Merge remote-tracking branch 'ms/dns-forwarding' into next

diff --git a/doc/language_issues.en b/doc/language_issues.en
index 4af86025ffdf59e9c4bc0f7f3ff10f4afab32c2f..5a3012207a8d99f4e120ec8e64aeb0ce0859eed5 100644 (file)
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -606,6 +606,8 @@ WARNING: untranslated string: dns desc = If the red0 interface gets the IP addre
 WARNING: untranslated string: dns error 0 = The IP address of the <strong>primary</strong> DNS server is not valid, please check your entries!<br />The entered <strong>secondary</strong> DNS server address is valid.
 WARNING: untranslated string: dns error 01 = The entered IP address of the <strong>primary</strong> and <strong>secondary</strong> DNS server are not valid, please check your entries!
 WARNING: untranslated string: dns error 1 = The IP address of the <strong>secondary</strong> DNS server is not valid, please check your entries!<br />The entered <strong>primary</strong> DNS server address is valid.
+WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
+WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
 WARNING: untranslated string: dns header = Assign DNS server addresses only for DHCP on red0
 WARNING: untranslated string: dns list = List of free public DNS servers
 WARNING: untranslated string: dns menu = Assign DNS-Server

diff --git a/doc/language_issues.es b/doc/language_issues.es
index d1a593566188338a26eae5b50ed5ab6d0bc382f4..d8b49f918b7216b109a84cf36fb042798249a29d 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -778,6 +778,8 @@ WARNING: untranslated string: dhcp dns update algo = Algorithm:
 WARNING: untranslated string: dhcp dns update secret = Secret:
 WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
 WARNING: untranslated string: dnat address = Firewall Interface
+WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
+WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
 WARNING: untranslated string: dns servers = DNS Servers
 WARNING: untranslated string: dnsforward = DNS Forwarding
 WARNING: untranslated string: dnsforward add a new entry = Add a new entry

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index ded039f5a20e00f12116885148971b76f88dff7b..37b43569c6e4e2d42778573e3cdfee5069843cb8 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -772,6 +772,8 @@ WARNING: untranslated string: Captive clients = unknown string
 WARNING: untranslated string: Scan for Songs = unknown string
 WARNING: untranslated string: bytes = unknown string
 WARNING: untranslated string: default IP address = Default IP Address
+WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
+WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
 WARNING: untranslated string: fwhost cust geoipgrp = unknown string
 WARNING: untranslated string: fwhost err hostip = unknown string
 WARNING: untranslated string: guardian block a host = unknown string

diff --git a/doc/language_issues.it b/doc/language_issues.it
index 7c465aae6e4fc198dce0231aa7f1890ce0219a3c..c2b0b23279513e4f4eccd957f460fc3fb623a98b 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -798,6 +798,8 @@ WARNING: untranslated string: dhcp dns update = DNS Update
 WARNING: untranslated string: dhcp dns update algo = Algorithm:
 WARNING: untranslated string: dhcp dns update secret = Secret:
 WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
+WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
+WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
 WARNING: untranslated string: dnsforward forward_servers = Nameservers
 WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been disabled
 WARNING: untranslated string: eight hours = 8 Hours

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index 2ed6e3d85d6e5aa17b67d6a90e2056d6696b07be..46d923fe51e96d0b05894d7c155e5d44bbb4adb6 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -801,6 +801,8 @@ WARNING: untranslated string: dhcp dns update = DNS Update
 WARNING: untranslated string: dhcp dns update algo = Algorithm:
 WARNING: untranslated string: dhcp dns update secret = Secret:
 WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
+WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
+WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
 WARNING: untranslated string: dns servers = DNS Servers
 WARNING: untranslated string: dnsforward forward_servers = Nameservers
 WARNING: untranslated string: dnssec aware = DNSSEC Aware

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index d1a593566188338a26eae5b50ed5ab6d0bc382f4..d8b49f918b7216b109a84cf36fb042798249a29d 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -778,6 +778,8 @@ WARNING: untranslated string: dhcp dns update algo = Algorithm:
 WARNING: untranslated string: dhcp dns update secret = Secret:
 WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
 WARNING: untranslated string: dnat address = Firewall Interface
+WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
+WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
 WARNING: untranslated string: dns servers = DNS Servers
 WARNING: untranslated string: dnsforward = DNS Forwarding
 WARNING: untranslated string: dnsforward add a new entry = Add a new entry

