netbox-plugin-dns-bridge 1.5.0__py3-none-any.whl

build/lib/netbox_dns_bridge/__init__.py

@@ -0,0 +1,36 @@
+import logging
+from netbox.plugins import PluginConfig
+from django.conf import settings
+
+__version__ = "1.5.0"
+
+logger = logging.getLogger(__name__)
+
+logging.basicConfig(
+    level=logging.DEBUG,  # Log level (DEBUG, INFO, WARNING, ERROR, CRITICAL)
+    format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",  # Log format
+    datefmt="%Y-%m-%d %H:%M:%S",  # Date format for timestamps
+)
+
+
+class DNSBridgeConfig(PluginConfig):
+    name = "netbox_dns_bridge"
+    verbose_name = "Netbox DNS Bridge"
+    description = ""
+    version = __version__
+    author = "Sven Luethi"
+    author_email = "dev@sven.luethi.co"
+    base_url = "dns-bridge"
+
+    def ready(self):
+        self.settings = settings.PLUGINS_CONFIG.get(self.name, None)
+        if not self.settings:
+            raise RuntimeError(
+                f"{self.name}: Plugin {self.verbose_name} failed to initialize due to missing settings. Terminating Netbox."
+            )
+
+        from . import signals as signals
+
+
+config = DNSBridgeConfig
+default_app_config = ".apps.NetboxDNSBridgeConfig"

