netbox-plugin-dns 1.2.6__py3-none-any.whl → 1.2.7b2__py3-none-any.whl

netbox_dns/templates/netbox_dns/dnsseckeytemplate.html

@@ -0,0 +1,70 @@
+{% extends 'generic/object.html' %}
+{% load render_table from django_tables2 %}
+{% load i18n %}
+
+{% block content %}
+    <div class="row">
+        <div class="col col-md-6">
+            <div class="card">
+                <h5 class="card-header">{% trans "DNSSEC Key" %}</h5>
+                <table class="table table-hover attr-table">
+                    <tr>
+                        <th scope="row">{% trans "Name" %}</th>
+                        <td>{{ object.name }}</td>
+                    </tr>
+                    {% if object.description %}
+                    <tr>
+                        <th scope="row">{% trans "Description" %}</th>
+                        <td style="word-break:break-all;">{{ object.description }}</td>
+                    </tr>
+                    {% endif %}
+                    <tr>
+                        <th scope="row">{% trans "Type" %}</th>
+                        <td>{% badge object.get_type_display bg_color=object.get_type_color %}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Lifetime" %}</th>
+                        <td>{{ object.lifetime|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Algorithm" %}</th>
+                        <td>{% badge object.get_algorithm_display %}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Key Size" %}</th>
+                        <td>{% badge object.get_key_size_display %}</td>
+                    </tr>
+                    {% if object.tenant %}
+                    <tr>
+                        <th scope="row">{% trans "Tenant" %}</th>
+                        <td>
+                            {% if object.tenant.group %}
+                                {{ object.tenant.group|linkify }} /
+                            {% endif %}
+                            {{ object.tenant|linkify|placeholder }}
+                        </td>
+                    </tr>
+                    {% endif %}
+                </table>
+            </div>
+            {% include 'inc/panels/custom_fields.html' %}
+        </div>
+        <div class="col col-md-6">
+            {% include 'inc/panels/tags.html' %}
+        </div>
+    </div>
+    {% if policy_table %}
+        <div class="col col-md-12">
+            <div class="card">
+                {% if policy_table.rows|length == 1 %}
+                    <h2 class="card-header">{% trans "Policy" %}</h2>
+                {% else %}
+                    <h2 class="card-header">{% trans "Policies" %}</h2>
+                {% endif %}
+                <div class="table-responsive">
+                    {% render_table policy_table 'inc/table.html' %}
+                </div>
+            </div>
+        </div>
+    {% endif %}
+{% endblock %}