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 2f0b4d9e8bc617b31aa310d0477a886ed6cf5189..1286bcd87ddf572097ba347a1ad838d179e602cb 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -782,6 +782,8 @@ WARNING: untranslated string: dhcp dns update secret = Secret:
 WARNING: untranslated string: disk access per = Disk Access per
 WARNING: untranslated string: dl client arch insecure = Download insecure Client Package (zip)
 WARNING: untranslated string: dnat address = Firewall Interface
+WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
+WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
 WARNING: untranslated string: dns servers = DNS Servers
 WARNING: untranslated string: dnsforward = DNS Forwarding
 WARNING: untranslated string: dnsforward add a new entry = Add a new entry

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index c6fb9f25582f2450273b935f53432c0523b9ca25..0e95d60458e442199dc02f8bd3dd143aa0aa3510 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -775,6 +775,8 @@ WARNING: untranslated string: bytes = unknown string
 WARNING: untranslated string: crypto error = Cryptographic error
 WARNING: untranslated string: crypto warning = Cryptographic warning
 WARNING: untranslated string: default IP address = Default IP Address
+WARNING: untranslated string: dns forward disable dnssec = Disable DNSSEC (dangerous)
+WARNING: untranslated string: dns forwarding dnssec disabled notice = (DNSSEC disabled)
 WARNING: untranslated string: dnsforward forward_servers = Nameservers
 WARNING: untranslated string: fwdfw all subnets = All subnets
 WARNING: untranslated string: fwhost cust geoipgrp = unknown string

diff --git a/doc/language_missings b/doc/language_missings
index 4d0499960cef818beec01e733de04c4b7aac9979..12ef6e673faa6594e9c159bae1d4075ad719f090 100644 (file)
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -210,9 +210,11 @@
 < dnsforward
 < dnsforward add a new entry
 < dnsforward configuration
+< dns forward disable dnssec
 < dnsforward edit an entry
 < dnsforward entries
 < dnsforward forward_servers
+< dns forwarding dnssec disabled notice
 < dnsforward zone
 < dnssec aware
 < dnssec disabled warning
@@ -803,6 +805,8 @@
 ############################################################################
 < cryptographic settings
 < default IP address
+< dns forward disable dnssec
+< dns forwarding dnssec disabled notice
 < interface mode
 < invalid input for interface address
 < invalid input for interface mode
@@ -898,7 +902,9 @@
 < dhcp dns update algo
 < dhcp dns update secret
 < dl client arch insecure
+< dns forward disable dnssec
 < dnsforward forward_servers
+< dns forwarding dnssec disabled notice
 < dnssec disabled warning
 < eight hours
 < email config
@@ -1141,7 +1147,9 @@
 < dh name is invalid
 < dh parameter
 < dl client arch insecure
+< dns forward disable dnssec
 < dnsforward forward_servers
+< dns forwarding dnssec disabled notice
 < dnssec aware
 < dnssec disabled warning
 < dnssec information
@@ -1501,9 +1509,11 @@
 < dnsforward
 < dnsforward add a new entry
 < dnsforward configuration
+< dns forward disable dnssec
 < dnsforward edit an entry
 < dnsforward entries
 < dnsforward forward_servers
+< dns forwarding dnssec disabled notice
 < dnsforward zone
 < dnssec aware
 < dnssec disabled warning
@@ -2235,9 +2245,11 @@
 < dnsforward
 < dnsforward add a new entry
 < dnsforward configuration
+< dns forward disable dnssec
 < dnsforward edit an entry
 < dnsforward entries
 < dnsforward forward_servers
+< dns forwarding dnssec disabled notice
 < dnsforward zone
 < dnssec aware
 < dnssec disabled warning
@@ -2820,7 +2832,9 @@
 < cryptographic settings
 < crypto warning
 < default IP address
+< dns forward disable dnssec
 < dnsforward forward_servers
+< dns forwarding dnssec disabled notice
 < fwdfw all subnets
 < interface mode
 < invalid input for interface address

diff --git a/html/cgi-bin/dnsforward.cgi b/html/cgi-bin/dnsforward.cgi
index 0439817b9a8cb540054b3653dab0a337e10087c8..d9807c90e6599c721bb3cbc29089f05a4049b627 100644 (file)
--- a/html/cgi-bin/dnsforward.cgi
+++ b/html/cgi-bin/dnsforward.cgi
@@ -52,6 +52,7 @@ $cgiparams{'ACTION'} = '';
 $cgiparams{'ZONE'} = '';
 $cgiparams{'FORWARD_SERVERS'} = '';
 $cgiparams{'REMARK'} ='';
+$cgiparams{'DISABLE_DNSSEC'} = 'off';
 &Header::getcgihash(\%cgiparams);
 open(FILE, $filename) or die 'Unable to open config file.';
 my @current = <FILE>;
@@ -76,6 +77,10 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'add'})
                }
        }
 
