571 lines
25 KiB
Plaintext
571 lines
25 KiB
Plaintext
# This file is a rewrote of 'bind.exlib' <https://gitlab.exherbo.org/exherbo/arbor/-/blob/895c462a12394ab984bdcd2808745023826300db/packages/net-dns/bind/bind.exlib> originally licensed under GPLv2 <https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html> with copyright:
|
|
# - Copyright 2008 Ingmar Vanhassel <ingmar@exherbo.org>
|
|
# - Copyright 2008-2016 Wulf C. Krueger <philantrop@exherbo.org>
|
|
# Changes made to this file in relation to mentioned original file are licensed under:
|
|
# Copyright (C) All rights reserved by Jacob Hrbek identified by GPG identifier assigned to the electronic mail <kreyren@rixotstudio.cz> according to the keyserver <https://keys.openpgp.org> in 19/10/2020-EU 13:30:08 CEST
|
|
|
|
# shellcheck shell=sh # Written to comply with POXIS IEEE 1003.1-2017
|
|
# shellcheck disable=SC2034 # FIXME(Krey): Provide source directory to metadata variables
|
|
|
|
export_exlib_phases pkg_setup src_prepare src_configure src_install pkg_postinst
|
|
|
|
BUGS_TO="kreyren+exheredrey@rixotstudio.cz"
|
|
|
|
SUMMARY="Berkeley Internet Name Domain"
|
|
DESCRIPTION="
|
|
The Berkeley Internet Name Domain (BIND) implements an Internet name server for
|
|
Unix operating systems. BIND consists of a server (or \`daemon') called \`named'
|
|
and a resolver library.
|
|
A name server is a network service that enables clients to name resources or objects
|
|
and share this information with other objects in the network.
|
|
"
|
|
DOMAIN="isc.org"
|
|
HOMEPAGE="https://www.$DOMAIN/software/$PN"
|
|
# NOTE(Krey): Matching agains 'https://downloads.isc.org/isc/bind9/9.16.7/bind-9.16.7.tar.xz'
|
|
# FIXME(Krey): Implement checksum checking
|
|
# NOTE(Krey): Upstream supports ftp on <https://ftp.isc.org/>
|
|
DOWNLOADS="
|
|
https://downloads.$DOMAIN/isc/$PN${PV%%.*}/${MY_PV}/${MY_PNV}.tar.xz -> $PN-$PV.tar.xz
|
|
https://www.internic.net/domain/named.cache"
|
|
UPSTREAM_DOCUMENTATION="
|
|
${HOMEPAGE%%/software/$PN}/downloads/$PN/doc [[ lang = en description = [ User manuals ] ]]
|
|
https://downloads.$DOMAIN/isc/bind9/$PV/doc/arm/Bv9ARM.pdf [[ lang = en description = [ Administrator Reference Manual (ARM) ] ]]"
|
|
UPSTREAM_RELEASE_NOTES="https://ftp.isc.org/isc/$PN${PV%%.*}/$PV/doc/arm/html/notes.html"
|
|
|
|
LICENCES="MPL-2.0"
|
|
SLOT="0"
|
|
MYOPTIONS="
|
|
authoritative [[ description = [ Setup as authoritative server for provided domain(s) ] ]]
|
|
berkdb
|
|
caps
|
|
chroot [[ description = [ Configure to run in chroot() ] ]]
|
|
dane [[ description = [ Configure for DNS-based Authentication of Named Entities ] ]]
|
|
dnssec [[ description = [ Configure for DNSSEC ] ]]
|
|
geoip [[ description = [ ACLs can also be used for geographic access restrictions. ] ]]
|
|
idn
|
|
kerberos
|
|
recursive [[ description = [ Setup as recursive server (used as nameserver) ] ]]
|
|
ldap
|
|
mysql
|
|
postgresql
|
|
kerberos? ( ( providers: heimdal krb5 ) [[ number-selected = exactly-one ]] )
|
|
( providers: libressl openssl ) [[ number-selected = exactly-one ]]
|
|
"
