#!/bin/sh # # $FreeBSD$ # # PROVIDE: named # REQUIRE: %%NAMED_REQUIRE%% # BEFORE: %%NAMED_BEFORE%% # KEYWORD: shutdown # # Add the following lines to /etc/rc.conf to enable BIND: # named_enable (bool): Run named, the DNS server (or NO). # named_program (str): Path to named, if you want a different one. # named_conf (str): Path to the configuration file # named_flags (str): Use this for flags OTHER than -u and -c # named_uid (str): User to run named as # named_chrootdir (str): Chroot directory (or "" not to auto-chroot it) # Historically, was /var/named # named_chroot_autoupdate (bool): Automatically install/update chrooted # components of named. # named_symlink_enable (bool): Symlink the chrooted pid file # named_wait (bool): Wait for working name service before exiting # named_wait_host (str): Hostname to check if named_wait is enabled # named_auto_forward (str): Set up forwarders from /etc/resolv.conf # named_auto_forward_only (str): Do "forward only" instead of "forward first" %%NATIVE_PKCS11%%# named_pkcs11_engine (str): Path to the PKCS#11 library to use. # . /etc/rc.subr name=named desc="named BIND startup script" rcvar=named_enable load_rc_config ${name} extra_commands=reload start_precmd=named_prestart start_postcmd=named_poststart reload_cmd=named_reload stop_cmd=named_stop stop_postcmd=named_poststop named_enable=${named_enable:-"NO"} named_program=${named_program:-"%%PREFIX%%/sbin/named"} named_conf=${named_conf:-"%%ETCDIR%%/named.conf"} named_flags=${named_flags:-""} named_uid=${named_uid:-"bind"} named_chrootdir=${named_chrootdir:-""} named_chroot_autoupdate=${named_chroot_autoupdate:-"YES"} named_symlink_enable=${named_symlink_enable:-"YES"} named_wait=${named_wait:-"NO"} named_wait_host=${named_wait_host:-"localhost"} named_auto_forward=${named_auto_forward:-"NO"} named_auto_forward_only=${named_auto_forward_only:-"NO"} %%NATIVE_PKCS11%%named_pkcs11_engine=${named_pkcs11_engine:-""} # Not configuration variables but having them here keeps rclint happy required_dirs="${named_chrootdir}" _named_confdirroot="${named_conf%/*}" _named_confdir="${named_chrootdir}${_named_confdirroot}" _named_program_root="${named_program%/sbin/named}" _openssl_engines="%%ENGINES%%" # Needed if named.conf and rndc.conf are moved or if rndc.conf is used rndc_conf=${rndc_conf:-"$_named_confdir/rndc.conf"} rndc_key=${rndc_key:-"$_named_confdir/rndc.key"} # If running in a chroot cage, ensure that the appropriate files # exist inside the cage, as well as helper symlinks into the cage # from outside. # # As this is called after the is_running and required_dir checks # are made in run_rc_command(), we can safely assume ${named_chrootdir} # exists and named isn't running at this point (unless forcestart # is used). # chroot_autoupdate() { local file # If it's the first time around, fiddle with things and move the # current configuration to the chroot. if [ -d ${_named_confdirroot} -a ! -d ${_named_confdir} ]; then warn "named chroot: Moving current configuration in the chroot!" install -d ${_named_confdir%/*} mv ${_named_confdirroot} ${_named_confdir} fi # Create (or update) the chroot directory structure # if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.dist ]; then mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.dist \ -p ${named_chrootdir} else warn "%%PREFIX%%/etc/mtree/BIND.chroot.dist missing," warn "${named_chrootdir} directory structure not updated" fi if [ -r %%PREFIX%%/etc/mtree/BIND.chroot.local.dist ]; then mkdir -p ${named_chrootdir}%%PREFIX%% mtree -deU -f %%PREFIX%%/etc/mtree/BIND.chroot.local.dist \ -p ${named_chrootdir}%%PREFIX%% else warn "%%PREFIX%%/etc/mtree/BIND.chroot.local.dist missing," warn "${named_chrootdir}%%PREFIX%% directory structure not updated" fi # Create (or update) the configuration directory symlink # if [ ! -L "${_named_confdirroot}" ]; then if [ -d "${_named_confdirroot}" ]; then warn "named chroot: ${_named_confdirroot} is a directory!" elif [ -e "${_named_confdirroot}" ]; then warn "named chroot: ${_named_confdirroot} exists!" else ln -s ${_named_confdir} ${_named_confdirroot} fi else # Make sure it points to the right