From 7fe63f823388648c671389e7146b91c2fec7b2ca Mon Sep 17 00:00:00 2001 From: Martin Kosek Date: Fri, 24 Feb 2012 16:23:52 +0100 Subject: Add SSHFP update policy for existing zones SSH public key support includes a feature to automatically add/update client SSH fingerprints in SSHFP records. However, the update won't work for zones created before this support was added as they don't allow clients to update SSHFP records in their update policies. This patch lets dns upgrade module extend the original policy to allow the SSHFP dynamic updates. It updates only original policy, we don't want it to overwrite custom user policies. https://fedorahosted.org/freeipa/ticket/2394 --- ipalib/util.py | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'ipalib/util.py') diff --git a/ipalib/util.py b/ipalib/util.py index eb6702dc9..395bf0cf0 100644 --- a/ipalib/util.py +++ b/ipalib/util.py @@ -439,3 +439,21 @@ def parse_time_duration(value): raise ValueError('no time duration found in "%s"' % value) return duration + +def gen_dns_update_policy(realm, rrtypes=('A', 'AAAA', 'SSHFP')): + """ + Generate update policy for a DNS zone (idnsUpdatePolicy attribute). Bind + uses this policy to grant/reject access for client machines trying to + dynamically update their records. + + :param realm: A realm of the of the client + :param rrtypes: A list of resource records types that client shall be + allowed to update + """ + policy_element = "grant %(realm)s krb5-self * %(rrtype)s" + policies = [ policy_element % dict(realm=realm, rrtype=rrtype) \ + for rrtype in rrtypes ] + policy = "; ".join(policies) + policy += ";" + + return policy -- cgit