. /etc/sysconfig/rc
. ${rc_functions}
+TEST_DOMAIN="ipfire.org"
+
+# This domain will never validate
+TEST_DOMAIN_FAIL="dnssec-failed.org"
+
+INSECURE_ZONES=
USE_FORWARDERS=1
# Cache any local zones for 60 seconds
echo "${cidr}/${nbits}"
}
+ip_address_revptr() {
+ local addr=${1}
+
+ local a1 a2 a3 a4
+ IFS=. read -r a1 a2 a3 a4 <<< ${addr}
+
+ echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
+}
+
read_name_servers() {
local i
for i in 1 2; do
}
update_forwarders() {
- local forwarders="$(read_name_servers)"
+ if [ "${USE_FORWARDERS}" = "1" -a -e "/var/ipfire/red/active" ]; then
+ local forwarders
+ local broken_forwarders
+
+ local ns
+ for ns in $(read_name_servers); do
+ test_name_server ${ns} &>/dev/null
+ case "$?" in
+ # Only use DNSSEC-validating or DNSSEC-aware name servers
+ 0|2)
+ forwarders="${forwarders} ${ns}"
+ ;;
+ *)
+ broken_forwarders="${broken_forwarders} ${ns}"
+ ;;
+ esac
+ done
+
+ # Determine EDNS buffer size
+ local current_edns_buffer_size=$(unbound-control get_option edns-buffer-size)
+
+ if [ -n "${current_edns_buffer_size}" ]; then
+ local new_edns_buffer_size=${current_edns_buffer_size}
+
+ for ns in ${forwarders}; do
+ local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
+ if [ -n "${edns_buffer_size}" ]; then
+ if [ ${edns_buffer_size} -lt ${current_edns_buffer_size} ]; then
+ new_edns_buffer_size=${edns_buffer_size}
+ fi
+ fi
+ done
+
+ unbound-control -q set_option edns-buffer-size: ${new_edns_buffer_size}
+ fi
+
+ # Show warning for any broken upstream name servers
+ if [ -n "${broken_forwarders}" ]; then
+ boot_mesg "Ignoring broken upstream name server(s): ${broken_forwarders:1}" ${WARNING}
+ echo_warning
+ fi
- if [ "${USE_FORWARDERS}" = "1" ] && [ -n "${forwarders}" ]; then
- boot_mesg "Using Name Server(s): ${forwarders}"
- boot_mesg_flush
+ if [ -n "${broken_forwarders}" -a -z "${forwarders}" ]; then
+ boot_mesg "Falling back to recursor mode" ${WARNING}
+ echo_warning
- unbound-control -q forward ${forwarders}
+ elif [ -n "${forwarders}" ]; then
+ boot_mesg "Configuring upstream name server(s): ${forwarders:1}" ${INFO}
+ echo_ok
+
+ echo "${forwarders}" > /var/ipfire/red/dns
+ unbound-control -q forward ${forwarders}
+ return 0
+ fi
+ fi
# If forwarders cannot be used we run in recursor mode
- else
- unbound-control -q forward off
+ echo "local recursor" > /var/ipfire/red/dns
+ unbound-control -q forward off
+}
+
+own_hostname() {
+ local hostname=$(hostname -f)
+ # 1.1.1.1 is reserved for unused green, skip this
+ if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
+ unbound-control -q local_data "${hostname} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}"
fi
+
+ local address
+ for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
+ [ -n "${address}" ] || continue
+ [ "${address}" = "1.1.1.1" ] && continue
+
+ address=$(ip_address_revptr ${address})
+ unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${hostname}"
+ done
}
update_hosts() {
local fqdn="${hostname}.${domainname}"
unbound-control -q local_data "${fqdn} ${LOCAL_TTL} IN A ${address}"
- done < /var/ipfire/main/hosts
-}
-
-write_interfaces_conf() {
- (
- config_header
- if [ -n "${GREEN_ADDRESS}" ]; then
- echo "# GREEN"
- echo "interface: ${GREEN_ADDRESS}"
- echo "access-control: $(cidr ${GREEN_NETADDRESS} ${GREEN_NETMASK}) allow"
- fi
+ # Skip reverse resolution if the address equals the GREEN address
+ [ "${address}" = "${GREEN_ADDRESS}" ] && continue
- if [ -n "${BLUE_ADDRESS}" ]; then
- echo "# BLUE"
- echo "interface: ${BLUE_ADDRESS}"
- echo "access-control: $(cidr ${BLUE_NETADDRESS} ${BLUE_NETMASK}) allow"
- fi
- ) > /etc/unbound/interfaces.conf
+ # Add RDNS
+ address=$(ip_address_revptr ${address})
+ unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${fqdn}"
+ done < /var/ipfire/main/hosts
}
write_forward_conf() {
(
config_header
+ local insecure_zones="${INSECURE_ZONES}"