netbox_dns/templates/netbox_dns/dnssecpolicy.html

@@ -0,0 +1,155 @@
+{% extends 'generic/object.html' %}
+{% load i18n %}
+
+{% block content %}
+    <div class="row">
+        <div class="col col-md-6">
+            <div class="card">
+                <h5 class="card-header">{% trans "DNSSEC Policy" %}</h5>
+                <table class="table table-hover attr-table">
+                    {% if object.description %}
+                    <tr>
+                        <th scope="row">{% trans "Description" %}</th>
+                        <td style="word-break:break-all;">{{ object.description }}</td>
+                    </tr>
+                    {% endif %}
+                    <tr>
+                        <th scope="row">{% trans "Status" %}</th>
+                        <td>{% badge object.get_status_display bg_color=object.get_status_color %}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Key Templates" %}</th>
+                        <td>
+                            <table>
+                                {% for key_template in object.key_templates.all %}
+                                    <tr><td>{{ key_template|linkify }}</td></tr>
+                                    {% for template_id, errors in key_template_errors.items %}
+                                        {% if template_id == key_template.pk %}
+                                            {% for error in errors %}
+                                                <tr><td class="text-danger">{{ error }}</td></tr>
+                                            {% endfor %}
+                                        {% endif %}
+                                    {% endfor %}
+                                {% endfor %}
+                            </table>
+                        </td>
+                    </tr>
+                    {% if policy_warning %}
+                        <tr><td class="text-danger">{{ policy_warning }}</td></tr>
+                    {% endif %}
+                    {% if object.tenant %}
+                    <tr>
+                        <th scope="row">{% trans "Tenant" %}</th>
+                        <td>
+                            {% if object.tenant.group %}
+                                {{ object.tenant.group|linkify }} /
+                            {% endif %}
+                            {{ object.tenant|linkify|placeholder }}
+                        </td>
+                    </tr>
+                    {% endif %}
+                </table>
+            </div>
+            <div class="card">
+                <h5 class="card-header">{% trans "Timing" %}</h5>
+                <table class="table table-hover attr-table">
+                    <tr>
+                        <th scope="row">{% trans "DNSKEY TTL" %}</th>
+                        <td>{{ object.dnskey_ttl|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Publish Safety" %}</th>
+                        <td>{{ object.publish_safety|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Purge Keys" %}</th>
+                        <td>{{ object.purge_keys|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Retire Safety" %}</th>
+                        <td>{{ object.retire_safety|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Signatures Jitter" %}</th>
+                        <td>{{ object.signatures_jitter|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Signatures Refresh" %}</th>
+                        <td>{{ object.signatures_refresh|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Signatures Validity" %}</th>
+                        <td>{{ object.signatures_validity|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Signatures Validity (DNSKEY)" %}</th>
+                        <td>{{ object.signatures_validity_dnskey|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Max Zone TTL" %}</th>
+                        <td>{{ object.max_zone_ttl|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Zone Propagation Delay" %}</th>
+                        <td>{{ object.zone_propagation_delay|placeholder }}</td>
+                    </tr>
+                </table>
+            </div>
+            {% include 'inc/panels/custom_fields.html' %}
+        </div>
+        <div class="col col-md-6">
+            {% include 'inc/panels/tags.html' %}
+            <div class="card">
+                <h5 class="card-header">{% trans "Parent Delegation" %}</h5>
+                <table class="table table-hover attr-table">
+                    <tr>
+                        <th scope="row">{% trans "Create CDNSKEY" %}</th>
+                        <td>{% checkmark object.create_cdnskey %}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "CDS Digest Types" %}</th>
+                        <td>{% if object.cds_digest_types %}{% for digest_type in object.cds_digest_types %}{% badge digest_type %}{% endfor %}{% else %}{{ object_cds_digest_types|placeholder }}{% endif %}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Parent DS TTL" %}</th>
+                        <td>{{ object.parent_ds_ttl|placeholder }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Parent Propagation Delay" %}</th>
+                        <td>{{ object.parent_propagation_delay|placeholder }}</td>
+                    </tr>
+                </table>
+            </div>
+            <div class="card">
+                <h5 class="card-header">{% trans "Proof of Non-Existence" %}</h5>
+                <table class="table table-hover attr-table">
+                    <tr>
+                        <th scope="row">{% trans "Use NSEC3" %}</th>
+                        <td>{% checkmark object.use_nsec3 %}</td>
+                    </tr>
+                    {% if object.use_nsec3 %}
+                        <tr>
+                            <th scope="row">{% trans "NSEC3 Iterations" %}</th>
+                            <td>{{ object.nsec3_iterations|placeholder }}</td>
+                        </tr>
+                        <tr>
+                            <th scope="row">{% trans "NSEC3 Opt Out" %}</th>
+                            <td>{% checkmark object.nsec3_opt_out %}</td>
+                        </tr>
+                        <tr>
+                            <th scope="row">{% trans "NSEC3 Salt Size" %}</th>
+                            <td>{{ object.nsec3_salt_size|placeholder }}</td>
+                        </tr>
+                        {% if object.nsec3_iterations or object.nsec3_opt_out or object.nsec3_salt_size %}
+                        <tr>
+                            <th class="text-warning">
+                                {% blocktrans with link='<a href="https://datatracker.ietf.org/doc/html/rfc9276.html#section-3.1">RFC 9276, Section 3.1</a>' %}Using NSEC3 options is not recommended (see {{ link }}){% endblocktrans %}
+                            </th>
+                        </tr>
+                        {% endif %}
+                    {% endif %}
+                </table>
+            </div>
+        </div>
+    </div>
+{% endblock %}

netbox_dns/templates/netbox_dns/zone.html

@@ -96,6 +96,22 @@
             </table>
         </div>
 
+        {% if object.dnssec_policy %}
+            <div class="card">
+                <h5 class="card-header">{% trans "DNSSEC" %}</h5>
+                <table class="table table-hover attr-table">
+                    <tr>
+                        <th scope="row">{% trans "Policy" %}</th>
+                        <td>{{ object.dnssec_policy|linkify }}</td>
+                    </tr>
+                    <tr>
+                        <th scope="row">{% trans "Use Inline Signing" %}</th>
+                        <td>{% checkmark object.inline_signing %}</td>
+                    </tr>
+                </table>
+            </div>
+        {% endif %}
+
         {% include 'inc/panels/tags.html' %}
         {% include 'inc/panels/custom_fields.html' %}
     </div>

