[bind] Mise au propre de named.conf.local, ajout d'une response-policy
On utilise des with class as v pour écrire named.conf.local, ça permet d'avoir a de forcer l'identation à être identique dans le fichier de bcfg2 et dans le fichier produit. On rajoute une zone de response-policy pour les vlan où on ment potentiellement sur les réponse dns (pour le moment, ça ne concerne que install-party). Actuellement, on ne ment que pour rediriger les dépot officiel d'ubuntu vers charybde depuis install-party.
This commit is contained in:
Valentin Samir
parent
100f3c35bd
commit
bf71450e4d
3 changed files with 109 additions and 77 deletions
|
|
@ -3,6 +3,7 @@
|
||||||
<Python name="/etc/bind/named.conf"/>
|
<Python name="/etc/bind/named.conf"/>
|
||||||
<Python name="/etc/bind/named.conf.local"/>
|
<Python name="/etc/bind/named.conf.local"/>
|
||||||
<Python name="/etc/bind/named.conf.options"/>
|
<Python name="/etc/bind/named.conf.options"/>
|
||||||
|
<Python name="/etc/bind/db.loppsi.crans.org"/>
|
||||||
<Group name="dns-primary">
|
<Group name="dns-primary">
|
||||||
<Python name="/etc/bind/named.conf.notify"/>
|
<Python name="/etc/bind/named.conf.notify"/>
|
||||||
</Group>
|
</Group>
|
||||||
|
|
|
||||||
|
|
@ -12,96 +12,126 @@ comment_start = "//"
|
||||||
|
|
||||||
header("Conf locale de Bind9")
|
header("Conf locale de Bind9")
|
||||||
|
|
||||||
def forward_zone(zone,forwarders):
|
ident=0
|
||||||
print """zone "%s" {
|
class print_idented(object):
|
||||||
type forward;
|
def __init(self):
|
||||||
forward only;
|
pass
|
||||||
forwarders { %s; };
|
def p(self, str):
|
||||||
};
|
print '%s%s' % (' '*ident, str)
|
||||||
""" % (zone,'; '.join(forwarders))
|
|
||||||
|
class view(print_idented):
|
||||||
|
def __init__(self, name, match_client=None):
|
||||||
|
self.name = name
|
||||||
|
self.match_client =match_client
|
||||||
|
def __enter__(self):
|
||||||
|
global ident
|
||||||
|
self.p('view "%s" {' % self.name)
|
||||||
|
ident+=1
|
||||||
|
if self.match_client:
|
||||||
|
self.p("match-clients { %s; };" % self.match_client)
|
||||||
|
return self
|
||||||
|
def __exit__(self ,type, value, traceback):
|
||||||
|
global ident
|
||||||
|
ident-=1
|
||||||
|
self.p("};")
|
||||||
|
|
||||||
|
class zone(print_idented):
|
||||||
|
def __init__(self, name, type):
|
||||||
|
self.name = name
|
||||||
|
self.type = type
|
||||||
|
def __enter__(self):
|
||||||
|
global ident
|
||||||
|
self.p('zone "%s" {' % self.name)
|
||||||
|
ident+=1
|
||||||
|
self.p("type %s;" % self.type)
|
||||||
|
return self
|
||||||
|
def __exit__(self ,type, value, traceback):
|
||||||
|
global ident
|
||||||
|
ident-=1
|
||||||
|
self.p("};")
|
||||||
|
|
||||||
|
def forward_zone(zone_name, forwarders):
|
||||||
|
with zone(zone_name, "forward") as z:
|
||||||
|
z.p("forward only;")
|
||||||
|
z.p("forwarders { %s; };" % '; '.join(forwarders))
|
||||||
|
|
||||||
def reverse_crans():
|
def reverse_crans():
|
||||||
for net in set([ net for net in config.dns.zones_reverse if net not in config.NETs['multicast']]):
|
# On ne génère plus les zone de forward pour les reverse des ips publiques, vu que maintenant, ils marchent
|
||||||
|
for net in set([ net for net in config.dns.zones_reverse if net not in config.NETs['multicast'] + config.NETs["all"]]):