+
local enabled zone server remark
while IFS="," read -r enabled zone server remark; do
# Line must be enabled.
[ "${enabled}" = "on" ] || continue
+ # Zones that end with .local are commonly used for internal
+ # zones and therefore not signed
+ case "${zone}" in
+ *.local)
+ insecure_zones="${insecure_zones} ${zone}"
+ ;;
+ esac
+
echo "forward-zone:"
echo " name: ${zone}"
echo " forward-addr: ${server}"
echo
done < /var/ipfire/dnsforward/config
+
+ if [ -n "${insecure_zones}" ]; then
+ echo "server:"
+
+ for zone in ${insecure_zones}; do
+ echo " domain-insecure: ${zone}"
+ done
+ fi
) > /etc/unbound/forward.conf
}
done < /proc/meminfo
}
+test_name_server() {
+ local ns=${1}
+ local args
+
+ # Return codes:
+ # 0 DNSSEC validating
+ # 1 Error: unreachable, etc.
+ # 2 DNSSEC aware
+ # 3 NOT DNSSEC-aware
+
+ # Exit when the server is not reachable
+ ns_is_online ${ns} || return 1
+
+ # Determine the maximum edns buffer size that works
+ local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
+ if [ -n "${edns_buffer_size}" ]; then
+ args="${args} +bufsize=${edns_buffer_size}"
+ fi
+
+ local errors
+ for rr in DNSKEY DS RRSIG; do
+ if ! ns_forwards_${rr} ${ns} ${args}; then
+ errors="${errors} ${rr}"
+ fi
+ done
+
+ if [ -n "${errors}" ]; then
+ echo >&2 "Unable to retrieve the following resource records from ${ns}: ${errors:1}"
+ return 3
+ fi
+
+ if ns_is_validating ${ns} ${args}; then
+ # Return 0 if validating
+ return 0
+ else
+ # Is DNSSEC-aware
+ return 2
+ fi
+}
+
+# Sends an A query to the nameserver w/o DNSSEC
+ns_is_online() {
+ local ns=${1}
+ shift
+
+ dig @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null
+}
+
+# Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating
+ns_is_validating() {
+ local ns=${1}
+ shift
+
+ dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL
+}
+
+# Checks if we can retrieve the DNSKEY for this domain.
+# dig will print the SOA if nothing was found
+ns_forwards_DNSKEY() {
+ local ns=${1}
+ shift
+
+ dig @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA
+}
+
+ns_forwards_DS() {
+ local ns=${1}
+ shift
+
+ dig @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA
+}
+
+ns_forwards_RRSIG() {
+ local ns=${1}
+ shift
+
+ dig @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG
+}
+
+ns_supports_tcp() {
+ local ns=${1}
+ shift
+
+ dig @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1
+}
+
+ns_determine_edns_buffer_size() {
+ local ns=${1}
+ shift
+
+ local b
+ for b in 4096 2048 1500 1480 1464 1400 1280 512; do
+ if dig @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then
+ echo "${b}"
+ return 0
+ fi
+ done
+
+ return 1
+}
+
case "$1" in
start)
+ # Print a nicer messagen when unbound is already running
+ if pidofproc -s unbound; then
+ statusproc /usr/sbin/unbound
+ exit 0
+ fi
+
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
# Create control keys at first run
# Update configuration files
write_tuning_conf
- write_interfaces_conf
write_forward_conf
boot_mesg "Starting Unbound DNS Proxy..."
loadproc /usr/sbin/unbound || exit $?
+ # Make own hostname resolveable
+ own_hostname
+
# Update any known forwarding name servers
update_forwarders
;;
update-forwarders)
+ # Do not try updating forwarders when unbound is not running
+ if ! pgrep unbound &>/dev/null; then
+ exit 0
+ fi
+
update_forwarders
;;
+ test-name-server)
+ ns=${2}
+
+ test_name_server ${ns}
+ ret=${?}
+
+ case "${ret}" in
+ 0)
+ echo "${ns} is validating"
+ ;;
+ 2)
+ echo "${ns} is DNSSEC-aware"
+ ;;
+ 3)
+ echo "${ns} is NOT DNSSEC-aware"
+ ;;
+ *)
+ echo "Test failed for an unknown reason"
+ exit ${ret}
+ ;;
+ esac
+
+ if ns_supports_tcp ${ns}; then
+ echo "${ns} supports TCP fallback"
+ else
+ echo "${ns} does not support TCP fallback"
+ fi
+
+ edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
+ if [ -n "${edns_buffer_size}" ]; then
+ echo "EDNS buffer size for ${ns}: ${edns_buffer_size}"
+ fi
+
+ exit ${ret}
+ ;;
+
*)
- echo "Usage: $0 {start|stop|restart|status|update-forwarders}"
+ echo "Usage: $0 {start|stop|restart|status|update-forwarders|test-name-server}"
exit 1
;;
esac
projects / people / pmueller / ipfire-2.x.git / blobdiff