netbox_dns/templates/netbox_dns/zonetemplate/child.html

@@ -0,0 +1,46 @@
+{% extends 'generic/object.html' %}
+{% load helpers %}
+{% load render_table from django_tables2 %}
+{% load perms %}
+{% load i18n %}
+
+{% block content %}
+    {% include 'inc/table_controls_htmx.html' with table_modal="ZoneTemplateTable_config" %}
+
+    <form method="post">
+        {% csrf_token %}
+        <input type="hidden" name="return_url" value="{% if return_url %}{{ return_url }}{% else %}{{ request.path }}{% if request.GET %}?{{ request.GET.urlencode }}{% endif %}{% endif %}" />
+
+        <div class="card">
+            <div class="htmx-container table-responsive" id="object_list">
+                {% include 'htmx/table.html' %}
+            </div>
+        </div>
+
+        {% if perms.netbox_dns.change_zonetemplate or perms.netbox_dns.delete_zonetemplate %}
+             {% with bulk_edit_url="plugins:netbox_dns:zonetemplate_bulk_edit" bulk_delete_url="plugins:netbox_dns:zonetemplate_bulk_delete" %}
+                 <div class="noprint bulk-buttons">
+                     <div class="bulk-button-group">
+                         {% block bulk_buttons %}{% endblock %}
+                         {% if bulk_edit_url and perms.netbox_dns.change_zonetemplate %}
+                             <button type="submit" name="_edit" formaction="{% url bulk_edit_url %}{% if request.GET %}?{{ request.GET.urlencode }}{% endif %}" class="btn btn-warning">
+                                 <i class="mdi mdi-pencil" aria-hidden="true"></i> {% trans "Edit Selected" %}
+                             </button>
+                         {% endif %}
+                         {% if bulk_delete_url and perms.netbox_dns.delete_zonetemplate %}
+                             <button type="submit" name="_delete" formaction="{% url bulk_delete_url %}{% if request.GET %}?{{ request.GET.urlencode }}{% endif %}" class="btn btn-danger">
+                                 <i class="mdi mdi-trash-can-outline" aria-hidden="true"></i> {% trans "Delete Selected" %}
+                             </button>
+                         {% endif %}
+                     </div>
+                 </div>
+             {% endwith %}
+        {% endif %}
+    </form>
+
+{% endblock %}
+
+{% block modals %}
+    {{ block.super }}
+    {% table_config_form table %}
+{% endblock modals %}

netbox_dns/templates/netbox_dns/zonetemplate.html

@@ -53,6 +53,18 @@
             </table>
         </div>
 
+        {% if object.dnssec_policy %}
+            <div class="card">
+                <h5 class="card-header">{% trans "DNSSEC" %}</h5>
+                <table class="table table-hover attr-table">
+                    <tr>
+                        <th scope="row">{% trans "Policy" %}</th>
+                        <td>{{ object.dnssec_policy|linkify }}</td>
+                    </tr>
+                </table>
+            </div>
+        {% endif %}
+
         {% include 'inc/panels/tags.html' %}
         {% include 'inc/panels/custom_fields.html' %}
     </div>

netbox_dns/urls.py

@@ -69,4 +69,20 @@ urlpatterns = (
         "zones/<int:pk>/",
         include(get_model_urls("netbox_dns", "zone")),
     ),
+    path(
+        "dnsseckeytemplates/",
+        include(get_model_urls("netbox_dns", "dnsseckeytemplate", detail=False)),
+    ),
+    path(
+        "dnsseckeytemplates/<int:pk>/",
+        include(get_model_urls("netbox_dns", "dnsseckeytemplate")),
+    ),
+    path(
+        "dnssecpolicies/",
+        include(get_model_urls("netbox_dns", "dnssecpolicy", detail=False)),
+    ),
+    path(
+        "dnssecpolicies/<int:pk>/",
+        include(get_model_urls("netbox_dns", "dnssecpolicy")),
+    ),
 )

netbox_dns/validators/__init__.py

@@ -1,3 +1,4 @@
 from .dns_name import *
 from .dns_value import *
 from .rfc2317 import *
+from .dnssec import *