|
|
|
|
# DNM(Krey): Process
|
|
# Tons of sandbox violations.
|
|
RESTRICT="test"
|
|
|
|
DEPENDENCIES="
|
|
build:
|
|
virtual/pkg-config
|
|
build+run:
|
|
dev-libs/json-c:=[>=0.11]
|
|
dev-libs/libuv[>=1.0.0]
|
|
dev-libs/libxml2:2.0[>=2.6.0]
|
|
sys-libs/zlib
|
|
berkdb? ( sys-libs/db:= )
|
|
caps? ( sys-libs/libcap[>=2.1.0] )
|
|
geoip? ( net-libs/libmaxminddb )
|
|
idn? ( net-dns/libidn2:= )
|
|
kerberos? (
|
|
providers:heimdal? ( app-crypt/heimdal )
|
|
providers:krb5? ( app-crypt/krb5 )
|
|
)
|
|
ldap? ( net-directory/openldap )
|
|
mysql? ( virtual/mysql )
|
|
postgresql? ( dev-db/postgresql-client )
|
|
providers:libressl? ( dev-libs/libressl:= )
|
|
providers:openssl? ( dev-libs/openssl[>=1.0.0] )
|
|
group/bind
|
|
user/bind
|
|
run:
|
|
net-dns/bind-tools[~${PV}][geoip=][idn=][kerberos=][providers:*=]
|
|
suggestion:
|
|
postgresql? ( dev-db/postgresql:* )
|
|
"
|
|
|
|
# Parallel make is not supported upstream
|
|
# FIXME-POSIX(Krey): Arrays are undefined in POSIX sh
|
|
DEFAULT_SRC_COMPILE_PARAMS=( -j1 )
|
|
# FIXME-POSIX(Krey): Arrays are undefined in POSIX sh
|
|
DEFAULT_SRC_INSTALL_EXTRA_DOCS=( KNOWN-DEFECTS )
|
|
|
|
bind_pkg_setup() {
|
|
# Make sure that the expected variabels are set
|
|
# DNM: Implement check for used kernel
|
|
if true; then
|
|
export PALUDIS_BIND_DATA_DIR="${PALUDIS_BIND_DATA_DIR:-/var/named}"
|
|
export PALUDIS_BIND_ZONEFILE_DIR="${PALUDIS_BIND_ZONEFILE_DIR:-${PALUDIS_BIND_DATA_DIR}/master}"
|
|
export PALUDIS_BIND_CONFDIR="${PALUDIS_BIND_CONFDIR:-/etc/$PN}"
|
|
export PALUDIS_BIND_KEYDIR="${PALUDIS_BIND_KEYDIR:-${PALUDIS_BIND_DATA_DIR:-/var/named}/keys}"
|
|
export PALUDIS_BIND_USER="${PALUDIS_BIND_USER:-root}"
|
|
export PALUDIS_BIND_GROUP="${PALUDIS_BIND_GROUP:-bind}"
|
|
! option chroot || export PALUDIS_BIND_CHROOTDIR="${PALUDIS_BIND_CHROOTDIR:-/var/spool/named}"
|
|
export PALUDIS_RANDOM_DEVICE="${PALUDIS_RANDOM_DEVICE:-/dev/random}"
|
|
export PALUDIS_BIND_RUN_DIR="${PALUDIS_BIND_RUN_DIR:-/run/named}"
|
|
export PALUDIS_HOSTNAME="${PALUDIS_HOSTNAME:-$(hostname)}"
|
|
else
|
|
# FIXME-QA(Krey): This outputs 'Kernel Linux is not implemeted...'
|
|
case "$PALUDIS_LANG" in
|
|
cs-*) die fixme "Downstream pro kernel '$(uname -s)' není implementován pro balíček '$PC/$PN-$PV::$PO' fáze '${FUNCNAME:-bind_pkg_postinst}'" ;;
|
|
en-*|*) die fixme "Downstream for kernel '$(uname -s)' is not implemented to handle '${FUNCNAME:-bind_pkg_postinst}' phase of package $PC/$PN-$PV::$PO"
|
|
esac
|
|
fi
|
|
|
|
# FIXME(Krey)
|
|
! option dane || printf 'FIXME: %s\n' "Option 'dane' is not yet implemented.."
