generate-tlsa

#!/bin/bash

# Copyright 2014-2015 Richard Russon (FlatCap)
# Licensed under the GPLv3

SUFFIX="tlsa.inc"
PATH="/var/named/bin:/usr/bin:/usr/sbin"
source log.sh

export TZ="UTC"

set -o errexit	# set -e
set -o nounset	# set -u

renice --priority 19 --pid $$ > /dev/null
ionice --class 3     --pid $$ > /dev/null

shopt -s nullglob

function finish()
{
	local RETVAL=$?
	[ $RETVAL = 0 ] || log_error "${0##*/} failed: $RETVAL"
}

trap finish EXIT

cd /var/named

[ $# = 0 ] && exit 2

log_info "Generate TLSA Records for Services"
for ZONE in $@; do
	FILE="$ZONE.$SUFFIX"
	if [ -f "$FILE" ]; then
		log_warning "\t$ZONE already exists"
		continue
	fi

	OUT=()
	for PORT in $DNSSEC_PORTS; do
		OUT+=("$(danetool --load-certificate /etc/pki/tls/certs/$ZONE.crt --proto tcp --port $PORT --host $ZONE --tlsa-rr)")
	done

	(
		echo '; TLSA records for services'
		printf "%s\n" "${OUT[@]}"
	) > "$FILE"

	echo -e "\t$ZONE: $DNSSEC_PORTS"
done

exit 0