View difference between Paste ID: GY333pmr and 9C7EXmnF

 #!/bin/sh
 
 #exit 0
 
 ## CONFIGURATION ##
 # Kerberos realm
 realm="DOMAIN.LAN"
 # Kerberos principal
 principal="dhcpduser@$realm"
 # Kerberos keytab
 keytab="/etc/dhcp/dhcpd.keytab"
 # Kerberos credentials cache
 krb5cc="/run/dhcp-server/dhcpd.krb5cc"
 # Use MIT kerberos args instead of heimdal.
 #KRB5MIT="YES"
 
 # Domain appended to hostname
 domain="domain.lan"
-NSUPDFLAGS="-d"
+
 NSRVS="ns1.domain.lan ns2.domain.lan"
 # Default DNS resource records TTL
 RRTTL="3600"
 # Do not use TXT RRs (rfc4701)
 #NOTXTRRS="YES"
 # Additional nsupdate flags (-g already applied), e.g. "-d" for debug
 #NSUPDFLAGS="-d"
 
 ######################################################
-## KERBEROS ##
+
 ## VARIABLES ##
 action=$1
 ip=$2
 DHCID=$3
-# Heimdal
+
-klist -t || kinit -t $keytab $principal
+
-# MIT (not tested)
+
-#klist -s || kinit $principal -k -t $keytab
+
 echo "Usage:"
 echo "	`basename $0` add ip-address dhcid|mac-address hostname [dns-ttl]"
 echo "	`basename $0` delete ip-address dhcid|mac-address"
 }
 
 _kerberos() {
 export KRB5_KTNAME="$keytab"
 export KRB5CCNAME="$krb5cc"
 
 if [ "$KRB5MIT" = "YES" ]; then
     klist -s || kinit $principal -k -t $keytab
 else
     klist -t || kinit -t $keytab $principal
 fi
 }
 
 _main() {
 umask 77
 
 if [ -z "$ip" ] || [ -z "$DHCID" ]; then
-	RRAOLD=`host $name.$domain | awk '/has address/ {print $4}'`
+
-	if [ -n "$RRAOLD" ]; then
+
-	    RRTXTOLD=`host -t txt "$name.$domain" | sed -n '/descriptive text/s/^.*[[:space:]]descriptive text[[:space:]]*"\(.*\)"$/\1/p'`
+
-	    [ -z "$RRTXTOLD" ] && echo "Forward map from $name.$domain to $ip FAILED: Has an address record but no DHCID, not mine." && exit 0
+
 ## NSUPDATE ##
-	    RRTXT=`echo "$DHCID$name$domain" | sha256sum`
+
-	    RRTXT="000101${RRTXT%% *}"
+
-	    [ "$RRTXT" != "$RRTXTOLD" ] && echo "Forward map from $name.$domain to $ip FAILED: Has an address record but DHCID is wrong, not mine." && exit 0
+	if [ "$NOTXTRRS" != "YES" ]; then
 	    NOTXTRRS=""
-	    RRTXT=`echo "$DHCID$name$domain" | sha256sum`
+	    RRAOLD=`host $name.$domain | awk '/has address/ {print $4}'`
-	    RRTXT="000101${RRTXT%% *}"
+	    if [ -n "$RRAOLD" ]; then
 		RRTXTOLD=`host -t txt "$name.$domain" | sed -n '/descriptive text/s/^.*[[:space:]]descriptive text[[:space:]]*"\(.*\)"$/\1/p'`
 		[ -z "$RRTXTOLD" ] && echo "Forward map from $name.$domain to $ip FAILED: Has an address record but no DHCID, not mine." && exit 0
 
