auto-generate include-files for bind
This commit is contained in:
parent
041c98026d
commit
a797b50fc4
116
README.md
116
README.md
|
|
@ -1,7 +1,11 @@
|
|||
|
||||
# fff-scripts
|
||||
Dieses Git enthält eine Sammlung an Scripten zur Aktualisierung der Zonendatei für fff.community.
|
||||
Außerdem gibt es Skripte, die aus der Forward-Zone und optional eigener Subdomain (durch community-Zonefile gesteuert) passende Reverse-Zones für unsere internen RFC 1918 und RFC 4193 Adressen erzeugen.
|
||||
Dieses Git enthält eine Sammlung an Scripten zur Aktualisierung der Zonen für fff.community.
|
||||
Dabei werden aus der Forward-Zone und optional eigener Subdomain (durch community-Zonefile gesteuert) auch passende Reverse-Zonen für unsere internen RFC 1918 und RFC 4193 Adressen erzeugen.
|
||||
|
||||
Weiterhin werden bei eigener Subdomain die momentan vergebenen Adressen von dnsmasq und odhcpd (alles unter /tmp/hosts/) inkludiert.
|
||||
Das ermöglicht eine Namensauflösung für Freifunk-Teilnehmer ohne manuelle Konfiguration.
|
||||
Damit kann jeder Freifunk-Teilnehmer ein gültiges TLS-Zertifikat bekommen, sofern DHCPv6 am Gateway aktiviert ist.
|
||||
|
||||
## Installation
|
||||
|
||||
|
|
@ -10,11 +14,15 @@ Außerdem gibt es Skripte, die aus der Forward-Zone und optional eigener Subdoma
|
|||
curl
|
||||
named-checkzone (z.B. bei bind oder bind-tools enthalten)
|
||||
|
||||
der Befehl:
|
||||
echo "dump" | nc ::1 33123
|
||||
muss die babel routen ausgeben, ansonsten muss update-public-acl.sh angepasst werden
|
||||
|
||||
|
||||
#### dns-scripts klonen
|
||||
Die Scripte müssen geklont werden, oder anderweitig in einem Ordner auf dem Server abgelegt werden. Dabei ist aktuell noch die Position wichtig, da das Skript derzeit absolulte Pfade verwendet (oder den Pfad in update-dns.sh anpassen)
|
||||
```
|
||||
git clone https://git.freifunk-franken.de/freifunk-franken/dns-scripts.git /srv/fff-scripts
|
||||
git clone https://git.freifunk-franken.de/freifunk-franken/dns-scripts.git /usr/lib/ffdns
|
||||
```
|
||||
|
||||
#### konfigurieren
|
||||
|
|
@ -28,41 +36,10 @@ Schließlich muss noch ein Cron angelegt werden, der regelmäßig das Skript auf
|
|||
```
|
||||
|
||||
#### DNS-Server konfigurieren
|
||||
Dann muss nur noch der DNS Server, z.B. `bind`, für die entsprechenden Zonen eingerichtet werden,
|
||||
die Zonenfiles werden durch die Scripte angelegt, für jedes Zonefile muss ein Eintrag in den entsprechenden
|
||||
view:
|
||||
Dann muss nur noch der DNS Server, z.B. `bind`, eingerichtet werden.
|
||||
Für bind werden durch die Scripte die include-Dateien angelegt (fff.community-[in|ex]ternal.conf|icvpn-acl.conf):
|
||||
|
||||
Einfachste Konfiguration:
|
||||
```
|
||||
$ cat named.conf.local
|
||||
[..]
|
||||
|
||||
zone "50.10.in-addr.arpa" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.10.50";
|
||||
allow-query { any; };
|
||||
};
|
||||
zone "83.10.in-addr.arpa" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.10.83";
|
||||
allow-query { any; };
|
||||
};
|
||||
zone "d.b.9.2.2.0.6.5.3.4.d.f.ip6.arpa" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.f.d.4.3.5.6.0.2.2.9.b.d";
|
||||
allow-query { any; };
|
||||
};
|
||||
|
||||
zone "fff.community" {
|
||||
type master;
|
||||
file "/srv/fff-dns/db.fff.community";
|
||||
allow-query { any; };
|
||||
};
|
||||
|
||||
[..]
