1 #!/usr/bin/perl 

     2 

     3 use strict;

     4 use warnings;

     5 use FindBin;

     6 use File::Basename;

     7 

     8 sub del_double {

     9     # entfernt doppelte eintraege in einer liste

    10     my %all;

    11     grep { $all{$_} = 0 } @_;

    12     return ( keys %all );

    13 }

    14 

    15 sub read_conf {

    16     # liest die Konfiguration ein

    17     my @configs = ( "$FindBin::Bin/dnstools.conf", "/etc/dnstools.conf" );

    18     our %config;

    19 

    20     for ( grep {-f} @configs ) {

    21         open( CONFIG, $_ ) or die "Can't open $_: $!\n";

    22     }

    23     unless ( seek( CONFIG, 0, 0 ) ) {

    24         die "Can't open config (searched: @configs)\n";

    25     }

    26     while (<CONFIG>) {

    27         chomp;

    28         s/#.*//;

    29         s/\t//g;

    30         s/\s//g;

    31 

    32         next unless length;

    33         my ( $cname, $ccont ) = split( /\s*=\s*/, $_, 2 );

    34         $config{$cname} = $ccont;

    35     }

    36     close(CONFIG);

    37 }

    38 

    39 sub add_argv {

    40     # prueft ob zonen aus ARGV verwaltete zonen sind

    41     # und fuegt sie, falls ja in die liste @new_serial ein

    42     our @new_serial;

    43     our $master_dir;

    44     my $zone;

    45     

    46     for (@ARGV) {

    47         chomp( $zone = `idn --quiet "$_"` );

    48         if ( -e "$master_dir/$zone/$zone" ) {

    49             push @new_serial, $zone;

    50         }

    51     }

    52 }

    53 

    54 sub changed_zone {

    55     our $master_dir;

    56     our @new_serial;

    57 

    58     for (<$master_dir/*>) {

    59         my $zone = basename($_);

    60 

    61         if (-e "$master_dir/$zone/.stamp") {

    62             my $stamptime = (-M "$master_dir/$zone/.stamp");

    63             my $filetime = (-M "$master_dir/$zone/$zone");

    64             if ($stamptime > $filetime) {

    65                 push @new_serial, $zone;

    66                 print " * $zone: zonedatei wurde geaendert\n";

    67             }

    68         }

    69         else {

    70             print " * $zone: keine .stamp-datei gefunden\n"; # NOCH IN NEW_SERIAL PUSHEN

    71             push @new_serial, $zone;

    72         }

    73     }

    74 

    75 }

    76 

    77 sub sign_end {

    78     our $sign_alert_time;  # die zeit zwischen dem ende und der neuen

    79                            # signierung (siehe externe konfiguration)

    80     our $master_dir;

    81     our @new_serial;

    82     

    83     # erzeugt $time (die zeit ab der neu signiert werden soll)

    84     chomp( my $unixtime = `date +%s` );

    85     $unixtime = $unixtime + ( 3600 * $sign_alert_time );

    86     my $time = `date -d \@$unixtime +%Y%m%d%H`;

    87     

    88     ## vergleicht fuer alle zonen im ordner $master_dir mit einer

    89     ## <zone>.signed-datei den zeitpunkt in $time mit dem ablaufdatum der

    90     ## signatur, welcher aus der datei <zone>.signed ausgelesen wird.

    91     for (<$master_dir/*>) {

    92         s#($master_dir/)(.*)#$2#;

    93         my $zone = $_;

    94     

    95         if ( -e "$master_dir/$zone/$zone.signed" ) {

    96             open( ZONE, "$master_dir/$zone/$zone.signed" );

    97             my @zone_sig_content = <ZONE>;

    98             close(ZONE);

    99             

   100             for (@zone_sig_content) {

   101                 if (m#SOA.*[0-9]{14}#) {

   102                     s#.*([0-9]{10})([0-9]{4}).*#$1#;

   103                     if ( $_ < $time ) {

   104                         push @new_serial, $zone;