build/lib/netbox_dns_bridge/catalog_zone_manager.py

@@ -0,0 +1,234 @@
+import logging
+import threading
+import dns.query
+import dns.message
+import dns.tsigkeyring
+import dns.name
+import dns.zone
+import dns.rdatatype
+import dns.rdataclass
+import dns.rdtypes
+import dns.exception
+import dns.renderer
+from netbox_dns.models import Zone
+from netbox_dns.choices import ZoneStatusChoices
+from netbox_dns_bridge.models import IntegerKeyValueSetting, CatalogZoneMemberIdentifier
+from uuid import uuid4
+from base64 import b32encode
+
+logger = logging.getLogger(__name__)
+
+_LOCK = threading.Lock()
+_SERIAL_MAX = 0xFFFFFFFF
+_SERIAL_OBJ = None
+_PREVIOUS_LAST_ZONE_UPDATE = None
+
+
+def init() -> None:
+    _init_serial()
+    _create_missing_member_identifiers()
+
+
+# Following function loads the last serial from the DB. No return value
+# but it sets the setting "catalog_serial" or terminates the plugin on failure.
+def _init_serial() -> None:
+    global _SERIAL_OBJ
+
+    try:
+        _SERIAL_OBJ = IntegerKeyValueSetting.objects.get(key="catalog-zone-soa-serial")
+        logger.debug(
+            f"Catalog zone SOA serial number {_SERIAL_OBJ.value} loaded from database"
+        )
+    except IntegerKeyValueSetting.DoesNotExist:
+        _SERIAL_OBJ = IntegerKeyValueSetting.objects.create(
+            key="catalog-zone-soa-serial", value=1
+        )
+        logger.debug(
+            f"Catalog zone SOA serial number was not set in the database. Set to {_SERIAL_OBJ.value}"
+        )
+
+
+def _set_serial(new_serial: int) -> bool:
+    global _SERIAL_OBJ
+
+    if 0 < new_serial < _SERIAL_MAX:
+        _SERIAL_OBJ.value = new_serial
+        _SERIAL_OBJ.save()
+        return True
+    else:
+        return False
+
+
+def _increment_serial() -> None:
+    if not _set_serial(_SERIAL_OBJ.value + 1):
+        logger.warning(
+            f"Failed to incremenet catalog serial {_SERIAL_OBJ.value}. Will overflow serial back to 1"
+        )
+        _set_serial(1)
+        logger.debug(
+            f"Catalog zone SOA serial number incremented to {_SERIAL_OBJ.value}"
+        )
+
+
+# If a zone has no catz identifier yet, create it:
+def _create_missing_member_identifiers() -> None:
+    existing_zone_ids = CatalogZoneMemberIdentifier.objects.values_list(
+        "zone_id", flat=True
+    )
+
+    missing_zones = Zone.objects.exclude(id__in=existing_zone_ids)
+
+    new_objects = [
+        CatalogZoneMemberIdentifier(
+            zone=zone,
+            name=_generate_member_identifier(),
+        )
+        for zone in missing_zones
+    ]
+
+    for identifier in new_objects:
+        logger.debug(
+            f"Zone {identifier.zone} has no catz member identifier. Creating..."
+        )
+
+    CatalogZoneMemberIdentifier.objects.bulk_create(
+        new_objects,
+        ignore_conflicts=False,
+    )
+
+
+def create_zone(name, view_name) -> dns.zone.Zone:
+    global _PREVIOUS_LAST_ZONE_UPDATE
+    # Synchronize following across threads as TCP and UDP listener both use it.
+    with _LOCK:
+        latest_zone = (
+            Zone.objects.filter(status=ZoneStatusChoices.STATUS_ACTIVE)
+            .order_by("-last_updated")
+            .first()
+        )
+
+        last_zone_update = getattr(latest_zone, "last_updated", None)
+
+        # Check if there was a zone updated since last call
+        # If no zone was found previously then this will be false since (None != None) = False
+        if _PREVIOUS_LAST_ZONE_UPDATE != last_zone_update:
+            if last_zone_update is not None:
+                logger.debug(
+                    f"Zone {latest_zone.name} was updated in view {latest_zone.view.name}"
+                )
+            # Setting previous last zone update for next iteration:
+            _PREVIOUS_LAST_ZONE_UPDATE = last_zone_update
+            _increment_serial()
+
+    # Zone origin
+    origin = dns.name.from_text(name, dns.name.root)
+
+    # Create a new empty zone
+    zone = dns.zone.Zone(origin)
+    zone.rdclass = dns.rdataclass.IN
+
+    # get zones from netbox
+    nb_zones = Zone.objects.filter(
+        view__name=view_name, status=ZoneStatusChoices.STATUS_ACTIVE
+    ).select_related("catz_identifier")
+
+    ptr_base = dns.name.from_text("zones", origin)
+
+    for nb_zone in nb_zones:
+        ttl = 0
+        qname = dns.name.from_text(nb_zone.name, dns.name.root)
+
+        # Create PTR record
+        # p_name = f"zid-{nb_zone.id:09d}"
+        p_name = nb_zone.catz_identifier.name
+
+        ptr_name = dns.name.from_text(p_name, ptr_base)
+        if not ptr_name.is_subdomain(origin):
+            raise ValueError(
+                "Catalog zone member identifier {ptr_name.to_text()} not a subdomain"
+            )
+        rdata = dns.rdata.from_text(
+            dns.rdataclass.IN, dns.rdatatype.PTR, qname.to_text()
+        )
+        rdataset = zone.find_rdataset(ptr_name, dns.rdatatype.PTR, create=True)
+        rdataset.add(rdata, ttl)
+
+        # Configure DNSSec Policy for member Zone if DNSSec is enabled
+        if nb_zone.dnssec_policy:
+            # Configure policy
+            rid = dns.name.from_text("group", ptr_name)
+            policy_name = nb_zone.dnssec_policy.name.rstrip(" ")
+            group_name = f"dnssec-policy-{policy_name}"
+            rdata = dns.rdata.from_text(
+                dns.rdataclass.IN, dns.rdatatype.TXT, group_name
+            )
+            rdataset = zone.find_rdataset(rid, dns.rdatatype.TXT, create=True)
+            rdataset.add(rdata, ttl)
+
+        ## Configure dnssec status for member zone
+        # status = str(1 if nb_zone.dnssec_policy else 0)
+        # rid = dns.name.from_text("enabled.dnssec.ext", ptr_name)
+        # rdata = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.TXT, status)
+        # rdataset = zone.find_rdataset(rid, dns.rdatatype.TXT, create=True)
+        # rdataset.add(rdata, ttl)
+
+    # SOA Record components
+    ttl = 0
+    rclass = dns.rdataclass.IN
+    rtype = dns.rdatatype.SOA
+    mname = dns.name.from_text("invalid", dns.name.root)
+    rname = dns.name.from_text("invalid", dns.name.root)
+    serial = _SERIAL_OBJ.value
+    refresh = 60
+    retry = 10
+    expire = 1209600
+    minimum = 0
+
+    # Create SOA rdata object
+    soa_rdata = dns.rdata.from_text(
+        rclass,
+        rtype,
+        f"{mname} {rname} {serial} {refresh} {retry} {expire} {minimum}",
+    )
+
+    # Create Rdataset and add the RDATA to it
+    soa_rdataset = dns.rdataset.Rdataset(rclass, rtype)
+    soa_rdataset.add(soa_rdata, ttl)
+
+    # Add to the origin node in the zone
+    node = zone.find_node(origin, create=True)
+    node.rdatasets.append(soa_rdataset)
+
+    # NS record for catz.
+    ns_name = dns.name.from_text("invalid", dns.name.root)
+    ns_rdata = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.NS, str(ns_name))
+    ns_rdataset = dns.rdataset.Rdataset(dns.rdataclass.IN, dns.rdatatype.NS)
+    ns_rdataset.add(ns_rdata, 0)
+
+    # Add to node (catz. is the origin)
+    ns_node = zone.find_node(origin, create=True)
+    ns_node.rdatasets.append(ns_rdataset)
+
+    # TXT record for version.catz.
+    version_name = dns.name.from_text("version", origin)  # relative to origin "catz."
+    txt_rdata = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.TXT, '"2"')
+
+    txt_rdataset = dns.rdataset.Rdataset(dns.rdataclass.IN, dns.rdatatype.TXT)
+    txt_rdataset.add(txt_rdata, 0)
+
+    # Add to node version.catz.
+    txt_node = zone.find_node(version_name, create=True)
+    txt_node.rdatasets.append(txt_rdataset)
+
+    return zone
+
+
+def _generate_member_identifier() -> None:
+    return b32encode(uuid4().bytes)[0:26].lower().decode("UTF-8")
+
+
+def update_member_identifier(zone: Zone) -> None:
+    CatalogZoneMemberIdentifier.objects.update_or_create(
+        zone=zone,
+        defaults={"name": _generate_member_identifier},
+    )

