mirror of
https://github.com/StackExchange/dnscontrol.git
synced 2025-12-09 13:46:07 +08:00
1b2f5d4d34
# Issue Fixes https://github.com/StackExchange/dnscontrol/issues/3842 CC @das7pad # Resolution Convert domain.Name to IDN earlier in the pipeline. Hack the --domains processing to convert everything to IDN. * Domain names are now stored 3 ways: The original input from dnsconfig.js, canonical IDN format (`xn--...`), and Unicode format. All are downcased. Providers that haven't been updated will receive the IDN format instead of the original input format. This might break some providers but only for users with unicode in their D("domain.tld"). PLEASE TEST YOUR PROVIDER. * BIND filename formatting options have been added to access the new formats. # Breaking changes * BIND zonefiles may change. The default used the name input in the D() statement. It now defaults to the IDN name + "!tag" if there is a tag. * Providers that are not IDN-aware may break (hopefully only if they weren't processing IDN already) --------- Co-authored-by: Jakob Ackermann <das7pad@outlook.com>
67 lines
1.7 KiB
Go
67 lines
1.7 KiB
Go
package powerdns
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/StackExchange/dnscontrol/v4/models"
|
|
"github.com/mittwald/go-powerdns/apis/cryptokeys"
|
|
"github.com/mittwald/go-powerdns/pdnshttp"
|
|
)
|
|
|
|
// getDNSSECCorrections returns corrections that update a domain's DNSSEC state.
|
|
func (dsp *powerdnsProvider) getDNSSECCorrections(dc *models.DomainConfig) ([]*models.Correction, error) {
|
|
domainVariant := dsp.zoneName(dc.Name, dc.Tag)
|
|
zoneCryptokeys, getErr := dsp.client.Cryptokeys().ListCryptokeys(context.Background(), dsp.ServerName, domainVariant)
|
|
if getErr != nil {
|
|
if _, ok := getErr.(pdnshttp.ErrNotFound); ok {
|
|
// Zone doesn't exist, this is okay as no corrections are needed
|
|
return nil, nil
|
|
}
|
|
return nil, getErr
|
|
}
|
|
|
|
// check if any of the avail. key is active and published
|
|
hasEnabledKey := false
|
|
var keyID int
|
|
|
|
if len(zoneCryptokeys) > 0 {
|
|
for _, cryptoKey := range zoneCryptokeys {
|
|
if cryptoKey.Active && cryptoKey.Published {
|
|
hasEnabledKey = true
|
|
keyID = cryptoKey.ID
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
// dnssec is enabled, we want it to be disabled
|
|
if hasEnabledKey && dc.AutoDNSSEC == "off" {
|
|
return []*models.Correction{
|
|
{
|
|
Msg: "Disable DNSSEC",
|
|
F: func() error {
|
|
return dsp.client.Cryptokeys().DeleteCryptokey(context.Background(), dsp.ServerName, domainVariant, keyID)
|
|
},
|
|
},
|
|
}, nil
|
|
}
|
|
|
|
// dnssec is disabled, we want it to be enabled
|
|
if !hasEnabledKey && dc.AutoDNSSEC == "on" {
|
|
return []*models.Correction{
|
|
{
|
|
Msg: "Enable DNSSEC",
|
|
F: func() (err error) {
|
|
_, err = dsp.client.Cryptokeys().CreateCryptokey(context.Background(), dsp.ServerName, domainVariant, cryptokeys.Cryptokey{
|
|
KeyType: "csk",
|
|
Active: true,
|
|
Published: true,
|
|
})
|
|
return
|
|
},
|
|
},
|
|
}, nil
|
|
}
|
|
|
|
return nil, nil
|
|
}
|