firewall new models: Domain, Record

firewall/admin.py

@@ -11,13 +11,16 @@ class AliasInline(contrib.admin.TabularInline):
 class RuleInline(contrib.admin.TabularInline):
     model = Rule
 
+class RecordInline(contrib.admin.TabularInline):
+    model = Record
+
 class HostAdmin(admin.ModelAdmin):
     list_display = ('hostname', 'vlan', 'ipv4', 'ipv6', 'pub_ipv4', 'mac', 'shared_ip', 'owner', 'description', 'reverse', 'groups_l')
     ordering = ('hostname', )
     list_filter = ('owner', 'vlan', 'groups')
     search_fields = ('hostname', 'description', 'ipv4', 'ipv6', 'mac')
     filter_horizontal = ('groups', )
-    inlines = (AliasInline, RuleInline)
+    inlines = (RuleInline, RecordInline)
 
     def groups_l(self, instance):
         retval = []
@@ -72,6 +75,22 @@ class GroupAdmin(admin.ModelAdmin):
 class FirewallAdmin(admin.ModelAdmin):
     inlines = (RuleInline, )
 
+class DomainAdmin(admin.ModelAdmin):
+    list_display = ('name', 'owner')
+
+class RecordAdmin(admin.ModelAdmin):
+    list_display = ('name_', 'type', 'address_', 'ttl', 'host', 'owner')
+
+    def address_(self, instance):
+        a = instance.get_data()
+        if(a):
+            return a['address']
+
+    def name_(self, instance):
+        a = instance.get_data()
+        if(a):
+            return a['name']
+
 admin.site.register(Host, HostAdmin)
 admin.site.register(Vlan, VlanAdmin)
 admin.site.register(Rule, RuleAdmin)
@@ -79,3 +98,6 @@ admin.site.register(Alias, AliasAdmin)
 admin.site.register(Group, GroupAdmin)
 admin.site.register(VlanGroup)
 admin.site.register(Firewall, FirewallAdmin)
+admin.site.register(Domain, DomainAdmin)
+admin.site.register(Record, RecordAdmin)
+

firewall/fields.py

@@ -9,6 +9,7 @@ mac_re = re.compile(r'^([0-9a-fA-F]{2}([:-]?|$)){6}$')
 alfanum_re = re.compile(r'^[A-Za-z0-9_-]+$')
 domain_re = re.compile(r'^([A-Za-z0-9_-]\.?)+$')
 ipv4_re = re.compile('^[0-9]+\.([0-9]+)\.([0-9]+)\.([0-9]+)$')
+reverse_domain_re = re.compile(r'^(%\([abcd]\)d|[a-z0-9.-])+$')
 
 class MACAddressFormField(fields.RegexField):
     default_error_messages = {
@@ -41,6 +42,10 @@ def val_domain(value):
      if not domain_re.search(value):
           raise ValidationError(u'%s - helytelen domain' % value)
 
+def val_reverse_domain(value):
+    if not reverse_domain_re.search(value):
+        raise ValidationError(u'%s - reverse domain' % value)
+
 def ipv4_2_ipv6(ipv4):
     m = ipv4_re.match(ipv4)
     return "2001:738:2001:4031:%s:%s:%s:0" % (m.group(1), m.group(2), m.group(3))

firewall/fw.py

@@ -350,38 +350,31 @@ def dns():
 
     for i_vlan in vlans:
         m = regex.search(i_vlan.net4)
-        if(i_vlan.name != "DMZ" and i_vlan.name != "PUB"):
-            DNS.append("Z%s.%s.in-addr.arpa:%s:support.ik.bme.hu::::::%s" % (m.group(2), m.group(1), settings['dns_hostname'], settings['dns_ttl']))
-            DNS.append("&%s.%s.in-addr.arpa::%s:%s:" % (m.group(2), m.group(1), settings['dns_hostname'], settings['dns_ttl']))
-            DNS.append("Z%s:%s:support.ik.bme.hu::::::%s" % (i_vlan.domain, settings['dns_hostname'], settings['dns_ttl']))
-            DNS.append("&%s::%s:%s" % (i_vlan.domain, settings['dns_hostname'], settings['dns_ttl']))
-            if(i_vlan.name == "WAR"):
-                DNS.append("Zdns1.%s.%s.%s.in-addr.arpa:%s:support.ik.bme.hu::::::%s" % (m.group(3), m.group(2), m.group(1), settings['dns_hostname'], settings['dns_ttl']))
-                DNS.append("&dns1.%s.%s.%s.in-addr.arpa::%s:%s::" % (m.group(3), m.group(2), m.group(1), settings['dns_hostname'], settings['dns_ttl']))
+        rev = i_vlan.reverse_domain
+
         for i_host in i_vlan.host_set.all():
             ipv4 = ( i_host.pub_ipv4 if i_host.pub_ipv4 and not i_host.shared_ip else i_host.ipv4 )
-            reverse = i_host.reverse if(i_host.reverse and len(i_host.reverse)) else i_host.hostname + u'.' + i_vlan.domain
-            hostname = i_host.get_fqdn()
+            i = ipv4.split('.', 4)
+            reverse = i_host.reverse if(i_host.reverse and len(i_host.reverse)) else i_host.get_fqdn()
 
