mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-21 08:22:59 +02:00
de7abd2cd5
This disables DNSSEC until the system clock has been set correctly. There is a circular dependency on working DNS and being able to resolve DNS records in order to reach a time server. Systems without a RTC or empty RTC battery will start up with time way in the past in which all DNSSEC signatures are invalid.
127 lines
2.9 KiB
Bash
127 lines
2.9 KiB
Bash
#!/bin/sh
|
|
########################################################################
|
|
# Begin $rc_base/init.d/dnsmasq
|
|
#
|
|
# Description : dnsmasq init script
|
|
#
|
|
# Authors : Michael Tremer - mitch@ipfire.org
|
|
#
|
|
# Version : 01.00
|
|
#
|
|
# Notes :
|
|
#
|
|
########################################################################
|
|
|
|
. /etc/sysconfig/rc
|
|
. ${rc_functions}
|
|
|
|
# Pull custom configuration file
|
|
if [ -e "/etc/sysconfig/dnsmasq" ]; then
|
|
. /etc/sysconfig/dnsmasq
|
|
fi
|
|
|
|
CACHE_SIZE=2500
|
|
ENABLE_DNSSEC=1
|
|
SHOW_SRV=1
|
|
TRUST_ANCHOR=".,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5"
|
|
|
|
function dnssec_args() {
|
|
local cmdline="--dnssec --dnssec-timestamp"
|
|
|
|
if [ -n "${TRUST_ANCHOR}" ]; then
|
|
cmdline="${cmdline} --trust-anchor=${TRUST_ANCHOR}"
|
|
fi
|
|
|
|
echo "${cmdline}"
|
|
}
|
|
|
|
function dns_forward_args() {
|
|
local file="${1}"
|
|
|
|
# Do nothing if file is empty.
|
|
[ -s "${file}" ] || return
|
|
|
|
local cmdline
|
|
|
|
local enabled zone server remark
|
|
while IFS="," read -r enabled zone server remark; do
|
|
# Line must be enabled.
|
|
[ "${enabled}" = "on" ] || continue
|
|
|
|
cmdline="${cmdline} --server=/${zone}/${server}"
|
|
done < ${file}
|
|
|
|
echo "${cmdline}"
|
|
}
|
|
|
|
case "${1}" in
|
|
start)
|
|
# kill already running copy of dnsmasq...
|
|
killproc /usr/sbin/dnsmasq 2>&1 > /dev/null
|
|
|
|
boot_mesg "Starting Domain Name Service Proxy..."
|
|
|
|
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
|
|
ARGS="$CUSTOM_ARGS"
|
|
[ "$DOMAIN_NAME_GREEN" != "" ] && ARGS="$ARGS -s $DOMAIN_NAME_GREEN"
|
|
|
|
echo > /var/ipfire/red/resolv.conf # Clear it
|
|
if [ -e "/var/ipfire/red/dns1" ]; then
|
|
DNS1=$(cat /var/ipfire/red/dns1 2>/dev/null)
|
|
if [ ! -z ${DNS1} ]; then
|
|
echo "nameserver ${DNS1}" >> /var/ipfire/red/resolv.conf
|
|
fi
|
|
fi
|
|
if [ -e "/var/ipfire/red/dns2" ]; then
|
|
DNS2=$(cat /var/ipfire/red/dns2 2>/dev/null)
|
|
if [ ! -z ${DNS2} ]; then
|
|
echo "nameserver ${DNS2}" >> /var/ipfire/red/resolv.conf
|
|
fi
|
|
fi
|
|
[ -e "/var/ipfire/red/active" ] && ARGS="$ARGS -r /var/ipfire/red/resolv.conf"
|
|
|
|
ARGS="$ARGS --domain=`cat /var/ipfire/main/settings |grep DOMAIN |cut -d = -f 2`"
|
|
|
|
# Add custom forward dns zones.
|
|
ARGS="${ARGS} $(dns_forward_args /var/ipfire/dnsforward/config)"
|
|
|
|
# Enabled DNSSEC validation
|
|
if [ "${ENABLE_DNSSEC}" -eq 1 ]; then
|
|
ARGS="${ARGS} $(dnssec_args)"
|
|
fi
|
|
|
|
if [ -n "${CACHE_SIZE}" ]; then
|
|
ARGS="${ARGS} --cache-size=${CACHE_SIZE}"
|
|
fi
|
|
|
|
loadproc /usr/sbin/dnsmasq -l /var/state/dhcp/dhcpd.leases $ARGS
|
|
|
|
if [ "${SHOW_SRV}" -eq 1 ] && [ "${DNS1}" != "" -o "${DNS2}" != "" ]; then
|
|
boot_mesg "Using DNS server(s): ${DNS1} ${DNS2}"
|
|
boot_mesg_flush
|
|
fi
|
|
;;
|
|
|
|
stop)
|
|
boot_mesg "Stopping Domain Name Service Proxy..."
|
|
killproc /usr/sbin/dnsmasq
|
|
;;
|
|
|
|
restart)
|
|
${0} stop
|
|
sleep 1
|
|
${0} start
|
|
;;
|
|
|
|
status)
|
|
statusproc /usr/sbin/dnsmasq
|
|
;;
|
|
|
|
*)
|
|
echo "Usage: ${0} {start|stop|restart|status}"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# End $rc_base/init.d/dnsmasq
|