# Copyright (C) 2012 Internet Systems Consortium. # # Permission to use, copy, modify, and distribute this software for any # purpose with or without fee is hereby granted, provided that the above # copyright notice and this permission notice appear in all copies. # # THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SYSTEMS CONSORTIUM # DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL # INTERNET SYSTEMS CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, # INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING # FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. from isc.dns import * import isc.ddns.zone_config from isc.log import * from isc.ddns.logger import logger, ClientFormatter, ZoneFormatter,\ RRsetFormatter from isc.log_messages.libddns_messages import * from isc.datasrc import ZoneFinder import isc.xfrin.diff from isc.acl.acl import ACCEPT, REJECT, DROP import copy # Result codes for UpdateSession.handle() UPDATE_SUCCESS = 0 UPDATE_ERROR = 1 UPDATE_DROP = 2 # Convenient aliases of update-specific section names SECTION_ZONE = Message.SECTION_QUESTION SECTION_PREREQUISITE = Message.SECTION_ANSWER SECTION_UPDATE = Message.SECTION_AUTHORITY # Shortcut DBGLVL_TRACE_BASIC = logger.DBGLVL_TRACE_BASIC class UpdateError(Exception): '''Exception for general error in update request handling. This exception is intended to be used internally within this module. When UpdateSession.handle() encounters an error in handling an update request it can raise this exception to terminate the handling. This class is constructed with some information that may be useful for subsequent possible logging: - msg (string) A string explaining the error. - zname (isc.dns.Name) The zone name. Can be None when not identified. - zclass (isc.dns.RRClass) The zone class. Like zname, can be None. - rcode (isc.dns.RCode or None) The RCODE to be set in the response message; this can be None if the response is not expected to be sent. - nolog (bool) If True, it indicates there's no more need for logging. ''' def __init__(self, msg, zname, zclass, rcode, nolog=False): Exception.__init__(self, msg) self.zname = zname self.zclass = zclass self.rcode = rcode self.nolog = nolog def foreach_rr(rrset): ''' Generator that creates a new RRset with one RR from the given RRset upon each iteration, usable in calls that need to loop over an RRset and perform an action with each of the individual RRs in it. Example: for rr in foreach_rr(rrset): print(str(rr)) ''' for rdata in rrset.get_rdata(): rr = isc.dns.RRset(rrset.get_name(), rrset.get_class(), rrset.get_type(), rrset.get_ttl()) rr.add_rdata(rdata) yield rr def convert_rrset_class(rrset, rrclass): '''Returns a (new) rrset with the data from the given rrset, but of the given class. Useful to convert from NONE and ANY to a real class. Note that the caller should be careful what to convert; and DNS error that could happen during wire-format reading could technically occur here, and is not caught by this helper. ''' new_rrset = isc.dns.RRset(rrset.get_name(), rrclass, rrset.get_type(), rrset.get_ttl()) for rdata in rrset.get_rdata(): # Rdata class is nof modifiable, and must match rrset's # class, so we need to to some ugly conversion here. # And we cannot use to_text() (since the class may be unknown) wire = rdata.to_wire(bytes()) new_rrset.add_rdata(isc.dns.Rdata(rrset.get_type(), rrclass, wire)) return new_rrset def collect_rrsets(collection, rrset): ''' Helper function to collect similar rrsets. Collect all rrsets with the same name, class, and type collection is the currently collected list of RRsets, rrset is the RRset to add; if an RRset with the same name, class and type as the given rrset exists in the collection, its rdata fields are added to that RRset. Otherwise, the rrset is added to the given collection. TTL is ignored. This method does not check rdata contents for duplicate values. The collection