+++ /dev/null
-# Copyright (C) 2015-2019 CZ.NIC, z. s. p. o. (https://www.nic.cz/)
-# SPDX-License-Identifier: GPL-2.0
-
-PKG_RELRO_FULL:=0
-
-include $(TOPDIR)/rules.mk
-
-PKG_NAME:=knot-resolver
-PKG_VERSION:=__VERSION__
-PKG_RELEASE:=1
-
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-
-PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)
-
-PKG_MAINTAINER:=Knot DNS <knot-dns@labs.nic.cz>
-PKG_LICENSE:=GPL-3.0
-
-PKG_INSTALL:=1
-
-include $(INCLUDE_DIR)/package.mk
-
-define Package/knot-resolver
- SECTION:=net
- CATEGORY:=Network
- SUBMENU:=IP Addresses and Names
- TITLE:=Knot DNS Resolver
- URL:=https://gitlab.nic.cz/knot/resolver
- DEPENDS=+knot-libs +knot-libzscanner +libuv +luajit +dnssec-rootkey +resolver-conf +libstdcpp
- PROVIDES:=dns-resolver
-endef
-
-define Package/knot-resolver/description
- The Knot DNS Resolver is a minimalistic caching resolver implementation.
-endef
-
-MAKE_FLAGS += \
- PREFIX=/usr \
- ETCDIR=/etc/kresd
-
-define Build/Patch
- $(Build/Patch/Default)
- cd $(PKG_BUILD_DIR) && \
- sed -i -e 's/\(.*find_lib,hiredis.*\)/HAS_hiredis := no/' \
- -e 's/\(.*find_lib,libmemcached.*\)/HAS_libmemcached := no/' Makefile
-endef
-
-define Package/knot-resolver/install
- $(INSTALL_DIR) $(1)/usr/bin
- $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/*bin/kresd $(1)/usr/bin/
-
- $(INSTALL_DIR) $(1)/usr/lib
- $(CP) $(PKG_INSTALL_DIR)/usr/lib/libkres.so* $(1)/usr/lib
- $(CP) $(PKG_INSTALL_DIR)/usr/lib/kdns_modules $(1)/usr/lib
-
- $(INSTALL_DIR) $(1)/etc/init.d
- $(INSTALL_BIN) ./files/kresd.init $(1)/etc/init.d/kresd
-
- $(INSTALL_DIR) $(1)/etc/kresd
- $(CP) $(PKG_BUILD_DIR)/etc/icann-ca.pem $(1)/etc/kresd
- $(CP) $(PKG_BUILD_DIR)/etc/root.hints $(1)/etc/kresd
- $(INSTALL_BIN) ./files/kresd.postinst $(1)/etc/kresd/kresd.postinst.sh
- $(INSTALL_BIN) ./files/convert_config.sh $(1)/etc/kresd/convert_config.sh
-endef
-
-define Package/$(PKG_NAME)/postinst
-#!/bin/sh
-set -x
-if [ -z "$$IPKG_INSTROOT" ]; then
-/etc/init.d/dnsmasq restart
-sleep 2 # Cooldown for above (problems in times of reinstall)
-/etc/kresd/kresd.postinst.sh && rm /etc/kresd/kresd.postinst.sh
-/etc/kresd/convert_config.sh && rm /etc/kresd/convert_config.sh
-if [ "`uci -q get resolver.common.prefered_resolver`" = kresd ] && uci -q get resolver.common.forward_upstream | egrep -q '(1|yes|true|enabled|on)'; then
- ping -c 1 api.turris.cz 2> /dev/null >&2 || {
- uci set resolver.common.forward_upstream=0
- uci commit
- /etc/init.d/resolver restart
- if ping -c 1 api.turris.cz 2> /dev/null >&2; then
- create_notification -s error "DNS servery vašeho poskytovatele internetu nefungují úplně dobře - pravděpodobně nepodporují DNSSEC. Bylo proto vypnuto forwardování a váš router bude nyní vyhodnocovat DNS dotazy sám." "Your ISPs DNS servers does not work properly - most likely they don't support DNSSEC. Therefore DNS forwarding was turned off and your router will now resolve all DNS queries by itself."