|
||||
```
|
||||
|
||||
mit Split-View und eigener Subdomain:
|
||||
Konfiguration:
|
||||
|
||||
```
|
||||
$ cat named.conf.local
|
||||
|
|
@ -71,67 +48,30 @@ $ cat named.conf.local
|
|||
acl icvpnlocal {
|
||||
10.0.0.0/8;
|
||||
172.16.0.0/12;
|
||||
fd00::/8;
|
||||
};
|
||||
acl icvpnrange {
|
||||
icvpnlocal;
|
||||
# Die via babel/bird verteilten IPv6-Netze mit src-prefix, diese sollten per Script as der fff-table aktuell gehalten werden
|
||||
#z.B. 2a00:1aa0:ffff::/48;
|
||||
fc00::/7;
|
||||
};
|
||||
include "/etc/bind/icvpn-acl.conf"; # auto-generated
|
||||
|
||||
[..]
|
||||
|
||||
options {
|
||||
[..]
|
||||
check-names master warn; #Important for Hostnames with _ (example: HUAWEI_P30_lite )
|
||||
[..] # eigene Optionen
|
||||
|
||||
check-names master warn; # Wichtig, da sonst Hostnamen mit _ (z.B.: HUAWEI_P30_lite ) bind nicht laden lassen
|
||||
}
|
||||
|
||||
[..]
|
||||
|
||||
view "icvpn-internal-view" {
|
||||
match-clients { icvpnrange; localhost; };
|
||||
allow-query-cache { any; }
|
||||
|
||||
[..] # eigene Optionen
|
||||
|
||||
zone "<EIGENE SUBDOMAIN>.fff.community" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.<EIGENE SUBDOMAIN>.fff.community";
|
||||
};
|
||||
|
||||
zone "<EIGENES IPv4SUBNETZ>.50.10.in-addr.arpa" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.10.50.<EIGENES IPv4SUBNETZ>";
|
||||
}; # Subnetz kann auch in 10.83 liegen
|
||||
|
||||
zone "<EIGENES IPv6SUBNETZ>.d.b.9.2.2.0.6.5.3.4.d.f.ip6.arpa" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.f.d.4.3.5.6.0.2.2.9.b.d.<EIGENES IPv6SUBNETZ>";
|
||||
};
|
||||
|
||||
|
||||
zone "50.10.in-addr.arpa" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.10.50";
|
||||
allow-query { any; };
|
||||
};
|
||||
zone "83.10.in-addr.arpa" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.10.83";
|
||||
allow-query { any; };
|
||||
};
|
||||
zone "d.b.9.2.2.0.6.5.3.4.d.f.ip6.arpa" {
|
||||
type master;
|
||||
file "/var/lib/bind/db.f.d.4.3.5.6.0.2.2.9.b.d";
|
||||
allow-query { any; };
|
||||
};
|
||||
|
||||
zone "fff.community" {
|
||||
type master;
|
||||
file "/srv/fff-dns/db.fff.community";
|
||||
allow-query { any; };
|
||||
};
|
||||
|
||||
include "/var/lib/bind/icvpn-zones.conf"; # Nicht vergessen ;)
|
||||
include "/etc/bind/fff.community-internal.conf"; # auto-generated
|
||||
|
||||
include "/etc/bind/icvpn-zones.conf"; # Nicht vergessen ;)
|
||||
|
||||
[..]
|
||||
};
|
||||
|
|
@ -140,15 +80,7 @@ view "external-view" {
|
|||
match-clients { any; };
|
||||
[..] # eigene Optionen
|
||||
|
||||
zone "<EIGENE SUBDOMAIN>.fff.community" {
|
||||
type master;
|
||||
file "/var/lib/bind/dbextern.<EIGENE SUBDOMAIN>.fff.community";
|
||||
};
|
||||
|
||||
zone "fff.community" {
|
||||
type master;
|
||||
file "/var/lib/bind/dbextern.fff.community";
|
||||
};
|
||||
include "/etc/bind/fff.community-external.conf"; # auto-generated
|
||||
|
||||
[..]