build/lib/netbox_dns_bridge/dns_server.py

@@ -0,0 +1,46 @@
+import logging
+import socketserver
+import socket
+
+logger = logging.getLogger(__name__)
+
+
+class DNSAddressMixin:
+    def _resolve_address(self, server_address, socktype, proto):
+        host, port = server_address
+
+        infos = socket.getaddrinfo(
+            host, port, socket.AF_UNSPEC, socktype, proto, socket.AI_PASSIVE
+        )
+
+        family, _, _, _, sockaddr = infos[0]
+        self.address_family = family
+        return sockaddr
+
+
+class TCPDNSServer(DNSAddressMixin, socketserver.TCPServer):
+    allow_reuse_address = True
+
+    def __init__(self, server_address, handler_class, keyring, tsig_view_map):
+        sockaddr = self._resolve_address(
+            server_address, socket.SOCK_STREAM, socket.IPPROTO_TCP
+        )
+
+        super().__init__(sockaddr, handler_class)
+
+        self.keyring = keyring
+        self.tsig_view_map = tsig_view_map
+
+
+class UDPDNSServer(DNSAddressMixin, socketserver.UDPServer):
+    allow_reuse_address = True
+
+    def __init__(self, server_address, handler_class, keyring, tsig_view_map):
+        sockaddr = self._resolve_address(
+            server_address, socket.SOCK_DGRAM, socket.IPPROTO_UDP
+        )
+
+        super().__init__(sockaddr, handler_class)
+
+        self.keyring = keyring
+        self.tsig_view_map = tsig_view_map