- else
- uci set resolver.common.forward_upstream=1
- uci commit
- /etc/init.d/resolver restart
- fi
- }
-fi
-fi
-endef
-
-define Package/$(PKG_NAME)/prerm
-#!/bin/sh
-set -ex
-if [ -z "$$IPKG_INSTROOT" ]; then
-# Remove the script if it is there.
-if [ -e /etc/init.d/kresd ] ; then /etc/init.d/kresd stop ; /etc/init.d/kresd disable ; fi
-fi
-endef
-
-define Package/knot-resolver/postrm
-#!/bin/sh
-if [ -z "$$IPKG_INSTROOT" ]; then
-[ \! -x /etc/init.d/resolver ] || /etc/init.d/resolver restart
-fi
-endef
-
-$(eval $(call BuildPackage,knot-resolver))
-
+++ /dev/null
-#!/bin/sh /etc/rc.common
-# SPDX-License-Identifier: GPL-2.0
-
-START=61
-STOP=00
-
-USE_PROCD=1
-PROG=/usr/bin/kresd
-CONFIGFILE=/tmp/kresd.config
-ROOTKEYFILE=/etc/root.keys
-DEFAULT_RUNDIR=/tmp/kresd
-STATIC_DOMAINS=1
-DYNAMIC_DOMAINS=0
-USERNAME=kresd
-GROUP=kresd
-
-# Check the /etc/unbound/root.keys is reasonable and try to fix it with given command
-check_root_key() {
- # Don't do anything if it looks OK
- grep -qE '[[:space:]](DNSKEY|DS|TYPE[[:digit:]][[:digit:]])[[:space:]]' $ROOTKEYFILE && return
- # Not OK -> run the command and hope for the best
- echo "Trying to restore broken $ROOTKEYFILE with command $@"
- eval "$@"
-}
-
-print() {
- echo "...---..."
-}
-
-service_triggers() {
- procd_add_reload_trigger "dhcp"
-}
-
-add_listen_addr() {
- local addr="$1"
- local port="$2"
- [ "$addr" = "::0" ] && addr="::"
- procd_append_param command -a "$addr#$port"
-}
-
-init_header() {
- echo "--Automatically generated file; DO NOT EDIT" > $CONFIGFILE
- echo "modules = {" >> $CONFIGFILE
- config_get_bool prefetch common prefetch 0
- echo " 'hints > iterate'" >> $CONFIGFILE
- echo " , 'policy'" >> $CONFIGFILE
- if [ "$prefetch" \!= 0 ]; then
- echo " , 'stats'" >> $CONFIGFILE
- echo " , predict = {" >> $CONFIGFILE
- echo " window = 30 -- 30 minutes sampling window" >> $CONFIGFILE
- echo " , period = 24*(60/30) -- track last 24 hours" >> $CONFIGFILE
- echo " }" >> $CONFIGFILE
- fi
- echo "}" >> $CONFIGFILE
-
- echo "hints.use_nodata(true)" >> $CONFIGFILE
-
- # clear hints file
- echo "" > $HINTS_CONFIG
-}
-
-set_param_func() {
- local func_name="$1"
- local val="$2"
- echo "$func_name($val)">>$CONFIGFILE
-}
-
-set_param_var() {
- local name="$1"
- local val="$2"
- echo "$name=$val">>$CONFIGFILE
-}
-
-include_custom_config() {
- local custom_config_path
- config_get custom_config_path "kresd" include_config
- if [ -e "$custom_config_path" ]; then
- echo "" >> $CONFIGFILE
- echo "--- Included custom configuration file from: ---" >> $CONFIGFILE
- echo "--- $custom_config_path " >> $CONFIGFILE
- cat $custom_config_path >> $CONFIGFILE
- else
- [ -z "$custom_config_path" ] || echo "Warning! Kresd custom config file $custom_config_path doesn't exist."
