Add SSHFP update policy for existing zones

SSH public key support includes a feature to automatically add/update
client SSH fingerprints in SSHFP records. However, the update won't
work for zones created before this support was added as they don't
allow clients to update SSHFP records in their update policies.

This patch lets dns upgrade module extend the original policy
to allow the SSHFP dynamic updates. It updates only original
policy, we don't want it to overwrite custom user policies.

https://fedorahosted.org/freeipa/ticket/2394

3 files changed, 40 insertions, 7 deletions

diff --git a/ipalib/util.py b/ipalib/util.py
index eb6702dc9..395bf0cf0 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -439,3 +439,21 @@ def parse_time_duration(value):
         raise ValueError('no time duration found in "%s"' % value)
 
     return duration
+
+def gen_dns_update_policy(realm, rrtypes=('A', 'AAAA', 'SSHFP')):
+    """
+    Generate update policy for a DNS zone (idnsUpdatePolicy attribute). Bind
+    uses this policy to grant/reject access for client machines trying to
+    dynamically update their records.
+
+    :param realm: A realm of the of the client
+    :param rrtypes: A list of resource records types that client shall be
+                    allowed to update
+    """
+    policy_element = "grant %(realm)s krb5-self * %(rrtype)s"
+    policies = [ policy_element % dict(realm=realm, rrtype=rrtype) \
+               for rrtype in rrtypes ]
+    policy = "; ".join(policies)
+    policy += ";"
+
+    return policy
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py
index 9dc12e276..a37a29303 100644
--- a/ipaserver/install/bindinstance.py
+++ b/ipaserver/install/bindinstance.py
@@ -32,7 +32,7 @@ from ipapython import sysrestore
 from ipapython import ipautil
 from ipalib.constants import DNS_ZONE_REFRESH
 from ipalib.parameters import IA5Str
-from ipalib.util import validate_zonemgr, normalize_zonemgr
+from ipalib.util import validate_zonemgr, normalize_zonemgr, gen_dns_update_policy
 from ipapython.ipa_log_manager import *
 
 import ipalib
@@ -185,7 +185,7 @@ def read_reverse_zone(default, ip_address):
 def add_zone(name, zonemgr=None, dns_backup=None, ns_hostname=None, ns_ip_address=None,
        update_policy=None):
     if update_policy is None:
-        update_policy = "grant %(realm)s krb5-self * A; grant %(realm)s krb5-self * AAAA; grant %(realm)s krb5-self * SSHFP;" % dict(realm=api.env.realm)
+        update_policy = gen_dns_update_policy(api.env.realm)
 
     if zonemgr is None:
         zonemgr = 'hostmaster.%s' % name
diff --git a/ipaserver/install/plugins/dns.py b/ipaserver/install/plugins/dns.py
index 6d72db43c..04f6e2bec 100644
--- a/ipaserver/install/plugins/dns.py
+++ b/ipaserver/install/plugins/dns.py
@@ -20,10 +20,13 @@
 from ipaserver.install.plugins import MIDDLE
 from ipaserver.install.plugins.baseupdate import PostUpdate
 from ipaserver.install.plugins import baseupdate
-from ipalib import api, errors
+from ipalib import api, errors, util
 
-class update_dnszone_acls(PostUpdate):
+class update_dnszones(PostUpdate):
     """
+    Update all zones to meet requirements in the new FreeIPA versions
+
+    1) AllowQuery and AllowTransfer
     Set AllowQuery and AllowTransfer ACLs in all zones that may be configured
     in an upgraded FreeIPA instance.
 
@@ -34,6 +37,14 @@ class update_dnszone_acls(PostUpdate):
 
     This plugin disables the zone transfer by default so that it needs to be
     explicitly enabled by FreeIPA Administrator.
+
+    2) Update policy
+    SSH public key support includes a feature to automatically add/update
+    client SSH fingerprints in SSHFP records. However, the update won't
+    work for zones created before this support was added as they don't allow
+    clients to update SSHFP records in their update policies.
+
+    This module extends the original policy to allow the SSHFP updates.
     """
     order=MIDDLE
 
@@ -41,7 +52,7 @@ class update_dnszone_acls(PostUpdate):
         ldap = self.obj.backend
 
         try:
-            zones = api.Command.dnszone_find()['result']
+            zones = api.Command.dnszone_find(all=True)['result']
         except errors.NotFound:
             self.log.info('No DNS zone to update found')
             return (False, False, [])
@@ -56,10 +67,14 @@ class update_dnszone_acls(PostUpdate):
                 # do not open zone transfers by default
                 update['idnsallowtransfer'] = u'none;'
 
+            old_policy = util.gen_dns_update_policy(api.env.realm, ('A', 'AAAA'))
+            if zone.get('idnsupdatepolicy', [''])[0] == old_policy:
+                update['idnsupdatepolicy'] = util.gen_dns_update_policy(\
+                        api.env.realm)
+
             if update:
                 api.Command.dnszone_mod(zone[u'idnsname'][0], **update)
 
-
         return (False, False, [])
 
-api.register(update_dnszone_acls)
+api.register(update_dnszones)