|
|
}
|
|
|
|
bind_src_prepare() {
|
|
default
|
|
|
|
# FIXME(Krey): Report what upstream?
|
|
# TODO: Report upstream
|
|
edo sed -i "/AC_PATH_PROG(AR/d" configure.ac
|
|
edo sed -i 's/"nm"/"'$(exhost --tool-prefix)'nm"/' util/mksymtbl.pl
|
|
|
|
eautoconf
|
|
}
|
|
|
|
bind_src_configure() {
|
|
# DNM(Krey): What the fuck
|
|
myoption() {
|
|
if option ${2}; then
|
|
echo "--${1}-${3:-$(optionfmt ${2} )}=yes"
|
|
else
|
|
echo "--${1}-${3:-$(optionfmt ${2} )}=no"
|
|
fi
|
|
}
|
|
|
|
# DNM(Krey): paludis_pipe_command returned error 'E' with text 'OPTIONQ ID net-dns/bind-9.16.7:0::arbor has no choice named 'postgresql''
|
|
# DNM(Krey): Add more options
|
|
# - Should be resolved by adding 'postgresql' in MY_OPTIONS
|
|
# --enable-isc-spnego: Bundled kerberos parts
|
|
econf \
|
|
--includedir="/usr/$(exhost --target)/include" \
|
|
--localstatedir=/var \
|
|
--sysconfdir="$PALUDIS_BIND_CONFDIR" \
|
|
--enable-auto-validation \
|
|
--enable-buffer-useinline \
|
|
--enable-dnsrps \
|
|
--enable-dnsrps-dl \
|
|
--enable-isc-spnego=no \
|
|
--enable-largefile=yes \
|
|
--disable-dnstap \
|
|
--disable-fips-mode \
|
|
--disable-static \
|
|
--with-dlz-filesystem=yes \
|
|
--with-dlz-odbc=no \
|
|
--with-dlz-stub=yes \
|
|
--with-json-c \
|
|
--with-libtool=yes \
|
|
--with-libxml2=yes \
|
|
--with-openssl="/usr/$(exhost --target)" \
|
|
--with-pkcs11=no \
|
|
--with-zlib \
|
|
--without-cmocka \
|
|
--without-lmdb \
|
|
--without-python \
|
|
$(option_enable caps linux-caps) \
|
|
$(option_enable geoip) \
|
|
$(myoption with berkdb dlz-bdb) \
|
|
$(myoption with geoip maxminddb) \
|
|
$(myoption with idn libidn2) \
|
|
$(myoption with kerberos gssapi) \
|
|
$(myoption with ldap dlz-ldap) \
|
|
$(myoption with mysql dlz-mysql) \
|
|
$(myoption with postgresql dlz-postgres)
|
|
}
|
|
|
|
# Note to self or anyone who's going to work on bind: It will fail with a cryptic
|
|
# error ("RUNTIME_CHECK(dst_initialized == isc_boolean_true) failed") if you try
|
|
# to disable pkcs11 with either of the following switches:
|
|
# --with-pkcs11=no \
|
|
# --without-pkcs11 \
|
|
# *Not* using any switches turns pkcs11 off, though... Upstreams...
|
|
|
|
bind_src_install() {
|
|
default
|
|
|
|
# FIXME-QA(Krey): Check if this is needed as previous version was using /var/bind which is wrong
|
|
#remove conflicts with bind-tools
|
|
local BIND_TOOL BIND_TOOLS=( delv.1 dig.1 host.1 nslookup.1 nsupdate.1 dnssec-keygen.8 )
|
|
for BIND_TOOL in "${BIND_TOOLS[@]}"; do
|
|
edo rm "${IMAGE}"/usr/$(exhost --target)/bin/${BIND_TOOL%.*}
|
|
edo rm "${IMAGE}"/usr/share/man/man${BIND_TOOL#*.}/${BIND_TOOL}
|
|
done
|
|
|
|
keepdir "$PALUDIS_BIND_CONFDIR" "$PALUDIS_BIND_DATA_DIR/pri" "$PALUDIS_BIND_DATA_DIR/sec"
|
|
edo chown "$PALUDIS_BIND_USER":"$PALUDIS_BIND_GROUP" "${IMAGE}/$PALUDIS_BIND_DATA_DIR/pri"
|
|
edo chown "$PALUDIS_BIND_USER":"$PALUDIS_BIND_GROUP" "${IMAGE}/$PALUDIS_BIND_DATA_DIR/sec"
|
|
|
|
# Install a basic configuration.
|
|
insinto "$PALUDIS_BIND_CONFDIR"