- fi
-}
-
-load_uci_config_common() {
- local interface keyfile verbose port msg_buffer_size net_ipv4 net_ipv6 msg_cache_size do_forward ignore_root_key keep_cache_bool
- local forward_dns
- local section="common"
-
- # port
- config_get port "$section" port
-
- # list of listen addresses
- config_list_foreach "$section" interface add_listen_addr $port
-
- # ignore keyfile
- config_get_bool ignore_root_key "$section" ignore_root_key 0
-
- if [ "$ignore_root_key" = "0" ]; then
- #keyfile
- config_get keyfile "$section" keyfile
- if [ -n "$keyfile" ]; then
- ROOTKEYFILE=$keyfile
- check_root_key cert-backup -x $ROOTKEYFILE
- procd_append_param command -k "$keyfile"
- fi
- fi
-
- # verbosity
- config_get verbose "$section" verbose 0
- [ "$verbose" -ge 1 ] && procd_append_param command -v
-
- # EDNS payload
- config_get msg_buffer_size "$section" msg_buffer_size
- [ "$msg_buffer_size" -ge 512 ] && set_param_func "net.bufsize" "$msg_buffer_size"
-
- # ipv4
- config_get_bool net_ipv4 "$section" net_ipv4
- net_ipv4_bool=$(if test "$net_ipv4" -eq "1"; then echo true; else echo false; fi)
- set_param_var "net.ipv4" "$net_ipv4_bool"
-
- # ipv6
- config_get_bool net_ipv6 "$section" net_ipv6
- net_ipv6_bool=$(if test "$net_ipv6" -eq "1"; then echo true; else echo false; fi)
- set_param_var "net.ipv6" "$net_ipv6_bool"
-
- # msg_cache_size
- config_get msg_cache_size "$section" msg_cache_size
- conv_msg_cache_size=$(echo "$msg_cache_size"|sed -e 's/k$/*kB/gi' -e 's/M$/*MB/gi' -e 's/G$/*GB/gi')
- set_param_func "cache.open" "$conv_msg_cache_size"
-
- # clear cache
- config_get_bool keep_cache_bool "kresd" keep_cache 1
- if [ "$keep_cache_bool" = "0" ]; then
- set_param_func "cache.clear" ""
- fi
-
- config_get_bool do_forward "$section" forward_upstream 1
- config_get forward_dns "$section" forward_custom
-
- #check custom forwarding
- if [ -n "$forward_dns" ] && [ "$do_forward" = "1" ]; then
- dns_config_load "$forward_dns"
- else
- if [ "$do_forward" = "1" ] ; then
- local SERVERS
- SERVERS=$(sed -ne 's/^nameserver \(.*\)/\1/p' /tmp/resolv.conf.auto | sort -u |head -n 4)
- if [ "$SERVERS" ] ; then
- if [ "$ignore_root_key" = "1" ] ; then
- echo "policy.add(policy.all(policy.STUB({">>$CONFIGFILE
- else
- echo "policy.add(policy.all(policy.FORWARD({">>$CONFIGFILE
- fi
- for SERVER in $SERVERS ; do
- echo " '$SERVER',">>$CONFIGFILE
- done
- echo "})))">>$CONFIGFILE
- fi
- fi
- md5sum /tmp/resolv.conf.auto | cut -f1 -d\ >/tmp/resolv.conf.auto.last.md5
- fi
-
- # enable static local domains
- config_get_bool STATIC_DOMAINS "$section" static_domains 1
-
- # get dynamic domains
- config_get_bool DYNAMIC_DOMAINS "$section" dynamic_domains 1
-
- # include custom kresd config
- include_custom_config
-}
-
-get_local_domain() {
- config_get DOMAIN $1 local
- [ -z "$DOMAIN" ] || DOMAIN="`echo "$DOMAIN" | sed 's|/||g'`"
-}
-
-set_local_host() {
- config_get NAME $1 name
- config_get IP $1 ip
- if [ -n "$NAME" ] && [ -n "$DOMAIN" ] && [ -n "$IP" ]; then
- echo "$IP $NAME.$DOMAIN" >> $HINTS_CONFIG
- fi
-}
-
-get_dnsmasq_dhcp_script() {
- local config="$1"
- local DHCPSCRIPT
- config_get DHCPSCRIPT "$config" dhcpscript
- echo $DHCPSCRIPT
-}
-
-add_rpz_file() {
- local rpz_file="$1"
- if [ -e "$rpz_file" ]; then
- echo "policy.add(policy.rpz(policy.DENY, '$rpz_file'))" >>$CONFIGFILE
- fi
-}
-
-add_hostname_config() {
- local hostname_config="$1"
- if [ -e "$hostname_config" ] && [ "$STATIC_DOMAINS" = "1" ]; then
- cat $hostname_config >> $HINTS_CONFIG
- fi
-}
-
-modify_rundir() {
- local rundir
- local section="kresd"
-
- #rundir
- config_get rundir "$section" rundir "$DEFAULT_RUNDIR"
- if [ ! -d "$rundir" ]; then
- mkdir -p "$rundir"
- fi
- chown -R $USERNAME:$GROUP "$rundir" #maybe we should be more restrictive ...
