DNS Locations: dnsserver-* commands

New commands for manipulation with DNS server configuration were added:
 * dnsserver-show
 * dnsserver-mod
 * dnsserver-find

https://fedorahosted.org/bind-dyndb-ldap/wiki/Design/PerServerConfigInLDAP
https://fedorahosted.org/freeipa/ticket/2008

Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>

4 files changed, 199 insertions, 56 deletions

diff --git a/ipaserver/plugins/dns.py b/ipaserver/plugins/dns.py
index e9eb1f98f..094f8eb57 100644
--- a/ipaserver/plugins/dns.py
+++ b/ipaserver/plugins/dns.py
@@ -66,7 +66,9 @@ from ipalib.util import (normalize_zonemgr,
                          EDNS0UnsupportedError, DNSSECValidationError,
                          validate_dnssec_zone_forwarder_step1,
                          validate_dnssec_zone_forwarder_step2,
-                         verify_host_resolvable)
+                         verify_host_resolvable,
+                         validate_bind_forwarder,
+                         ipaddr_validator)
 from ipapython.dn import DN
 from ipapython.ipautil import CheckedIPAddress
 from ipapython.dnsutil import check_zone_overlap
@@ -373,23 +375,12 @@ def _reverse_zone_name(netstr):
     else:
         return None
 
-def _validate_ipaddr(ugettext, ipaddr, ip_version=None):
-    try:
-        ip = netaddr.IPAddress(str(ipaddr), flags=netaddr.INET_PTON)
-
-        if ip_version is not None:
-            if ip.version != ip_version:
-                return _('invalid IP address version (is %(value)d, must be %(required_value)d)!') \
-                        % dict(value=ip.version, required_value=ip_version)
-    except (netaddr.AddrFormatError, ValueError):
-        return _('invalid IP address format')
-    return None
 
 def _validate_ip4addr(ugettext, ipaddr):
-    return _validate_ipaddr(ugettext, ipaddr, 4)
+    return ipaddr_validator(ugettext, ipaddr, 4)
 
 def _validate_ip6addr(ugettext, ipaddr):
-    return _validate_ipaddr(ugettext, ipaddr, 6)
+    return ipaddr_validator(ugettext, ipaddr, 6)
 
 def _validate_ipnet(ugettext, ipnet):
     try:
@@ -457,24 +448,6 @@ def _normalize_bind_aci(bind_acis):
     acis += u';'
     return acis
 
-def _validate_bind_forwarder(ugettext, forwarder):
-    ip_address, sep, port = forwarder.partition(u' port ')
-
-    ip_address_validation = _validate_ipaddr(ugettext, ip_address)
-
-    if ip_address_validation is not None:
-        return ip_address_validation
-
-    if sep:
-        try:
-            port = int(port)
-            if port < 0 or port > 65535:
-                raise ValueError()
-        except ValueError:
-            return _('%(port)s is not a valid port' % dict(port=port))
-
-    return None
-
 def _validate_nsec3param_record(ugettext, value):
     _nsec3param_pattern = (r'^(?P<alg>\d+) (?P<flags>\d+) (?P<iter>\d+) '
         r'(?P<salt>([0-9a-fA-F]{2})+|-)$')
@@ -2001,7 +1974,7 @@ class DNSZoneBase(LDAPObject):
             attribute=True,
         ),
         Str('idnsforwarders*',
-            _validate_bind_forwarder,
+            validate_bind_forwarder,
             cli_name='forwarder',
             label=_('Zone forwarders'),
             doc=_('Per-zone forwarders. A custom port can be specified '
@@ -4043,7 +4016,7 @@ class dnsconfig(LDAPObject):
 