and its rrsets are modified in-place, this method does not return anything. ''' found = False for existing_rrset in collection: if existing_rrset.get_name() == rrset.get_name() and\ existing_rrset.get_class() == rrset.get_class() and\ existing_rrset.get_type() == rrset.get_type(): for rdata in rrset.get_rdata(): existing_rrset.add_rdata(rdata) found = True if not found: collection.append(rrset) class UpdateSession: '''Protocol handling for a single dynamic update request. This class is instantiated with a request message and some other information that will be used for handling the request. Its main method, handle(), will process the request, and normally build a response message according to the result. The application of this class can use the message to send a response to the client. ''' def __init__(self, req_message, client_addr, zone_config): '''Constructor. Parameters: - req_message (isc.dns.Message) The request message. This must be in the PARSE mode, its Opcode must be UPDATE, and must have been TSIG validatd if it's TSIG signed. - client_addr (socket address) The address/port of the update client in the form of Python socket address object. This is mainly for logging and access control. - zone_config (ZoneConfig) A tentative container that encapsulates the server's zone configuration. See zone_config.py. - req_data (binary) Wire format data of the request message. It will be used for TSIG verification if necessary. ''' self.__message = req_message self.__tsig = req_message.get_tsig_record() self.__client_addr = client_addr self.__zone_config = zone_config self.__added_soa = None def get_message(self): '''Return the update message. After handle() is called, it's generally transformed to the response to be returned to the client. If the request has been dropped, this method returns None. If this method is called before handle() the return value would be identical to the request message passed on construction, although it's of no practical use. ''' return self.__message def handle(self): '''Handle the update request according to RFC2136. This method returns a tuple of the following three elements that indicate the result of the request. - Result code of the request processing, which are: UPDATE_SUCCESS Update request granted and succeeded. UPDATE_ERROR Some error happened to be reported in the response. UPDATE_DROP Error happened and no response should be sent. Except the case of UPDATE_DROP, the UpdateSession object will have created a response that is to be returned to the request client, which can be retrieved by get_message(). If it's UPDATE_DROP, subsequent call to get_message() returns None. - The name of the updated zone (isc.dns.Name object) in case of UPDATE_SUCCESS; otherwise None. - The RR class of the updated zone (isc.dns.RRClass object) in case of UPDATE_SUCCESS; otherwise None. ''' try: self.__get_update_zone() # conceptual code that would follow prereq_result = self.__check_prerequisites() if prereq_result != Rcode.NOERROR(): self.__make_response(prereq_result) return UPDATE_ERROR, self.__zname, self.__zclass self.__check_update_acl(self.__zname, self.__zclass) update_result = self.__do_update() if update_result != Rcode.NOERROR(): self.__make_response(update_result) return UPDATE_ERROR, self.__zname, self.__zclass self.__make_response(Rcode.NOERROR()) return UPDATE_SUCCESS, self.__zname, self.__zclass except UpdateError as e: if not e.nolog: logger.debug(logger.DBGLVL_TRACE_BASIC, LIBDDNS_UPDATE_ERROR, ClientFormatter(self.__client_addr, self.__tsig), ZoneFormatter(e.zname, e.zclass), e) # If RCODE is specified, create a corresponding resonse and return # ERROR; otherwise clear the message and return DROP. if e.rcode is not None: self.__make_response(e.rcode) return UPDATE_ERROR, None, None self.__message = None return UPDATE_DROP, None, None def __get_update_zone(self): '''Parse the zone section and find the zone to be updated. If the zone section is valid and the specified zone is found in the configuration, sets private member variables for this session: __datasrc_client: A matching data source that contains the specified zone __zname: The zone name as a Name object __zclass: The zone class as an RRClass object __finder: A ZoneFinder for this zone If this method raises an exception, these members are not set ''' # Validation: the zone section must contain exactly one question, # and it must be of type SOA. n_zones = self.__message.get_rr_count(SECTION_ZONE) if n_zones != 1: raise UpdateError('Invalid number of records in zone section: ' + str(n_zones), None, None, Rcode.FORMERR()) zrecord = self.__message.get_question()[0] if zrecord.get_type() != RRType.SOA(): raise UpdateError('update zone section contains non-SOA', None, None, Rcode.FORMERR()) # See if we're serving a primary zone specified in the zone section. zname = zrecord.get_name() zclass = zrecord.get_class() zone_type, datasrc_client = self.__zone_config.find_zone(zname, zclass) if zone_type == isc.ddns.zone_config.ZONE_PRIMARY: # create an ixfr-out-friendly diff structure to work on self.__diff = isc.xfrin.diff.Diff(datasrc_client, zname, journaling=True, single_update_mode=True) # Note that while it is really the ZoneUpdater that is set # here, it is still called finder, as the only methods that # are and should be used on this object are find() and find_all() # (ZoneUpdater provides the ZoneFinder interface itself, no # separate get_zone_finder()) self.__finder = self.__diff.get_updater() self.__zname = zname self.__zclass = zclass self.__datasrc_client = datasrc_client return elif zone_type == isc.ddns.zone_config.ZONE_SECONDARY: # We are a secondary server; since we don't yet support update # forwarding, we return 'not implemented'. logger.debug(DBGLVL_TRACE_BASIC, LIBDDNS_UPDATE_FORWARD_FAIL, ClientFormatter(self.__client_addr, self.__tsig), ZoneFormatter(zname, zclass)) raise UpdateError('forward', zname, zclass, Rcode.NOTIMP(), True) # zone wasn't found logger.debug(DBGLVL_TRACE_BASIC, LIBDDNS_UPDATE_NOTAUTH, ClientFormatter(self.__client_addr, self.__tsig), ZoneFormatter(zname, zclass)) raise UpdateError('notauth', zname, zclass, Rcode.NOTAUTH(), True) def __check_update_acl(self, zname, zclass): '''Apply update ACL for the zone to be updated.''' acl = self.__zone_config.get_update_acl(zname, zclass) action = acl.execute(isc.acl.dns.RequestContext( (self.__client_addr[0], self.__client_addr[1]), self.__tsig)) if action == REJECT: logger.info(LIBDDNS_UPDATE_DENIED, ClientFormatter(self.__client_addr, self.__tsig), ZoneFormatter(zname, zclass)) raise UpdateError('rejected', zname, zclass, Rcode.REFUSED(), True) if action == DROP: logger.info(LIBDDNS_UPDATE_DROPPED, ClientFormatter(self.__client_addr, self.__tsig), ZoneFormatter(zname, zclass)) raise UpdateError('dropped', zname, zclass, None, True) logger.debug(logger.DBGLVL_TRACE_BASIC, LIBDDNS_UPDATE_APPROVED, ClientFormatter(self.__client_addr, self.__tsig), ZoneFormatter(zname, zclass)) def __make_response(self, rcode): '''Transform the internal message to the update response. According RFC2136 Section 3.8, the zone section will be cleared as well as other sections. The response Rcode will be set to the given value. ''' self.__message.make_response() self.__message.clear_section(SECTION_ZONE) self.__message.set_rcode(rcode) def __prereq_rrset_exists(self, rrset): '''Check whether an rrset with the given name and type exists. Class, TTL, and Rdata (if any) of the given RRset are ignored. RFC2136 Section 2.4.1. Returns True if the prerequisite is satisfied, False otherwise. Note: the only thing used in the call to find() here is the result status. The actual data is immediately dropped. As a future optimization, we may want to add a find() option to only return what the result code would be (and not read/copy any actual data). ''' result, _, _ = self.__finder.find(rrset.get_name(), rrset.get_type(), ZoneFinder.NO_WILDCARD | ZoneFinder.FIND_GLUE_OK) return result == ZoneFinder.SUCCESS def __prereq_rrset_exists_value(self, rrset): '''Check whether an rrset that matches name, type, and rdata(s) of the given rrset exists. RFC2136 Section 2.4.2 Returns True if the prerequisite is satisfied, False otherwise. ''' result, found_rrset, _ = self.__finder.find(rrset.get_name(), rrset.get_type(), ZoneFinder.NO_WILDCARD | ZoneFinder.FIND_GLUE_OK) if result == ZoneFinder.SUCCESS and\ rrset.get_name() == found_rrset.get_name() and\ rrset.get_type() == found_rrset.get_type(): # We need to match all actual RRs, unfortunately there is no # direct order-independent comparison for rrsets, so this # a slightly inefficient way to handle that. # shallow copy of the rdata list, so we are sure that this # loop does not mess with actual data. found_rdata = copy.copy(found_rrset.get_rdata()) for rdata in rrset.get_rdata(): if rdata in found_rdata: found_rdata.remove(rdata) else: return False return len(found_rdata) == 0 return False def __prereq_rrset_does_not_exist(self, rrset): '''Check whether no rrsets with the same name and type as the given rrset exist. RFC2136 Section 2.4.3. Returns True if the prerequisite is satisfied, False otherwise. ''' return not self.__prereq_rrset_exists(rrset) def __prereq_name_in_use(self, rrset): '''Check whether the name of the given RRset is in use (i.e. has 1 or more RRs). RFC2136 Section 2.4.4 Returns True if the prerequisite is satisfied, False otherwise. Note: the only thing used in the call to find_all() here is the result status. The actual data is immediately dropped. As a future optimization, we may want to add a find_all() option to only return what the result code would be (and not read/copy any actual data). ''' result, rrsets, flags = self.__finder.find_all(rrset.get_name(), ZoneFinder.NO_WILDCARD | ZoneFinder.FIND_GLUE_OK) if result == ZoneFinder.SUCCESS and\ (flags & ZoneFinder.RESULT_WILDCARD == 0): return True return False def __prereq_name_not_in_use(self, rrset): '''Check whether the name of the given RRset is not in use (i.e. does not exist at all, or is an empty nonterminal. RFC2136 Section 2.4.5. Returns True if the prerequisite is satisfied, False otherwise. ''' return not self.__prereq_name_in_use(rrset) def __check_in_zone(self, rrset): '''Returns true if the name of the given rrset is equal to or a subdomain of the zname from the Zone Section.''' relation = rrset.get_name().compare(self.__zname).get_relation() return relation == NameComparisonResult.SUBDOMAIN or\ relation == NameComparisonResult.EQUAL def __check_prerequisites(self): '''Check the prerequisites section of the UPDATE Message. RFC2136 Section 2.4. Returns a dns Rcode signaling either no error (Rcode.NOERROR()) or that one of the prerequisites failed (any other Rcode). ''' # Temporary array to store exact-match RRsets exact_match_rrsets = [] for rrset in self.__message.get_section(SECTION_PREREQUISITE): # First check if the name is in the zone if not self.__check_in_zone(rrset): logger.info(LIBDDNS_PREREQ_NOTZONE, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.NOTZONE() # Algorithm taken from RFC2136 Section 3.2 if rrset.get_class() == RRClass.ANY(): if rrset.get_ttl().get_value() != 0 or\ rrset.get_rdata_count() != 0: logger.info(LIBDDNS_PREREQ_FORMERR_ANY, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() elif rrset.get_type() == RRType.ANY(): if not self.__prereq_name_in_use(rrset): rcode = Rcode.NXDOMAIN() logger.info(LIBDDNS_PREREQ_NAME_IN_USE_FAILED, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset), rcode) return rcode else: if not self.