|
||||||
for zone in netv4_to_arpa(net):
|
for zone in netv4_to_arpa(net):
|
||||||
forward_zone(zone, [config.dns.master] + config.dns.slaves)
|
forward_zone(zone, [config.dns.master] + config.dns.slaves)
|
||||||
|
|
||||||
for net in set(config.dns.zones_reverse_v6):
|
#for net in set(config.dns.zones_reverse_v6):
|
||||||
forward_zone(netv6_to_arpa(net), [config.dns.master] + config.dns.slaves)
|
# forward_zone(netv6_to_arpa(net), [config.dns.master] + config.dns.slaves)
|
||||||
|
|
||||||
def direct_crans():
|
def direct_crans():
|
||||||
for zone in config.dns.zones_direct:
|
for zone in config.dns.zones_direct:
|
||||||
forward_zone(zone, [config.dns.master] + config.dns.slaves)
|
forward_zone(zone, [config.dns.master] + config.dns.slaves)
|
||||||
|
|
||||||
if has("vlan-accueil"):
|
|
||||||
@view "accueilview" {
|
|
||||||
@ match-clients { "accueil"; };
|
|
||||||
@
|
|
||||||
@// On ment pour tout sauf quelques ips crans
|
|
||||||
@ zone "." {
|
|
||||||
@ type master;
|
|
||||||
@ file "/etc/bind/db.fake";
|
|
||||||
@ };
|
|
||||||
@
|
|
||||||
@ recursion no;
|
|
||||||
@};
|
|
||||||
|
|
||||||
@view "others" {
|
|
||||||
@ match-clients { any; };
|
|
||||||
@ recursion yes;
|
|
||||||
if has("dns-secondary-no-forward") or has("dns-secondary") or has("dns-primary"):
|
|
||||||
@include "/etc/bind/zones.rfc1918";
|
|
||||||
|
|
||||||
@// zones crans
|
|
||||||
@include "/etc/bind/generated/zones_crans";
|
|
||||||
|
|
||||||
if has("dns-tv"):
|
|
||||||
@// La zone TV
|
|
||||||
@zone "tv.crans.org" {
|
|
||||||
@ type master;
|
|
||||||
if not "tv.crans.org" in config.dns.zones_dnssec:
|
|
||||||
@ file "/etc/bind/generated/db.tv.crans.org";
|
|
||||||
else:
|
|
||||||
@ file "/etc/bind/signed/db.tv.crans.org";
|
|
||||||
@};
|
|
||||||
|
|
||||||
@zone "239.in-addr.arpa" {
|
|
||||||
@ type master;
|
|
||||||
@ file "/etc/bind/generated/db.239.in-addr.arpa";
|
|
||||||
@};
|
|
||||||
|
|
||||||
|
|
||||||
if has("dns-recursif") and not has("dns-secondary-no-forward"):
|
if has("dns-recursif") and not has("dns-secondary-no-forward"):
|
||||||
@zone "239.in-addr.arpa" {
|
with view("menteur", "menteur") as v:
|
||||||
@ type slave;
|
v.p('response-policy { zone "loppsi.crans.org"; };')
|
||||||
@ file "/etc/bind/generated/db.239.in-addr.arpa";
|
with zone("loppsi.crans.org", "master") as z:
|
||||||
print" masters { %s; };" % config.dns.master_tv
|
z.p('file "/etc/bind/db.loppsi.crans.org";')
|
||||||
@};
|
z.p('allow-query {none;};')
|
||||||
|
|
||||||
reverse_crans()
|
|
||||||
|
|
||||||
elif has("dns-forward-only"):
|
|
||||||
@forward only;
|
|
||||||
print "forwarders { %s; };" % '; '.join(config.dns.recursiv['adm'])
|
|
||||||
|
|
||||||
@// anti SPAM
|
|
||||||
@// Rajout pour generer le forward vers ariane pour la zone rbl-plus.mail-abuse.org --Nico 21/04/02
|
|
||||||
@zone "rbl-plus.mail-abuse.org" {
|
|
||||||
@ type forward;
|
|
||||||
@ forward only;
|
|
||||||
print " forwarders { "
|
|
||||||
print " %s;" % "; \n ".join(config.dns.parents)
|
|
||||||
print " }; "
|
|
||||||
@};
|
|
||||||
@
|
|
||||||
|
|
||||||
|
with zone("239.in-addr.arpa", "slave") as z:
|
||||||
|
z.p('file "/etc/bind/generated/db.239.in-addr.arpa";')
|
||||||
|
z.p('masters { %s; };' % config.dns.master_tv)
