X-Git-Url: https://git.distorted.org.uk/~mdw/zones/blobdiff_plain/aef7892ba4aa9ba78d761b2943d5df76f8bbd2d1..6fc6709b784fd8c14390eb6124782af3ea43b018:/distorted.lisp diff --git a/distorted.lisp b/distorted.lisp index b2118a4..57a7225 100644 --- a/distorted.lisp +++ b/distorted.lisp @@ -16,7 +16,7 @@ ;; IPv6 anycast addresses are globally routable, while IPv4 ones aren't. (if (zone-preferred-subnet-p (car any-provider)) (zone-set-address #'rec (cdr any-provider) :make-ptr-p t) - (dolist (addr (host-addrs (host-parse (cdr any-provider)))) + (do-host (addr (cdr any-provider)) (let ((family (ipaddr-family addr))) (if (member family *anycast-routable-families*) (zone-set-address #'rec addr @@ -28,9 +28,10 @@ (dolist (provider (list* any-provider default-provider other-providers)) (zone-set-address #'rec (cdr provider) :make-ptr-p (eq provider any-provider) - :name (concatenate 'string prefix "." - (string-downcase (car provider)) - "." (string-downcase zname)))))) + :name (domain-name-concat prefix + (zone-parse-host + (car provider) + zname)))))) ;;;-------------------------------------------------------------------------- ;;; Other definitions. @@ -47,15 +48,17 @@ ;; Nameservers. :ns #+view/inside ((radius.ns :ip radius) (precision.ns :ip precision) + (telecaster.ns :ip telecaster) (vampire.ns :ip vampire)) #-view/inside ((radius.ns :ip radius) (precision.ns :ip precision) + (telecaster.ns :ip telecaster) (mythic-beasts-1.ns :ip mythic-ns1) (mythic-beasts-2.ns :ip mythic-ns2) (chiark.ns :ip chiark.greenend.org.uk)) ;; Mail servers. - ((@ mail) + ((@ mail blackhole) :mx mail :srv ((:smtp mail))) ((lists bugs cryptomail) @@ -122,13 +125,12 @@ ;; Entry is via little router box. (dmz :net dmz) - (guvnor (dmz :a guvnor.dmz)) - (gate (dmz :a gate.dmz)) - (nat (dmz :a nat.dmz)) + (guvnor (dmz :addr guvnor.dmz)) + (nat (dmz :addr nat.dmz)) ;; Wireless gateway. (wireless :net wireless) - (evolution (safe :a evolution.safe)) + (evolution (safe :addr evolution.safe)) (evolution :alias evo) ;; Colocated services. @@ -136,11 +138,21 @@ (jump :svc jazz.jump :sshfp "jazz")) ((git www mail) (colo :svc stratocaster.colo :sshfp "stratocaster") (jump :svc stratocaster.jump :sshfp "stratocaster")) + ((www @) :tlsa (:https (:service-certificate-constraint + :certificate :sha-256 #p"http-server-www#1"))) + (git :tlsa (:https (:trust-anchor-assertion + :certificate :sha-256 #p"distorted-ca"))) + (www-cache :tlsa (3127 (:trust-anchor-assertion + :certificate :sha-256 #p"distorted-ca"))) + (mail :tlsa ((:smtp :submission :imap) + (:trust-anchor-assertion + :certificate :sha-256 #p"distorted-ca"))) :svc #+view/inside stratocaster.colo #-view/inside stratocaster.jump (cabal :svc stratocaster.colo :sshfp "stratocaster") ((db ftp) (colo :svc telecaster.colo :sshfp "telecaster") (jump :svc telecaster.jump :sshfp "telecaster")) + (dyndns :svc telecaster.jump :sshfp "telecaster") ;; Local services. ((rawk pifi) (unsafe :svc artist.unsafe) @@ -155,56 +167,57 @@ ;; Anonymity services. (anon (colo :svc jazz.colo) (unsafe :svc vampire.unsafe) - (jump :a anon.jump) - (dmz :a anon.dmz)) + (jump :addr anon.jump) + (dmz :addr anon.dmz)) ;; Fancy connectivity. - (iodine (jump :a jazz.jump)) + (iodine (jump :svc jazz.jump)) ;; Colocated hosts. (colo :net colo) (jump :net jump) - (fender (colo :a fender.colo :sshfp "fender") - (jump :a fender.jump :sshfp "fender")) - (precision (colo :a precision.colo :sshfp "precision") - (jump :a precision.jump :sshfp "precision")) - (telecaster (colo :a telecaster.colo :sshfp "telecaster") - (jump :a telecaster.jump :sshfp "telecaster")) + (gate (jump :addr gate.jump :sshfp "precision")) + (fender (colo :addr fender.colo :sshfp "fender") + (jump :addr fender.jump :sshfp "fender")) + (precision (colo :addr precision.colo :sshfp "precision") + (jump :addr precision.jump :sshfp "precision")) + (telecaster (colo :addr telecaster.colo :sshfp "telecaster") + (jump :addr telecaster.jump :sshfp "telecaster")) (telecaster :alias tele) - (stratocaster (colo :a stratocaster.colo :sshfp "stratocaster") - (jump :a stratocaster.jump :sshfp "stratocaster")) + (stratocaster (colo :addr stratocaster.colo :sshfp "stratocaster") + (jump :addr stratocaster.jump :sshfp "stratocaster")) (stratocaster :alias strat) - (jazz (colo :a jazz.colo :sshfp "jazz") - (jump :a jazz.jump :sshfp "jazz") - (iodine :a jazz.iodine :sshfp "jazz")) + (jazz (colo :addr jazz.colo :sshfp "jazz") + (jump :addr jazz.jump :sshfp "jazz") + (iodine :addr jazz.iodine :sshfp "jazz")) ;; Media server (on loan to Good Technology HSTG). - (jaguar (jump :a jaguar.jump)) + (jaguar (jump :addr jaguar.jump :sshfp "jaguar")) ;; Nicko's server. - (richmond (jump :a richmond.jump)) + (richmond (jump :svc richmond.jump)) ;; Wired ethernet. (unsafe :net unsafe) (safe :net safe) (untrusted :net untrusted) - (vampire (unsafe :a vampire.unsafe :sshfp "vampire") - (dmz :a vampire.dmz :sshfp "vampire") - (safe :a vampire.safe :sshfp "vampire") - (untrusted :a vampire.untrusted :sshfp "vampire")) - (ibanez (unsafe :a ibanez.unsafe :sshfp "ibanez") - (dmz :a ibanez.dmz :sshfp "ibanez")) - (radius (unsafe :a radius.unsafe :sshfp "radius") - (dmz :a radius.dmz :sshfp "radius") - (safe :a radius.safe :sshfp "radius") - (untrusted :a radius.untrusted :sshfp "radius")) - (roadstar (unsafe :a roadstar.unsafe :sshfp "roadstar") - (dmz :a roadstar.dmz :sshfp "roadstar")) - (jem (unsafe :a jem.unsafe :sshfp "jem") - (dmz :a jem.dmz :sshfp "jem")) - (artist (unsafe :a artist.unsafe :sshfp "artist") - (dmz :a artist.dmz :sshfp "artist") - (untrusted :a artist.untrusted :sshfp "artist")) + (vampire (unsafe :addr vampire.unsafe :sshfp "vampire") + (dmz :addr vampire.dmz :sshfp "vampire") + (safe :addr vampire.safe :sshfp "vampire") + (untrusted :addr vampire.untrusted :sshfp "vampire")) + (ibanez (unsafe :addr ibanez.unsafe :sshfp "ibanez") + (dmz :addr ibanez.dmz :sshfp "ibanez")) + (radius (unsafe :addr radius.unsafe :sshfp "radius") + (dmz :addr radius.dmz :sshfp "radius") + (safe :addr radius.safe :sshfp "radius") + (untrusted :addr radius.untrusted :sshfp "radius")) + (roadstar (unsafe :addr roadstar.unsafe :sshfp "roadstar") + (dmz :addr roadstar.dmz :sshfp "roadstar")) + (jem (unsafe :addr jem.unsafe :sshfp "jem") + (dmz :addr jem.dmz :sshfp "jem")) + (artist (unsafe :addr artist.unsafe :sshfp "artist") + (dmz :addr artist.dmz :sshfp "artist") + (untrusted :addr artist.untrusted :sshfp "artist")) ;; DHCP hosts. (gibson :cname gibson.dhcp) @@ -212,63 +225,123 @@ (firebird :cname firebird.dhcp) (marauder :cname marauder.dhcp) (invader :cname invader.dhcp) + (gretsch :cname