|
||||
};
|
||||
|
|
|
|||
|
|
@ -12,6 +12,23 @@ GetZoneFileSerial() {
|
|||
fi
|
||||
echo "${ZoneSerial:-0}"
|
||||
}
|
||||
InsertZoneToIncludeFile() {
|
||||
if [ ! -f "$3" ]; then
|
||||
echo "zone \"""$1""\" {" > "$3"
|
||||
echo " type master;" >> "$3"
|
||||
echo " file \"""$2""\";" >> "$3"
|
||||
echo "};" >> "$3"
|
||||
else
|
||||
sed -i "1i\
|
||||
zone \"""$1""\" {\n\
|
||||
type master;\n\
|
||||
file \"""$2""\";\n\
|
||||
};" "$3"
|
||||
fi
|
||||
}
|
||||
GetReverseZoneFileFromZone() {
|
||||
echo "db.""$(echo "$1" | awk -F. '{ printf $(NF-2);for(i=NF-3;i>0;--i) printf "."$i}')"
|
||||
}
|
||||
FillIPv4MissingBlocks() {
|
||||
echo "$1" | sed -ne 's/^\([^.]\+\)\.\(\([^.]\+\)\.\)\?\(\([^.]\+\)\.\)\?\([^.]\+\)$/\1.\3.\5.\6/p' | sed -r 's/\.\./\.0\./g;s/\.\./\.0\./g'
|
||||
}
|
||||
|
|
@ -137,4 +154,4 @@ ReloadZone() {
|
|||
else
|
||||
/etc/init.d/named reload
|
||||
fi
|
||||
}
|
||||
}
|
||||
|
|
@ -14,6 +14,7 @@ export DNSSCRIPT_CONTACT_EMAIL=info.freifunk-herpf.de.
|
|||
export DNSSCRIPT_SERVER_NAME=dns.herpf.fff.community
|
||||
UpdateScriptsFolder="/usr/lib/ffdns/"
|
||||
ZoneFilesFolder="/etc/bind/fff/"
|
||||
BindIncludeFileFolder="/etc/bind/"
|
||||
|
||||
# 0 -> Debian (and like) systemctl reload bind9
|
||||
# 1 -> use rndc to reload zone (recommended; rndc needs setup first)
|
||||
|
|
@ -37,6 +38,9 @@ cd "$UpdateScriptsFolder"
|
|||
. ./dns-functions.sh
|
||||
|
||||
MasterFile="$ZoneFilesFolder""db.""$CommunityDomain"
|
||||
BindInternalFile="$BindIncludeFileFolder""$CommunityDomain""-internal.conf"
|
||||
BindExternalFile="$BindIncludeFileFolder""$CommunityDomain""-external.conf"
|
||||
BindIcvpnAcl="$BindIncludeFileFolder""icvpn-acl.conf"
|
||||
|
||||
PreFetchMasterSerial="$(GetZoneFileSerial "$MasterFile")"
|
||||
curl "$MasterFileRemoteLocation" --output "$MasterFile"
|
||||
|
|
@ -46,21 +50,22 @@ if [ $((PostFetchMasterSerial)) -gt $((PreFetchMasterSerial)) ]; then
|
|||
ReloadZone "$CommunityDomain" "$InternalViews"
|
||||
fi
|
||||
|
||||
[ -f "$BindExternalFile"".tmp" ] && rm "$BindExternalFile"".tmp"
|
||||
[ -f "$BindInternalFile"".tmp" ] && rm "$BindInternalFile"".tmp"
|
||||
InsertZoneToIncludeFile "$CommunityDomain" "$ZoneFilesFolder""db.""$CommunityDomain" "$BindExternalFile"".tmp"
|
||||
|
||||
for Subnet in $CommunitySubnets; do
|
||||
ReverseDomains="$(GetReverseDomains "$Subnet")"
|
||||
for RDomain in $ReverseDomains; do
|
||||
./update-rdnszone.sh "$RDomain" "$ForwardZones" "$ZoneFilesFolder" "$TTLReReExMi" "$InternalViews"
|
||||
InsertZoneToIncludeFile "$RDomain" "$ZoneFilesFolder""$(GetReverseZoneFileFromZone "${RDomain%*.}")" "$BindInternalFile"".tmp"
|
||||
done
|
||||
done
|
||||
|
||||
if [ -n "$ExternalView" ]; then
|
||||
# Split-View
|
||||
InternFile="$MasterFile"
|
||||
ExternFile="$ZoneFilesFolder""dbextern.""$CommunityDomain"
|
||||
Domain="$CommunityDomain"
|
||||
./update-extzone.sh "$InternFile" "$ExternFile" "$Domain" "$ExternalView"
|
||||
fi
|
||||
|
