OpenBSD : Gérer DNS, DNSSEC (puis automatiser ses enregistrements TLSA)

$ cd /usr/local/src/
$ doas mkdir ldnscripts
$ doas chown $USER ldnscripts
$ git clone https://framagit.org/22decembre/ldnscripts.git
$ cd ldnscripts
$ doas make install

; SHA256 est largement suffisant et sécuritaire
ALG=ECDSAP256SHA256 
NSEC3_ALG=SHA-256

### ldnscript
printf '%s\n' "=> ldnscript rollover"
/usr/local/sbin/ldnscript rollover all

tlsa="$(dig TLSA _443._tcp."${domain}" +short)"
d_tlsa="$(echo "${tlsa}" | awk '{ for(i=4;i<=NF;++i) printf "%s", tolower($i); print "" }')"

tlsa="$(echo | openssl s_client -servername "${domain}" -showcerts -connect "${domain}":443 2>/dev/null | openssl x509 -noout -pubkey | openssl pkey -outform der -pubin 2>/dev/null | openssl dgst -"${algo}" 2>/dev/null )"
o_tlsa="$(echo "${tlsa}" | awk -F'=' '{ print $2 }' | tr -d ' ')"

#!/bin/sh

### ldnscript
printf '%s\n' "=> ldnscript rollover"
/usr/local/sbin/ldnscript rollover all

### renew ssl by certbot
printf '%s\n' "=> renew letsencrypt certs"
/usr/local/bin/certbot renew --pre-hook "rcctl stop nginx" --post-hook "rcctl start nginx"

### check tlsa records for domain; only for tcp:443
for domain in "sub.domain.tld" "domain.tld" "www.domain.tld" "sub.domain2.tld" "domain2.tld" "www.domain2.tld"; do
	printf '%s\n' "=> Test TLSA for ${domain}"
	/home/-your-user-/dns-tools/tlsa.sh "${domain}"
done

(…)

#!/bin/sh
set -e
#set -x

########################################################################
#
# Author: Stéphane HUC
# mail: devs@stephane-huc.net
# gpg:fingerprint: CE2C CF7C AB68 0329 0D20  5F49 6135 D440 4D44 BD58
#
# License: BSD Simplified
#
# Github: 
#
# Date: 2022/07/01 06:45
#
########################################################################
#
# Purpose: tool  to test TLSA record
#  - for the geek: DANE-TLSA...
#
# Needed tools: dig, openssl
#
# OS: Tested on OpenBSD, Devuan
#
########################################################################
###
##
# see: https://www.bortzmeyer.org/monitor-dane.html
##
###
########################################################################

ROOT="$(dirname "$(readlink -f -- "$0")")"

. "${ROOT}/dns.conf"

dir_admin="/home/-your-user-/dns-tools"
domain="$1"
### DO NOT TOUCH!
d_tlsa=''	# TLSA record by dig
o_tlsa=''	# TLSA record by openssl
tlsa_record=''	# TLSA record 
tlsa_method=2

########################################################################
####
##
#   All needed functions! DO NOT TOUCH-IT!
##
###
########################################################################

byebye() {

    mssg "KO" "Script stop here!"
    mssg "KO" "Please, search to understand reasons."
    exit 1

}

check_uid() {

    if [ "$(id -u)" -ne 0 ]; then

        mssg "KO" "ERROR: Script not launch with rights admin!"
        byebye

    fi

}

_dig() {
	
	tlsa="$(dig TLSA _443._tcp."${domain}" +short)"
	d_tlsa="$(echo $tlsa | awk '{ for(i=4;i<=NF;++i) printf "%s", tolower($i); print "" }')"
	
}

_openssl() {
	
	tlsa="$(echo | openssl s_client -servername "${domain}" -showcerts -connect "${domain}":443 2>/dev/null | openssl x509 -noout -pubkey | openssl pkey -outform der -pubin 2>/dev/null | openssl dgst -"${algo}" 2>/dev/null )"
	o_tlsa="$(echo $tlsa | awk -F'=' '{ print $2 }' | tr -d ' ')"
	