build/lib/netbox_dns_bridge/management/commands/dns-export-zone.py

@@ -0,0 +1,60 @@
+import os
+import dns.zone
+import dns.rdatatype
+import dns.rdataclass
+import dns.exception
+import netbox_dns.models
+from netbox_dns_bridge.utils import export_bind_zone_file
+from django.core.management.base import BaseCommand, CommandError
+
+
+class Command(BaseCommand):
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--view",
+            type=str,
+            help="The name of the view the Zone to be exported is in",
+        )
+        parser.add_argument(
+            "--zone", type=str, help="The FQDN of the Zone to be exported"
+        )
+        parser.add_argument(
+            "--file", type=str, help="Path of the zone file to be written"
+        )
+
+    def handle(self, *args, **options):
+        # if len(options) < 2:
+        #    print("export-zone <zone name> <file path>")
+        #    sys.exit(1)
+
+        # Load parameters
+        view_name = options["view"]
+        zone_name = options["zone"]
+        file_path = options["file"]
+
+        if not view_name:
+            raise CommandError("No --view parameter given")
+        elif not zone_name:
+            raise CommandError("No --zone parameter given")
+        elif not file_path:
+            raise CommandError("No --file parameter given")
+
+        try:
+            # Load the zone from NetBox DNS
+            nb_zone = netbox_dns.models.Zone.objects.get(
+                view__name=view_name, name=zone_name
+            )
+
+            if nb_zone:
+                export_bind_zone_file(nb_zone, file_path=file_path)
+            else:
+                print("Zone not found in Netbox. Aborting")
+                sys.exit(1)
+
+        except Exception as e:
+            raise CommandError(f"Failed to export zone: {e}")
+
+        self.stdout.write(
+            self.style.SUCCESS(f"Zone '{zone_name}' exported to '{file_path}'")
+        )

build/lib/netbox_dns_bridge/management/commands/dns-export-zones.py

@@ -0,0 +1,52 @@
+import os
+import dns.zone
+import dns.rdatatype
+import dns.rdataclass
+import dns.exception
+import netbox_dns.models
+from netbox_dns_bridge.utils import export_bind_zone_file
+from django.core.management.base import BaseCommand, CommandError
+
+
+class Command(BaseCommand):
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--path",
+            type=str,
+            help="Path to the directory where zone files are to be written",
+        )
+
+    def handle(self, *args, **options):
+        # Load parameters
+        base_path = options["path"]
+
+        if not base_path:
+            raise CommandError("No --path parameter given")
+
+        # Ensure base_path exists
+        os.makedirs(base_path, exist_ok=True)
+
+        # Iterate through all zones
+        nb_zones = netbox_dns.models.Zone.objects.prefetch_related("view").all()
+        if not nb_zones.exists():
+            self.stdout.write(self.style.WARNING("No zones found in NetBox DNS."))
+            return
+
+        for zone in nb_zones:
+            # Determine view directory
+            view_name = zone.view.name
+            view_dir = os.path.join(base_path, view_name)
+            os.makedirs(view_dir, exist_ok=True)
+
+            # Zone file path
+            file_path = os.path.join(view_dir, zone.name)
+
+            try:
+                # Call existing export function
+                export_bind_zone_file(zone, file_path=file_path)
+                self.stdout.write(
+                    self.style.SUCCESS(f"Exported zone '{zone.name}' to '{file_path}'")
+                )
+            except Exception as e:
+                self.stderr.write(f"Failed to export zone '{zone.name}': {e}")

