dnsmasq: Enable DNSSEC timestamp feature

[ipfire-2.x.git] / src / initscripts / init.d / dnsmasq

diff --git a/src/initscripts/init.d/dnsmasq b/src/initscripts/init.d/dnsmasq
index a02097e4109febedae15ee1dd3b0604001b4dd67..4e37925171a4687d056f4f93ef3ec7b317ed8e3d 100644 (file)
--- a/src/initscripts/init.d/dnsmasq
+++ b/src/initscripts/init.d/dnsmasq
@@ -20,7 +20,20 @@ if [ -e "/etc/sysconfig/dnsmasq" ]; then
        . /etc/sysconfig/dnsmasq
 fi
 
+CACHE_SIZE=2500
+ENABLE_DNSSEC=1
 SHOW_SRV=1
+TRUST_ANCHOR=".,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5"
+
+function dnssec_args() {
+       local cmdline="--dnssec --dnssec-timestamp"
+
+       if [ -n "${TRUST_ANCHOR}" ]; then
+               cmdline="${cmdline} --trust-anchor=${TRUST_ANCHOR}"
+       fi
+
+       echo "${cmdline}"
+}
 
 function dns_forward_args() {
        local file="${1}"
@@ -41,7 +54,6 @@ function dns_forward_args() {
        echo "${cmdline}"
 }
 
-
 case "${1}" in
        start)
                # kill already running copy of dnsmasq...
@@ -50,8 +62,8 @@ case "${1}" in
                boot_mesg "Starting Domain Name Service Proxy..."
                
                eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
-               ARGS=
-               [ "$DOMAIN_NAME_GREEN" != "" ] && ARGS="-s $DOMAIN_NAME_GREEN"
+               ARGS="$CUSTOM_ARGS"
+               [ "$DOMAIN_NAME_GREEN" != "" ] && ARGS="$ARGS -s $DOMAIN_NAME_GREEN"
                
                echo > /var/ipfire/red/resolv.conf # Clear it
                if [ -e "/var/ipfire/red/dns1" ]; then
@@ -73,7 +85,14 @@ case "${1}" in
                # Add custom forward dns zones.
                ARGS="${ARGS} $(dns_forward_args /var/ipfire/dnsforward/config)"
 
-               ARGS="$ARGS $CUSTOM_ARGS"
+               # Enabled DNSSEC validation
+               if [ "${ENABLE_DNSSEC}" -eq 1 ]; then
+                       ARGS="${ARGS} $(dnssec_args)"
+               fi
+
+               if [ -n "${CACHE_SIZE}" ]; then
+                       ARGS="${ARGS} --cache-size=${CACHE_SIZE}"
+               fi
 
                loadproc /usr/sbin/dnsmasq -l /var/state/dhcp/dhcpd.leases $ARGS