}

mssg() {

    typeset statut info text
    statut="$1" info="$2"

    case "${statut}" in
        "KO") text="[ ${red}${statut}${neutral} ]    ${info}" ;;
        "OK") text="[ ${green}${statut}${neutral} ]   ${info}" ;;
        #*) mssg="${text}" ;;
    esac

    printf "%s \n" "${text}"

    unset info statut text

}

new_tlsa() {
	
	cert="/etc/letsencrypt/live/${domain}/cert.pem"
	
	case "${le_key_type}" in 
		"ecdsa")
			tlsa_cert_associated="$(openssl x509 -noout -pubkey -in "${cert}" | openssl ec -pubin -outform der 2>/dev/null | "${algo}")"
		;;
		"rsa")
			tlsa_cert_associated="$(openssl x509 -noout -pubkey -in "${cert}" | openssl rsa -pubin -outform der 2>/dev/null | "${algo}")"
		;;
	esac
	
	tlsa_record="_${tls_port}._${tls_proto}.${domain}. IN TLSA ${tlsa_usage} ${tlsa_selector} ${tlsa_method} ${tlsa_cert_associated}"
	unset tlsa_cert_associated
	
}


########################################################################
####
##
#   Execution
##
###
########################################################################

if [ -z "${domain}" ]; then printf '%s\n' "[ KO ] Script stops here; no domain!"; exit; fi

_dig
_openssl

if [ "${d_tlsa}" = "${o_tlsa}" ]; then
	mssg "OK" "Similar TLSA records! :D"
else
	mssg "KO" "There seems to be a problem with the TLSA records of the domain: ${domain}!"
	printf '%s\n' "Have you renew recently the TLS certs for the domain? If yes, change the TLSA record into the DNS zone relevent!"
	printf '%s\n%s\n' "⇒ Perhaps, the dns.sh script shell can help you. ;-)"
	
	check_uid
	
	printf '%s\n' "⇒ Display new TLSA record:"
	new_tlsa
	printf '%s\n%s\n' "Add/modify tlsa into your DNS zone for ${domain}: " "${tlsa_record}"
	
	printf '%s\n' "⇒ Modify TLSA record into the domain zone for ${domain}"
	"${dir_admin}"/dns.ksh tlsa "${domain}"
	
fi

#!/bin/ksh
set -e
#set -x

################################################################################
#
# Author: Stéphane HUC
# mail: devs@stephane-huc.net
# gpg:fingerprint: CE2C CF7C AB68 0329 0D20  5F49 6135 D440 4D44 BD58
#
# License: BSD Simplified
#
# Github: 
#
# Date: 2022/06/01 07:25
#
################################################################################
#
# Purpose: to add a TLSA Record into DNS zone, segun your cert TLS (LE)
#  - for the geek: DANE-TLSA...
#### IMPORTANT: recreate your TLSA Record after (re?)new cert...
#
# Needed tools: nsd* and ldnscript
## ldnscript is a tool to sign dns zone. (DNSSEC)
## https://framagit.org/22decembre/ldnscripts.git
#
# OS: Tested on OpenBSD
#
################################################################################

ROOT="$(dirname "$(readlink -f -- "$0")")"

. "${ROOT}/dns.conf"

################################################################################
###
##
#   DONT TOUCH THOSES VARIABLES!
##
###
################################################################################

debug=0
dir_le="/etc/letsencrypt/live"
dir_ns_cfg="/etc/ns"    # folder config ns
dir_sbin="/usr/local/sbin"
log="${ROOT}/dns-script.log"
nsd_cfg="/var/nsd/etc/nsd.conf"

timestamp="$(date +%s)"
today="$(date +"%Y%m%d")"

server="nsd"

SOA_ns=""

tlsa_record=""
set -A tlsa_records	# if X509 DNS Alternative Names > 1

set -A tlsa_method_names -- "FULL" "SHA256" "SHA512"
set -A tlsa_selector_names -- "CERT" "SPKI"
set -A tlsa_usage_names -- "PKIX-TA" "PKIX-EE" "DANE-TA" "DANE-EE"