|
|
|
|
# documentation and a sample with everything bind can do.
|
|
dodoc "${WORKBASE}/$PNV/doc/misc/named.conf.rst"
|
|
newins "${WORKBASE}/$PNV/bin/tests/named.conf" named.conf.complex_sample
|
|
|
|
# Install the Administrator Reference Manual (ARM)
|
|
docinto Administrator_Reference_Manual
|
|
dodoc doc/arm/*.rst
|
|
|
|
docinto misc
|
|
dodoc doc/misc/*
|
|
|
|
# Creating a CONFIG_PROTECT file for PALUDIS_BIND_DATA_DIR
|
|
hereenvd 30bind <<-PROTECT
|
|
CONFIG_PROTECT="$PALUDIS_BIND_DATA_DIR"
|
|
PROTECT
|
|
|
|
insinto "/usr/$(exhost --target)/lib/tmpfiles.d"
|
|
# DNM(Krey): Process
|
|
hereins "$PN.conf" <<-EOF
|
|
d /run/named 0755 $PALUDIS_BIND_USER $PALUDIS_BIND_GROUP -
|
|
EOF
|
|
|
|
# FIXME-QA(Krey): On my non-standard system this is a symlink which fails the merge-check
|
|
[ ! -d "${IMAGE}/var" ] || { ${RM:-rm} -r "${IMAGE}/var" || die false "Unable to remove directory '${IMAGE}/var'" ;}
|
|
|
|
# DNM(Krey): Stubbed
|
|
#install_systemd_files
|
|
# DNM(Krey): Implement
|
|
#install_openrc_files
|
|
|
|
# Install standard zones and root cache
|
|
insinto "$PALUDIS_BIND_DATA_DIR" # i.e. /var/named
|
|
doins "${FETCHEDDIR}/named.cache"
|
|
insinto "$PALUDIS_BIND_DATA_DIR/pri"
|
|
doins "${FILES}/127.zone"
|
|
doins "${FILES}/localhost.zone"
|
|
|
|
# FIXME-QA(Krey): Sanitize
|
|
# FIXME-QA(Krey): Rename the var to PALUDIS_BIND_CONFDIR_PERMS
|
|
${CHMOD:-chmod} "${PALUDIS_BIND_DIR_PERMS:-0777}" "${IMAGE}/$PALUDIS_BIND_CONFDIR"
|
|
|
|
## Use command 'rndc-confgen' from compiled target unless set by the end-user
|
|
# NOTE(Krey): Do not use rndc-confgen from imagedir because it requires preloads.
|
|
RNDC_CONFGEN="${RNDC_CONFGEN:-"${WORKBASE}/$PNV/bin/confgen/rndc-confgen"}"
|
|
|
|
# Create rndc.conf file
|
|
# FIXME-QA(Krey): rndc-confgen doesn't support non-shorthand arguments, submit patch upstream for better readability
|
|
# FIXME-SECURITY(Krey): Adapt option for threat model to use KEYSIZE
|
|
[ -s "${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.conf" ] || {
|
|
{ ${RNDC_CONFGEN:-rndc-confgen} \
|
|
-A "${PALUDIS_BIND_CONFGEN_ALGORITHM:-hmac-sha512}" \
|
|
-b "${PALUDIS_BIND_CONFGEN_KEYSIZE:-512}" \
|
|
-u "${PALUDIS_BIND_USER:-bind}" \
|
|
-p "${PALUDIS_BIND_PORT:-953}" \
|
|
> "${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.conf"
|
|
} || die 1 "Unable to generate file '${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.conf' using command '$RNDC_CONFGEN'"
|
|
}
|
|
|
|
# NOTE(Krey): Remove rndc.key file if it exists as we are uding rndc.conf which conflicts with each other
|
|
[ ! -f "${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.key" ] || { ${RM:-rm} "${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.key" || die 1 "Unable to remove file '${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.key'" ;}
|
|
|
|
# NOTE(Krey): We need the rndc-key defined in named.conf which makes it bad idea to expose named.conf for the users so this is a method to make that sane
|
|
[ -f "${IMAGE}/$PALUDIS_BIND_CONFDIR/secret.rndc-key" ] || { { ${GREP:-grep} "^#" "${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.conf" | ${GREP:-grep} "^# key" -A 3 | ${SED:-sed} "s/# //" > "${IMAGE}/$PALUDIS_BIND_CONFDIR/secret.rndc-key" ;} || die false "Unable to generate 'secret.rndc-key'" ;}
|
|
# FIXME-QA(Krey): Sanitize
|
|