- DEFAULT_RUNDIR="$rundir"
- HINTS_CONFIG=$DEFAULT_RUNDIR/hints.tmp
-}
-
-load_uci_config_kresd() {
- local addr config keyfile forks verbose log_stderr log_stdout hostname_config
- local section="kresd"
-
- # knot-resolver config
- procd_append_param command -c "$CONFIGFILE"
-
- # number of forks
- config_get forks "$section" forks 1
- procd_append_param command -f "$forks"
-
- # rundir
- procd_append_param command "$DEFAULT_RUNDIR"
-
- # procd stdout/err logging
- config_get_bool log_stderr "$section" log_stderr 1
- procd_set_param stderr $log_stderr
- config_get_bool log_stdout "$section" log_stdout 1
- procd_set_param stdout $log_stdout
-
- # hostnames for local DNS
- config_list_foreach "$section" hostname_config add_hostname_config
-
- #add rpz files
- config_list_foreach "$section" rpz_file add_rpz_file
-
- config_load dhcp
- config_foreach get_local_domain dnsmasq
-
- if [ "$STATIC_DOMAINS" = "1" ]; then
- config_foreach set_local_host host
- config_foreach set_local_host domain
- fi
-
- config_load resolver
-
- # load hints config
- set_param_func "hints.config" "'$HINTS_CONFIG'"
-}
-
-run_instance() {
- procd_open_instance
- procd_set_param file /etc/config/resolver
- procd_set_param command "$PROG"
- procd_set_param respawn
- modify_rundir
- init_header
- load_uci_config_kresd
- load_uci_config_common
- procd_close_instance
- ( sleep 60 # Wait for resolver to start working and system to boot up
- if ! ip -6 r s | grep -q '^default' &&\
- ping -c 1 api.turris.cz > /dev/null 2>&1 && \
- ! ping -6 -c 1 api.turris.cz > /dev/null 2>&1; then
- echo "net.ipv6 = false" | socat - UNIX-CONNECT:$(sleep 5; ls -1 $DEFAULT_RUNDIR/tty/*) > /dev/null 2>&1
- fi) &
-}
-
-
-print_dns_config() {
- local name description enable_tls port ipv4 ipv6 pin_sha256 hostname ca_file
- local net_ipv6 net_ipv4
-
- name="$1"
- description="$2"
- enable_tls="$3"
- port="$4"
- ipv4="$5"
- ipv6="$6"
- pin_sha256="$7"
- hostname="$8"
- ca_file="$9"
- net_ipv4="$10"
- net_ipv6="$11"
-
-
- if [ "$net_ipv4" == "1" ] && [ "$net_ipv6" == "1" ]; then
- if [ ! -z "$ipv4" ] && [ ! -z "$ipv6" ]; then
- ip_list="$ipv4 $ipv6"
- elif [ ! -z "$ipv4" ] && [ -z "$ipv6" ]; then
- ip_list="$ipv4"
- elif [ -z "$ipv4" ] && [ ! -z "$ipv6" ]; then
- ip_list="$ipv6"
- else
- echo "Error ipv4 and ipv6 not set !"
- exit -1
- fi
- elif [ "$net_ipv4" != "1" ] && [ "$net_ipv6" == "1" ]; then
- if [ ! -z "$ipv6" ]; then
- ip_list="$ipv6"
- else
- echo "Error ipv6 not set !"