NB_PARAMS="$#"
set -A PARAMS -- "$@"

ROOT="$(dirname "$(readlink -f -- "$0")")"

if [ -z "${PARAMS[0]}" ]; then MENU_CHOICE="help"
else
    PARAMS[0]="$(printf '%s' "${PARAMS[0]}" | tr -s "[:upper:]" "[:lower:]")"

    MENU_CHOICE=${PARAMS[0]}
fi

[ -n "${PARAMS[1]}" ] && domain="$(printf '%s' "${PARAMS[1]}" | tr -s "[:upper:]" "[:lower:]")"

################################################################################
####
##
#   All needed functions! DO NOT TOUCH-IT!
##
###
################################################################################

_add_tlsa() {
	
	check_var_algo
	check_var_soa_serial_type
	check_var_tls_port
	check_var_tls_proto
	
	check_tlsa_methods
	check_tlsa_selectors
	check_tlsa_usages
	
	get_soa_ns
	
	danefile="${zonefile}.dane"
	newzonefile="${zonefile}.${today}"
	oldzonefile="${zonefile}.${OLD_SOA_sn}"
	
    create_new_filezone
    
    if [ -f "${newzonefile}" ]; then

		write_soa_serial_number
		
		build_tlsa_record
		write_tlsa_record

		mv_new_file_zone

		if _resign; then del_old_zonefile; fi
		
	fi
	
	unset danefile newzonefile oldzonefile
}

build_needed_variables() {
	
    check_var_domain
    
    printf '%s\n' "*** Build needed variables:"

    # build cert variable if menu 'tlsa'
    if [ "${MENU_CHOICE}" = "tlsa" ]; then
        cert="${dir_le}/${domain}/cert.pem"
        
        if [ ! -f "${cert}" ]; then
			display_mssg "KO" "*** It seems cert file not exists!"
			byebye
		else
			printf '%s\n' "cert: ${cert}"
		fi
    fi

    # build zonedir and zonefile variables
    zonedir="$(awk -F '"' '/zonesdir/ { print substr($2,-1) }' "${nsd_cfg}")"
    if [ -z "${zonedir}" ]; then zonedir="/var/nsd/zones/"; fi
    printf '%s\n' "zonedir: ${zonedir}"

    #zonefile="$(awk -F '"' '/zonefile: "[a-z]*\/'"${domain}"'"/ { print substr($2, -1) }' "${nsd_cfg}")"    
    #if [ "$(printf '%s' "${zonefile}" | awk -F'/' '{ print $1}')" == "signed" ]; then
        ##zonefilesigned=$zonefile        
        #zonefile="$(find "${dir_ns_cfg}" -name "${domain}")"
        #if [ -z "${zonefile}" ]; then zonefile="$(find "${zonedir}" -name "${domain}")"; fi
        #if [ -z "${zonefile}" ]; then
            #display_mssg "KO" "ERROR: It seems zonefile for domain: '${domain}' not exists!"
            #byebye
        #fi
    #else
        #zonefile="${zonedir}${zonefile}"
    #fi
    zonefile="${dir_ns_cfg}/${domain}"
    printf '%s\n' "zonefile: ${zonefile}"
	
}

build_tlsa_record() {

	# get TLSA by reading cert pem
	case "${le_key_type}" in 
		"ecdsa")
			command="ec"
		;;
		"rsa")
			command="rsa"
		;;
	esac
	
	tlsa_cert_associated="$(openssl x509 -noout -pubkey -in "${cert}" | openssl "${command}" -pubin -outform der 2>/dev/null | "${algo}")"
    _log "TLSA Cert Associated: ${tlsa_cert_associated}"
    unset command

    if [ -z "${tlsa_cert_associated}" ]; then
        display_mssg "KO" "ERROR: TLSA Cert Associated could not generated!"
        byebye