${CHMOD:-chmod} "${PALUDIS_BIND_RNDC_KEY_PERMS:-0640}" "${IMAGE}/$PALUDIS_BIND_CONFDIR/secret.rndc-key"
|
|
# FIXME-QA(Krey): Sanitize
|
|
${CHOWN:-chown} "${PALUDIS_BIND_USER}":"$PALUDIS_BIND_GROUP" "${IMAGE}/$PALUDIS_BIND_CONFDIR/secret.rndc-key"
|
|
|
|
# Remove the confidential parts fron rndc.conf
|
|
${GREP:-grep} "^# " "${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.conf" >/dev/null || { ${PRINTF:-printf} 'g/# .*/d\nw\nq\n' | ${ED:-ed} -s "${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.conf" ;} || die confidential-remove "Unable to remove confidential parts from '${IMAGE}/$PALUDIS_BIND_CONFDIR/rndc.conf'"
|
|
|
|
# Declare header
|
|
${CAT:-cat} <<-CONFIG > "${IMAGE}/$PALUDIS_BIND_CONFDIR/named.conf"
|
|
# Comment
|
|
// Comment
|
|
/* Comment */
|
|
|
|
# Relevant Administrator Reference Manual (ARM): https://downloads.isc.org/isc/bind9/$PV/doc/arm/Bv9ARM.pdf
|
|
# FIXME-DOCS(Krey): Provide best practices reference
|
|
|
|
// The key has to be included in named.conf
|
|
include "$PALUDIS_BIND_CONFDIR/secret.rndc-key"
|
|
CONFIG
|
|
|
|
# Set up options
|
|
# shellcheck disable=SC2129 # Krey: Invidual redirects are invalid here as this is by design
|
|
${CAT:-cat} <<-CONFIG >> "${IMAGE}/$PALUDIS_BIND_CONFDIR/named.conf"
|
|
options {
|
|
// Working directory
|
|
directory "$PALUDIS_BIND_DATA_DIR";
|
|
|
|
// Path configuration
|
|
dump-file "$PALUDIS_BIND_DATA_DIR/named_dump.db"; // _PATH_DUMPFILE
|
|
pid-file "$PALUDIS_BIND_RUN_DIR/named.pid"; // _PATH_PIDFILE
|
|
statistics-file "$PALUDIS_BIND_DATA_DIR/named.stats"; // _PATH_STATS
|
|
memstatistics-file "$PALUDIS_BIND_DATA_DIR/named.memstats"; // _PATH_MEMSTATS
|
|
|
|
// uncomment the following lines to turn on DNS forwarding,
|
|
// and change the forwarding ip address(es) :
|
|
//forward first;
|
|
//forwarders {
|
|
// 123.123.123.123;
|
|
// 123.123.123.123;
|
|
//};
|
|
|
|
listen-on-v6 { none; };
|
|
listen-on { 127.0.0.1; };
|
|
|
|
// to allow only specific hosts to use the DNS server:
|
|
//allow-query {
|
|
// 127.0.0.1;
|
|
//};
|
|
|
|
// if you have problems and are behind a firewall:
|
|
//query-source address * port 53;
|
|
|
|
// Cache configuration
|
|
max-cache-size ${PALUDIS_BIND_MAX_CACHE_SIZE:-2000};
|
|
$(! option recursive || printf '%s\n' \
|
|
" min-cache-ttl ${PALUDIS_BIND_MIN_CACHE_TTL:-60};" \
|
|
" max-cache-ttl ${PALUDIS_BIND_MAX_CACHE_TTL:-600};")
|
|
|
|
// Set random device
|
|
random-device "$PALUDIS_RANDOM_DEVICE";
|
|
|
|
// Toggle switch for recursion service (allows to be used as a nameserver)
|
|
$(! option recursive || ${PRINTF:-printf} '%s\n' "recursion yes;")
|
|
$(option recursive || ${PRINTF:-printf} '%s\n' "recursion no;")
|
|
|
|
$(! option dnssec || ${PRINTF:-printf} ' %s\n' \
|
|
"# Enables DNSSEC validation in named" \
|
|
"# - If set to auto, DNSSEC validation is enabled and a default trust ancor for the DNS root zone is used" \
|
|
"dnssec-validation \"auto\";")
|
|
|
|
$(! option dnssec || ${PRINTF:-printf} ' %s\n' \
|
|
"# Automatically sign zones" \
|
|
"auto-dnssec \"${PALUDIS_BIND_AUTO_DNSSEC_OPTION:-maintain}\";")
|
|
};
|
|
CONFIG
|
|
|
|
# Set up controls
|
|
${CAT:-cat} <<-CONFIG >> "${IMAGE}/$PALUDIS_BIND_CONFDIR/named.conf"
|
|
controls {
|
|
inet 127.0.0.1 port ${PALUDIS_BIND_PORT:-953}
|
|
allow { 127.0.0.1; } keys { "rndc-key"; };
|
|
};