             # ipv4
             if i_host.ipv4:
-                # A record
-                DNS.append("+%s:%s:%s" % (hostname, ipv4, settings['dns_ttl']))
-                # PTR record 4.3.2.1.in-addr.arpa
-                DNS.append("^%s:%s:%s" % (ipv4_to_arpa(ipv4), reverse, settings['dns_ttl']))
-                # PTR record 4.dns1.3.2.1.in-addr.arpa
-                DNS.append("^%s:%s:%s" % (ipv4_to_arpa(ipv4, cname=True), reverse, settings['dns_ttl']))
+                DNS.append("^%s:%s:%s" % ((rev % { 'a': int(i[0]), 'b': int(i[1]), 'c': int(i[2]), 'd': int(i[3]) }), reverse, models.settings['dns_ttl']))
 
             # ipv6
             if i_host.ipv6:
-                # AAAA record
-                DNS.append(":%s:28:%s:%s" % (hostname, ipv6_to_octal(i_host.ipv6), settings['dns_ttl']))
-                # PTR record
-                DNS.append("^%s:%s:%s" % (ipv6_to_arpa(i_host.ipv6), reverse, settings['dns_ttl']))
-
-            # cname
-            for i_alias in i_host.alias_set.all():
-                DNS.append("C%s:%s:%s" % (i_alias.alias, hostname, settings['dns_ttl']))
+                DNS.append("^%s:%s:%s" % (ipv6_to_arpa(i_host.ipv6), reverse, models.settings['dns_ttl']))
+
+    for r in models.Record.objects.all():
+        d = r.get_data()
+        if d['type'] == 'A':
+            DNS.append("+%s:%s:%s" % (d['name'], d['address'], d['ttl']))
+        elif d['type'] == 'AAAA':
+            DNS.append(":%s:28:%s:%s" % (d['name'], ipv6_to_octal(d['address']), d['ttl']))
+        elif d['type'] == 'NS':
+            DNS.append("&%s::%s:%s" % (d['name'], d['address'], d['ttl']))
+        elif d['type'] == 'CNAME':
+            DNS.append("C%s:%s:%s" % (d['name'], d['address'], d['ttl']))
 
     process = subprocess.Popen(['/usr/bin/ssh', 'tinydns@%s' % settings['dns_hostname']], shell=False, stdin=subprocess.PIPE)
     process.communicate("\n".join(DNS)+"\n")

firewall/models.py

@@ -8,6 +8,8 @@ from firewall.fields import *
 from south.modelsinspector import add_introspection_rules
 from django.core.validators import MinValueValidator, MaxValueValidator
 from cloud.settings import firewall_settings as settings
+from django.utils.ipv6 import is_valid_ipv6_address
+import re
 
 class Rule(models.Model):
     CHOICES_type = (('host', 'host'), ('firewall', 'firewall'), ('vlan', 'vlan'))
@@ -70,7 +72,8 @@ class Vlan(models.Model):
     snat_to = models.ManyToManyField('self', symmetrical=False, blank=True, null=True)
     description = models.TextField(blank=True)
     comment = models.TextField(blank=True)
-    domain = models.TextField(blank=True, validators=[val_domain])
+    domain = models.ForeignKey('Domain')
+    reverse_domain = models.TextField(validators=[val_reverse_domain])
     dhcp_pool = models.TextField(blank=True)
     created_at = models.DateTimeField(auto_now_add=True)
     owner = models.ForeignKey(User, blank=True, null=True)
@@ -143,6 +146,7 @@ class Host(models.Model):
         return self.hostname
 
     def save(self, *args, **kwargs):
+        id = self.id
         if not self.id and self.ipv6 == "auto":
             self.ipv6 = ipv4_2_ipv6(self.ipv4)
         if not self.shared_ip and self.pub_ipv4 and Host.objects.exclude(id=self.id).filter(pub_ipv4=self.pub_ipv4):
@@ -151,6 +155,10 @@ class Host(models.Model):
             raise ValidationError("Egy masik host natolt cimet nem hasznalhatod sajat ipv4-nek")
         self.full_clean()
         super(Host, self).save(*args, **kwargs)
+        if(id is None):
+            Record(domain=self.vlan.domain, host=self, type='A', owner=self.owner).save()
+            if self.ipv6 == "auto":
+                Record(domain=self.vlan.domain, host=self, type='AAAA', owner=self.owner).save()
 