netbox_dns/validators/dnssec.py

@@ -0,0 +1,146 @@
+from django.core.exceptions import ValidationError
+from django.utils.translation import gettext_lazy as _
+
+from netbox_dns.choices import (
+    DNSSECKeyTemplateTypeChoices,
+    DNSSECKeyTemplateAlgorithmChoices,
+    DNSSECKeyTemplateKeySizeChoices,
+)
+
+__all__ = (
+    "validate_key_template",
+    "validate_key_template_assignment",
+    "validate_key_template_lifetime",
+)
+
+
+def validate_key_template(key_template):
+    if key_template.key_size is None:
+        return
+
+    if key_template.key_size not in DNSSECKeyTemplateKeySizeChoices.values():
+        raise ValidationError(
+            {
+                "key_size": _("{key_size} is not a supported key size.").format(
+                    key_size=key_template.key_size
+                )
+            }
+        )
+
+    if key_template.algorithm != DNSSECKeyTemplateAlgorithmChoices.RSASHA256:
+        raise ValidationError(
+            {
+                "key_size": _(
+                    "Specifying the key size is not supported for algorithm {algorithm}."
+                ).format(algorithm=key_template.algorithm)
+            }
+        )
+
+
+def validate_key_template_assignment(key_templates):
+    if key_templates is None:
+        return
+
+    csk = key_templates.filter(type=DNSSECKeyTemplateTypeChoices.TYPE_CSK)
+    ksk = key_templates.filter(type=DNSSECKeyTemplateTypeChoices.TYPE_KSK)
+    zsk = key_templates.filter(type=DNSSECKeyTemplateTypeChoices.TYPE_ZSK)
+
+    if csk and (ksk or zsk):
+        raise ValidationError(
+            {
+                "key_templates": _(
+                    "Specifying a CSK together with any other key template type is not allowed."
+                )
+            }
+        )
+
+    if any(
+        (
+            csk.count() > 1,
+            ksk.count() > 1,
+            zsk.count() > 1,
+        )
+    ):
+        raise ValidationError(
+            {
+                "key_templates": _(
+                    "At most one key template per type (CSK, KSK and ZSK) is allowed."
+                )
+            }
+        )
+
+    if (ksk and zsk) and (ksk.first().algorithm != zsk.first().algorithm):
+        raise ValidationError(
+            {"key_templates": _("KSK and ZSK must use the same algorithm.")}
+        )
+
+
+def validate_key_template_lifetime(key_template, policy, raise_exception=True):
+    key_lifetime = key_template.lifetime
+
+    if not key_lifetime:
+        return
+
+    dnskey_ttl = policy.get_effective_value("dnskey_ttl")
+    publish_safety = policy.get_effective_value("publish_safety")
+    zone_propagation_delay = policy.get_effective_value("zone_propagation_delay")
+    max_zone_ttl = policy.get_effective_value("max_zone_ttl")
+    retire_safety = policy.get_effective_value("retire_safety")
+
+    validation_errors = []
+
+    if (
+        dnskey_ttl is not None
+        and publish_safety is not None
+        and zone_propagation_delay is not None
+        and key_lifetime < (dnskey_ttl + publish_safety + zone_propagation_delay)
+    ):
+        validation_errors.append(
+            _(
+                "Key Lifetime is less than DNSKEY TTL + Publish Safety + Zone Propagation Delay."
+            )
+        )
+
+    if (
+        max_zone_ttl is not None
+        and retire_safety is not None
+        and zone_propagation_delay is not None
+        and key_lifetime < (max_zone_ttl + retire_safety + zone_propagation_delay)
+    ):
+        validation_errors.append(
+            _(
+                "Key Lifetime is less than Max Zone TTL + Retire Safety + Zone Propagation Delay."
+            )
+        )
+
+    if key_template.type == DNSSECKeyTemplateTypeChoices.TYPE_ZSK:
+        signatures_validity = policy.get_effective_value("signatures_validity")
+        signatures_refresh = policy.get_effective_value("signatures_refresh")
+
+        if (
+            signatures_validity is not None
+            and signatures_validity is not None
+            and key_lifetime < signatures_validity - signatures_refresh
+        ):
+            validation_errors.append(
+                _("Key Lifetime is less than Signatures Validity - Signatures Refresh.")
+            )
+    else:
+        parent_ds_ttl = policy.get_effective_value("parent_ds_ttl")
+        parent_propagation_delay = policy.get_effective_value(
+            "parent_propagation_delay"
+        )
+
+        if (
+            parent_ds_ttl is not None
+            and retire_safety is not None
+            and parent_propagation_delay is not None
+            and parent_ds_ttl < retire_safety + parent_propagation_delay
+        ):
+            validation_errors.append(
+                _(
+                    "Key Lifetime is less than Parent DS TTL + Retire Safety + Parent Propagation Delay."
+                )
+            )
+
+    return validation_errors