- exit -1
- fi
- elif [ "$net_ipv4" == "1" ] && [ "$net_ipv6" != "1" ]; then
- if [ ! -z "$ipv4" ]; then
- ip_list="$ipv4"
- else
- echo "Error ipv4 not set !"
- exit -1
- fi
- else
- echo "net_ipv4=$net_ipv4 net_ipv6=$net_ipv6"
- echo "Error cannot choose IP address because of net_ipv4 and net_ipv6 settings!"
- exit -1
- fi
-
- #([ "$enable_tls" == "0" ] || [ -z "$enable_tls" ]) && echo -ne "{" >> $CONFIGFILE
- if [ "$enable_tls" == "1" ]; then
- echo "policy.add(policy.all(policy.TLS_FORWARD(">>$CONFIGFILE
- else
- echo "policy.add(policy.all(policy.FORWARD(">>$CONFIGFILE
- fi
- #TODO add stub !!
-
- echo -ne "{" >> $CONFIGFILE
- for ip in $ip_list
- do
-
- [ "$enable_tls" == "1" ] && echo -ne "{" >> $CONFIGFILE
- if [ ! -z "$ip" ]; then
- #check nonstandard port
- if [ "$port" == "853" ] || [ -z "$port" ]; then
- echo "'$ip'" >> $CONFIGFILE
- else
- echo "'$ip@$port'" >> $CONFIGFILE
- fi
-
- #check of DNS-over-TLS
- if [ "$enable_tls" == "1" ]; then
-
- #prefer pin
- if [ ! -z "$pin_sha256" ];then
- echo -ne "," >> $CONFIGFILE
- echo "pin_sha256='$pin_sha256'" >> $CONFIGFILE
- #else use hostname and certificate from system ca storage
- elif [ ! -z "$hostname" ]; then
- echo -ne "," >> $CONFIGFILE
- echo "hostname='$hostname'" >> $CONFIGFILE
- #or use ca file if defined
- if [ ! -z "$ca_file" ] && [ -f "$ca_file" ];then
- echo -ne "," >> $CONFIGFILE
- echo "ca_file='$ca_file'" >> $CONFIGFILE
- fi
- fi
- fi
- fi
-
- last_item=$(echo $ip_list | awk '{print $NF}')
- if [ "$enable_tls" == "1" ] && [ "$last_item" != "$ip" ] ; then
- echo -ne "}," >> $CONFIGFILE
- elif [ "$enable_tls" == "1" ] && [ "$last_item" == "$ip" ] ; then
- echo -ne "}" >> $CONFIGFILE
- elif ([ "$enable_tls" == "0" ] || [ -z "$enable_tls" ]) && [ "$last_item" != "$ip" ]; then
- echo -ne "," >> $CONFIGFILE
- fi
- done
- echo -ne "}" >> $CONFIGFILE
- echo ")))" >>$CONFIGFILE
-}
-
-dns_config_load() {
- local config_name config_file ret
- local name description enable_tls port ipv4 ipv6 pin_sha256 hostname ca_file
- local net_ipv4 net_ipv6
-
- config_name="$1"
- config_file="/etc/resolver/dns_servers/${config_name}.conf"
- config_load resolver
-
- #check file config file
- if [ -f "$config_file" ]; then
- enable_tls="0" #set default value
- config_get net_ipv6 "common" "net_ipv6" 1
- config_get net_ipv4 "common" "net_ipv4" 1
-
- echo "loading file from ... $config_file"
- source $config_file
- echo print_dns_config "$name" "$description" "$enable_tls" "$port" "$ipv4" "$ipv6" "$pin_sha256" "$hostname" "$ca_file" "$net_ipv4" "$net_ipv6"
- print_dns_config "$name" "$description" "$enable_tls" "$port" "$ipv4" "$ipv6" "$pin_sha256" "$hostname" "$ca_file" "$net_ipv4" "$net_ipv6"
- else
- echo "Error DNS Resolver config not found!"
- fi
- echo "ret_value_dns_load=$ret"
-}
-
-
-start_service() {
- config_load resolver
- run_instance
-}
-
-reload_service()
-{
- stop
- start
-}
projects / thirdparty / knot-resolver.git / commitdiff