     def enable_net(self):
         self.groups.add(Group.objects.get(name="netezhet"))
@@ -179,14 +187,7 @@ class Host(models.Model):
         self.rules.filter(owner=self.owner).delete()
 
     def get_fqdn(self):
-        return self.hostname + u'.' + self.vlan.domain
-
-    def clean(self):
-        # FIXME later: critical race condition
-        for a in Alias.objects.all():
-            if self.get_fqdn() == a.alias:
-                raise ValidationError(_("Host name already used as alias."))
-
+        return self.hostname + u'.' + unicode(self.vlan.domain)
 
 
 class Firewall(models.Model):
@@ -195,3 +196,92 @@ class Firewall(models.Model):
     def __unicode__(self):
         return self.name
 
+class Domain(models.Model):
+    name = models.CharField(max_length=40, validators=[val_domain])
+    owner = models.ForeignKey(User)
+    created_at = models.DateTimeField(auto_now_add=True)
+    modified_at = models.DateTimeField(auto_now=True)
+    ttl = models.IntegerField(default=600)
+    description = models.TextField(blank=True)
+
+    def __unicode__(self):
+        return self.name
+
+class Record(models.Model):
+    CHOICES_type = (('A', 'A'), ('CNAME', 'CNAME'), ('AAAA', 'AAAA'), ('MX', 'MX'), ('NS', 'NS'), ('PTR', 'PTR'), ('TXT', 'TXT'))
+    name = models.CharField(max_length=40, validators=[val_domain], blank=True, null=True)
+    domain = models.ForeignKey('Domain')
+    host = models.ForeignKey('Host', blank=True, null=True)
+    type = models.CharField(max_length=6, choices=CHOICES_type)
+    address = models.CharField(max_length=40, blank=True, null=True)
+    ttl = models.IntegerField(default=600)
+    owner = models.ForeignKey(User)
+    description = models.TextField(blank=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+    modified_at = models.DateTimeField(auto_now=True)
+
+    def __unicode__(self):
+        return self.desc()
+
+    def desc(self):
+        a = self.get_data()
+        if a:
+            return a['name'] + u' ' + a['type'] + u' ' + a['address']
+        return '(nincs)'
+
+    def save(self, *args, **kwargs):
+        self.full_clean()
+        super(Record, self).save(*args, **kwargs)
+
+    def clean(self):
+        if not((not self.name and self.host) or self.name.endswith(u'.' + self.domain.name) or self.name == self.domain.name ):
+            raise ValidationError(u'nemok')
+
+        if self.host and self.type in ['CNAME', 'A', 'AAAA', 'PTR']:
+            if self.type == 'CNAME':
+                if not self.name or self.address:
+                    raise ValidationError(u'CNAME rekordnal csak a name legyen kitoltve, ha van host beallitva')
+            elif self.type == 'PTR':
+                if not self.address or self.name:
+                    raise ValidationError(u'PTR rekordnal csak a name legyen kitoltve, ha van host beallitva')
+            elif self.name or self.address:
+                raise ValidationError(u'A, AAAA rekord eseten nem szabad megadni name-t, address-t, ha tarsitva van host')
+        else:
+            if not (self.name and self.address):
+                raise ValidationError(u'name v address hianyzik')
+
+            if self.type == 'A':
+                if not ipv4_re.match(self.address):
+                    raise ValidationError(u'ez nem ipcim, ez nudli!')
+            elif self.type in ['CNAME', 'NS', 'PTR', 'TXT']:
+                if not domain_re.match(self.address):
+                    raise ValidationError(u'ez nem domain, ez nudli!')
+            elif self.type == 'AAAA':
+                if not is_valid_ipv6_address(self.address):
+                    raise ValidationError(u'ez nem ipv6cim, ez nudli!')
+            elif self.type == 'MX':
+                mx = self.address.split(':', 1)
+                if not (len(mx) == 2 and mx[0].isdigit() and domain_re.match(mx[1])):
+                    raise ValidationError(u'prioritas:hostname')
+            else:
+                raise ValidationError(u'ez ismeretlen rekord, ez nudli!')
+
+    def get_data(self):
+        retval = { 'name': self.name, 'type': self.type, 'ttl': self.ttl, 'address': self.address }
+        if self.host:
+            if self.type == 'A':
+                retval['address'] = self.host.pub_ipv4 if self.host.pub_ipv4 and not self.host.shared_ip else self.host.ipv4
+                retval['name'] = self.host.get_fqdn()
+            elif self.type == 'AAAA':
+                if not self.host.ipv6:
+                    return None
+                retval['address'] = self.host.ipv6
+                retval['name'] = self.host.get_fqdn()
+            elif self.type == 'CNAME':
+                retval['address'] = self.host.get_fqdn()
+        if not (retval['address'] and retval['name']):
+            return None
+        return retval
+
+
+