    else
        # rebuild tlsa method segun algo choosed; possible: 0 (no match), 1 (sha256), 2 (sha512)
        case "${algo}" in
            "sha256") tlsa_method=1 ;;
            "sha512") tlsa_method=2 ;;
            *) tlsa_method=0 ;;
        esac

		if [ "${tls_port}" = "443" ] && [ "${tls_proto}" = "tcp" ]; then
			get_dns_alternative_names
			count="${#domains[@]}"
			
			if [ "${count}" -eq 1 ]; then
				set_tlsa_record			
			else
				set_tlsa_records
			fi
			
        fi
    fi

    unset tlsa_cert_associated

}

byebye() {

    display_mssg "KO" "Script stop here!"
    display_mssg "KO" "Please, search to understand reasons."
    exit 1

}

check_domain_name() {

    pattern="^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$" # like RFC 1123

    if [ ${#domain} -gt 67 ]; then    # Larg domain name <= 67
        display_mssg "KO" "Error: Domain Length: ${domain}; >= 67 carachters!"
        byebye
    fi

    if printf '%s\n' "${domain}" | grep -Eio "${pattern}"; then
        display_mssg "OK" "Domain Name: ${domain} is valid!"
        sleep 1

    else
        display_mssg "KO" "Error: Bad Domain Name: ${domain}"
        byebye

    fi

    unset pattern

    }

check_tlsa_methods() {

	case "${tlsa_method}" in 
		0|"FULL") 	tlsa_method=0 ;; 
		1|"SHA256") tlsa_method=1 ;;
		2|"SHA512")	tlsa_method=2 ;;
		*)
			display_mssg "KO" "/!\  The TLSA Method: not correctly configurated!"
			byebye
		::
	esac

	_log "TLSA Method: ${tlsa_method}"
	
}

check_tlsa_selectors() {

	case "${tlsa_selector}" in 
		0|"CERT") 	tlsa_selector=0 ;; 
		1|"SPKI") 	tlsa_selector=1 ;;
		*)
			display_mssg "KO" "/!\  The TLSA Selector: not correctly configurated!"
			byebye
		;;
	esac
	_log "TLSA Selector: ${tlsa_selector}"
	
}

check_tlsa_usages() {
	
	case "${tlsa_usage}" in 
		0|"PKIX-TA") 	tlsa_usage=0 ;; 
		1|"PKIX-EE") 	tlsa_usage=1 ;;
		2|"DANE-TA")	tlsa_usage=2 ;;
		3|"DANE-EE")	tlsa_usage=3 ;;
		*)
			display_mssg "KO" "/!\  The TLSA Usage: not correctly configurated!"
			byebye
		;;
	esac
	_log "TLSA Usage: ${tlsa_usage}"
	
}

check_uid() {

    if [ "$(id -u)" -ne 0 ]; then

        display_mssg "KO" "ERROR: Script not launch with rights admin!"
        byebye

    fi

}

check_var_algo () {
	
	if [ "${algo}" != "sha256" ] && [ "${algo}" != "sha512" ]; then
			display_mssg "KO" "/!\ Algorythm: not correctly configurated!"
			byebye
	fi
	_log "Algo: ${algo}"
	
}

check_var_domain() {
	
	if [ -z "${domain}" ]; then
        display_mssg "KO" "*** It seems fault informations!"
        help
        byebye
    fi
    _log "Domain: ${domain}"
	
}

check_var_soa_serial_type() {
	
	if [ "${SOA_serial_type}" != "date" ] && [ "${SOA_serial_type}" != "timestamp" ]; then
			display_mssg "KO" "/!\ SOA Serial Type: not correctly configurated!"
			byebye
	fi
	_log "SOA Serial Type: ${SOA_serial_type}"
	
}

check_var_tls_port(){
	
	if [ "${tls_port}" -lt 0 ]; then
		display_mssg "KO" "/!\ TLS port: not correctly configurated!"
		byebye
	fi 
	_log "TLS port: ${tls_port}"
	