gretsch.dhcp) ;; Virtual network. (vpn :net vpn) - (crybaby (vpn :a crybaby.vpn :sshfp "crybaby")) - (terror (vpn :a terror.vpn :sshfp "terror")) - (orange (vpn :a orange.vpn :sshfp "orange")) + (crybaby (vpn :addr crybaby.vpn :sshfp "crybaby")) + (terror (vpn :addr terror.vpn :sshfp "terror")) + (orange (vpn :addr orange.vpn :sshfp "orange")) + (haze (vpn :addr haze.vpn :sshfp "haze")) (iodine :net iodine) ;; ITS. (its :net its) - (gw (its :a gw.its)) - (mz (its :a mz.its)) + (gw (its :addr gw.its)) + (mz (its :addr mz.its)) ;; Strange things. - (blackhole (jump :a blackhole.jump)) + (blackhole (jump :addr blackhole.jump)) ;; Delegations. (dhcp :ns ((radius.ns.dhcp :ip radius) (precision.ns.dhcp :ip precision) + (telecaster.ns.dhcp :ip telecaster) (vampire.ns.dhcp :ip vampire))) (dyn :ns ((radius.ns.dyn :ip radius) (precision.ns.dyn :ip precision) + (telecaster.ns.dyn :ip telecaster) (vampire.ns.dyn :ip vampire))) (dnserr :ns ((radius.ns.dnserr :ip radius.dmz) (precision.ns.dnserr :ip precision.jump) + (telecaster.ns.dnserr :ip telecaster) (vampire.ns.dnserr :ip vampire.dmz))) (io :ns ((ns.io :ip jazz.jump)))) ;;;-------------------------------------------------------------------------- ;;; Other subsidiary zones. +(defzone dhcp.distorted.org.uk + (gibson :addr gibson.unsafe) + (lespaul :addr lespaul.safe) + (invader :addr invader.safe) + (marauder :addr marauder.safe)) + +(defzone nicko.org + (richmond :addr richmond.jump)) + (defrevzone trusted - :ns ((radius.ns :ip radius) - (precision.ns :ip precision) - (vampire.ns :ip vampire)) + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) :reverse unsafe :reverse vpn :reverse colo :reverse its :reverse any - (dhcp :ns ((radius.ns.dhcp :ip radius) - (precision.ns.dhcp :ip precision) - (vampire.ns.dhcp :ip vampire))) + (dhcp :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.)) :multi (((dhcp safe) :family :ipv4 :suffix "199.29.172.dhcp") :cname *)) -(defrevzone dmz - :ns ((radius.ns :ip radius) - (precision.ns :ip precision) - (vampire.ns :ip vampire)) +(defrevzone (dmz :family :ipv6) + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) :reverse dmz) -(defrevzone jump - :ns ((radius.ns :ip radius) - (precision.ns :ip precision) - (vampire.ns :ip vampire)) +(defrevzone (dmz :family :ipv4) + (144-159 :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.)) + :multi ((dmz :suffix "144-159") :cname *)) + +(defzone 144-159.204.49.62.in-addr.arpa + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse ((((:ipv4 dmz))))) + +(defrevzone (jump :family :ipv6) + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) :reverse jump) +(defrevzone (jump :family :ipv4) + (64-79 :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.)) + :multi ((jump :suffix "64-79") :cname *)) + +(defzone 64-79.198.13.212.in-addr.arpa + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse ((((:ipv4 jump))))) + +(defrevzone distorted.org.uk-he + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse distorted.org.uk-he) + +(defrevzone distorted.org.uk-jump + :ns (radius.distorted.org.uk. + precision.distorted.org.uk. + telecaster.distorted.org.uk. + vampire.distorted.org.uk.) + :reverse distorted.org.uk-jump) + (defzone io.distorted.org.uk :ns ((ns :ip jazz.jump)) (about :txt "Fake zone used for IP-over-DNS tunnelling."))