Add SSHFP update policy for existing zones

SSH public key support includes a feature to automatically add/update
client SSH fingerprints in SSHFP records. However, the update won't
work for zones created before this support was added as they don't
allow clients to update SSHFP records in their update policies.

This patch lets dns upgrade module extend the original policy
to allow the SSHFP dynamic updates. It updates only original
policy, we don't want it to overwrite custom user policies.

https://fedorahosted.org/freeipa/ticket/2394

1 files changed, 18 insertions, 0 deletions

diff --git a/ipalib/util.py b/ipalib/util.py
index eb6702dc9..395bf0cf0 100644
--- a/ipalib/util.py
+++ b/ipalib/util.py
@@ -439,3 +439,21 @@ def parse_time_duration(value):
         raise ValueError('no time duration found in "%s"' % value)
 
     return duration
+
+def gen_dns_update_policy(realm, rrtypes=('A', 'AAAA', 'SSHFP')):
+    """
+    Generate update policy for a DNS zone (idnsUpdatePolicy attribute). Bind
+    uses this policy to grant/reject access for client machines trying to
+    dynamically update their records.
+
+    :param realm: A realm of the of the client
+    :param rrtypes: A list of resource records types that client shall be
+                    allowed to update
+    """
+    policy_element = "grant %(realm)s krb5-self * %(rrtype)s"
+    policies = [ policy_element % dict(realm=realm, rrtype=rrtype) \
+               for rrtype in rrtypes ]
+    policy = "; ".join(policies)
+    policy += ";"
+
+    return policy