     takes_params = (
         Str('idnsforwarders*',
-            _validate_bind_forwarder,
+            validate_bind_forwarder,
             cli_name='forwarder',
             label=_('Global forwarders'),
             doc=_('Global forwarders. A custom port can be specified for each '
diff --git a/ipaserver/plugins/dnsserver.py b/ipaserver/plugins/dnsserver.py
new file mode 100644
index 000000000..f22d6943e
--- /dev/null
+++ b/ipaserver/plugins/dnsserver.py
@@ -0,0 +1,183 @@
+#
+# Copyright (C) 2016  FreeIPA Contributors see COPYING for license
+#
+
+from __future__ import absolute_import
+
+from ipalib import (
+    _,
+    ngettext,
+    api,
+    DNSNameParam,
+    Str,
+    StrEnum,
+)
+from ipalib.frontend import Local
+from ipalib.plugable import Registry
+from ipalib.util import (
+    normalize_hostname,
+    hostname_validator,
+    validate_bind_forwarder,
+)
+from ipaserver.plugins.baseldap import (
+    LDAPObject,
+    LDAPRetrieve,
+    LDAPUpdate,
+    LDAPSearch,
+    LDAPCreate,
+    LDAPDelete,
+)
+
+
+__doc__ = _("""
+DNS server configuration
+""") + _("""
+Manipulate DNS server configuration
+""") + _("""
+EXAMPLES:
+""") + _("""
+  Show configuration of a specific DNS server:
+    ipa dnsserver-show
+""") + _("""
+  Update configuration of a specific DNS server:
+    ipa dnsserver-mod
+""")
+
+
+register = Registry()
+
+dnsserver_object_class = ['top', 'idnsServerConfigObject']
+
+@register()
+class dnsserver(LDAPObject):
+    """
+    DNS Servers
+    """
+    container_dn = api.env.container_dnsservers
+    object_name = _('DNS server')
+    object_name_plural = _('DNS servers')
+    object_class = dnsserver_object_class
+    default_attributes = [
+        'idnsServerId',
+        'idnsSOAmName',
+        'idnsForwarders',
+        'idnsForwardPolicy',
+    ]
+    label = _('DNS Servers')
+    label_singular = _('DNS Server')
+
+    permission_filter_objectclasses = ['idnsServerConfigObject']
+
+    managed_permissions = {
+        'System: Read DNS Servers Configuration': {
+            'ipapermright': {'read', 'search', 'compare'},
+            'ipapermdefaultattr': {
+                'objectclass',
+                'idnsServerId',
+                'idnsSOAmName',
+                'idnsForwarders',
+                'idnsForwardPolicy',
+                'idnsSubstitutionVariable',
+            },
+            'ipapermlocation': api.env.basedn,
+            'default_privileges': {
+                'DNS Servers',
+                'DNS Administrators'
+            },
+        },
+        'System: Modify DNS Servers Configuration': {
+            'ipapermright': {'write'},
+            'ipapermdefaultattr': {
+                'idnsSOAmName',
+                'idnsForwarders',
+                'idnsForwardPolicy',
+                'idnsSubstitutionVariable',
+            },
+            'ipapermlocation': api.env.basedn,
+            'default_privileges': {'DNS Administrators'},
+        },
+    }
+
+    takes_params = (
+        Str(
+            'idnsserverid',
+            hostname_validator,
+            cli_name='hostname',
+            primary_key=True,
+            label=_('Server name'),
+            doc=_('DNS Server name'),
+            normalizer=normalize_hostname,
+        ),
+        DNSNameParam(
+            'idnssoamname?',
+            cli_name='soa_mname_override',
+            label=_('SOA mname override'),
+            doc=_('SOA mname (authoritative server) override'),
+        ),
+        Str(
+            'idnsforwarders*',
+            validate_bind_forwarder,
+            cli_name='forwarder',
+            label=_('Forwarders'),
+            doc=_(
+                'Per-server forwarders. A custom port can be specified '
+                'for each forwarder using a standard format '
+                '"IP_ADDRESS port PORT"'
+            ),
+        ),
+        StrEnum(
+            'idnsforwardpolicy?',
+            cli_name='forward_policy',
+            label=_('Forward policy'),
+            doc=_(
+                'Per-server conditional forwarding policy. Set to "none" to '
+                'disable forwarding to global forwarder for this zone. In '
+                'that case, conditional zone forwarders are disregarded.'
+            ),
+            values=(u'only', u'first', u'none'),
+        ),
+    )
+
+
+@register()
+class dnsserver_mod(LDAPUpdate):
+    __doc__ = _('Modify DNS server configuration')
+
+    msg_summary = _('Modified DNS server "%(value)s"')
+
+
+@register()
+class dnsserver_find(LDAPSearch):
+    __doc__ = _('Search for DNS servers.')
+
+    msg_summary = ngettext(
+        '%(count)d DNS server matched',
+        '%(count)d DNS servers matched', 0
+    )
+
+
+@register()
+class dnsserver_show(LDAPRetrieve):
+    __doc__=_('Display configuration of a DNS server.')
+
+
+@register()
+class dnsserver_add(LDAPCreate, Local):
+    """
+    Only for internal use, this is not part of public API on purpose.
+    Be careful in future this will be transformed to public API call
+    """
+    __doc__ = _('Add a new DNS server.')
+
+    msg_summary = _('Added new DNS server "%(value)s"')
+
+
+@register()
+class dnsserver_del(LDAPDelete, Local):
+    """
+    Only for internal use, this is not part of public API on purpose.
+    Be careful in future this will be transformed to public API call
+    """
+    __doc__ = _('Delete a DNS server')
+
+    msg_summary = _('Deleted DNS server "%(value)s"')
diff --git a/ipaserver/plugins/host.py b/ipaserver/plugins/host.py
index e59e0fa93..15805a3d2 100644
--- a/ipaserver/plugins/host.py
+++ b/ipaserver/plugins/host.py
@@ -44,10 +44,13 @@ from ipalib import x509
 from ipalib import output
 from ipalib.request import context
 from ipalib.util import (normalize_sshpubkey, validate_sshpubkey_no_options,
-    convert_sshpubkey_post, validate_hostname,
+    convert_sshpubkey_post,
     add_sshpubkey_to_attrs_pre,
     remove_sshpubkey_from_output_post,
-    remove_sshpubkey_from_output_list_post)
+    remove_sshpubkey_from_output_list_post,
+    normalize_hostname,
+    hostname_validator,
+)
 from ipapython.ipautil import ipa_generate_password, CheckedIPAddress
 from ipapython.dnsutil import DNSName
 from ipapython.ssh import SSHPublicKey
@@ -271,23 +274,6 @@ def validate_ipaddr(ugettext, ipaddr):
     return None
 