place. ln -shf ${_named_confdir} ${_named_confdirroot} fi # Mount a devfs in the chroot directory if needed # if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then umount ${named_chrootdir}/dev 2>/dev/null devfs_domount ${named_chrootdir}/dev devfsrules_hide_all devfs -m ${named_chrootdir}/dev rule apply path null unhide devfs -m ${named_chrootdir}/dev rule apply path random unhide else if [ -c ${named_chrootdir}/dev/null -a \ -c ${named_chrootdir}/dev/random ]; then info "named chroot: using pre-mounted devfs." else err 1 "named chroot: devfs cannot be mounted from " \ "within a jail. Thus a chrooted named cannot " \ "be run from within a jail. Either mount the " \ "devfs with null and random from the host, or " \ "run named without chrooting it, set " \ "named_chrootdir=\"\" in /etc/rc.conf." fi fi # The OpenSSL engines should be present in the chroot, named loads them # after chrooting. if [ -d ${_openssl_engines} ]; then if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ] || [ `${SYSCTL_N} security.jail.mount_allowed` -eq 1 ] || [ `${SYSCTL_N} security.jail.mount_nullfs_allowed` -eq 1 ] ; then mkdir -p ${named_chrootdir}${_openssl_engines} mount -t nullfs ${_openssl_engines} ${named_chrootdir}${_openssl_engines} else warn "named chroot: cannot nullfs mount OpenSSL" \ "engines into the chroot, will copy the shared" \ "libraries instead." mkdir -p ${named_chrootdir}${_openssl_engines} cp -f ${_openssl_engines}/*.so ${named_chrootdir}${_openssl_engines} fi fi # Copy and/or update key files to the chroot /etc # for file in localtime protocols services; do if [ -r /etc/${file} ] && \ ! cmp -s /etc/${file} "${named_chrootdir}/etc/${file}"; then cp -p /etc/${file} "${named_chrootdir}/etc/${file}" fi done } # Make symlinks to the correct pid file # make_symlinks() { checkyesno named_symlink_enable && ln -fs "${named_chrootdir}${pidfile}" ${pidfile} && ln -fs "${named_chrootdir}${sessionkeyfile}" ${sessionkeyfile} } named_poststart() { make_symlinks if checkyesno named_wait; then until ${_named_program_root}/bin/host ${named_wait_host} >/dev/null 2>&1; do echo " Waiting for nameserver to resolve ${named_wait_host}" sleep 1 done fi } named_reload() { # This is a one line function, but ${named_program} is not defined early # enough to be there when the reload_cmd variable is defined up there. rndc reload } find_pidfile() { if get_pidfile_from_conf pid-file ${named_conf}; then pidfile="${_pidfile_from_conf}" else pidfile="/var/run/named/pid" fi } find_sessionkeyfile() { if get_pidfile_from_conf session-keyfile ${named_conf}; then sessionkeyfile="${_pidfile_from_conf}" else sessionkeyfile="/var/run/named/session.key" fi } named_stop() { find_pidfile # This duplicates an undesirably large amount of code from the stop # routine in rc.subr in order to use rndc to shut down the process, # and to give it a second chance in case rndc fails. rc_pid=$(check_pidfile ${pidfile} ${command}) if [ -z "${rc_pid}" ]; then [ -n "${rc_fast}" ] && return 0 _run_rc_notrunning return 1 fi echo 'Stopping named.' if rndc stop; then wait_for_pids ${rc_pid} else echo -n 'rndc failed, trying kill: ' kill -TERM ${rc_pid} wait_for_pids ${rc_pid} fi } named_poststop() { if [ -n "${named_chrootdir}" -a -c ${named_chrootdir}/dev/null ]; then # if using OpenSSL from ports, unmount OpenSSL engines, if they # were not mounted but only copied, do nothing. if [ -d ${_openssl_engines} -a \( `${SYSCTL_N} security.jail.jailed` -eq 0 -o `${SYSCTL_N} security.jail.mount_allowed` -eq 1 \) ]; then umount ${named_chrootdir}${_openssl_engines} fi # unmount /dev if [ `${SYSCTL_N} security.jail.jailed` -eq 0 ]; then umount ${named_chrootdir}/dev 2>/dev/null || true else warn "named chroot:" \ "cannot unmount devfs from inside jail!" fi fi } create_file() { if [ -e "$1" ]; then unlink $1 fi install -o root -g wheel -m 0644 /dev/null $1 } rndc() { if [ -z "${rndc_flags}" ]; then if [ -s "${rndc_conf}" ] ; then rndc_flags="-c ${rndc_conf}" elif [ -s "${rndc_key}" ] ; then rndc_flags="-k ${rndc_key}" else rndc_flags="" fi fi ${_named_program_root}/sbin/rndc ${rndc_flags} "$@" } named_prestart() { find_pidfile