   105                     }

   106                 }

   107             }

   108         }

   109     }

   110 }

   111 

   112 sub sign_zone {

   113     # signiert die zonen und erhoeht den wert in der keycounter-datei

   114     our @new_serial;

   115     our $master_dir;

   116     my $zone;

   117     my $kc;

   118 

   119     for ( &del_double( @new_serial ) ) {

   120         $zone = $_;

   121 

   122         unless (-e "$master_dir/$zone/.index.zsk") {

   123             next;

   124         }

   125 

   126         chdir "$master_dir/$zone";

   127         if (`dnssec-signzone $zone 2>/dev/null`) {

   128             print " * $zone neu signiert \n";

   129 

   130             # erhoeht den keycounter

   131             if ("$master_dir/$zone/.keycounter") {

   132                 open( KC, "$master_dir/$zone/.keycounter" );

   133                 $kc = <KC>;

   134                 close(KC);

   135                 $kc += 1;

   136             }

   137             else {

   138                 $kc = 1;

   139             }

   140             open( KC, ">$master_dir/$zone/.keycounter" );

   141             print KC $kc;

   142             close(KC);

   143         }

   144         else { print "$zone konnte nicht signiert werden \n"; }

   145     }

   146 }

   147 

   148 sub update_serial {

   149     our $master_dir;

   150     our @new_serial;

   151     chomp (my  $date = `date +%Y%m%d`);

   152     my @new_content;

   153     my  $sdate;

   154     my  $scount;

   155     my  $serial;

   156 

   157     for ( &del_double( @new_serial ) ) {

   158         # erhoeht den serial

   159         my $zone = $_;

   160         my $file = "$master_dir/$zone/$zone";

   161         my @new_content = ();

   162  

   163         open (SER, "<$file") or die "$file: $!\n";

   164         for (<SER>) {

   165             if (/^\s+(\d+)(\d{2})\s*;\s*serial/i) {

   166                 $sdate  = $1;

   167                 $scount = $2;

   168                 $serial = "$sdate$scount";

   169                 if ( $date eq $sdate ) {

   170                     $scount++;

   171                 }

   172                 else {

   173                     $sdate = $date;

   174                     $scount = "00";

   175                 }

   176             }

   177             if ($serial) {

   178                 s/$serial/$sdate$scount/;

   179             }

   180             push @new_content, $_;

   181         }

   182         close (SER);

   183 

   184         open (RES, ">$file") or die "$file: $!\n";

   185         print RES @new_content;

   186         close (RES);

   187         print " * $zone: serial erhoeht \n";

   188 

   189         open(STAMP, ">$master_dir/$zone/.stamp") or die "$master_dir/$zone/.stamp: $!\n";

   190         close(STAMP);

   191         print " * $zone: stamp aktualisiert \n";

   192     }

   193 }

   194 

   195 sub mk_zone_conf {

   196     # erzeugt eine named.conf-datei aus den entsprechenden vorlagen.

   197     our $bind_dir;

   198     our $conf_dir;

   199 

   200     open( TO, ">$bind_dir/named.conf.zones" )

   201         or die "$bind_dir/named.conf.zones: $!\n";

   202     while (<$conf_dir/*>) {

   203         open( FROM, "$_" ) or die "$_: $! \n";

   204         print TO <FROM>;

   205         close(FROM);

   206     }

   207     close(TO);

   208     print "** zonekonfiguration erzeugt\n";

   209 }

   210 

   211 sub update_index {

   212     # aktualisiert die indexzone;

   213     our @new_serial;

   214     our $indexzone;

   215     our $master_dir;

   216     my @iz_content_old;

   217     my @iz_content_new;

   218 

   219     open (INDEXZONE, "$master_dir/$indexzone/$indexzone")

   220         or die "$master_dir/$indexzone/$indexzone: $!\n";

   221     @iz_content_old = <INDEXZONE>;

   222     close (INDEXZONE);

   223 

   224     for (@iz_content_old) {

   225         unless (m#ZONE::#) {

   226             push @iz_content_new, $_;