}

check_var_tls_proto() {
	
	if [ "${tls_proto}" != "sctp" ] && [ "${tls_proto}" != "tcp" ] && [ "${tls_proto}" != "tcp" ]; then
			display_mssg "KO" "/!\ TLS proto: not correctly configurated!"
			byebye
	fi
	_log "TLS proto: ${tls_proto}"
	
}

checkconf() {

    nsd-checkconf "${nsd_cfg}"

}

checkzone() {

    nsd-checkzone "${domain}" "${zonefile}"

}

confirm () {

    read -r response?"${1} [y|n] "
    case "${response}" in
        # 'o', 'O': Oui and not 0!
        y|Y|o|O|1)  true ;;
        *)          false ;;
    esac
    unset response

}

create_new_filezone() {
	
	cp "${zonefile}" "${newzonefile}"
	
}

del_old_zonefile() {

    if [ -f "${oldzonefile}" ]; then
        rm -fP "${oldzonefile}"
    fi

}

display_mssg() {

    typeset statut info text
    statut="$1" info="$2"

    case "${statut}" in
        "KO") text="[ ${red}${statut}${neutral} ]    ${info}" ;;
        "OK") text="[ ${green}${statut}${neutral} ]   ${info}" ;;
        #*) mssg="${text}" ;;
    esac

    printf "%s \n" "${text}"

    unset info statut text

}

get_dns_alternative_names() {
	
	# get "X509 DNS Alternative Names" characters
	domains="$(echo | openssl x509 -text -noout -in "${cert}" | awk -F ',' '/DNS:/ { for(i=1;i<NF;i++) { p=match($i,":"); print substr($i,p+1) }}')"
	# convert into array; no double-quotes, else not run!
	set -A domains -- ${domains[@]}
	printf '%s\n' "domains: ${domains[*]}"
	_log "domains: ${domains[*]}"
	
}

get_soa_ns() {
	
	OLD_SOA_sn="$(grep -A1 "SOA" "${zonefile}" | tail -n1 | awk -F ' ' '{ print $1 }')"
	_log "Old SOA Serial Number: ${OLD_SOA_sn}!"
	
}

get_soa_serial_number() {

    OLD_SOA_sn="$(printf '%s\n' "${line}" | awk -F ' ' '{ print $1 }')"
	_log "OLD SOA Serial Number: ${OLD_SOA_sn}"
	
}

help() {

    printf '%s\n' "
    $0 sign domain      # to sign a domain
    $0 tlsa domain      # to add a tlsa record into domain zone
    ----
    when use tlsa, this script will resign the domain zone...
    "

}

init_zone() {

    "${dir_sbin}"/ldnscript init "${domain}"

}

in_array() {
    
    local i=0 need="$1" IFS=" "; shift; set -A array -- $*
    count="${#array[@]}"
    while [ $i -le $count ]; do
        if [ "${array[$i]}" = "${need}" ]; then return 0; fi # true
        #let "i=$i+1"
        (( i=i+1 ))
    done
    return 1
    unset i need IFS array

}

_log() {
	
	if [ "${debug}" -eq 1 ]; then printf '%s\n' "$1" >> "${log}"; fi
	
}

main() {
		
	check_uid
	verify_need_softs
	
	build_needed_variables
	
    check_domain_name

    case "${MENU_CHOICE}" in
        "help") help ;;
        "sign") _resign ;;
        "tlsa") _add_tlsa ;;
        *)
            display_mssg "KO" "ERROR: this option ${MENU_CHOICE} is not exists!"
            help
            byebye
        ;;
    esac

}

mv_new_file_zone() {

    if [ -f "${newzonefile}" ]; then
        mv "${zonefile}" "${oldzonefile}"
        mv "${newzonefile}" "${zonefile}"
    fi