|
|
CONFIG
|
|
|
|
# Set up zones
|
|
# FIXME-QA(Krey): These are provided by default in the source, regex our lines in?
|
|
${CAT:-cat} <<-CONFIG >> "${IMAGE}/$PALUDIS_BIND_CONFDIR/named.conf"
|
|
// Briefly, a zone which has been declared delegation-only will be effectively
|
|
// limited to containing NS RRs for subdomains, but no actual data beyond its
|
|
// own apex (for example, its SOA RR and apex NS RRset). This can be used to
|
|
// filter out "wildcard" or "synthesized" data from NAT boxes or from
|
|
// authoritative name servers whose undelegated (in-zone) data is of no
|
|
// interest.
|
|
// See http://www.isc.org/products/BIND/delegation-only.html for more info
|
|
|
|
zone "COM" { type delegation-only; };
|
|
zone "NET" { type delegation-only; };
|
|
|
|
zone "." IN {
|
|
type hint;
|
|
file "named.cache";
|
|
};
|
|
|
|
zone "localhost" IN {
|
|
type master;
|
|
file "pri/localhost.zone";
|
|
allow-update { none; };
|
|
notify no;
|
|
};
|
|
|
|
zone "127.in-addr.arpa" IN {
|
|
type master;
|
|
file "pri/127.zone";
|
|
allow-update { none; };
|
|
notify no;
|
|
};
|
|
CONFIG
|
|
|
|
# Set up zone servers
|
|
if option authoritative; then
|
|
PALUDIS_BIND_AUTH_DOMAIN="rixotstudio.cz" # DNM(Krey): Testing
|
|
if [ -n "$PALUDIS_BIND_AUTH_DOMAIN" ]; then
|
|
for domain in $PALUDIS_BIND_AUTH_DOMAIN; do
|
|
# FIXME-QA(Krey): Make sure that the domain has correct format
|
|
|
|
${CAT:-cat} <<-CONFIG >> "${IMAGE}/$PALUDIS_BIND_CONFDIR/named.conf"
|
|
zone "$domain" {
|
|
type master;
|
|
$(option dnssec || printf '%s\n' "file \"$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain\";")
|
|
$(! option dnssec || printf ' %s\n' \
|
|
"file \"$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain.signed\";" \
|
|
"key-directory \"${PALUDIS_BIND_KEYDIR}/$domain\";")
|
|
// To allow zone transfer i.e. used to transfer the zone to secondary DNS
|
|
allow-transfer {
|
|
${PALUDIS_BIND_ALLOWED_TRANSFER:-127.0.0.1;}
|
|
};
|
|
// FIXME-DOCS: Info
|
|
update-policy local;
|
|
};
|
|
CONFIG
|
|
|
|
# Make sure that expected directories are available
|
|
[ -d "${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain" ] || { ${MKDIR:-mkdir} --parents "${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain" || die 1 "Unable to create a new directory in '${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain'" ;}
|
|
|
|
[ -d "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain" ] || { ${MKDIR:-mkdir} --parents "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain" || die 1 "Unable to create a new directory in '${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain'";}
|
|
|
|
# Clear the zonefile
|
|
${PRINTF:-printf} "" > "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
|
|
# Add note about signing
|
|
if option dnssec; then
|
|
# DNM(Krey): Make sure that this is the same command used
|
|
${PRINTF:-printf} '%s\n' ";; Signed using: ${DNSSEC_SIGNZONE:-dnssec-signzone} -g -K $PALUDIS_BIND_KEYDIR -M ${PALUDIS_BIND_DNSSEC_SIGNZONE_MAXTTL:-300} \"$PALUDIS_BIND_ZONEFILE_DIR/$domain\"" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
else
|
|
true
|
|
fi
|
|
|
|
# FIXME-FEATURE(Krey): Allow method to define a function that creates the zonefile
|
|
|
|
# Add note about verifying zone file
|
|
# FIXME-QA(Krey): Add info to shellcheck SC2129
|
|
# shellcheck disable=SC2129 # Using this by design to allow further logic implementation
|
|
${PRINTF:-printf} '%s\n' ";; Tested using: named-checkzone $domain $PALUDIS_BIND_ZONEFILE_DIR/$domain" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
|
|
# Define global Time To Live (TTL)
|
|
${PRINTF:-printf} '%s\n' "\$TTL ${PALUDIS_BIND_TTS:-300}" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
|
|
# Define global origin
|
|
${PRINTF:-printf} '%s\n' "\$ORIGIN $domain." >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