+       if ($cgiparams{'DISABLE_DNSSEC'} !~ /^(on|off)?$/) {
+               $errormessage = $Lang::tr{'invalid input'};
+       }
+
        # Go further if there was no error.
        if ( ! $errormessage)
        {
@@ -85,11 +90,16 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'add'})
            # Check if a remark has been entered.
            $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
 
+               # Set to off if not enabled
+               if (!$cgiparams{'DISABLE_DNSSEC'}) {
+                       $cgiparams{'DISABLE_DNSSEC'} = "off";
+               }
+
                # Check if we want to edit an existing or add a new entry.
                if($cgiparams{'EDITING'} eq 'no') {
                        open(FILE,">>$filename") or die 'Unable to open config file.';
                        flock FILE, 2;
-                       print FILE "$cgiparams{'ENABLED'},$cgiparams{'ZONE'},$cgiparams{'FORWARD_SERVERS'},$cgiparams{'REMARK'}\n";
+                       print FILE "$cgiparams{'ENABLED'},$cgiparams{'ZONE'},$cgiparams{'FORWARD_SERVERS'},$cgiparams{'REMARK'},$cgiparams{'DISABLE_DNSSEC'}\n";
                } else {
                        open(FILE, ">$filename") or die 'Unable to open config file.';
                        flock FILE, 2;
@@ -98,7 +108,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'add'})
                        {
                                $id++;
                                if ($cgiparams{'EDITING'} eq $id) {
-                                       print FILE "$cgiparams{'ENABLED'},$cgiparams{'ZONE'},$cgiparams{'FORWARD_SERVERS'},$cgiparams{'REMARK'}\n";
+                                       print FILE "$cgiparams{'ENABLED'},$cgiparams{'ZONE'},$cgiparams{'FORWARD_SERVERS'},$cgiparams{'REMARK'},$cgiparams{'DISABLE_DNSSEC'}\n";
                                } else { print FILE "$line"; }
                        }
                }
@@ -151,7 +161,10 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'})
                {
                        chomp($line);
                        my @temp = split(/\,/,$line);
-                       print FILE "$cgiparams{'ENABLE'},$temp[1],$temp[2],$temp[3]\n";
+
+                       $temp[0] = $cgiparams{'ENABLE'};
+
+                       print FILE join(",", @temp) . "\n";
                }
        }
        close(FILE);
@@ -176,6 +189,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'})
                        $cgiparams{'ZONE'} = $temp[1];
                        $cgiparams{'FORWARD_SERVERS'} = join(",", split(/\|/, $temp[2]));
                        $cgiparams{'REMARK'} = $temp[3];
+                       $cgiparams{'DISABLE_DNSSEC'} = $temp[4];
                }
        }
 }
@@ -184,6 +198,10 @@ $checked{'ENABLED'}{'off'} = '';
 $checked{'ENABLED'}{'on'} = '';
 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = "checked='checked'";
 
+$checked{'DISABLE_DNSSEC'}{'off'} = '';
+$checked{'DISABLE_DNSSEC'}{'on'} = '';
+$checked{'DISABLE_DNSSEC'}{$cgiparams{'DISABLE_DNSSEC'}} = "checked='checked'";
+
 &Header::openpage($Lang::tr{'dnsforward configuration'}, 1, '');
 
 &Header::openbigbox('100%', 'left', '', $errormessage);
@@ -230,6 +248,10 @@ print <<END
                <td width ='20%' class='base'>$Lang::tr{'remark'}:</td>
                <td><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='40' maxlength='50' /></td>
        </tr>
+       <tr>
+               <td width ='20%' class='base'>$Lang::tr{'dns forward disable dnssec'}:</td>
+               <td><input type='checkbox' name='DISABLE_DNSSEC' $checked{'DISABLE_DNSSEC'}' /></td>
+       </tr>
 </table>
 <br>
 <hr>
@@ -291,13 +313,19 @@ foreach my $line (@current)
        my $gif = '';
        my $gdesc = '';
        my $toggle = '';
+       my $notice = "";
 