}

_resign() {

    if checkzone && checkconf; then

        display_mssg "OK" "file config nsd and zone ${domain} are good! :D"
        sign_zone

    else

        display_mssg "KO" "ERROR: it exists a problem with file config nsd or zone ${domain}"
        byebye

    fi

}

restart_server() {
    printf '%s\n' "=> Restart Server: "

    stop_server

    start_server

    status_server
}

set_soa_serial_number() {

    case "${SOA_serial_type}" in
        "date")
            SOA_date="$(printf '%s' "${OLD_SOA_sn}" | awk '{print substr($0, 0, 8)}')";
            SOA_number="$(printf '%s' "${OLD_SOA_sn}" | awk '{print substr($0, 9)}')";

            if [ "${SOA_date}" == "${today}" ]; then
                #let SOA_number=$SOA_number+1
                (( SOA_number=${SOA_number}+1 )) || true
                if [ "${SOA_number}" -lt 10 ]; then SOA_number="0${SOA_number}"; fi
                SOA_sn="${SOA_date}${SOA_number}"
            else
                SOA_sn="${today}01"
            fi
        ;;
        "timestamp")
            SOA_sn="${timestamp}"
        ;;
        *)
			display_mssg "KO" "Invalid SOA Serial Type!"
			byebye
        ;;
    esac
    _log "New SOA Serial Number: ${SOA_sn}!"
    
}

set_tlsa_record() {
	
	# build tlsa record
	tlsa_records[0]="_${tls_port}._${tls_proto}.${domains[0]}. IN TLSA ${tlsa_usage} ${tlsa_selector} ${tlsa_method} ${tlsa_cert_associated}"
	_log "TLSA Record: ${tlsa_records[0]}"
	
}

set_tlsa_records() {

	# do not use domain variable here
	i=0
	for dom in "${domains[@]}"; do 
		tlsa_records[$i]="_${tls_port}._${tls_proto}.${dom}. IN TLSA ${tlsa_usage} ${tlsa_selector} ${tlsa_method} ${tlsa_cert_associated}"
		(( i=i+1 ))
	done
	unset i dom
	_log "TLSA Records: ${tlsa_records[*]}"
	
}

sign_zone() {

    "${dir_sbin}"/ldnscript signing "${domain}"

}

start_server() {
    printf '%s\n' "Start serveur: ${server}"
    rcctl start "${server}"
    sleep 1s
}

status_server() {

    printf '%s\n' "Check serveur: ${server}"
    rcctl check "${server}"

}

stop_server() {

    printf '%s\n' "Stop serveur: ${server}"
    rcctl stop "${server}"
    sleep 1s

}

verify_need_softs() {

    if [ ! -f "${dir_sbin}/ldnscript" ]; then
        display_mssg "KO" "ERROR: ldnscript seems not install!"
        byebye
    elif [ ! -x "${dir_sbin}/ldnscript" ]; then
        display_mssg "KO" "ERROR: ldnscript is not executable!"
        byebye
    fi

}

write_soa_serial_number() {

	set_soa_serial_number
	
	if sed -i -e "s#\(.*\)${OLD_SOA_sn} \;#\1${SOA_sn} \;#" "${newzonefile}"; then
		_log "SOA serial number changed!"
	
	else 
		display_mssg "KO" "/!\  Script cant change SOA serial number!"
	fi

}

write_tlsa_record() {
	
	if [ ! -f "${danefile}" ]; then touch "${danefile}"; fi
	
	i=0
    # add tlsa records into dns zone
    for tlsa_record in "${tlsa_records[@]}"; do
		dom="${domains[$i]}"
		_log "domain: $dom"
		### /!\ ERROR with $domain /!\ 
		if sed -i -e "s#_${tls_port}._${tls_proto}.${dom}. IN TLSA\(.*\)#${tlsa_record}#" "${newzonefile}"; then
			_log "TLSA Record rewrited!"
						
		else
			printf '%s\n' "${tlsa_record}" >> "${newzonefile}"
			_log "TLSA Record added!"
		fi
		
		(( i=i+1 ))
		# add record in first line into dane file
		printf '%s\n' "${timestamp}:${tlsa_record}" >> "${danefile}"
		_log "${timestamp}:${tlsa_record}"
		unset dom
    done
    unset i tlsa_record

}

################################################################################

main

./dns.ksh sign domain

./tlsa.sh domain