||||
InternFile="$MasterFile"
|
||||
ExternFile="$ZoneFilesFolder""dbextern.""$CommunityDomain"
|
||||
Domain="$CommunityDomain"
|
||||
./update-extzone.sh "$InternFile" "$ExternFile" "$Domain" "$ExternalView"
|
||||
|
||||
# set shorter TTL for Hoods
|
||||
TTLReReExMi="420 360 180 1800 360"
|
||||
|
|
@ -78,18 +83,47 @@ for Hood in $Hoods; do
|
|||
echo "$(GetOwnGlueRecords "$CommunityDomain" "$MasterFile")" >> "$HoodZoneFile"
|
||||
fi
|
||||
./update-hoodzone.sh "$HoodZoneFile" "$HoodSubDomain"".""$CommunityDomain" "$Subnets" "$InternalViews"
|
||||
InsertZoneToIncludeFile "$HoodSubDomain"".""$CommunityDomain" "$ZoneFilesFolder""db.""$HoodSubDomain"".""$CommunityDomain" "$BindExternalFile"".tmp"
|
||||
|
||||
HoodForwardZones="$ForwardZones $HoodSubDomain"".""$CommunityDomain""/""$ZoneFilesFolder""db.""$HoodSubDomain"".""$CommunityDomain"
|
||||
for Subnet in $Subnets; do
|
||||
ReverseDomains="$(GetReverseDomains "$Subnet")"
|
||||
for RDomain in $ReverseDomains; do
|
||||
./update-rdnszone.sh "$RDomain" "$HoodForwardZones" "$ZoneFilesFolder" "$TTLReReExMi" "$InternalViews"
|
||||
InsertZoneToIncludeFile "$RDomain" "$ZoneFilesFolder""$(GetReverseZoneFileFromZone "${RDomain%*.}")" "$BindInternalFile"".tmp"
|
||||
done
|
||||
done
|
||||
if [ -n "$ExternalView" ]; then
|
||||
# Split-View
|
||||
|
||||
InternFile="$ZoneFilesFolder""db.""$HoodSubDomain"".""$CommunityDomain"
|
||||
ExternFile="$ZoneFilesFolder""dbextern.""$HoodSubDomain"".""$CommunityDomain"
|
||||
Domain="$HoodSubDomain"".""$CommunityDomain"
|
||||
./update-extzone.sh "$InternFile" "$ExternFile" "$Domain" "$ExternalView"
|
||||
done
|
||||
|
||||
sed -i "1i include \"""$BindExternalFile""\";\n" "$BindInternalFile"".tmp"
|
||||
./update-public-acl.sh "$BindIcvpnAcl"".tmp"
|
||||
|
||||
|
||||
ReConfigBind=1
|
||||
UpdateBindConfig() {
|
||||
if [ -f "$1"".tmp" ] && ! cmp -s "$1"".tmp" "$1"; then
|
||||
mv "$1"".tmp" "$1"
|
||||
ReConfigBind=0
|
||||
else
|
||||
rm -f "$1"".tmp"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
UpdateBindConfig "$BindIcvpnAcl"
|
||||
UpdateBindConfig "$BindInternalFile"
|
||||
UpdateBindConfig "$BindExternalFile"
|
||||
|
||||
if [ $ReConfigBind -eq 0 ]; then
|
||||
if [ $DNSSCRIPT_BIND_RELOAD_VER -eq 0 ]; then
|
||||
systemctl restart bind9
|
||||
elif [ $DNSSCRIPT_BIND_RELOAD_VER -eq 1 ]; then
|
||||
rndc reconfig
|
||||
else
|
||||
/etc/init.d/named restart
|
||||
fi
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -0,0 +1,15 @@
|
|||
#!/bin/sh
|
||||
|
||||
. ./dns-functions.sh
|
||||
|
||||
IncludeFile="$1"
|
||||
|
||||
rm -f "$IncludeFile"
|
||||
|
||||
echo "acl icvpnrange {" > "$IncludeFile"
|
||||
echo " icvpnlocal;" >> "$IncludeFile"
|
||||
|
||||
echo "dump" | nc ::1 33123 | \
|
||||
sed -e '/add route/!d;/installed yes/!d;/\(from ::\/0\|from 0\.0\.\0\.0\/0\)/d;' | \
|
||||
sed -ne 's/^.*from \(\S\+\).*/\t\1;/p' >> "$IncludeFile"
|
||||
echo "};" >> "$IncludeFile"
|
||||
Loading…
Reference in New Issue