RFC 2136 DNS Authenticator (#4701)

Introduce a plugin that automates the process of completing a dns-01 challenge by creating, and subsequently removing, TXT records using RFC 2136 Dynamic Updates (a.k.a. nsupdate).

This plugin has been tested with BIND, but may work with other RFC 2136-compatible DNS servers, such as PowerDNS.

certbot/cli.py

@@ -1264,6 +1264,8 @@ def _plugins_parsing(helpful, plugins):
     helpful.add(["plugins", "certonly"], "--dns-nsone", action="store_true",
                 help=('Obtain certificates using a DNS TXT record (if you are '
                       'using NS1 for DNS).'))
+    helpful.add(["plugins", "certonly"], "--dns-rfc2136", action="store_true",
+                help='Obtain certificates using a DNS TXT record (if you are using BIND for DNS).')
     helpful.add(["plugins", "certonly"], "--dns-route53", action="store_true",
                 help=('Obtain certificates using a DNS TXT record (if you are using Route53 for '
                       'DNS).'))

certbot/plugins/disco.py

@@ -36,6 +36,7 @@ class PluginEntryPoint(object):
         "certbot-dns-google",
         "certbot-dns-luadns",
         "certbot-dns-nsone",
+        "certbot-dns-rfc2136",
         "certbot-dns-route53",
         "certbot-nginx",
     ]

certbot/plugins/dns_common.py

@@ -139,7 +139,7 @@ class DNSAuthenticator(common.Plugin):
 
             setattr(self.config, self.dest(key), os.path.abspath(os.path.expanduser(new_value)))
 
-    def _configure_credentials(self, key, label, required_variables=None):
+    def _configure_credentials(self, key, label, required_variables=None, validator=None):
         """
         As `_configure_file`, but for a credential configuration file.
 
@@ -150,11 +150,20 @@ class DNSAuthenticator(common.Plugin):
         :param str key: The configuration key.
         :param str label: The user-friendly label for this piece of information.
         :param dict required_variables: Map of variable which must be present to error to display.
+        :param callable validator: A method which will be called to validate the
+            `CredentialsConfiguration` resulting from the supplied input after it has been validated
+            to contain the `required_variables`. Should throw a `~certbot.errors.PluginError` to
+            indicate any issue.
         """
 
         def __validator(filename):
+            configuration = CredentialsConfiguration(filename, self.dest)
+
             if required_variables:
-                CredentialsConfiguration(filename, self.dest).require(required_variables)
+                configuration.require(required_variables)
+
+            if validator:
+                validator(configuration)
 
         self._configure_file(key, label, __validator)
 
@@ -162,6 +171,9 @@ class DNSAuthenticator(common.Plugin):
         if required_variables:
             credentials_configuration.require(required_variables)
 
+        if validator:
+            validator(credentials_configuration)
+
         return credentials_configuration
 
     @staticmethod

certbot/plugins/selection.py

@@ -128,7 +128,7 @@ def choose_plugin(prepared, question):
 
 noninstaller_plugins = ["webroot", "manual", "standalone", "dns-cloudflare", "dns-cloudxns",
                         "dns-digitalocean", "dns-dnsimple", "dns-dnsmadeeasy", "dns-google",
-                        "dns-luadns", "dns-route53", "dns-nsone"]
+                        "dns-luadns", "dns-nsone", "dns-rfc2136", "dns-route53"]
 
 def record_chosen_plugins(config, plugins, auth, inst):
     "Update the config entries to reflect the plugins we actually selected."
@@ -249,6 +249,8 @@ def cli_plugin_requests(config):  # pylint: disable=too-many-branches
         req_auth = set_configurator(req_auth, "dns-luadns")
     if config.dns_nsone:
         req_auth = set_configurator(req_auth, "dns-nsone")
+    if config.dns_rfc2136:
+        req_auth = set_configurator(req_auth, "dns-rfc2136")
     if config.dns_route53:
         req_auth = set_configurator(req_auth, "dns-route53")
     logger.debug("Requested authenticator %s and installer %s", req_auth, req_inst)