mirror of
https://github.com/pfsense/pfsense.git
synced 2025-10-26 11:38:35 +00:00
Merge pull request #3893 from JoeriCapens/ddns-rfc2136-algorithm-choice
This commit is contained in:
jim-p
commit
31bb3fb620
@ -74,7 +74,7 @@ $g = array(
|
||||
"disablecrashreporter" => false,
|
||||
"crashreporterurl" => "https://crashreporter.pfsense.org/crash_reporter.php",
|
||||
"debug" => false,
|
||||
"latest_config" => "17.3",
|
||||
"latest_config" => "17.4",
|
||||
"minimum_ram_warning" => "101",
|
||||
"minimum_ram_warning_text" => "128 MB",
|
||||
"wan_interface_name" => "wan",
|
||||
|
||||
@ -2531,39 +2531,16 @@ function services_dnsupdate_process($int = "", $updatehost = "", $forced = false
|
||||
$hostname .= ".";
|
||||
}
|
||||
|
||||
/*
|
||||
* write private key file
|
||||
* this is dumb - public and private keys are the same for
|
||||
* HMAC-MD5, but nsupdate insists on having both
|
||||
*/
|
||||
$fd = fopen($g['varetc_path'] .
|
||||
"/K{$i}{$keyname}+157+00000.private", "w");
|
||||
$privkey = <<<EOD
|
||||
Private-key-format: v1.2
|
||||
Algorithm: 157 (HMAC)
|
||||
Key: {$dnsupdate['keydata']}
|
||||
/* write key file */
|
||||
$algorithm = empty($dnsupdate['keyalgorithm']) ? 'hmac-md5' : $dnsupdate['keyalgorithm'];
|
||||
$upkey = <<<EOD
|
||||
key "{$keyname}" {
|
||||
algorithm {$algorithm};
|
||||
secret "{$dnsupdate['keydata']}";
|
||||
};
|
||||
|
||||
EOD;
|
||||
fwrite($fd, $privkey);
|
||||
fclose($fd);
|
||||
|
||||
/* write public key file */
|
||||
if ($dnsupdate['keytype'] == "zone") {
|
||||
$flags = 257;
|
||||
$proto = 3;
|
||||
} else if ($dnsupdate['keytype'] == "host") {
|
||||
$flags = 513;
|
||||
$proto = 3;
|
||||
} else if ($dnsupdate['keytype'] == "user") {
|
||||
$flags = 0;
|
||||
$proto = 2;
|
||||
}
|
||||
|
||||
$fd = fopen($g['varetc_path'] .
|
||||
"/K{$i}{$keyname}+157+00000.key", "w");
|
||||
fwrite($fd, "{$keyname} IN KEY {$flags} {$proto} 157 " .
|
||||
"{$dnsupdate['keydata']}\n");
|
||||
fclose($fd);
|
||||
@file_put_contents("{$g['varetc_path']}/nsupdatekey{$i}", $upkey);
|
||||
|
||||
/* generate update instructions */
|
||||
$upinst = "";
|
||||
@ -2633,12 +2610,10 @@ EOD;
|
||||
continue;
|
||||
}
|
||||
|
||||
@file_put_contents("{$g['varetc_path']}/nsupdatecmds{$i}",
|
||||
$upinst);
|
||||
@file_put_contents("{$g['varetc_path']}/nsupdatecmds{$i}", $upinst);
|
||||
unset($upinst);
|
||||
/* invoke nsupdate */
|
||||
$cmd = "/usr/local/bin/nsupdate -k " .
|
||||
"{$g['varetc_path']}/K{$i}{$keyname}+157+00000.key";
|
||||
$cmd = "/usr/local/bin/nsupdate -k {$g['varetc_path']}/nsupdatekey{$i}";
|
||||
|
||||
if (isset($dnsupdate['usetcp'])) {
|
||||
$cmd .= " -v";
|
||||
|
||||
@ -5493,6 +5493,18 @@ function upgrade_172_to_173() {
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Dynamic DNS nsupdate keyfiles have been replaced with a simpler ddns-confgen style file.