find_sessionkeyfile if [ -n "${named_pidfile}" ]; then warn 'named_pidfile: now determined from the conf file' fi if [ -n "${named_sessionkeyfile}" ]; then warn 'named_sessionkeyfile: now determined from the conf file' fi piddir=`/usr/bin/dirname ${pidfile}` if [ ! -d ${piddir} ]; then install -d -o ${named_uid} -g ${named_uid} ${piddir} fi sessionkeydir=`/usr/bin/dirname ${sessionkeyfile}` if [ ! -d ${sessionkeydir} ]; then install -d -o ${named_uid} -g ${named_uid} ${sessionkeydir} fi command_args="-u ${named_uid:=root} -c ${named_conf} ${command_args}" %%NATIVE_PKCS11%% if [ -z "${named_pkcs11_engine}"]; then %%NATIVE_PKCS11%% err 3 "named_pkcs11_engine has to be set to the PKCS#11 engine's library you want to use" %%NATIVE_PKCS11%% elif [ ! -f ${named_pkcs11_engine} ]; then %%NATIVE_PKCS11%% err 3 "named_pkcs11_engine the PKCS#11 engine's library you want to use doesn't exist" %%NATIVE_PKCS11%% else %%NATIVE_PKCS11%% mkdir -p ${named_chrootdir}${named_pkcs11_engine%/*} %%NATIVE_PKCS11%% cp -p ${named_pkcs11_engine} ${named_chrootdir}${named_pkcs11_engine} %%NATIVE_PKCS11%% command_args="-E ${named_pkcs11_engine} ${command_args}" %%NATIVE_PKCS11%% fi local line nsip firstns # Is the user using a sandbox? # if [ -n "${named_chrootdir}" ]; then rc_flags="${rc_flags} -t ${named_chrootdir}" checkyesno named_chroot_autoupdate && chroot_autoupdate case "${altlog_proglist}" in *named*) ;; *) warn 'Using chroot without setting altlog_proglist, logging may not' warn 'work correctly. Run sysrc altlog_proglist+=named' ;; esac else named_symlink_enable=NO fi # Create an rndc.key file for the user if none exists # confgen_command="${_named_program_root}/sbin/rndc-confgen -a -b256 -u ${named_uid} \ -c ${_named_confdir}/rndc.key" if [ -s "${_named_confdir}/rndc.conf" ]; then unset confgen_command fi if [ -s "${_named_confdir}/rndc.key" ]; then case `stat -f%Su ${_named_confdir}/rndc.key` in root|${named_uid}) ;; *) ${confgen_command} ;; esac else ${confgen_command} fi local checkconf checkconf="${_named_program_root}/sbin/named-checkconf" if ! checkyesno named_chroot_autoupdate && [ -n "${named_chrootdir}" ]; then checkconf="${checkconf} -t ${named_chrootdir}" fi # Create a forwarder configuration based on /etc/resolv.conf if checkyesno named_auto_forward; then if [ ! -s /etc/resolv.conf ]; then warn "named_auto_forward enabled, but no /etc/resolv.conf" # Empty the file in case it is included in named.conf [ -s "${_named_confdir}/auto_forward.conf" ] && create_file ${_named_confdir}/auto_forward.conf ${checkconf} ${named_conf} || err 3 'named-checkconf for ${named_conf} failed' return fi create_file /var/run/naf-resolv.conf create_file /var/run/auto_forward.conf echo ' forwarders {' > /var/run/auto_forward.conf while read line; do case "${line}" in 'nameserver '*|'nameserver '*) nsip=${line##nameserver[ ]} if [ -z "${firstns}" ]; then if [ ! "${nsip}" = '127.0.0.1' ]; then echo 'nameserver 127.0.0.1' echo " ${nsip};" >> /var/run/auto_forward.conf fi firstns=1 else [ "${nsip}" = '127.0.0.1' ] && continue echo " ${nsip};" >> /var/run/auto_forward.conf fi ;; esac echo ${line} done < /etc/resolv.conf > /var/run/naf-resolv.conf echo ' };' >> /var/run/auto_forward.conf echo '' >> /var/run/auto_forward.conf if checkyesno named_auto_forward_only; then echo " forward only;" >> /var/run/auto_forward.conf else echo " forward first;" >> /var/run/auto_forward.conf fi if cmp -s /etc/resolv.conf /var/run/naf-resolv.conf; then unlink /var/run/naf-resolv.conf else [ -e /etc/resolv.conf ] && unlink /etc/resolv.conf mv /var/run/naf-resolv.conf /etc/resolv.conf fi if cmp -s ${_named_confdir}/auto_forward.conf \ /var/run/auto_forward.conf; then unlink /var/run/auto_forward.conf else [ -e "${_named_confdir}/auto_forward.conf" ] && unlink ${_named_confdir}/auto_forward.conf mv /var/run/auto_forward.conf \ ${_named_confdir}/auto_forward.conf fi else # Empty the file in case it is included in named.conf [ -s "${_named_confdir}/auto_forward.conf" ] && create_file ${_named_confdir}/auto_forward.conf fi ${checkconf} ${named_conf} || err 3 "named-checkconf for ${named_conf} failed" } run_rc_command "$1"