   227         }

   228     }

   229 

   230     for my $dir ( glob "$master_dir/*" ) {

   231         my $zone = basename($dir);

   232         my $info_end = "::sec-off";

   233 

   234         if (-e "$dir/.keycounter") {

   235             $info_end = "::sec-on";

   236         }

   237 

   238         my $iz_line = "\t\tIN TXT\t\t\"ZONE::$zone$info_end\"\n";

   239 

   240         push @iz_content_new, $iz_line;

   241     }

   242 

   243     open (INDEXZONE, ">$master_dir/$indexzone/$indexzone")

   244         or die "$master_dir/$indexzone/$indexzone: $!\n";

   245     print INDEXZONE @iz_content_new;

   246     close (INDEXZONE);

   247 

   248     # fuegt die index-zone in die liste damit der serial erhoet wird

   249     push @new_serial, $indexzone;

   250 

   251     print "** index-zone aktualisiert \n";

   252 }

   253 

   254 sub file_entry {

   255     # prueft jede domain, die ein verzeichnis in $master_dir hat, ob sie

   256     # dnssec nutzt.

   257     # passt die eintraege in $config_file falls noetig an.

   258     our $master_dir;

   259     our $conf_dir;

   260 

   261     while (<$master_dir/*>) {

   262         s#($master_dir/)(.*)#$2#;

   263         my $zone = $_;

   264         my $zone_file = "$master_dir/$zone/$zone";

   265         my $conf_file = "$conf_dir/$zone";

   266         my @c_content;

   267 

   268         unless ( -f "$conf_file" ) {

   269             die "$conf_file: $! \n";

   270         }

   271 

   272         if ( -e "$master_dir/$zone/.keycounter" ) {

   273             open( FILE, "<$conf_file" ) or die "$conf_file: $!\n";

   274             @c_content = <FILE>;

   275             close(FILE);

   276             for (@c_content) {

   277                 if (m{(.*)($zone_file)(";)}) {

   278                     print " * zonekonfiguration aktualisiert ($2 ==> $2.signed)\n";

   279                     $_ = "$1$2.signed$3\n";

   280                 }

   281             }

   282             open( FILE, ">$conf_file" ) or die "$conf_file: $!\n";

   283             print FILE @c_content;

   284             close(FILE);

   285         }

   286         else {

   287             open( FILE, "<$conf_file" ) or die "$conf_file: $!\n";

   288             @c_content = <FILE>;

   289             close(FILE);

   290             for (@c_content) {

   291                 if (m{(.*)($zone_file)\.signed(.*)}) {

   292                     print " * zonekonfiguration aktualisiert ($2.signed ==> $2)\n";

   293                     $_ = "$1$2$3\n";

   294                 }

   295             }

   296             open( FILE, ">$conf_file" ) or die "$conf_file: $!\n";

   297             print FILE @c_content;

   298             close(FILE);

   299         }

   300     }

   301 }

   302 

   303 sub server_reload {

   304     if (`rndc reload`) {print "** reload dns-server \n"};

   305 }

   306 

   307 

   308 &read_conf;

   309 

   310 our %config;

   311 our @new_serial;     # liste fuer neuen serial

   312 our $master_dir      = $config{master_dir};

   313 our $bind_dir        = $config{bind_dir};

   314 our $conf_dir        = $config{zone_conf_dir};

   315 our $sign_alert_time = $config{sign_alert_time};

   316 our $indexzone       = $config{indexzone};

   317 

   318 &add_argv;

   319 &changed_zone;

   320 &sign_end;

   321 

   322 if (@new_serial) {

   323     &update_index; # index zone aktuallisieren

   324     &update_serial; # serial aktuallisieren

   325     &sign_zone; # zone signieren

   326 }

   327 

   328 &file_entry;  # bearbeitet die file-eintraege der konfigurations-datei

   329 &mk_zone_conf; # konfiguration zusammenfuegen

   330 &server_reload; # server neu laden

   331