build/lib/netbox_dns_bridge/management/commands/dns-settings.py

@@ -0,0 +1,51 @@
+from django.core.management.base import BaseCommand, CommandError
+from netbox_dns_bridge.models import IntegerKeyValueSetting
+
+
+class Command(BaseCommand):
+    help = "Get or set integer key-value settings"
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "action", choices=["get", "set", "list"], help="Action to perform"
+        )
+        parser.add_argument("key", nargs="?", help="Setting key")
+        parser.add_argument(
+            "value", nargs="?", type=int, help="Value to set (required for 'set')"
+        )
+
+    def handle(self, *args, **options):
+        action = options["action"]
+        key = options.get("key")
+        value = options.get("value")
+
+        if action == "list":
+            settings = IntegerKeyValueSetting.objects.all()
+            if not settings.exists():
+                self.stdout.write("No settings found.")
+                return
+            for setting in settings:
+                self.stdout.write(str(setting))
+
+        elif action == "get":
+            if not key:
+                raise CommandError("A key is required for GET")
+            try:
+                setting = IntegerKeyValueSetting.objects.get(key=key)
+                self.stdout.write(f"{setting.key}: {setting.value}")
+            except IntegerKeyValueSetting.DoesNotExist:
+                raise CommandError(f"No setting was found for {key}")
+
+        elif action == "set":
+            if not key:
+                raise CommandError("A setting is required for SET command")
+            if value is None:
+                raise CommandError("A value is required for SET command")
+            try:
+                setting = IntegerKeyValueSetting.objects.get(key=key)
+                old_value = setting.value
+                setting.value = value
+                setting.save()
+                self.stdout.write(f"Updated {key} from {old_value} to {value}")
+            except IntegerKeyValueSetting.DoesNotExist:
+                raise CommandError(f"No setting found for {key}")

build/lib/netbox_dns_bridge/management/commands/dns-transfer-endpoint.py

@@ -0,0 +1,117 @@
+import logging
+import threading
+import dns.query
+import dns.message
+import dns.tsigkeyring
+import dns.name
+import dns.zone
+import dns.rdatatype
+import dns.rdataclass
+import dns.rdtypes
+import dns.exception
+import dns.renderer
+
+from django.core.management.base import BaseCommand
+from django.conf import settings
+from netbox_dns.models import View
+from netbox_dns_bridge.request_handler import UDPRequestHandler, TCPRequestHandler
+from netbox_dns_bridge.dns_server import UDPDNSServer, TCPDNSServer
+from netbox_dns_bridge import catalog_zone_manager as catzm
+from netbox_dns_bridge.models import IntegerKeyValueSetting
+
+logger = logging.getLogger(__name__)
+
+
+class Command(BaseCommand):
+    help = "Run a minimal AXFR DNS server using data from NetBox DNS plugin"
+
+    def load_settings(self):
+        self.settings = settings.PLUGINS_CONFIG.get("netbox_dns_bridge", None)
+        if not self.settings:
+            raise RuntimeError(
+                "Command failed to initialize due to missing settings. Terminating Netbox."
+            )
+
+        self.tsig_keys = self.settings.get("tsig_keys", None)
+        if not self.tsig_keys:
+            raise RuntimeError("tsig_keys variable not set in plugin settings.")
+
+    # Load TSIG keys and map them to views
+    def load_tsig_key_settings(self):
+        self.keyring = {}
+        self.tsig_view_map = {}
+
+        for view_name, data in self.tsig_keys.items():
+            raw_key_name = data.get("keyname")
+            secret = data.get("secret")
+            algorithm_str = data.get("algorithm", "hmac-sha256")
+
+            if not raw_key_name or not secret:
+                logger.error(
+                    f"Skipping TSIG key for view {view_name}: missing keyname or secret."
+                )
+                continue
+
+            try:
+                nb_view = View.objects.get(name=view_name)
+            except View.DoesNotExist:
+                logger.error(
+                    f"Skipping TSIG key {raw_key_name}: view '{view_name}' not found."
+                )
+                continue
+
+            # Normalize key name to absolute DNS name
+            key_name_obj = dns.name.from_text(raw_key_name, origin=None).canonicalize()
+            if not key_name_obj.is_absolute():
+                key_name_obj = key_name_obj.concatenate(dns.name.root)
+            key_name_str = key_name_obj.to_text()  # Will always include trailing do
+
+            self.keyring[key_name_obj] = dns.tsig.Key(
+                name=key_name_obj, secret=secret, algorithm=algorithm_str
+            )
+            self.tsig_view_map[key_name_str] = nb_view
+            logger.debug(f"Loaded TSIG key: {key_name_str} view: {nb_view.name}")
+
+        if not self.keyring:
+            msg = "No TSIG keys found in database."
+            logger.critical(msg)
+            raise RuntimeError(msg)
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--port", type=int, default=5354, help="Port number to listen on"
+        )
+        parser.add_argument(
+            "--address", type=str, default="0.0.0.0", help="IP to bind to"
+        )
+
+    def handle(self, *args, **options):
+        # Load parameters
+        port = options["port"]
+        address = options["address"]
+        catzm.init()
+
+        # Initialize settings
+        self.load_settings()
+        self.load_tsig_key_settings()
+
+        udp_server = UDPDNSServer(
+            (address, port), UDPRequestHandler, self.keyring, self.tsig_view_map
+        )
+
+        tcp_server = TCPDNSServer(
+            (address, port), TCPRequestHandler, self.keyring, self.tsig_view_map
+        )
+
+        def run_udp_server(server):
+            logger.debug(f"Query endpoint listening on {address} udp/{port}")
+            server.serve_forever()
+
+        udp_thread = threading.Thread(
+            target=run_udp_server, args=(udp_server,), daemon=True
+        )
+
+        udp_thread.start()
+
+        logger.debug(f"Query endpoint listening on {address} tcp/{port}")
+        tcp_server.serve_forever()