 
-def normalize_hostname(hostname):
-    """Use common fqdn form without the trailing dot"""
-    if hostname.endswith(u'.'):
-        hostname = hostname[:-1]
-    hostname = hostname.lower()
-    return hostname
-
-
-def _hostname_validator(ugettext, value):
-    try:
-        validate_hostname(value)
-    except ValueError as e:
-        return _('invalid domain-name: %s') % unicode(e)
-
-    return None
-
-
 @register()
 class host(LDAPObject):
     """
@@ -465,7 +451,7 @@ class host(LDAPObject):
     label_singular = _('Host')
 
     takes_params = (
-        Str('fqdn', _hostname_validator,
+        Str('fqdn', hostname_validator,
             cli_name='hostname',
             label=_('Host name'),
             primary_key=True,
@@ -734,7 +720,7 @@ class host_del(LDAPDelete):
     def pre_callback(self, ldap, dn, *keys, **options):
         assert isinstance(dn, DN)
         # If we aren't given a fqdn, find it
-        if _hostname_validator(None, keys[-1]) is not None:
+        if hostname_validator(None, keys[-1]) is not None:
             hostentry = api.Command['host_show'](keys[-1])['result']
             fqdn = hostentry['fqdn'][0]
         else:
@@ -1093,7 +1079,7 @@ class host_disable(LDAPQuery):
         ldap = self.obj.backend
 
         # If we aren't given a fqdn, find it
-        if _hostname_validator(None, keys[-1]) is not None:
+        if hostname_validator(None, keys[-1]) is not None:
             hostentry = api.Command['host_show'](keys[-1])['result']
             fqdn = hostentry['fqdn'][0]
         else:
diff --git a/ipaserver/plugins/server.py b/ipaserver/plugins/server.py
index 3b58c6b2f..344756f00 100644
--- a/ipaserver/plugins/server.py
+++ b/ipaserver/plugins/server.py
@@ -237,6 +237,7 @@ class server_mod(LDAPUpdate):
             if not result.get('value'):
                 self.add_message(messages.AutomaticDNSRecordsUpdateFailed())
         self.obj.convert_location(entry_attrs, **options)
+
         return dn