ipsec-to-dns.rsc


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

#!rsc by RouterOS
# RouterOS script: ipsec-to-dns
# Copyright (c) 2021-2023 Christian Hesse <mail@eworm.de>
# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md
#
# and add/remove/update DNS entries from IPSec mode-config
# https://git.eworm.de/cgit/routeros-scripts/about/doc/ipsec-to-dns.md

:local 0 "ipsec-to-dns";
:global GlobalFunctionsReady;
:while ($GlobalFunctionsReady != true) do={ :delay 500ms; }

:global Domain;
:global HostNameInZone;
:global Identity;
:global PrefixInZone;

:global CharacterReplace;
:global EscapeForRegEx;
:global IfThenElse;
:global LogPrintExit2;

:local Zone \
  ([ $IfThenElse ($PrefixInZone = true) "ipsec." ] . \
   [ $IfThenElse ($HostNameInZone = true) ($Identity . ".") ] . $Domain);
:local Ttl 5m;
:local CommentPrefix ("managed by " . $0 . " for ");
:local CommentString ("--- " . $0 . " above ---");

:if ([ :len [ /ip/dns/static/find where (name=$CommentString or (comment=$CommentString and name=-)) type=NXDOMAIN disabled ] ] = 0) do={
  /ip/dns/static/add name=$CommentString type=NXDOMAIN disabled=yes;
  $LogPrintExit2 warning $0 ("Added disabled static dns record with name '" . $CommentString . "'.") false;
}
:local PlaceBefore ([ /ip/dns/static/find where (name=$CommentString or (comment=$CommentString and name=-)) type=NXDOMAIN disabled ]->0);

:foreach DnsRecord in=[ /ip/dns/static/find where comment ~ $CommentPrefix ] do={
  :local DnsRecordVal [ /ip/dns/static/get $DnsRecord ];
  :local PeerId [ $CharacterReplace ($DnsRecordVal->"comment") $CommentPrefix "" ];
  :if ([ :len [ /ip/ipsec/active-peers/find where id~("^(CN=)?" . [ $EscapeForRegEx $PeerId ] . "\$") \
       dynamic-address=($DnsRecordVal->"address") ] ] > 0) do={
    $LogPrintExit2 debug $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") still exists. Not deleting DNS entry.") false;
  } else={
    :local Found false;
    $LogPrintExit2 info $0 ("Peer " . $PeerId . " (" . $DnsRecordVal->"name" . ") has gone, deleting DNS entry.") false;
    /ip/dns/static/remove $DnsRecord;
  }
}

:foreach Peer in=[ /ip/ipsec/active-peers/find where !(dynamic-address=[]) ] do={
  :local PeerVal [ /ip/ipsec/active-peers/get $Peer ];
  :local PeerId [ $CharacterReplace ($PeerVal->"id") "CN=" "" ];
  :local Comment ($CommentPrefix . $PeerId);
  :local HostName [ :pick $PeerId 0 [ :find ($PeerId . ".") "." ] ];

  :local Fqdn ($HostName . "." . $Zone);
  :local DnsRecord [ /ip/dns/static/find where name=$Fqdn ];
  :if ([ :len $DnsRecord ] > 0) do={
    :local DnsIp [ /ip/dns/static/get $DnsRecord address ];
    :if ($DnsIp = $PeerVal->"dynamic-address") do={
      $LogPrintExit2 debug $0 ("DNS entry for " . $Fqdn . " does not need updating.") false;
    } else={
      $LogPrintExit2 info $0 ("Replacing DNS entry for " . $Fqdn . ", new address is " . $PeerVal->"dynamic-address" . ".") false;
      /ip/dns/static/set name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment $DnsRecord;
    }
  } else={
    $LogPrintExit2 info $0 ("Adding new DNS entry for " . $Fqdn . ", address is " . $PeerVal->"dynamic-address" . ".") false;
    /ip/dns/static/add name=$Fqdn address=($PeerVal->"dynamic-address") ttl=$Ttl comment=$Comment place-before=$PlaceBefore;
  }
}