|
||||
*/
|
||||
function upgrade_173_to_174() {
|
||||
global $config;
|
||||
|
||||
/* Remove unused keytype field. */
|
||||
foreach ($config['dnsupdates']['dnsupdate'] as $i => &$dnsupdate) {
|
||||
unset($dnsupdate['keytype']);
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Special function that is called independent of current config version. It's
|
||||
* a workaround to have config_upgrade running on older versions after next
|
||||
|
||||
@ -28,6 +28,15 @@
|
||||
|
||||
require_once("guiconfig.inc");
|
||||
|
||||
$tsig_key_algos = array(
|
||||
'hmac-md5' => 'HMAC-MD5 (legacy default)',
|
||||
'hmac-sha1' => 'HMAC-SHA1',
|
||||
'hmac-sha224' => 'HMAC-SHA224',
|
||||
'hmac-sha256' => 'HMAC-SHA256 (current bind9 default)',
|
||||
'hmac-sha384' => 'HMAC-SHA384',
|
||||
'hmac-sha512' => 'HMAC-SHA512 (most secure)',
|
||||
);
|
||||
|
||||
if (!is_array($config['dnsupdates']['dnsupdate'])) {
|
||||
$config['dnsupdates']['dnsupdate'] = array();
|
||||
}
|
||||
@ -45,12 +54,9 @@ if (isset($id) && isset($a_rfc2136[$id])) {
|
||||
if (!$pconfig['ttl']) {
|
||||
$pconfig['ttl'] = 60;
|
||||
}
|
||||
$pconfig['keydata'] = $a_rfc2136[$id]['keydata'];
|
||||
$pconfig['keyname'] = $a_rfc2136[$id]['keyname'];
|
||||
$pconfig['keytype'] = $a_rfc2136[$id]['keytype'];
|
||||
if (!$pconfig['keytype']) {
|
||||
$pconfig['keytype'] = "zone";
|
||||
}
|
||||
$pconfig['keyalgorithm'] = $a_rfc2136[$id]['keyalgorithm'];
|
||||
$pconfig['keydata'] = $a_rfc2136[$id]['keydata'];
|
||||
$pconfig['server'] = $a_rfc2136[$id]['server'];
|
||||
$pconfig['interface'] = $a_rfc2136[$id]['interface'];
|
||||
$pconfig['usetcp'] = isset($a_rfc2136[$id]['usetcp']);
|
||||
@ -69,22 +75,23 @@ if ($_POST['save'] || $_POST['force']) {
|
||||
$pconfig = $_POST;
|
||||
|
||||
/* input validation */
|
||||
$reqdfields = array();
|
||||
$reqdfieldsn = array();
|
||||
$reqdfields = array_merge($reqdfields, explode(" ", "host ttl keyname keydata"));
|
||||
$reqdfieldsn = array_merge($reqdfieldsn, array(gettext("Hostname"), gettext("TTL"), gettext("Key name"), gettext("Key")));
|
||||
$reqdfields = array('host', 'ttl', 'keyname', 'keydata');
|
||||
$reqdfieldsn = array(gettext("Hostname"), gettext("TTL"), gettext("Key name"), gettext("Key"));
|
||||
|
||||
do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);
|
||||
|
||||
if (($_POST['host'] && !is_domain($_POST['host']))) {
|
||||
if ($_POST['host'] && !is_domain($_POST['host'])) {
|
||||
$input_errors[] = gettext("The DNS update host name contains invalid characters.");
|
||||
}
|
||||
if (($_POST['ttl'] && !is_numericint($_POST['ttl']))) {
|
||||
if ($_POST['ttl'] && !is_numericint($_POST['ttl'])) {
|
||||
$input_errors[] = gettext("The DNS update TTL must be an integer.");
|
||||
}
|
||||
if (($_POST['keyname'] && !is_domain($_POST['keyname']))) {
|
||||
if ($_POST['keyname'] && !is_domain($_POST['keyname'])) {
|
||||
$input_errors[] = gettext("The DNS update key name contains invalid characters.");
|
||||
}
|
||||
if ($_POST['keyalgorithm'] && !array_key_exists($_POST['keyalgorithm'], $tsig_key_algos)) {
|
||||
$input_errors[] = gettext("The DNS update key algorithm is invalid.");
|
||||
}
|
||||
|
||||
if (!$input_errors) {
|
||||
$rfc2136 = array();
|
||||
@ -92,7 +99,7 @@ if ($_POST['save'] || $_POST['force']) {
|
||||
$rfc2136['host'] = $_POST['host'];
|
||||
$rfc2136['ttl'] = $_POST['ttl'];
|
||||
$rfc2136['keyname'] = $_POST['keyname'];
|
||||
$rfc2136['keytype'] = $_POST['keytype'];
|
||||
$rfc2136['keyalgorithm'] = $_POST['keyalgorithm'];
|
||||
$rfc2136['keydata'] = $_POST['keydata'];
|
||||
$rfc2136['server'] = $_POST['server'];
|
||||
$rfc2136['usetcp'] = $_POST['usetcp'] ? true : false;
|
||||
@ -161,8 +168,6 @@ $section->addInput(new Form_Checkbox(
|
||||
$pconfig['enable']
|
||||
));
|
||||
|
||||
$optionlist = array();
|
||||
|
||||
$iflist = build_if_list();
|
||||
|
||||
$section->addInput(new Form_Select(
|
||||
@ -193,40 +198,19 @@ $section->addInput(new Form_Input(
|
||||
$pconfig['keyname']
|
||||
))->setHelp('This must match the setting on the DNS server.');
|
||||
|
||||
$group = new Form_Group('*Key Type');
|
||||
|
||||
$group->add(new Form_Checkbox(
|
||||
'keytype',
|
||||
'Key Type',
|
||||
'Zone',
|
||||
($pconfig['keytype'] == 'zone'),
|
||||
'zone'
|
||||
))->displayAsRadio();
|
||||
|
||||
$group->add(new Form_Checkbox(
|
||||
'keytype',
|
||||
'Key Type',
|
||||
'Host',
|
||||
($pconfig['keytype'] == 'host'),
|
||||
'host'
|
||||
))->displayAsRadio();
|
||||
|
||||
$group->add(new Form_Checkbox(
|
||||
'keytype',
|
||||
'Key Type',
|
||||
'User',
|
||||
($pconfig['keytype'] == 'user'),
|
||||
'user'
|
||||
))->displayAsRadio();
|
||||
|
||||
$section->add($group);
|
||||
$section->addInput(new Form_Select(
|
||||
'keyalgorithm',
|
||||
'*Key algorithm',
|
||||
$pconfig['keyalgorithm'],
|
||||
$tsig_key_algos
|
||||
));
|
||||
|
||||
$section->addInput(new Form_Input(
|
||||
'keydata',
|
||||
'*Key',
|
||||
'text',
|
||||
$pconfig['keydata']
|
||||
))->setHelp('Paste an HMAC-MD5 key here.');
|
||||
))->setHelp('Secret TSIG domain key.');
|
||||
|
||||
$section->addInput(new Form_Input(
|
||||
'server',
|
||||
|
||||
Loading…
Reference in New Issue
Block a user