No OneTemporary
Actions

Subscribers

None

File Metadata

Created: Mon, Nov 25, 7:58 PM

View Options

	diff --git a/app/models/domain.rb b/app/models/domain.rb
	index 56e3fe5..3942117 100644
	--- a/app/models/domain.rb
	+++ b/app/models/domain.rb
	@@ -1,401 +1,402 @@
	class Domain < ActiveRecord::Base
	class NotAChild < StandardError; end
	self.inheritance_column = :nx

	# List all supported domain types.
	def self.domain_types
	[
	'NATIVE',
	'MASTER',
	'SLAVE',
	]
	end

	# List domain types that can be created.
	def self.allowed_domain_types
	domain_types - WebDNS.settings[:prohibit_domain_types]
	end

	# List parent authorities
	def self.dnssec_parent_authorities
	WebDNS.settings[:dnssec_parent_authorities].keys.map(&:to_s)
	end

	# Fire event after transaction commmit
	# Changing state inside a hook messes things up,
	# this trick handles that
	attr_accessor :fire_event

	belongs_to :group
	has_many :jobs
	has_many :opt_outs, class_name: 'Subscription', dependent: :delete_all

	has_many :records
	# BUG in bump_serial_trigger
	has_one :soa, -> { unscope(where: :type).where(type: 'soa') }, class_name: SOA
	belongs_to :dnssec_policy

	validates :group_id, presence: true
	validates :name, uniqueness: true, presence: true
	validates :type, presence: true, inclusion: { in: domain_types }
	validates :master, presence: true, ipv4: true, if: :slave?

	validates :dnssec, inclusion: { in: [false] }, unless: :dnssec_elegible?
	validates :dnssec_parent_authority, inclusion: { in: dnssec_parent_authorities }, if: :dnssec?
	validates :dnssec_parent, hostname: true, if: :dnssec?
	validates :dnssec_policy_id, presence: true, if: :dnssec?

	after_create :generate_soa
	after_create :generate_ns
	after_create :generate_subscriptions

	after_create :install
	before_save :check_convert
	before_save :check_dnssec_parent_authority, if: :dnssec?
	after_commit :after_commit_event

	attr_writer :serial_strategy

	def self.dnssec_progress(current_state)
	progress = [
	:pending_signing, # 1/3
	:wait_for_ready, # 2/3
	:pending_ds] # 3/3
	idx = progress.index(current_state.to_sym)
	return if idx.nil?

	[idx+1, progress.size].join('/')
	end

	state_machine initial: :initial do
	after_transition(any => :pending_install) { \|domain, _t\| Job.add_domain(domain) }
	after_transition(any => :pending_remove) { \|domain, _t\| Job.shutdown_domain(domain) }
	after_transition(any => :pending_ds_removal) { \|domain, _t\| Job.dnssec_drop_ds(domain) }
	after_transition(any => :pending_signing) { \|domain, _t\| Job.dnssec_sign(domain) }
	after_transition(any => :wait_for_ready) { \|domain, _t\| Job.wait_for_ready(domain) }
	after_transition(any => :pending_ds) { \|domain, t\| Job.dnssec_push_ds(domain, *t.args) }
	after_transition(any => :pending_ds_rollover) { \|domain, t\| Job.dnssec_rollover_ds(domain, *t.args) }
	after_transition(any => :pending_plain) { \|domain, _t\| Job.convert_to_plain(domain) }
	after_transition(any => :destroy) { \|domain, _t\| domain.destroy }

