($2 ==> $2.signed)\n";
+close B;
-$_ = "$1$2.signed$3\n";
+chown $uid, $gid, $cb or die "Can't 'chown $uid, $gid, $cb': $!";
-}
+chmod $mode, $cb or die "Can't 'chmod $mode, $cb': $!";
-}
+utime $atime, $mtime, $cb or die "Can't 'utime $atime, $mtime, $cb': $!";
-open(FILE, ">$conf_file") or die "$conf_file: $!\n";
-print FILE @c_content;
+seek C, 0, 0 or die "Can't seek C, 0, 0: $!";
-close(FILE);
+# write back @lines we modified earlier
-}
+print C @lines;
-else {
+close C;
-open(FILE, "<$conf_file") or die "$conf_file: $!\n";
-@c_content = <FILE>;
+print " * zonekonfiguration aktualisiert ($czf ==> $zf)\n";
-close(FILE);
-for (@c_content) {
+}
-if (m{(.*)($zone_file)\.signed(.*)}) {
-print
-" * zonekonfiguration aktualisiert ($2.signed ==> $2)\n";
-$_ = "$1$2$3\n";
-}
-}
-open(FILE, ">$conf_file") or die "$conf_file: $!\n";
-print FILE @c_content;
-close(FILE);
-}
-}
 }
 sub server_reload {
 if (`rndc reload`) { print "** reload dns-server \n" }
 }
 }
 return @r;
 }
+# dnssec_enabled($zone, $path_to_indexzone_file)
+# return true if the index zone indicates that dnssec is enabled for a zone
+sub dnssec_enabled($$) {
+my ($z, $if) = @_;
+my $re = qr/^[^;]*IN\s+TXT\s+"ZONE::\Q$z\E::sec-(on|off)"/;
+my $r;
+open I, "<$if" or die "Can't open index zone file '<$if': $!";
+while (<I>) {
+#        say "XXX: match: $_" if /$re/;
+$r = $1 eq 'on' and last if /$re/;
+}
+close I;
+return $r;
+}
 __END__
 =pod
 =head1 NAME

changeset 116	0e966f19a616
parent 114	d7dad17fbc1b
child 117	3b9250983996