diff options
Diffstat (limited to 'dns/bind912/files/named.in')
| -rw-r--r-- | dns/bind912/files/named.in | 406 |
1 files changed, 406 insertions, 0 deletions
diff --git a/dns/bind912/files/named.in b/dns/bind912/files/named.in new file mode 100644 index 000000000000..33b76d151028 --- /dev/null +++ b/dns/bind912/files/named.in @@ -0,0 +1,406 @@ +#!/bin/sh +# +# $FreeBSD$ +# + +# PROVIDE: named +# REQUIRE: %%NAMED_REQUIRE%% +# BEFORE: %%NAMED_BEFORE%% +# KEYWORD: shutdown + +# +# Add the following lines to /etc/rc.conf to enable BIND: +# named_enable (bool): Run named, the DNS server (or NO). +# named_program (str): Path to named, if you want a different one. +# named_conf (str): Path to the configuration file +# named_flags (str): Use this for flags OTHER than -u and -c +# named_uid (str): User to run named as +# named_chrootdir (str): Chroot directory (or "" not to auto-chroot it) +# Historically, was /var/named +# named_chroot_autoupdate (bool): Automatically install/update chrooted +# components of named. +# named_symlink_enable (bool): Symlink the chrooted pid file +# named_wait (bool): Wait for working name service before exiting +# named_wait_host (str): Hostname to check if named_wait is enabled +# named_auto_forward (str): Set up forwarders from /etc/resolv.conf +# named_auto_forward_only (str): Do "forward only" instead of "forward first" +%%NATIVE_PKCS11%%# named_pkcs11_engine (str): Path to the PKCS#11 library to use. +# + +. /etc/rc.subr + +name=named +desc="named BIND startup script" +rcvar=named_enable + +load_rc_config ${name} + +extra_commands=reload + +start_precmd=named_prestart +start_postcmd=named_poststart +reload_cmd=named_reload +stop_cmd=named_stop +stop_postcmd=named_poststop + +named_enable=${named_enable:-"NO"} +named_program=${named_program:-"%%PREFIX%%/sbin/named"} +named_conf=${named_conf:-"%%ETCDIR%%/named.conf"} +named_flags=${named_flags:-""} +named_uid=${named_uid:-"bind"} +named_chrootdir=${named_chrootdir:-""} +named_chroot_autoupdate=${named_chroot_autoupdate:-"YES"} +named_symlink_enable=${named_symlink_enable:-"YES"} +named_wait=${named_wait:-"NO"} +named_wait_host=${named_wait_host:-"localhost"} +named_auto_forward=${named_auto_forward:-"NO"} +named_auto_forward_only=${named_auto_forward_only:-"NO"} +%%NATIVE_PKCS11%%named_pkcs11_engine=${named_pkcs11_engine:-""} + +# Not configuration variables but having them here keeps rclint happy +required_dirs="${named_chrootdir}" +_named_confdirroot="${named_conf%/*}" +_named_confdir="${named_chrootdir}${_named_confdirroot}" +_named_program_root="${named_program%/sbin/named}" +_openssl_engines="%%LOCALBASE%%/lib/engines" + +# Needed if named.conf and rndc.conf are moved or if rndc.conf is used +rndc_conf=${rndc_conf:-"$_named_confdir/rndc.conf"} +rndc_key=${rndc_key:-"$_named_confdir/rndc.key"} + +# If running in a chroot cage, ensure that the appropriate files +# exist inside the cage, as well as helper symlinks into the cage +# from outside. +# +# As this is called after the is_running and required_dir checks +# are made in run_rc_command(), we can safely assume ${named_chrootdir} +# exists and named isn't running at this point (unless forcestart +# is used). +# +chroot_autoupdate() +{ + local file + + # If it's the first time around, fiddle with things and move the + # current configuration to the chroot. + if [ -d ${_named_confdirroot} -a ! -d ${_named_confdir} ]; then + warn "named chroot: Moving current configuration in the chroot!" + install -d ${_named_confdir%/*} + mv ${_named_confdirroot} ${_named_confdir} + fi + + # Create (or update) the chroot directory structure + # + if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.dist ]; then + mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.dist \ + -p ${named_chrootdir} + else + warn "%%PREFIX%%/etc/mtree/BIND.chroot.dist missing," + warn "${named_chrootdir} directory structure not updated" + fi + if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.local.dist ]; then + mkdir -p ${named_chrootdir}%%PREFIX%% + mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.local.dist \ + -p ${named_chrootdir}%%PREFIX%% + else + warn "%%PREFIX%%/etc/mtree/BIND.chroot.local.dist missing," + warn "${named_chrootdir}%%PREFIX%% directory structure not updated" + fi + + # Create (or update) the configuration directory symlink + # + if [ ! -L "${_named_confdirroot}" ]; then + if [ -d "${_named_confdirroot}" ]; then + warn "named chroot: ${_named_confdirroot} is a directory!" + elif [ -e "${_named_confdirroot}" ]; then + warn "named chroot: ${_named_confdirroot} exists!" + else + ln -s ${_named_confdir} ${_named_confdirroot} + fi + else + # Make sure it points to the right place. + ln -shf ${_named_confdir} ${_named_confdirroot} + fi + + # Mount a devfs in the chroot directory if needed + # + if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then + umount ${named_chrootdir}/dev 2>/dev/null + devfs_domount ${named_chrootdir}/dev devfsrules_hide_all + devfs -m ${named_chrootdir}/dev rule apply path null unhide + devfs -m ${named_chrootdir}/dev rule apply path random unhide + else + if [ -c ${named_chrootdir}/dev/null -a \ + -c ${named_chrootdir}/dev/random ]; then + info "named chroot: using pre-mounted devfs." + else + err 1 "named chroot: devfs cannot be mounted from " \ + "within a jail. Thus a chrooted named cannot " \ + "be run from within a jail. Either mount the " \ + "devfs with null and random from the host, or " \ + "run named without chrooting it, set " \ + "named_chrootdir=\"\" in /etc/rc.conf." + fi + fi + + # If OpenSSL from ports, then the engines should be present in the + # chroot, named loads them after chrooting. + if [ -d ${_openssl_engines} ]; then + # FIXME when 8.4 is gone see if + # security.jail.param.allow.mount.nullfs can be used. + if [ `${SYSCTL_N} security.jail.jailed` -eq 0 -o `${SYSCTL_N} security.jail.mount_allowed` -eq 1 ]; then + mkdir -p ${named_chrootdir}${_openssl_engines} + mount -t nullfs ${_openssl_engines} ${named_chrootdir}${_openssl_engines} + else + warn "named chroot: cannot nullfs mount OpenSSL" \ + "engines into the chroot, will copy the shared" \ + "libraries instead." + mkdir -p ${named_chrootdir}${_openssl_engines} + cp -f ${_openssl_engines}/*.so ${named_chrootdir}${_openssl_engines} + fi + fi + + # Copy and/or update key files to the chroot /etc + # + for file in localtime protocols services; do + if [ -r /etc/${file} ] && \ + ! cmp -s /etc/${file} "${named_chrootdir}/etc/${file}"; then + cp -p /etc/${file} "${named_chrootdir}/etc/${file}" + fi + done +} + +# Make symlinks to the correct pid file +# +make_symlinks() +{ + checkyesno named_symlink_enable && + ln -fs "${named_chrootdir}${pidfile}" ${pidfile} +} + +named_poststart() +{ + make_symlinks + + if checkyesno named_wait; then + until ${_named_program_root}/bin/host ${named_wait_host} >/dev/null 2>&1; do + echo " Waiting for nameserver to resolve ${named_wait_host}" + sleep 1 + done + fi +} + +named_reload() +{ + # This is a one line function, but ${named_program} is not defined early + # enough to be there when the reload_cmd variable is defined up there. + rndc reload +} + +find_pidfile() +{ + if get_pidfile_from_conf pid-file ${named_conf}; then + pidfile="${_pidfile_from_conf}" + else + pidfile="/var/run/named/pid" + fi +} + +named_stop() +{ + find_pidfile + + # This duplicates an undesirably large amount of code from the stop + # routine in rc.subr in order to use rndc to shut down the process, + # and to give it a second chance in case rndc fails. + rc_pid=$(check_pidfile ${pidfile} ${command}) + if [ -z "${rc_pid}" ]; then + [ -n "${rc_fast}" ] && return 0 + _run_rc_notrunning + return 1 + fi + echo 'Stopping named.' + if rndc stop; then + wait_for_pids ${rc_pid} + else + echo -n 'rndc failed, trying kill: ' + kill -TERM ${rc_pid} + wait_for_pids ${rc_pid} + fi +} + +named_poststop() +{ + if [ -n "${named_chrootdir}" -a -c ${named_chrootdir}/dev/null ]; then + # if using OpenSSL from ports, unmount OpenSSL engines, if they + # were not mounted but only copied, do nothing. + if [ -d ${_openssl_engines} -a \( `${SYSCTL_N} security.jail.jailed` -eq 0 -o `${SYSCTL_N} security.jail.mount_allowed` -eq 1 \) ]; then + umount ${named_chrootdir}${_openssl_engines} + fi + # unmount /dev + if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then + umount ${named_chrootdir}/dev 2>/dev/null || true + else + warn "named chroot:" \ + "cannot unmount devfs from inside jail!" + fi + fi +} + +create_file() +{ + if [ -e "$1" ]; then + unlink $1 + fi + install -o root -g wheel -m 0644 /dev/null $1 +} + +rndc() +{ + if [ -z "${rndc_flags}" ]; then + if [ -s "${rndc_conf}" ] ; then + rndc_flags="-c ${rndc_conf}" + elif [ -s "${rndc_key}" ] ; then + rndc_flags="-k ${rndc_key}" + else + rndc_flags="" + fi + fi + + ${_named_program_root}/sbin/rndc ${rndc_flags} "$@" +} + +named_prestart() +{ + find_pidfile + + if [ -n "${named_pidfile}" ]; then + warn 'named_pidfile: now determined from the conf file' + fi + + piddir=`/usr/bin/dirname ${pidfile}` + if [ ! -d ${piddir} ]; then + install -d -o ${named_uid} -g ${named_uid} ${piddir} + fi + + command_args="-u ${named_uid:=root} -c ${named_conf} ${command_args}" + +%%NATIVE_PKCS11%% if [ -z "${named_pkcs11_engine}"]; then +%%NATIVE_PKCS11%% err 3 "named_pkcs11_engine has to be set to the PKCS#11 engine's library you want to use" +%%NATIVE_PKCS11%% elif [ ! -f ${named_pkcs11_engine} ]; then +%%NATIVE_PKCS11%% err 3 "named_pkcs11_engine the PKCS#11 engine's library you want to use doesn't exist" +%%NATIVE_PKCS11%% else +%%NATIVE_PKCS11%% mkdir -p ${named_chrootdir}${named_pkcs11_engine%/*} +%%NATIVE_PKCS11%% cp -p ${named_pkcs11_engine} ${named_chrootdir}${named_pkcs11_engine} +%%NATIVE_PKCS11%% command_args="-E ${named_pkcs11_engine} ${command_args}" +%%NATIVE_PKCS11%% fi + + local line nsip firstns + + # Is the user using a sandbox? + # + if [ -n "${named_chrootdir}" ]; then + rc_flags="${rc_flags} -t ${named_chrootdir}" + checkyesno named_chroot_autoupdate && chroot_autoupdate + else + named_symlink_enable=NO + fi + + # Create an rndc.key file for the user if none exists + # + confgen_command="${_named_program_root}/sbin/rndc-confgen -a -b256 -u ${named_uid} \ + -c ${_named_confdir}/rndc.key" + if [ -s "${_named_confdir}/rndc.conf" ]; then + unset confgen_command + fi + if [ -s "${_named_confdir}/rndc.key" ]; then + case `stat -f%Su ${_named_confdir}/rndc.key` in + root|${named_uid}) ;; + *) ${confgen_command} ;; + esac + else + ${confgen_command} + fi + + local checkconf + + checkconf="${_named_program_root}/sbin/named-checkconf" + if ! checkyesno named_chroot_autoupdate && [ -n "${named_chrootdir}" ]; then + checkconf="${checkconf} -t ${named_chrootdir}" + fi + + # Create a forwarder configuration based on /etc/resolv.conf + if checkyesno named_auto_forward; then + if [ ! -s /etc/resolv.conf ]; then + warn "named_auto_forward enabled, but no /etc/resolv.conf" + + # Empty the file in case it is included in named.conf + [ -s "${_named_confdir}/auto_forward.conf" ] && + create_file ${_named_confdir}/auto_forward.conf + + ${checkconf} ${named_conf} || + err 3 'named-checkconf for ${named_conf} failed' + return + fi + + create_file /var/run/naf-resolv.conf + create_file /var/run/auto_forward.conf + + echo ' forwarders {' > /var/run/auto_forward.conf + + while read line; do + case "${line}" in + 'nameserver '*|'nameserver '*) + nsip=${line##nameserver[ ]} + + if [ -z "${firstns}" ]; then + if [ ! "${nsip}" = '127.0.0.1' ]; then + echo 'nameserver 127.0.0.1' + echo " ${nsip};" >> /var/run/auto_forward.conf + fi + + firstns=1 + else + [ "${nsip}" = '127.0.0.1' ] && continue + echo " ${nsip};" >> /var/run/auto_forward.conf + fi + ;; + esac + + echo ${line} + done < /etc/resolv.conf > /var/run/naf-resolv.conf + + echo ' };' >> /var/run/auto_forward.conf + echo '' >> /var/run/auto_forward.conf + if checkyesno named_auto_forward_only; then + echo " forward only;" >> /var/run/auto_forward.conf + else + echo " forward first;" >> /var/run/auto_forward.conf + fi + + if cmp -s /etc/resolv.conf /var/run/naf-resolv.conf; then + unlink /var/run/naf-resolv.conf + else + [ -e /etc/resolv.conf ] && unlink /etc/resolv.conf + mv /var/run/naf-resolv.conf /etc/resolv.conf + fi + + if cmp -s ${_named_confdir}/auto_forward.conf \ + /var/run/auto_forward.conf; then + unlink /var/run/auto_forward.conf + else + [ -e "${_named_confdir}/auto_forward.conf" ] && + unlink ${_named_confdir}/auto_forward.conf + mv /var/run/auto_forward.conf \ + ${_named_confdir}/auto_forward.conf + fi + else + # Empty the file in case it is included in named.conf + [ -s "${_named_confdir}/auto_forward.conf" ] && + create_file ${_named_confdir}/auto_forward.conf + fi + + ${checkconf} ${named_conf} || err 3 "named-checkconf for ${named_conf} failed" +} + +run_rc_command "$1" |