        # Format lists of servers
        my $servers = join(", ", split(/\|/, $temp[2]));
 
+       my $disable_dnssec = $temp[4];
+
        if($cgiparams{'ACTION'} eq $Lang::tr{'edit'} && $cgiparams{'ID'} eq $id) {
                print "<tr>";
                $col="bgcolor='${Header::colouryellow}'"; }
+       elsif ($disable_dnssec eq 'on') {
+               print "<tr>";
+               $col="bgcolor='${Header::colourred}' style='color: white'"; }
        elsif ($id % 2) {
                print "<tr>";
                $col="bgcolor='$color{'color22'}'"; }
@@ -308,11 +336,15 @@ foreach my $line (@current)
        if ($temp[0] eq 'on') { $gif='on.gif'; $toggle='off'; $gdesc=$Lang::tr{'click to disable'};}
        else { $gif='off.gif'; $toggle='on'; $gdesc=$Lang::tr{'click to enable'}; }
 
+       if ($disable_dnssec eq "on") {
+               $notice = $Lang::tr{'dns forwarding dnssec disabled notice'};
+       }
+
 ###
 # Display edit page.
 #
 print <<END
-       <td align='center' $col>$temp[1]</td>
+       <td align='center' $col>$temp[1] $notice</td>
        <td align='center' $col>$servers</td>
        <td align='center' $col>$temp[3]</td>
        <td align='center' $col>

diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index cf33567a1cc8589ec19f9f6166fc412e01ee4433..ce7090c39ec75ef4657e42569ed93dcf44925581 100644 (file)
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -805,6 +805,8 @@
 'dns error 0' => 'Die IP Adresse vom <strong>primären</strong> DNS Server ist nicht gültig, bitte überprüfen Sie Ihre Eingabe!<br />Die eingegebene <strong>sekundären</strong> DNS Server Adresse ist jedoch gültig.<br />',
 'dns error 01' => 'Die eingegebene IP Adresse des <strong>primären</strong> wie auch des <strong>sekundären</strong> DNS-Servers sind nicht gültig, bitte überprüfen Sie Ihre Eingaben!',
 'dns error 1' => 'Die IP Adresse vom <strong>sekundären</strong> DNS Server ist nicht gültig, bitte überprüfen Sie Ihre Eingabe!<br />Die eingegebene <strong>primäre</strong> DNS Server Adresse ist jedoch gültig.',
+'dns forward disable dnssec' => 'DNSSEC deaktivieren (nicht empfohlen)',
+'dns forwarding dnssec disabled notice' => '(DNSSEC deaktiviert)',
 'dns header' => 'DNS Server Adressen zuweisen nur mit DHCP an red0',
 'dns list' => 'Liste von freien öffentlichen DNS Servern',
 'dns menu' => 'DNS-Server zuweisen',

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 4f4b4d9c1b4fcefbc184e373f4cea65ec665688e..7697dc2020898a23ef733669a7130f0a205ea5ea 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -832,6 +832,8 @@
 'dns error 0' => 'The IP address of the <strong>primary</strong> DNS server is not valid, please check your entries!<br />The entered <strong>secondary</strong> DNS server address is valid.',
 'dns error 01' => 'The entered IP address of the <strong>primary</strong> and <strong>secondary</strong> DNS server are not valid, please check your entries!',
 'dns error 1' => 'The IP address of the <strong>secondary</strong> DNS server is not valid, please check your entries!<br />The entered <strong>primary</strong> DNS server address is valid.',
+'dns forward disable dnssec' => 'Disable DNSSEC (dangerous)',
+'dns forwarding dnssec disabled notice' => '(DNSSEC disabled)',
 'dns header' => 'Assign DNS server addresses only for DHCP on red0',
 'dns list' => 'List of free public DNS servers',
 'dns menu' => 'Assign DNS-Server',

diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound
index 2ef994e963cc1629f5d4ece415f80c036277b2d7..af9bcef73ce09e24944b88dd5e206d3294a0eb87 100644 (file)
--- a/src/initscripts/system/unbound
+++ b/src/initscripts/system/unbound
@@ -197,8 +197,8 @@ write_forward_conf() {
 
                local insecure_zones="${INSECURE_ZONES}"
 
-               local enabled zone server servers remark
-               while IFS="," read -r enabled zone servers remark; do
+               local enabled zone server servers remark disable_dnssec rest
+               while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
                        # Line must be enabled.
                        [ "${enabled}" = "on" ] || continue
 
@@ -208,6 +208,11 @@ write_forward_conf() {
                                *.local)
                                        insecure_zones="${insecure_zones} ${zone}"
                                        ;;
+                               *)
+                                       if [ "${disable_dnssec}" = "on" ]; then
+                                               insecure_zones="${insecure_zones} ${zone}"
+                                       fi
+                                       ;;
                        esac
 
                        # Reverse-lookup zones must be stubs