netbox_dns/views/__init__.py

@@ -6,3 +6,5 @@ from .registration_contact import *
 from .registrar import *
 from .zone_template import *
 from .record_template import *
+from .dnssec_key_template import *
+from .dnssec_policy import *

netbox_dns/views/dnssec_key_template.py

@@ -0,0 +1,87 @@
+from netbox.views import generic
+from utilities.views import register_model_view
+from tenancy.views import ObjectContactsView
+
+from netbox_dns.filtersets import DNSSECKeyTemplateFilterSet
+from netbox_dns.forms import (
+    DNSSECKeyTemplateImportForm,
+    DNSSECKeyTemplateFilterForm,
+    DNSSECKeyTemplateForm,
+    DNSSECKeyTemplateBulkEditForm,
+)
+from netbox_dns.models import DNSSECKeyTemplate
+from netbox_dns.tables import DNSSECKeyTemplateTable, DNSSECPolicyDisplayTable
+
+
+__all__ = (
+    "DNSSECKeyTemplateView",
+    "DNSSECKeyTemplateListView",
+    "DNSSECKeyTemplateEditView",
+    "DNSSECKeyTemplateDeleteView",
+    "DNSSECKeyTemplateBulkEditView",
+    "DNSSECKeyTemplateBulkImportView",
+    "DNSSECKeyTemplateBulkDeleteView",
+)
+
+
+@register_model_view(DNSSECKeyTemplate, "list", path="", detail=False)
+class DNSSECKeyTemplateListView(generic.ObjectListView):
+    queryset = DNSSECKeyTemplate.objects.all()
+    filterset = DNSSECKeyTemplateFilterSet
+    filterset_form = DNSSECKeyTemplateFilterForm
+    table = DNSSECKeyTemplateTable
+
+
+@register_model_view(DNSSECKeyTemplate)
+class DNSSECKeyTemplateView(generic.ObjectView):
+    queryset = DNSSECKeyTemplate.objects.prefetch_related("policies")
+
+    def get_extra_context(self, request, instance):
+        if instance.policies.exists():
+            return {
+                "policy_table": DNSSECPolicyDisplayTable(data=instance.policies.all())
+            }
+
+        return {}
+
+
+@register_model_view(DNSSECKeyTemplate, "add", detail=False)
+@register_model_view(DNSSECKeyTemplate, "edit")
+class DNSSECKeyTemplateEditView(generic.ObjectEditView):
+    queryset = DNSSECKeyTemplate.objects.all()
+    form = DNSSECKeyTemplateForm
+    default_return_url = "plugins:netbox_dns:dnsseckeytemplate_list"
+
+
+@register_model_view(DNSSECKeyTemplate, "delete")
+class DNSSECKeyTemplateDeleteView(generic.ObjectDeleteView):
+    queryset = DNSSECKeyTemplate.objects.all()
+    default_return_url = "plugins:netbox_dns:dnsseckeytemplate_list"
+
+
+@register_model_view(DNSSECKeyTemplate, "bulk_import", detail=False)
+class DNSSECKeyTemplateBulkImportView(generic.BulkImportView):
+    queryset = DNSSECKeyTemplate.objects.all()
+    model_form = DNSSECKeyTemplateImportForm
+    table = DNSSECKeyTemplateTable
+    default_return_url = "plugins:netbox_dns:dnsseckeytemplate_list"
+
+
+@register_model_view(DNSSECKeyTemplate, "bulk_edit", path="edit", detail=False)
+class DNSSECKeyTemplateBulkEditView(generic.BulkEditView):
+    queryset = DNSSECKeyTemplate.objects.all()
+    filterset = DNSSECKeyTemplateFilterSet
+    table = DNSSECKeyTemplateTable
+    form = DNSSECKeyTemplateBulkEditForm
+
+
+@register_model_view(DNSSECKeyTemplate, "bulk_delete", path="delete", detail=False)
+class DNSSECKeyTemplateBulkDeleteView(generic.BulkDeleteView):
+    queryset = DNSSECKeyTemplate.objects.all()
+    filterset = DNSSECKeyTemplateFilterSet
+    table = DNSSECKeyTemplateTable
+
+
+@register_model_view(DNSSECKeyTemplate, "contacts")
+class DNSSECKeyTemplateContactsView(ObjectContactsView):
+    queryset = DNSSECKeyTemplate.objects.all()