From 862417b8d32f6eef1c05ba9137fe2a7f14436987 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Mon, 17 May 2021 16:32:07 +0200 Subject: add 'ipsec-to-dns' --- README.md | 1 + doc/dhcp-to-dns.md | 1 + doc/ipsec-to-dns.md | 46 ++++++++++++++++++++++++++++++++++ global-config | 2 +- global-config-overlay | 2 +- global-config.changes | 1 + global-functions | 2 +- ipsec-to-dns | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++ 8 files changed, 120 insertions(+), 3 deletions(-) create mode 100644 doc/ipsec-to-dns.md create mode 100644 ipsec-to-dns diff --git a/README.md b/README.md index 5d7498d..e102202 100644 --- a/README.md +++ b/README.md @@ -165,6 +165,7 @@ Available Scripts * [Send backup via e-mail](doc/email-backup.md) * [Send GPS position to server](doc/gps-track.md) * [Use WPA2 network with hotspot credentials](doc/hotspot-to-wpa.md) +* [Create DNS records for IPSec peers](doc/ipsec-to-dns.md) * [Update configuration on IPv6 prefix change](doc/ipv6-update.md) * [Manage IP addresses with bridge status](doc/ip-addr-bridge.md) * [Run other scripts on DHCP lease](doc/lease-script.md) diff --git a/doc/dhcp-to-dns.md b/doc/dhcp-to-dns.md index 22bf3bc..60eb29d 100644 --- a/doc/dhcp-to-dns.md +++ b/doc/dhcp-to-dns.md @@ -44,6 +44,7 @@ See also * [Collect MAC addresses in wireless access list](collect-wireless-mac.md) * [Comment DHCP leases with info from access list](dhcp-lease-comment.md) +* [Create DNS records for IPSec peers](ipsec-to-dns.md) * [Run other scripts on DHCP lease](lease-script.md) --- diff --git a/doc/ipsec-to-dns.md b/doc/ipsec-to-dns.md new file mode 100644 index 0000000..9a0f486 --- /dev/null +++ b/doc/ipsec-to-dns.md @@ -0,0 +1,46 @@ +Create DNS records for IPSec peers +================================== + +[◀ Go back to main README](../README.md) + +🛈 This script can not be used on its own but requires the base installation. +See [main README](../README.md) for details. + +Description +----------- + +This script adds (and removes) dns records based on IPSec peers and their +dynamic addresses from mode-config. + +Requirements and installation +----------------------------- + +Just install the script: + + $ScriptInstallUpdate ipsec-to-dns; + +This script is run from scheduler: + + / system scheduler add interval=1m name=ipsec-to-dns on-event="/ system script run ipsec-to-dns;" start-time=startup; + +Configuration +------------- + +On first run a disabled static dns record acting as marker (with comment +"`--- ipsec-to-dns above ---`") is added. Move this entry to define where new +entries are to be added. + +The configuration goes to `global-config-overlay`, these are the parameters: + +* `Domain`: the domain used for dns records +* `HostNameInZone`: whether or not to add the ipsec/dns server's hostname +* `PrefixInZone`: whether or not to add prefix `ipsec` + +See also +-------- + +* [Create DNS records for DHCP leases](dns-to-dhcp.md) + +--- +[◀ Go back to main README](../README.md) +[▲ Go back to top](#top) diff --git a/global-config b/global-config index 77f41f6..a02d840 100644 --- a/global-config +++ b/global-config @@ -8,7 +8,7 @@ # Make sure all configuration properties are up to date and this # value is in sync with value in script 'global-functions'! -:global GlobalConfigVersion 50; +:global GlobalConfigVersion 51; # This is used for DNS and backup file. :global Domain "example.com"; diff --git a/global-config-overlay b/global-config-overlay index ac5e396..6ff1a9e 100644 --- a/global-config-overlay +++ b/global-config-overlay @@ -8,7 +8,7 @@ # Make sure all configuration properties are up to date and this # value is in sync with value in script 'global-functions'! # Comment or remove to disable news and change notifications. -:global GlobalConfigVersion 50; +:global GlobalConfigVersion 51; # Copy configuration from global-config here and modify it. diff --git a/global-config.changes b/global-config.changes index 74af117..4bada85 100644 --- a/global-config.changes +++ b/global-config.changes @@ -54,6 +54,7 @@ 48="Added support for overriding e-mail and Telegram settings for every script."; 49="Dropped '\$EmailBackupTo' & '\$EmailBackupCc' from configuration, use settings override if required."; 50="Added support for dynamic address update in 'netwatch-notify'."; + 51="Added 'ipsec-to-dns' to add DNS records for IPSec peers from mode-config."; }; # Migration steps to be applied on script updates diff --git a/global-functions b/global-functions index 2626c36..92995c9 100644 --- a/global-functions +++ b/global-functions @@ -8,7 +8,7 @@ # https://git.eworm.de/cgit/routeros-scripts/about/ # expected configuration version -:global ExpectedConfigVersion 50; +:global ExpectedConfigVersion 51; # global variables not to be changed by user :global GlobalFunctionsReady false; diff --git a/ipsec-to-dns b/ipsec-to-dns new file mode 100644 index 0000000..bfdc807 --- /dev/null +++ b/ipsec-to-dns @@ -0,0 +1,68 @@ +#!rsc by RouterOS +# RouterOS script: ipsec-to-dns +# Copyright (c) 2021 Christian Hesse +# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md +# +# and add/remove/update DNS entries from IPSec mode-config +# https://git.eworm.de/cgit/routeros-scripts/about/doc/ipsec-to-dns.md + +:local 0 "ipsec-to-dns"; +:global GlobalFunctionsReady; +:while ($GlobalFunctionsReady != true) do={ :delay 500ms; } + +:global Domain; +:global HostNameInZone; +:global Identity; +:global PrefixInZone; + +:global CharacterReplace; +:global LogPrintExit2; +:global IfThenElse; + +:local Zone \ + ([ $IfThenElse ($PrefixInZone = true) "ipsec." ] . \ + [ $IfThenElse ($HostNameInZone = true) ($Identity . ".") ] . $Domain); +:local Ttl 5m; +:local CommentPrefix ("managed by " . $0 . " for "); +:local CommentString ("--- " . $0 . " above ---"); + +:if ([ :len [ / ip dns static find where comment=$CommentString name=- type=NXDOMAIN disabled ] ] = 0) do={ + / ip dns static add comment=$CommentString name=- type=NXDOMAIN disabled=yes; + $LogPrintExit2 warning $0 ("Added disabled static dns record with comment '" . $CommentString . "'.") false; +} +:local PlaceBefore ([ / ip dns static find where comment=$CommentString name=- type=NXDOMAIN disabled ]->0); + +:foreach DnsRecord in=[ / ip dns static find where comment ~ $CommentPrefix ] do={ + :local DnsRecordVal [ / ip dns static get $DnsRecord ]; + :local PeerId [ $CharacterReplace ($DnsRecordVal->"comment") $CommentPrefix "" ]; + :if ([ :len [ / ip ipsec active-peers find where id=$PeerId dynamic-address=($DnsRecordVal->"address") ] ] > 0) do={ + $LogPrintExit2 debug $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") still exists. Not deleting DNS entry.") false; + } else={ + :local Found false; + $LogPrintExit2 info $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") has gone, deleting DNS entry.") false; + / ip dns static remove $DnsRecord; + } +} + +:foreach Peer in=[ / ip ipsec active-peers find where !(dynamic-address=[]) ] do={ + :local PeerVal [ / ip ipsec active-peers get $Peer ]; + :local Comment ($CommentPrefix . $PeerVal->"id"); +:put ($PeerVal->"id"); + :local HostName [ :pick ($PeerVal->"id") 0 [ :find ($PeerVal->"id" . ".") "." ] ]; +:put $HostName; + + :local Fqdn ($HostName . "." . $Zone); + :local DnsRecord [ / ip dns static find where name=$Fqdn ]; + :if ([ :len $DnsRecord ] > 0) do={ + :local DnsIp [ / ip dns static get $DnsRecord address ]; + :if ($DnsIp = $PeerVal->"dynamic-address") do={ + $LogPrintExit2 debug $0 ("DNS entry for " . $Fqdn . " does not need updating.") false; + } else={ + $LogPrintExit2 info $0 ("Replacing DNS entry for " . $Fqdn . ", new address is " . $PeerVal->"dynamic-address" . ".") false; + / ip dns static set name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment $DnsRecord; + } + } else={ + $LogPrintExit2 info $0 ("Adding new DNS entry for " . $Fqdn . ", address is " . $PeerVal->"dynamic-address" . ".") false; + / ip dns static add name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment place-before=$PlaceBefore; + } +} -- cgit v1.2.3-70-g09d2