Fix typo in unbound initscript

[ipfire-2.x.git] / src / initscripts / system / unbound

diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound
index e5554d725420727c21f841ccb59e0a23564d44a1..cc46c33c9425cc85d95b1d7412a9db3e146fea4b 100644 (file)
--- a/src/initscripts/system/unbound
+++ b/src/initscripts/system/unbound
@@ -61,7 +61,7 @@ read_name_servers() {
        local i
        for i in 1 2; do
                echo "$(</var/ipfire/red/dns${i})"
-       done | xargs echo
+       done 2>/dev/null | xargs echo
 }
 
 config_header() {
@@ -210,10 +210,24 @@ write_forward_conf() {
                                        ;;
                        esac
 
-                       echo "forward-zone:"
-                       echo "  name: ${zone}"
-                       echo "  forward-addr: ${server}"
-                       echo
+                       # Reverse-lookup zones must be stubs
+                       case "${zone}" in
+                               *.in-addr.arpa)
+                                       echo "stub-zone:"
+                                       echo "  name: ${zone}"
+                                       echo "  stub-addr: ${server}"
+                                       echo
+                                       echo "server:"
+                                       echo "  local-zone: \"${zone}\" transparent"
+                                       echo
+                                       ;;
+                               *)
+                                       echo "forward-zone:"
+                                       echo "  name: ${zone}"
+                                       echo "  forward-addr: ${server}"
+                                       echo
+                                       ;;
+                       esac
                done < /var/ipfire/dnsforward/config
 
                if [ -n "${insecure_zones}" ]; then
@@ -364,7 +378,12 @@ ns_is_validating() {
        local ns=${1}
        shift
 
-       dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL
+       if ! dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then
+               return 1
+       else
+               # Determine if NS replies with "ad" data flag if DNSSEC enabled
+               dig @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | awk -F: '/\;\;\ flags\:/ { s=1; if (/\ ad/) s=0; exit s }'
+       fi
 }
 
 # Checks if we can retrieve the DNSKEY for this domain.
@@ -460,7 +479,7 @@ fix_time_if_dns_fail() {
        if [ -e /var/ipfire/red/active ]; then
                host 0.ipfire.pool.ntp.org > /dev/null 2>&1
                if [ "${?}" != "0" ]; then
-                       boot_mesg "DNS still not work ... init time with ntp.ipfire.org at 81.3.27.46 ..."
+                       boot_mesg "DNS still not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
                        loadproc /usr/local/bin/settime 81.3.27.46
                fi
        fi