__prereq_rrset_exists(rrset): rcode = Rcode.NXRRSET() logger.info(LIBDDNS_PREREQ_RRSET_EXISTS_FAILED, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset), rcode) return rcode elif rrset.get_class() == RRClass.NONE(): if rrset.get_ttl().get_value() != 0 or\ rrset.get_rdata_count() != 0: logger.info(LIBDDNS_PREREQ_FORMERR_NONE, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() elif rrset.get_type() == RRType.ANY(): if not self.__prereq_name_not_in_use(rrset): rcode = Rcode.YXDOMAIN() logger.info(LIBDDNS_PREREQ_NAME_NOT_IN_USE_FAILED, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset), rcode) return rcode else: if not self.__prereq_rrset_does_not_exist(rrset): rcode = Rcode.YXRRSET() logger.info(LIBDDNS_PREREQ_RRSET_DOES_NOT_EXIST_FAILED, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset), rcode) return rcode elif rrset.get_class() == self.__zclass: if rrset.get_ttl().get_value() != 0: logger.info(LIBDDNS_PREREQ_FORMERR, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() else: collect_rrsets(exact_match_rrsets, rrset) else: logger.info(LIBDDNS_PREREQ_FORMERR_CLASS, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() for collected_rrset in exact_match_rrsets: if not self.__prereq_rrset_exists_value(collected_rrset): rcode = Rcode.NXRRSET() logger.info(LIBDDNS_PREREQ_RRSET_EXISTS_VAL_FAILED, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(collected_rrset), rcode) return rcode # All prerequisites are satisfied return Rcode.NOERROR() def __set_soa_rrset(self, rrset): '''Sets the given rrset to the member __added_soa (which is used by __do_update for updating the SOA record''' self.__added_soa = rrset def __do_prescan(self): '''Perform the prescan as defined in RFC2136 section 3.4.1. This method has a side-effect; it sets self._new_soa if it encounters the addition of a SOA record in the update list (so serial can be checked by update later, etc.). It puts the added SOA in self.__added_soa. ''' for rrset in self.__message.get_section(SECTION_UPDATE): if not self.__check_in_zone(rrset): logger.info(LIBDDNS_UPDATE_NOTZONE, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.NOTZONE() if rrset.get_class() == self.__zclass: # In fact, all metatypes are in a specific range, # so one check can test TKEY to ANY # (some value check is needed anyway, since we do # not have defined RRtypes for MAILA and MAILB) if rrset.get_type().get_code() >= 249: logger.info(LIBDDNS_UPDATE_ADD_BAD_TYPE, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() if rrset.get_type() == RRType.SOA(): # In case there's multiple soa records in the update # somehow, just take the last for rr in foreach_rr(rrset): self.__set_soa_rrset(rr) elif rrset.get_class() == RRClass.ANY(): if rrset.get_ttl().get_value() != 0: logger.info(LIBDDNS_UPDATE_DELETE_NONZERO_TTL, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() if rrset.get_rdata_count() > 0: logger.info(LIBDDNS_UPDATE_DELETE_RRSET_NOT_EMPTY, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() if rrset.get_type().get_code() >= 249 and\ rrset.get_type().get_code() <= 254: logger.info(LIBDDNS_UPDATE_DELETE_BAD_TYPE, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() elif rrset.get_class() == RRClass.NONE(): if rrset.get_ttl().get_value() != 0: logger.info(LIBDDNS_UPDATE_DELETE_RR_NONZERO_TTL, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() if rrset.get_type().get_code() >= 249: logger.info(LIBDDNS_UPDATE_DELETE_RR_BAD_TYPE, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() else: logger.info(LIBDDNS_UPDATE_BAD_CLASS, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), RRsetFormatter(rrset)) return Rcode.FORMERR() return Rcode.NOERROR() def __do_update_add_single_rr(self, rr, existing_rrset): '''Helper for __do_update_add_rrs_to_rrset: only add the rr if it is not present yet (note that rr here should already be a single-rr rrset) ''' if existing_rrset is None: self.__diff.add_data(rr) else: rr_rdata = rr.get_rdata()[0] if not rr_rdata in existing_rrset.get_rdata(): self.