dnsupdate

#!/usr/bin/python
# -*- coding: utf-8 -*-

# (c) 2012, Jan-Piet Mens <jpmens () gmail.com>
#
# This file is part of Ansible
#
# Ansible is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# Ansible is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.

DOCUMENTATION = '''
---
module: dnsupdate
short_description: Perform Dynamic DNS Updates (RFC 2136)
description:
     - This module performs dynamic DNS updates as per RFC 2136.
version_added: "0.9"
options:
  keyname:
    description:
      - name of the TSIG key required to perform updates
    required: true
    default: null
    aliases: []
  secret:
    description:
      - secret TSIG key blob (base-64 encoded)
    required: true
    default: null
    aliases: []
  keyalgo:
    description:
      - TSIG key algorithm
    required: false
    default: 'hmac-md5'
    choices: [ 'hmac-md5', 'hmac-sha1', 'hmac-sha224', 'hmac-sha256', 'hmac-sha384', 'hmac-sha512' ]
    aliases: []
  mname:
    description:
      - address of the master server to which to send the update to.
        This module does not currently determine the I(mname) from
        the zone's SOA record.
    required: true
    default: null
    aliases: []
  zone:
    description:
      - name of the authoritative zone (e.g. C(example.com))
    required: true
    default: null
    aliases: []
  domain:
    description:
      - domain name to update (e.g. C(www))
    required: true
    default: null
    aliases: []
  a:
    description:
      - The I(rdata) for the A resource record type (i.e. an IPv4 address)
    required: false
    default: null
    aliases: []
  aaaa:
    description:
      - The I(rdata) for the AAAA resource record type (i.e. an IPv6 address)
    required: false
    default: null
    aliases: []
  cname:
    description:
      - The I(rdata) for the CNAME resource record type (i.e. C(example.com))
    required: false
    default: null
    aliases: []
  txt:
    description:
      - The I(rdata) for the TXT resource record type. Space-separated strings
        are encoded as per DNS rules.
    required: false
    default: null
    aliases: []
  rtype:
    description:
      - The type of DNS resource record to operate on
    required: false
    default: null
    aliases: []
  rdata:
    description:
      - The I(rdata) for the resource record specified by the rtype option
    required: false
    default: null
    aliases: []
  ttl:
    description:
      - Time to Live for the RR.
    required: true
    default: 3600
    aliases: []
  op:
    description:
      - Operation to perform. C(add) adds the specified RR to the RRset, C(del)
        deletes the specified RRset and C(replace) replaces the RRset with the RRs.
        If the operation is C(delete), the value of the RR is not verified as the
        B(whole) RRset is deleted from the DNS.  If you want to delete only a record
        with a matching RR value, use C(delete-matching).
    required: false
    default: 'add'
    choices: ['add','delete', 'delete-matching', 'replace']
    aliases: []
examples:
   - code: |
       local_action: dnsupdate keyname="mykey1"
                  secret="xxxxxxxxxx=="
                  mname=192.168.1.10
                  zone=example.org
                  domain=www
                  a=${ec2_ip_address}
                  op=add
     description: "Example from Ansible Playbooks"
notes:
  - This module requires I(dnspython) (U(http://www.dnspython.org/)), and it will
    typically be run as a C(local_action) so as to not push the secret TSIG key
    all over the show.
# informational: requirements for nodes
requirements: [ dnspython ]
author: Jan-Piet Mens
'''

HAS_DNSPYTHON=True
try:
    import dns.update
    import dns.query
    import dns.tsigkeyring
except ImportError:
    HAS_DNSPYTHON=False

def dns_update(keyname, secret, keyalgo, mname, zone, domain, op, a, aaaa, cname, txt=None, rtype=None, rdata=None, ttl=3600):

    success=False
    msg = ''
    key_algorithms = {
        'hmac-md5'   : 'HMAC-MD5.SIG-ALG.REG.INT',
        'hmac-sha1'  : 'hmac-sha1.',
        'hmac-sha224': 'hmac-sha224.',
        'hmac-sha256': 'hmac-sha256.',
        'hmac-sha384': 'hmac-sha384.',
        'hmac-sha512': 'hmac-sha512.',
    }

    keyalgorithm = key_algorithms[keyalgo]

    keyring = dns.tsigkeyring.from_text({
            keyname : secret })