	# User events
	event :install do
	transition initial: :pending_install
	end

	event :dnssec_sign do
	transition operational: :pending_signing
	end

	event :signed do
	transition pending_signing: :wait_for_ready
	end

	event :push_ds do
	transition wait_for_ready: :pending_ds, operational: :pending_ds_rollover
	end

	event :plain_convert do
	transition operational: :pending_plain
	end

	event :remove do
	transition [:operational, :pending_ds_removal] => :pending_remove
	end

	event :full_remove do
	transition operational: :pending_ds_removal
	end

	# Machine events
	event :installed do
	transition pending_install: :operational
	end

	event :converted do
	transition [:pending_ds, :pending_plain] => :operational
	end

	event :complete_rollover do
	transition pending_ds_rollover: :operational
	end

	event :cleaned_up do
	transition pending_remove: :destroy
	end

	event :ksk_rollover_detected do
	transition operational: :ksk_rollover
	end
	end

	# Returns true if this domain is elegigble for DNSSEC
	def dnssec_elegible?
	return false if slave?

	true
	end

	# Returns the zone serial if a SOA record exists
	def serial
	return if !soa

	soa.serial
	end

	# Get the zone's serial strategy.
	#
	# Returns one of the supported serial strategies.
	def serial_strategy
	@serial_strategy \|\|= WebDNS.settings[:serial_strategy]
	end

	# Returns true if this a reverse zone.
	def reverse?
	name.end_with?('.in-addr.arpa') \|\| name.end_with?('.ip6.arpa')
	end

	# Returns true if this a ENUM zone.
	def enum?
	name.end_with?('.e164.arpa')
	end

	# Returns true if this is a slave zone.
	def slave?
	type == 'SLAVE'
	end

	def to_export
	Hash[
	:id, id,
	:name, name,
	:group, group.name,
	].with_indifferent_access
	end

	def to_api
	Hash[
	:name, name,
	:slave, slave?,
	:group, group.name,
	].with_indifferent_access
	end

	# Compute subnet for reverse records
	def subnet
	return if not reverse?

	if name.end_with?('.in-addr.arpa')
	subnet_v4
	elsif name.end_with?('.ip6.arpa')
	subnet_v6
	end
	end

	def self.replace_ds(parent, child, records)
	records \|\|= []
	parent = find_by_name!(parent)
	fail NotAChild if not child.end_with?(parent.name)

	existing = parent.records.where(name: child, type: 'DS')
	recs = records.map { \|rec\| DS.new(domain: parent, name: child, content: rec) }

	ActiveRecord::Base.transaction do
	existing.destroy_all
	recs.map(&:save!)
	end
	end

	# Apply api bulk to operations to the zone
	#
	# 1) Deletions
	# 2) Upserts
	# 3) Additions
	def api_bulk(opts)
	api_deletes = opts[:deletes] \|\| []
	api_upserts = opts[:upserts] \|\| []
	api_additions = opts[:additions] \|\| []
	api_delete_errors = {}

	deletes = []
	additions = {}

	api_deletes.each { \|del\|
	rec = records.find_by(del)
	# Fail-fast if record doesn't exist
	if rec.nil?
	return [{}, { deletes: { del: 'record not found'}}]
	end

	deletes << rec.id
	}

	# We delete records matching the same name & type
	api_upserts.each { \|ups\|
	query = ups.slice(:name, :type)
	+ query[:name] = Record::to_fqdn(query[:name], name)
	existing = records.where(query).to_a

	# Skip upsert if we are trying to save the same record
	next if existing.one? && ups.all? { \|k, v\| existing.first.to_api[k] == v }

	deletes += existing.map(&:id)
	api_additions << ups
	}

	api_additions.each { \|add\|
	additions[add] = add
	}

	ops, errors = bulk(deletes: deletes, additions: additions)

	# Serialize the response for API
	api_ops = {}
	api_errors = {}

	# ops
	ops.each { \|op, recs\| api_ops[op] = recs.map(&:to_api) }

	# errors
	if errors.any?
	errors.each { \|op, err\|
	api_errors[op] = err.map { \|rec, err\|
	{ operation: rec, error: err }
	}
	}
	end

	# This is a bit ugly, we return an ops hash with the original bulk
	# responses so we can feed it to record notification.
	[api_ops, api_errors, ops]
	end

	# Apply bulk to operations to the zones
	#
	# 1) Deletions
	# 2) Changes
	# 3) Additions
	def bulk(opts)
	deletes = opts[:deletes] \|\| []
	changes = opts[:changes] \|\| {}
	additions = opts[:additions] \|\| {}
	errors = Hash.new { \|h, k\| h[k] = {} }
	operations = Hash.new { \|h, k\| h[k] = [] }

	ActiveRecord::Base.transaction do
	# Deletes
	to_delete = records.where(id: deletes).index_by(&:id)
	deletes.each { \|rec_id\|
	if rec = to_delete[Integer(rec_id)]
	rec.destroy
	operations[:deletes] << rec
	next
	end

	errors[:deletes][rec_id] = 'Deleted record not found'
	}

	# Changes
	to_change = records.where(id: changes.keys).index_by(&:id)
	changes.each {\|rec_id, changes\|
	if rec = to_change[Integer(rec_id)]
	operations[:changes] << rec
	errors[:changes][rec_id] = rec.errors.full_messages.join(', ') if !rec.update(changes)
	next
	end

	errors[:changes][rec_id] = 'Changed record not found'
	}

	# Additions
	additions.each { \|inc, attrs\|
	rec = records.new(attrs)
	operations[:additions] << rec
	errors[:additions][inc] = rec.errors.full_messages.join(', ') if !rec.save
	}

	raise ActiveRecord::Rollback if errors.any?
	end

	[operations, errors]
	end

	private

	def subnet_v4
	# get ip octets (remove .in-addr.arpa)
	octets = name.split('.')[0...-2].reverse
	return if octets.any? { \|_\| false }

	mask = 8 * octets.size
	octets += [0, 0, 0, 0]

	ip = IPAddr.new octets[0, 4].join('.')

	[ip, mask].join('/')
	end

	def subnet_v6
	nibbles = name.split('.')[0...-2].reverse
	return if nibbles.any? { \|_\| false }

	mask = 4 * nibbles.size
	nibbles += [0] * 32

	ip = IPAddr.new nibbles[0, 32].in_groups_of(4).map(&:join).join(':')

	[ip, mask].join('/')
	end

	# Hooks

	def generate_soa
	soa_record = SOA.new(domain: self)

	soa_record.save!
	end

	def generate_ns
	return if slave?
	return if WebDNS.settings[:default_ns].empty?

	WebDNS.settings[:default_ns].each { \|ns\|
	Record.find_or_create_by!(domain: self, type: 'NS', name: '', content: ns)
	}
	end

	def generate_subscriptions
	group.users.where(notifications: false).each { \|u\|
	opt_outs.create(user: u)
	}
	end

	def check_convert
	return if !dnssec_changed?

	event = dnssec ? :dnssec_sign : :plain_convert
	if state_events.include?(event)
	self.fire_event = event # Schedule event for after commit
	return true
	end

	errors.add(:dnssec, 'You cannot modify dnssec settings in this state!')
	false
	end

	def check_dnssec_parent_authority
	cfg = WebDNS.settings[:dnssec_parent_authorities][dnssec_parent_authority.to_sym]
	return if !cfg[:valid]

	return true if cfg[:valid].call(dnssec_parent)

	errors.add(:dnssec_parent_authority, 'Parent zone is not accepted for the selected parent authority!')
	false
	end

	def after_commit_event
	return if !fire_event

	fire_state_event(fire_event)
	self.fire_event = nil
	end
	end
	diff --git a/app/models/record.rb b/app/models/record.rb
	index 69492eb..586ef12 100644
	--- a/app/models/record.rb
	+++ b/app/models/record.rb
	@@ -1,322 +1,328 @@
	require 'ipaddr'
	require_dependency 'drop_privileges_validator'

	class Record < ActiveRecord::Base
	belongs_to :domain
	# Powerdns inserts empty records on slave zones,
	# we want to hide them
	#
	# http://mailman.powerdns.com/pipermail/pdns-users/2013-December/010389.html
	default_scope { where.not(type: nil) }

	# List all supported DNS RR types.
	def self.record_types
	[
	'A', 'AAAA', 'CNAME',
	'MX',
	'TXT', 'SPF', 'SRV', 'SSHFP',
	'SOA', 'NS',
	'PTR', 'NAPTR',
	'DS'
	]
	end

	# List types usually used in forward zones.
	def self.forward_records
	record_types - ['SOA', 'PTR']
	end

	# List types usually used in reverse zones.
	def self.reverse_records
	['PTR', 'CNAME', 'TXT', 'NS', 'NAPTR', 'DS']
	end

	# List types usually used in enum zones.
	def self.enum_records
	['NAPTR', 'CNAME', 'TXT', 'NS', 'DS']
	end

	# List types that can be touched by a simple user.
	def self.allowed_record_types
	record_types - WebDNS.settings[:prohibit_records_types]
	end

	validates :name, presence: true
	validates :type, inclusion: { in: record_types }

	# http://mark.lindsey.name/2009/03/never-use-dns-ttl-of-zero-0.html
	validates_numericality_of :ttl,
	allow_nil: true, # Default pdns TTL
	only_integer: true,
	greater_than: 0,
	less_than_or_equal_to: 2_147_483_647

	# Don't allow the following actions on drop privileges mode
	validate :no_touching_for_slave_zones, if: -> { domain.slave? }

	validates_drop_privileges :type,
	message: 'You cannot touch that record!',
	unless: -> { Record.allowed_record_types.include?(type) }
	validates_drop_privileges :name,
	message: 'You cannot touch top level NS records!',
	if: -> { type == 'NS' && domain_record? }

	before_validation :guess_reverse_name
	before_validation :set_name
	after_save :update_zone_serial
	after_destroy :update_zone_serial

	before_create :generate_classless_delegations, unless: -> { domain.slave? }
	before_destroy :delete_classless_delegations, unless: -> { domain.slave? }

	# Smart sort a list of records.
	#
	# Order by:
	# * Top level records
	# * Record name
	# * SOA
	# * NS
	# * Friendly type
	# * Priority
	# * Content
	#
	# records - The list of records to order.
	#
	# Returns the list sorted.
	def self.smart_order(records)
	records.sort_by { \|r\|
	[
	r.domain_record? ? 0 : 1, # Zone records
	r.classless_delegated? ? 1 : 0,
	r.name,
	r.type == 'SOA' ? 0 : 1,
	r.type == 'NS' ? 0 : 1,
	record_types.index(r.type), # Friendly type
	r.prio \|\| 0,
	r.content
	]
	}
	end

	def self.search(query)
	wild_search = "%#{query}%" # !index_friendly

	where('name like :q or content like :q', q: wild_search)
	end

	# Get the a short name for the record (without the zone suffix).
	#
	# Returns a string.
	def short
	return '' if name == domain.name
	return '' if name.blank?

	File.basename(name, ".#{domain.name}")
	end

	# Returns true if this is a zone record.
	def domain_record?
	name.blank? \|\| name == domain.name
	end

	# Find out if the record is edittable.
	#
	# by - Editable by :user or :admin.
	#
	# Returns true if the record is editable.
	def editable?(by = :user)
	return false if domain.slave?
	return false if classless_delegated?

	case by
	when :user
	return false unless Record.allowed_record_types.include?(type)
	return false if type == 'NS' && domain_record?
	end

	true
	end

	# Find out this record type supports priorities.
	#
	# We set this to false by default, record types that support priorities.
	# shoule override this.
	#
	# Returns true this record type support priorities.
	def supports_prio?
	false
	end

	# Make sure rails generates record specific urls for all record types.
	#
	# Overrides default rails STI behavior.
	def self.model_name
	return super if self == Record

	Record.model_name
	end

	# Generate the usual admin friendly DNS record line.
	#
	# Returns a string.
	def to_dns
	[name, ttl, 'IN', type, supports_prio? ? prio : nil, content].compact.join(' ')
	end

	# Generate a shorter version of the DNS record line.
	#
	# Returns a string.
	def to_short_dns
	[name, 'IN', type].join(' ')
	end

	def to_api
	Hash[
	:name, name,
	:content, content,
	:type, type,
	:ttl, ttl,
	:prio, prio,
	:disabled, disabled
	].with_indifferent_access
	end

	def classless_delegated?
	return false if not type == 'CNAME'
	return false if not domain.name.end_with?('.in-addr.arpa')

	network, mask = parse_delegation(content)
	return false if network.nil?

	octet = name.split('.').first.to_i
	return true if octet >= network
	return true if octet <= network + 2 ^ (32 - mask) - 1 # max

	false
	end

	def classless_delegation?
	return true if classless_delegation

	false
	end

	def as_bulky_json
	Hash[
	id: id,
	name: name,
	type: type,
	ttl: ttl,
	prio: prio,
	content: content,
	disabled: disabled
	]
	end
	private

	# Validations

	def no_touching_for_slave_zones
	# Allow automatic SOA creation for slave zones
	# powerdns needs a valid serial to compare it with master
	return if type == 'SOA' && validation_context == :create

	errors.add(:type, 'This is a slave zone!')
	end

	# Hooks

	def guess_reverse_name
	return if not type == 'PTR'
	return if not domain.reverse?
	return if name.blank?

	reverse = IPAddr.new(name).reverse
	self.name = reverse if reverse.end_with?(domain.name)
	rescue IPAddr::InvalidAddressError # rubycop:disable HandleExceptions
	end

	# Powerdns expects full domain names
	def set_name
	self.name = domain.name if name.blank?
	self.name = "#{name}.#{domain.name}" if not name.end_with?(domain.name)
	end

	def remove_terminating_dot
	self.content = content.gsub(/\.+\Z/, '')
	end

	def update_zone_serial
	# SOA records handle serial themselves
	return true if type == 'SOA'
	return true if !domain

	domain.soa.bump_serial!
	end

	def classless_delegation
	return if not type == 'NS'
	return if not domain.name.end_with?('.in-addr.arpa')

	network, mask = parse_delegation(name)
	return if network.nil?

	range = IPAddr.new("0.0.0.#{network}/#{mask}").to_range
	return if !range.first.to_s.end_with?(".#{network}")

	range.map { \|ip\|
	octet = ip.to_s.split('.').last
	"#{octet}.#{domain.name}"
	}
	end

	def parse_delegation(value)
	first, _rest = value.split('.', 2)
	first.gsub!('-', '/')
	return if !first['/']

	network, mask = first.split('/', 2).map { \|i\| Integer(i).abs }
	return if [network, mask].join('/') != first
	return if mask <= 24
	return if mask > 31
	return if network > 255

	[network, mask]
	rescue ArgumentError # Not an integer
	end

	def delete_classless_delegations
	rnames = classless_delegation
	return unless rnames

	# Check if we have another NS for the same delegation
	return if domain.records.where(type: 'NS', name: name)
	.where.not(id: id).exists?

	# Delete all CNAMEs
	domain.records.where(name: rnames,
	type: 'CNAME',
	content: name).delete_all
	end

	def generate_classless_delegations
	rnames = classless_delegation
	return unless rnames

	# Make sure no record exists for a delegated domain
	if domain.records.where(name: rnames)
	.where.not(content: name).exists?

	errors.add(:name, 'Records already exist for the delegated octets!')
	return false
	end

	rnames.each { \|rname\|
	CNAME.find_or_create_by!(
	domain: domain,
	name: rname,
	content: name
	)
	}
	end
	+
	+ def self.to_fqdn(name, domain)
	+ return name if name.end_with?(domain)
	+
	+ "#{name}.#{domain}"
	+ end
	end

No OneTemporaryActions

File Metadata

View Options

Event Timeline

No OneTemporary
Actions