__diff.add_data(rr) def __do_update_add_rrs_to_rrset(self, rrset): '''Add the rrs from the given rrset to the internal diff. There is handling for a number of special cases mentioned in RFC2136; - If the addition is a CNAME, but existing data at its name is not, the addition is ignored, and vice versa. - If it is a CNAME, and existing data is too, it is replaced (existing data is deleted) An additional restriction is that SOA data is ignored as well (it is handled separately by the __do_update method). Note that in the (near) future, this method may have addition special-cases processing. ''' # For a number of cases, we may need to remove data in the zone # (note; SOA is handled separately by __do_update, so that one # is explicitely ignored here) if rrset.get_type() == RRType.SOA(): return result, orig_rrset, _ = self.__finder.find(rrset.get_name(), rrset.get_type(), ZoneFinder.NO_WILDCARD | ZoneFinder.FIND_GLUE_OK) if result == ZoneFinder.CNAME: # Ignore non-cname rrs that try to update CNAME records # (if rrset itself is a CNAME, the finder result would be # SUCCESS, see next case) return elif result == ZoneFinder.SUCCESS: # if update is cname, and zone rr is not, ignore if rrset.get_type() == RRType.CNAME(): # Remove original CNAME record (the new one # is added below) self.__diff.delete_data(orig_rrset) # We do not have WKS support at this time, but if there # are special Update equality rules such as for WKS, and # we do have support for the type, this is where the check # (and potential delete) would go. elif result == ZoneFinder.NXRRSET: # There is data present, but not for this type. # If this type is CNAME, ignore the update if rrset.get_type() == RRType.CNAME(): return for rr in foreach_rr(rrset): self.__do_update_add_single_rr(rr, orig_rrset) def __do_update_delete_rrset(self, rrset): '''Deletes the rrset with the name and type of the given rrset from the zone data (by putting all existing data in the internal diff as delete statements). Special cases: if the delete statement is for the zone's apex, and the type is either SOA or NS, it is ignored.''' result, to_delete, _ = self.__finder.find(rrset.get_name(), rrset.get_type(), ZoneFinder.NO_WILDCARD | ZoneFinder.FIND_GLUE_OK) if result == ZoneFinder.SUCCESS: if to_delete.get_name() == self.__zname and\ (to_delete.get_type() == RRType.SOA() or\ to_delete.get_type() == RRType.NS()): # ignore return for rr in foreach_rr(to_delete): self.__diff.delete_data(rr) def __ns_deleter_helper(self, rrset): '''Special case helper for deleting NS resource records at the zone apex. In that scenario, the last NS record may never be removed (and any action that would do so should be ignored). ''' # NOTE: This method is currently bad: it WILL delete all # NS rrsets in a number of cases. # We need an extension to our diff.py to handle this correctly # (see ticket #2016) # The related test is currently disabled. When this is fixed, # enable that test again. result, orig_rrset, _ = self.__finder.find(rrset.get_name(), rrset.get_type(), ZoneFinder.NO_WILDCARD | ZoneFinder.FIND_GLUE_OK) # Even a real rrset comparison wouldn't help here... # The goal is to make sure that after deletion of the # given rrset, at least 1 NS record is left (at the apex). # So we make a (shallow) copy of the existing rrset, # and for each rdata in the to_delete set, we check if it wouldn't # delete the last one. If it would, that specific one is ignored. # If it would not, the rdata is removed from the temporary list orig_rrset_rdata = copy.copy(orig_rrset.get_rdata()) for rdata in rrset.get_rdata(): if len(orig_rrset_rdata) == 1 and rdata == orig_rrset_rdata[0]: # ignore continue else: # create an individual RRset for deletion to_delete = isc.dns.RRset(rrset.get_name(), rrset.get_class(), rrset.get_type(), rrset.get_ttl()) to_delete.add_rdata(rdata) orig_rrset_rdata.remove(rdata) self.__diff.delete_data(to_delete) def __do_update_delete_name(self, rrset): '''Delete all data at the name of the given rrset, by adding all data found by find_all as delete statements to the internal diff. Special case: if the name is the zone's apex, SOA and NS records are kept. ''' result, rrsets, flags = self.__finder.find_all(rrset.get_name(), ZoneFinder.NO_WILDCARD | ZoneFinder.FIND_GLUE_OK) if result == ZoneFinder.SUCCESS and\ (flags & ZoneFinder.RESULT_WILDCARD == 0): for to_delete in rrsets: # if name == self.__zname and type is soa or ns, don't delete! if to_delete.get_name() == self.__zname and\ (to_delete.get_type() == RRType.SOA() or to_delete.get_type() == RRType.NS()): continue else: for rr in foreach_rr(to_delete): self.__diff.delete_data(rr) def __do_update_delete_rrs_from_rrset(self, rrset): '''Deletes all resource records in the given rrset from the zone. Resource records that do not exist are ignored. If the rrset if of type SOA, it is ignored. Uses the __ns_deleter_helper if the rrset's name is the zone's apex, and the type is NS. ''' # Delete all rrs in the rrset, except if name=self.__zname and type=soa, or # type = ns and there is only one left (...) # The delete does not want class NONE, we would not have gotten here # if it wasn't, but now is a good time to change it to the zclass. to_delete = convert_rrset_class(rrset, self.__zclass) if rrset.get_name() == self.__zname: if rrset.get_type() == RRType.SOA(): # ignore return elif rrset.get_type() == RRType.NS(): # hmm. okay. annoying. There must be at least one left, # delegate to helper method self.__ns_deleter_helper(to_delete) return for rr in foreach_rr(to_delete): self.__diff.delete_data(rr) def __update_soa(self): '''Checks the member value __added_soa, and depending on whether it has been set and what its value is, creates a new SOA if necessary. Then removes the original SOA and adds the new one, by adding the needed operations to the internal diff.''' # Get the existing SOA # if a new soa was specified, add that one, otherwise, do the # serial magic and add the newly created one # get it from DS and to increment and stuff result, old_soa, _ = self.__finder.find(self.__zname, RRType.SOA(), ZoneFinder.NO_WILDCARD | ZoneFinder.FIND_GLUE_OK) if self.__added_soa is not None: new_soa = self.__added_soa # serial check goes here else: new_soa = old_soa # increment goes here self.__diff.delete_data(old_soa) self.__diff.add_data(new_soa) def __do_update(self): '''Scan, check, and execute the Update section in the DDNS Update message. Returns an Rcode to signal the result (NOERROR upon success, any error result otherwise). ''' # prescan prescan_result = self.__do_prescan() if prescan_result != Rcode.NOERROR(): return prescan_result # update try: # Do special handling for SOA first self.__update_soa() # Algorithm from RFC2136 Section 3.4 # Note that this works on full rrsets, not individual RRs. # Some checks might be easier with individual RRs, but only if we # would use the ZoneUpdater directly (so we can query the # 'zone-as-it-would-be-so-far'. However, due to the current use # of the Diff class, this is not the case, and therefore it # is easier to work with full rrsets for the most parts # (less lookups needed; conversion to individual rrs is # the same effort whether it is done here or in the several # do_update statements) for rrset in self.__message.get_section(SECTION_UPDATE): if rrset.get_class() == self.__zclass: self.__do_update_add_rrs_to_rrset(rrset) elif rrset.get_class() == RRClass.ANY(): if rrset.get_type() == RRType.ANY(): self.__do_update_delete_name(rrset) else: self.__do_update_delete_rrset(rrset) elif rrset.get_class() == RRClass.NONE(): self.__do_update_delete_rrs_from_rrset(rrset) self.__diff.commit() return Rcode.NOERROR() except isc.datasrc.Error as dse: logger.info(LIBDDNS_UPDATE_DATASRC_ERROR, dse) return Rcode.SERVFAIL() except Exception as uce: logger.error(LIBDDNS_UPDATE_UNCAUGHT_EXCEPTION, ClientFormatter(self.__client_addr), ZoneFormatter(self.__zname, self.__zclass), uce) return Rcode.SERVFAIL()