    update = dns.update.Update(zone,
                    keyring=keyring,
                    keyname=keyname,
                    keyalgorithm=keyalgorithm)
    if op == 'add':
        if a is not None:
            update.add(domain, ttl, 'A', a)
        if aaaa is not None:
            update.add(domain, ttl, 'AAAA', aaaa)
        if cname is not None:
            update.add(domain, ttl, 'CNAME', cname)
        if txt is not None:
            update.add(domain, ttl, 'TXT', txt)
        # Generic support for all other record types
        if rtype is not None:
            update.add(domain, ttl, rtype, rdata)
    elif op == 'delete':
        if a is not None:
            update.delete(domain, 'A')
        if aaaa is not None:
            update.delete(domain, 'AAAA')
        if cname is not None:
            update.delete(domain, 'CNAME')
        if txt is not None:
            update.delete(domain, 'TXT')
        # Generic support for all other record types
        if rtype is not None:
            update.delete(domain, rtype)
    elif op == 'delete-matching':
        if a is not None:
            update.delete(domain, 'A', a)
        if aaaa is not None:
            update.delete(domain, 'AAAA', aaaa)
        if cname is not None:
            update.delete(domain, 'CNAME', cname)
        if txt is not None:
            update.delete(domain, 'TXT', txt)
        # Generic support for all other record types
        if rtype is not None:
            update.delete(domain, rtype, rdata)
    elif op == 'replace':
        if a is not None:
            update.replace(domain, ttl, 'A', a)
        if aaaa is not None:
            update.replace(domain, ttl, 'AAAA', aaaa)
        if cname is not None:
            update.replace(domain, ttl, 'CNAME', cname)
        if txt is not None:
            update.replace(domain, ttl, 'TXT', txt)
        # Generic support for all other record types
        if rtype is not None:
            update.replace(domain, ttl, rtype, rdata)
    else:
        return False, 'UNKNOWNOPERATION'

    try:
        response = dns.query.udp(update, mname, timeout=10)
        success = True
    except dns.tsig.PeerBadKey:
        return False, 'BADKEY'
        pass
    except dns.tsig.PeerBadSignature:
        return False, 'BADPEERSIG'
        pass
    except dns.exception.Timeout:
        return False, 'TIMEOUT'
        pass

    if success:
        msg = dns.rcode.to_text(response.rcode())
        if msg == 'REFUSED':
            return False, 'REFUSED'
    return True, msg


# ==============================================================
# main

def main():

    module = AnsibleModule(
        argument_spec = dict(
                keyname = dict(required=True),
                secret = dict(required=True),
                mname = dict(required=True),
                zone = dict(required=True),
                domain = dict(required=True),
                a = dict(required=False),
                aaaa = dict(required=False),
		cname = dict(required=False),
                txt = dict(required=False),
                rtype = dict(required=False),
                rdata = dict(required=False),
                ttl = dict(default=3600, required=False),
                keyalgo = dict(default='hmac-md5', choices=[
                     'hmac-md5', 'hmac-sha1', 'hmac-sha224',
                     'hmac-sha256', 'hmac-sha384', 'hmac-sha512' ]),
                op = dict(default='add', required=False, choices=[ 'add', 'delete', 'delete-matching', 'replace' ]),
        )
    )

    if not HAS_DNSPYTHON:
        module.fail_json(msg="dnspython is not installed")

    keyname    = module.params['keyname']
    secret     = module.params['secret']
    mname      = module.params['mname']
    zone       = module.params['zone']
    domain     = module.params['domain']
    a          = module.params['a']
    aaaa       = module.params['aaaa']
    rtype      = module.params['rtype']
    rdata      = module.params['rdata']
    cname      = module.params['cname']
    txt        = module.params['txt']
    ttl        = module.params['ttl']
    keyalgo    = module.params['keyalgo']
    op         = module.params['op']

    if rtype is not None and rdata is None:
        module.fail_json(msg="rdata is required if rtype is specified")

    changed=False

    r, msg = dns_update(keyname, secret, keyalgo, mname, zone, domain, op, a, aaaa, cname, txt, rtype, rdata, ttl)

    if r == False or msg == 'NOTAUTH':
        module.fail_json(msg='DNS update on %s failed: %s (%s)' % (mname, msg, zone))

    # Mission complete
    changed=True
    module.exit_json(changed=changed, msg="OK", dnsupdate=msg)

# this is magic, see lib/ansible/module_common.py
#<<INCLUDE_ANSIBLE_MODULE_COMMON>>
main()