|
||||||
|
|
||||||
|
reverse_crans()
|
||||||
|
|
||||||
if has("vlan-accueil"):
|
if has("vlan-accueil"):
|
||||||
@};
|
with view("accueilview", "accueil") as v:
|
||||||
|
v.p("recursion no;")
|
||||||
|
v.p("// On ment pour tout sauf quelques ips crans")
|
||||||
|
with zone(".", "master") as z:
|
||||||
|
z.p('file "/etc/bind/db.fake";')
|
||||||
|
|
||||||
@// bricoles de config en plus
|
with view("default-view", "any") as v:
|
||||||
@include "/etc/bind/rndc.key";
|
v.p("recursion yes;")
|
||||||
@
|
if has("dns-secondary-no-forward") or has("dns-secondary") or has("dns-primary"):
|
||||||
@controls {
|
v.p('include "/etc/bind/zones.rfc1918";')
|
||||||
@ inet 127.0.0.1 allow { 127.0.0.1; } keys { "key"; };
|
v.p('// zones crans')
|
||||||
@};
|
v.p('include "/etc/bind/generated/zones_crans";')
|
||||||
|
|
||||||
|
if has("dns-tv"):
|
||||||
|
v.p('// La zone TV')
|
||||||
|
with zone("tv.crans.org", "master") as z:
|
||||||
|
if not "tv.crans.org" in config.dns.zones_dnssec:
|
||||||
|
z.p('file "/etc/bind/generated/db.tv.crans.org";')
|
||||||
|
else:
|
||||||
|
z.p('file "/etc/bind/signed/db.tv.crans.org";')
|
||||||
|
|
||||||
|
with zone("239.in-addr.arpa", "master") as z:
|
||||||
|
z.p('type master;')
|
||||||
|
z.p('file "/etc/bind/generated/db.239.in-addr.arpa";')
|
||||||
|
|
||||||
|
if has("dns-recursif") and not has("dns-secondary-no-forward"):
|
||||||
|
with zone("239.in-addr.arpa", "slave") as z:
|
||||||
|
z.p('file "/etc/bind/generated/db.239.in-addr.arpa";')
|
||||||
|
z.p('masters { %s; };' % config.dns.master_tv)
|
||||||
|
|
||||||
|
reverse_crans()
|
||||||
|
|
||||||
|
elif has("dns-forward-only"):
|
||||||
|
v.p("forward only;")
|
||||||
|
v.p("forwarders { %s; };" % '; '.join(config.dns.recursiv['adm']))
|
||||||
|
|
||||||
|
v.p('// anti SPAM')
|
||||||
|
v.p('// Rajout pour generer le forward vers ariane pour la zone rbl-plus.mail-abuse.org --Nico 21/04/02')
|
||||||
|
with zone("rbl-plus.mail-abuse.org", "forward") as z:
|
||||||
|
z.p('forward only;')
|
||||||
|
z.p('forwarders {')
|
||||||
|
for f in config.dns.parents:
|
||||||
|
z.p(' %s;' % f)
|
||||||
|
z.p('};')
|
||||||
|
|
||||||
|
print """
|
||||||
|
// bricoles de config en plus
|
||||||
|
include "/etc/bind/rndc.key";
|
||||||
|
|
||||||
|
controls {
|
||||||
|
inet 127.0.0.1 allow { 127.0.0.1; } keys { "key"; };
|
||||||
|
};
|
||||||
|
"""
|
||||||
|
|
|
||||||
|
|
@ -22,6 +22,7 @@ if has("vlan-ens"):
|
||||||
print 'acl "appartement" { %s; };' % '; '.join(config.NETs['personnel-ens'] + config.prefix['personnel-ens'])
|
print 'acl "appartement" { %s; };' % '; '.join(config.NETs['personnel-ens'] + config.prefix['personnel-ens'])
|
||||||
print 'acl "crans" { %s; };' % '; '.join(config.prefix['fil'] + config.prefix['wifi'] + config.NETs['all'])
|
print 'acl "crans" { %s; };' % '; '.join(config.prefix['fil'] + config.prefix['wifi'] + config.NETs['all'])
|
||||||
print 'acl "cransadm" { %s; };' % '; '.join(config.prefix['adm'] + config.NETs['adm'])
|
print 'acl "cransadm" { %s; };' % '; '.join(config.prefix['adm'] + config.NETs['adm'])
|
||||||
|
print 'acl "menteur" { %s; };' % '; '.join(config.dns.menteur_clients)
|
||||||
|
|
||||||
|
|
||||||
@options {
|
@options {
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue