Core Update 139: fix syntax of generated Suricata DNS server file

[ipfire-2.x.git] / src / initscripts / system / unbound

diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound
index 34b3e06fda5179fdca1b963c0210b213d2d15fff..8eaf3734a88a1638004dd5c35a16fed638febe8c 100644 (file)
--- a/src/initscripts/system/unbound
+++ b/src/initscripts/system/unbound
@@ -15,6 +15,7 @@ TEST_DOMAIN_FAIL="dnssec-failed.org"
 INSECURE_ZONES=
 USE_FORWARDERS=1
 ENABLE_SAFE_SEARCH=off
+FORCE_TCP=off
 
 # Cache any local zones for 60 seconds
 LOCAL_TTL=60
@@ -25,6 +26,12 @@ EDNS_DEFAULT_BUFFER_SIZE=4096
 # Load optional configuration
 [ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound
 
+DIG_ARGS=()
+
+if [ "${FORCE_TCP}" = "on" ]; then
+       DIG_ARGS+=( "+tcp" )
+fi
+
 ip_address_revptr() {
        local addr=${1}
 
@@ -41,6 +48,22 @@ read_name_servers() {
        done 2>/dev/null | xargs echo
 }
 
+check_red_has_carrier_and_ip() {
+       # Interface configured ?
+       [ ! -e "/var/ipfire/red/iface" ] && return 0;
+
+       # Interface present ?
+       [ ! -e "/sys/class/net/$(</var/ipfire/red/iface)" ] && return 0;
+
+       # has carrier ?
+       [ ! "$(</sys/class/net/$(</var/ipfire/red/iface)/carrier)" = "1" ] && return 0;
+
+       # has ip ?
+       [ "$(ip address show dev $(</var/ipfire/red/iface) | grep "inet")" = "" ] && return 0;
+
+       return 1;
+}
+
 config_header() {
        echo "# This file is automatically generated and any changes"
        echo "# will be overwritten. DO NOT EDIT!"
@@ -48,7 +71,8 @@ config_header() {
 }
 
 update_forwarders() {
-       if [ "${USE_FORWARDERS}" = "1" -a -e "/var/ipfire/red/active" ]; then
+       check_red_has_carrier_and_ip
+       if [ "${USE_FORWARDERS}" = "1" -a "${?}" = "1" ]; then
                local forwarders
                local broken_forwarders
 
@@ -131,6 +155,13 @@ update_forwarders() {
        unbound-control -q forward off
 }
 
+remove_forwarders() {
+       enable_dnssec
+       echo "local recursor" > /var/ipfire/red/dns
+       unbound-control -q forward off
+
+}
+
 own_hostname() {
        local hostname=$(hostname -f)
        # 1.1.1.1 is reserved for unused green, skip this
@@ -175,6 +206,14 @@ write_forward_conf() {
        (
                config_header
 
+               # Force using TCP for upstream servers only
+               if [ "${FORCE_TCP}" = "on" ]; then
+                       echo "# Force using TCP for upstream servers only"
+                       echo "server:"
+                       echo "  tcp-upstream: yes"
+                       echo
+               fi
+
                local insecure_zones="${INSECURE_ZONES}"
 
                local enabled zone server servers remark disable_dnssec rest
@@ -367,7 +406,7 @@ ns_is_online() {
        local ns=${1}
        shift
 
-       dig @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null
+       dig "${DIG_ARGS[@]}" @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null
 }
 
 # Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating
@@ -375,11 +414,11 @@ ns_is_validating() {
        local ns=${1}
        shift
 
-       if ! dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then
+       if ! dig "${DIG_ARGS[@]}" @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then
                return 1
        else
                # Determine if NS replies with "ad" data flag if DNSSEC enabled
-               dig @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | awk -F: '/\;\;\ flags\:/ { s=1; if (/\ ad/) s=0; exit s }'
+               dig "${DIG_ARGS[@]}" @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | awk -F: '/\;\;\ flags\:/ { s=1; if (/\ ad/) s=0; exit s }'
        fi
 }
 
@@ -389,28 +428,33 @@ ns_forwards_DNSKEY() {
        local ns=${1}
        shift
 
-       dig @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA
+       dig "${DIG_ARGS[@]}" @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA
 }
 
 ns_forwards_DS() {
        local ns=${1}
        shift
 
-       dig @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA
+       dig "${DIG_ARGS[@]}" @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA
 }
 
 ns_forwards_RRSIG() {
        local ns=${1}
        shift
 
-       dig @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG
+       dig "${DIG_ARGS[@]}" @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG
 }
 
 ns_supports_tcp() {
        local ns=${1}
        shift
 
-       dig @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1
+       # If TCP is forced we know by now if the server responds to it
+       if [ "${FORCE_TCP}" = "on" ]; then
+               return 0
+       fi
+
+       dig "${DIG_ARGS[@]}" @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1
 }
 
 ns_determine_edns_buffer_size() {
@@ -419,7 +463,7 @@ ns_determine_edns_buffer_size() {
 
        local b
        for b in 4096 2048 1500 1480 1464 1400 1280 512; do
-               if dig @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then
+               if dig "${DIG_ARGS[@]}" @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then
                        echo "${b}"
                        return 0
                fi
@@ -440,7 +484,7 @@ get_root_nameservers() {
 can_resolve_root() {
        local ns
        for ns in $(get_root_nameservers); do
-               if dig @${ns} +dnssec SOA . $@ >/dev/null; then
+               if dig "${DIG_ARGS[@]}" @${ns} +dnssec SOA . $@ >/dev/null; then
                        return 0
                fi
        done
@@ -473,7 +517,8 @@ disable_dnssec() {
 fix_time_if_dns_fail() {
        # If DNS still not work try to init ntp with
        # hardcoded ntp.ipfire.org (81.3.27.46)
-       if [ -e /var/ipfire/red/active ]; then
+       check_red_has_carrier_and_ip
+       if [ -e "/var/ipfire/red/iface" -a "${?}" = "1" ]; then
                host 0.ipfire.pool.ntp.org > /dev/null 2>&1
                if [ "${?}" != "0" ]; then
                        boot_mesg "DNS still not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
@@ -489,7 +534,7 @@ resolve() {
        local ns
        for ns in $(read_name_servers); do
                local answer
-               for answer in $(dig +short "@${ns}" A "${hostname}"); do
+               for answer in $(dig "${DIG_ARGS[@]}" +short "@${ns}" A "${hostname}"); do
                        found=1
 
                        # Filter out non-IP addresses
@@ -807,6 +852,19 @@ case "$1" in
                fix_time_if_dns_fail
                ;;
 
+       remove-forwarders)
+               # Do not try updating forwarders when unbound is not running
+               if ! pgrep unbound &>/dev/null; then
+                       exit 0
+               fi
+
+               remove_forwarders
+
+               unbound-control flush_negative > /dev/null
+               unbound-control flush_bogus > /dev/null
+               ;;
+
+
        test-name-server)
                ns=${2}
 
@@ -848,7 +906,7 @@ case "$1" in
                ;;
 
        *)
-               echo "Usage: $0 {start|stop|restart|status|update-forwarders|test-name-server|resolve}"
+               echo "Usage: $0 {start|stop|restart|status|update-forwarders|remove-forwarders|test-name-server|resolve}"
                exit 1
                ;;
 esac