 		RRTXT=`echo "$DHCID$name.$domain" | sha256sum`
 		RRTXT="000101${RRTXT%% *}"
 		[ "$RRTXT" != "$RRTXTOLD" ] && echo "Forward map from $name.$domain to $ip FAILED: Has an address record but DHCID is wrong, not mine." && exit 0
 	    else
 		RRTXT=`echo "$DHCID$name.$domain" | sha256sum`
 		RRTXT="000101${RRTXT%% *}"
 	    fi
 	else
-update delete $name.$domain. $RRTTL TXT
+	    NOTXTRRS=";"
-update add $name.$domain. $RRTTL TXT $RRTXT
+
 
 	RRPTRNAME=`echo $ip | awk -F '.' '{print $4"."$3"."$2"."$1".in-addr.arpa"}'`
 
 	_kerberos
 
 	for NSRV in $NSRVS; do
 	    nsupdate -g $NSUPDFLAGS << UPDATE
 server $NSRV
 realm $realm
 update delete $name.$domain. $RRTTL A
 ${NOTXTRRS}update delete $name.$domain. $RRTTL TXT
 ${NOTXTRRS}update add $name.$domain. $RRTTL TXT $RRTXT
-	if [ -n "$RRPTR" ]; then
+
-	    RRTXTOLD=`host -t txt "$RRPTR" | sed -n '/descriptive text/s/^.*[[:space:]]descriptive text[[:space:]]*"\(.*\)"$/\1/p'`
+
-	    [ -z "$RRTXTOLD" ] && echo "Forward map from $RRPTR to $ip removing FAILED: Has an address record but no DHCID, not mine." && exit 0
+
 update add $RRPTRNAME. $RRTTL PTR $name.$domain.
-	    RRTXT=`echo "$DHCID$RRPTR" | sha256sum`
+
-	    RRTXT="000101${RRTXT%% *}"
+
-	    [ "$RRTXT" != "$RRTXTOLD" ] && echo "Forward map from $RRPTR to $ip removing FAILED: Has an address record but DHCID is wrong." && exit 0
+
 	    [ "$result" -eq "0" ] && break
-	    echo "$ip has no PTR, can not determine address record." && exit 0
+
     ;;
     delete)
 	RRPTR=`host $ip | awk '/domain name pointer/ { sub(/\.$/, "", $5); print $5}'`
 	if [ "$NOTXTRRS" != "YES" ]; then
 	    NOTXTRRS=""
 	    if [ -n "$RRPTR" ]; then
 		RRTXTOLD=`host -t txt "$RRPTR" | sed -n '/descriptive text/s/^.*[[:space:]]descriptive text[[:space:]]*"\(.*\)"$/\1/p'`
 		[ -z "$RRTXTOLD" ] && echo "Forward map from $RRPTR to $ip removing FAILED: Has an address record but no DHCID, not mine." && exit 0
 
 		RRTXT=`echo "$DHCID$RRPTR" | sha256sum`
 		RRTXT="000101${RRTXT%% *}"
-update delete $RRPTR. $RRTTL TXT
+		[ "$RRTXT" != "$RRTXTOLD" ] && echo "Forward map from $RRPTR to $ip removing FAILED: Has an address record but DHCID is wrong." && exit 0
 	    else
 		echo "$ip has no PTR, can not determine address record." && exit 0
 	    fi
 	else
 	    NOTXTRRS=";"
 	fi
 
 	RRPTRNAME=`echo $ip | awk -F '.' '{print $4"."$3"."$2"."$1".in-addr.arpa"}'`
 
 	_kerberos
 
 	for NSRV in $NSRVS; do
 	    nsupdate -g $NSUPDFLAGS << UPDATE
 server $NSRV
 realm $realm
 update delete $RRPTR. $RRTTL A
 ${NOTXTRRS}update delete $RRPTR. $RRTTL TXT
 send
 update delete $RRPTRNAME. $RRTTL PTR
 send
 UPDATE
 	    result=$?
 	    [ "$result" -eq "0" ] && break
 	done
     ;;
     *)
 	_usage && exit 1
     ;;
 esac
 
 [ "$result" != "0" ] && echo "GSS-TSIG DNS update failed: $result"
 exit $result
 }
 
 _main