PowerDNS DNSUPDATE policy script

dnsupdate-policy.lua

-- Policy control thing with policy derived from key name
-- "keyname.owner.domain" will be allowed to edit domain (including suddomains)
-- Special keyname "acme" should be allowed to add and remove _acme-challenge TXT records under domain
-- Assumes that the key name can't be faked

function updatepolicy(request)
	local tsig = request:getTsigName();
	local zone = request:getZoneName();
	pdnslog("updatepolicy: tsig "..tsig:toString().." wants to update "..request:getQName():toString().." in "..zone:toString(), pdns.loglevels.Info);

	if not tsig:isPartOf(zone) then
		pdnslog("updatepolicy: tsig "..tsig:toString().." is not part of "..zone:toString()..", UNACCEPTABLE!", pdns.loglevels.Info);
		return false
	end

	if tsig:toString():match("^acme%.") then -- Is there a better way to match prefixes?
		if string.match(request:getQName():toString(), "^_acme%-challenge%.") then
			local qtype = request:getQType();
			return  qtype == pdns.TXT or qtype == pdns.ANY;
		end
		return false;
	end

	pdnslog("updatepolicy: "..tsig:toString().." acting on "..request:getQName():toString(), pdns.loglevels.Info);

	return true;
end