build/lib/netbox_dns_bridge/migrations/0001_initial.py

@@ -0,0 +1,58 @@
+# Generated by Django 5.2.9 on 2026-04-08 11:29
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        (
+            "netbox_dns",
+            "0030_dnsseckeytemplate_comments_dnsseckeytemplate_owner_and_more",
+        ),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="IntegerKeyValueSetting",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True, primary_key=True, serialize=False
+                    ),
+                ),
+                ("key", models.CharField(max_length=64)),
+                ("value", models.IntegerField()),
+            ],
+            options={
+                "default_permissions": (),
+            },
+        ),
+        migrations.CreateModel(
+            name="CatalogZoneMemberIdentifier",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True, primary_key=True, serialize=False
+                    ),
+                ),
+                ("name", models.CharField(max_length=26, unique=True)),
+                (
+                    "zone",
+                    models.OneToOneField(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="catz_identifier",
+                        to="netbox_dns.zone",
+                    ),
+                ),
+            ],
+            options={
+                "ordering": ("name",),
+            },
+        ),
+    ]

build/lib/netbox_dns_bridge/models.py

@@ -0,0 +1,33 @@
+from django.db import models
+import netbox.models
+import netbox_dns.models
+
+
+class IntegerKeyValueSetting(models.Model):
+    key = models.CharField(max_length=64)
+    value = models.IntegerField()
+
+    def __str__(self):
+        return f"{self.key}: {str(self.value)}"
+
+    class Meta:
+        default_permissions = ()
+
+
+class CatalogZoneMemberIdentifier(models.Model):
+    name = models.CharField(
+        max_length=26,
+        unique=True,
+    )
+
+    zone = models.OneToOneField(
+        to=netbox_dns.models.Zone,
+        on_delete=models.CASCADE,
+        related_name="catz_identifier",
+    )
+
+    class Meta:
+        ordering = ("name",)
+
+    def __str__(self):
+        return self.name