Show HN: "Azu", a CLI utility for manipulating (hand written) DNS zone files

2 points

3 years ago

This is a tool I've been hoping to stumble upon for at least 2 decades. I found it hard to believe that something that does these things wouldn't already exist, but I couldn't find any. (This is your cue to inform me that I'm bad at searching the web, and that there are already tools out there that do exactly what I wanted :).) I've contemplated writing it before, but had always put that off... until last week. After updating numerous zone files by hand and with regexes for the umpteenth, but hopefully last, time.

There are of course existing tools to change zone files, but the ones I could find don't support arbitrary RFC 1035 zone files, or when they do, they insist on reformatting everything because they parse the old one and generate a completely new one - messing up any carefully crafted paragraphs their comment headings. To make matters worse, this approach results in huge diffs that are useless for determining what exactly went wrong.

Mostly, it appears that "everyone" just uses simple regexes for manipulating zone files. But regexes on a source file are error prone. /127.0.0.1/ also matches /127.0.0.10/ and if you anchor it like /127.0.0.1$/ it won't match if there's a space after it, so you need to remember to use \b or \> instead. Records can be written on a single line, or use "(" and ")" to spread over several lines (each of which can have an end-of-line comment) - which is common for SOA and large TXT records, but possible for anything.

For example, incrementing the serial number in a zone file is easy if you do it by hand. But if you want to automate it, it typically becomes a matter of making sure your zone file is formatted in a very specific way and then letting a regex substitution take care of it. But what if you don't have that "; serial" comment to match? What if the SOA record is written on a single line? What if an old record is commented out in favor of a newer one below?

But there are more tasks that are quite common, that benefit from something that actually parses the zone file rather than using regexes. Suppose a host that is known by many names in multiple domains gets an IPv6 address in addition to its existing IPv4 address, so now you need to add a lot of AAAA records in several different zone files. Or you want to add or remove servers from a round-robin address pool. Or some of your zones have an SPF record and you want to add one to the rest, but not to the ones that already have one. Or you want to build your own DNS-01 ACME verification script for Let's Encrypt, but in a way that works with existing zone files. Azu lets you do all of these things on the command line.

There are examples in the README/man page.

Azu tokenizes the zone file itself (that's the easy part), but leaves record parsing to Perl's famous Net::DNS library. More importantly, it will leave the structure and syntax of intact. Only the new additions are automatically normalized and formatted, and even that can be disabled if you prefer to add raw text. The result is a usable, minimal diff.

Due to semver and one breaking change, it's already at version 2.0.0, but be advised: this is pretty new and has not seen extensive use yet. There is a modest test suite based on some challenging zone files, and it hasn't broken any of the zone files I'm using in production, but given its infancy, you should probably inspect its results instead of blindly trusting that the resulting zone file will be correct.

Please give it a try, and share your thoughts!

P.S. Azu only works with actual text based zone files, so it's not great for database driven DNS servers. But then again, if you already have structured queries, you probably don't need this anyway.