|
|
# Define nameservers (At least one!)
|
|
for nameserver in ${PALUDIS_BIND_NAMESERVER:-ns.$PALUDIS_HOSTNAME.$domain}; do
|
|
${PRINTF:-printf} '%s\n' "@ IN NS $nameserver." >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
done
|
|
|
|
# Create SOA record
|
|
${CAT:-cat} <<-ZONEFILE >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
@ IN SOA (
|
|
${PALUDIS_BIND_SOA_MNAME:-ns.$PALUDIS_HOSTNAME.$domain.} ; MNAME
|
|
${PALUDIS_BIND_SOA_RNAME:-${PALUDIS_HOSTMASTER_NAME:-hostmaster}.$PALUDIS_HOSTNAME.$domain.} ; RNAME
|
|
${PALUDIS_BIND_SOA_SERIAL:-$(date -u +"%Y%m%d%H" || printf 1)} ; SERIAL
|
|
${PALUDIS_BIND_SOA_REFRESH:-8H} ; REFRESH
|
|
${PALUDIS_BIND_SOA_RETRY:-2H} ; RETRY
|
|
${PALUDIS_BIND_SOA_EXPIRY:-1W} ; EXPIRY
|
|
${PALUDIS_BIND_SOA_MINIMUM:-2H} ; MINIMUM Negative Cache TTL
|
|
)
|
|
ZONEFILE
|
|
|
|
# Define defaults
|
|
${PRINTF:-printf} '%s\n' ";; Default" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
|
|
# DNM(Krey): Used for testing
|
|
PALUDIS_HOST_IP="89.176.197.177"
|
|
|
|
# FIXME-QA(Krey): This may fail to show the IP Adresses
|
|
# - 'ip -j a | jq ...'
|
|
# - 'curl ifconfig.me'
|
|
# - 'ifconfig | <regex-here>'
|
|
# - 'ip a | <regex-here>'
|
|
for ip in ${PALUDIS_HOST_IP:-$(hostname --all-ip-addresses 2>/dev/null)}; do
|
|
case "$ip" in
|
|
*.*.*.*) # IPv4
|
|
# NOTE(Krey): On 9.16.7 using '@' causes 'not at top of zone' unless the file is openned in vim changed to '$domain' and/or after changed back to '@' -> Assuming possible upstream bug
|
|
${PRINTF:-printf} '%s\n' "$domain IN A $ip" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain" ;;
|
|
*::*:*:*:*) # IPv6
|
|
${PRINTF:-printf} '%s\n' "@ IN AAAA $ip" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain" ;;
|
|
*) die bug "Case statement processing defaults for IP adresses triggered bug trap for '$ip', report downstream"
|
|
esac
|
|
done
|
|
|
|
# DNM(Krey): Used for testing
|
|
PALUDIS_BIND_NAMESERVER_IP="89.176.197.177"
|
|
|
|
# Create the A/AAAA record for nameserver
|
|
case "${PALUDIS_BIND_NAMESERVER_IP:-$(${PRINTF:-printf} '%s\n' "$PALUDIS_HOST_IP" | ${GREP:-grep} -o "^.* " | ${SED:-sed} "s/\ //")}" in
|
|
*.*.*.*) # IPv4
|
|
${PRINTF:-printf} "ns.$PALUDIS_HOSTNAME.$domain. IN A %s\n" "$PALUDIS_BIND_NAMESERVER_IP" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain" ;;
|
|
*::*:*:*:*) # IPv6
|
|
${PRINTF:-printf} "ns.$PALUDIS_HOSTNAME.$domain. IN AAAA %s\n" "$PALUDIS_BIND_NAMESERVER_IP" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain" ;;
|
|
*) die unable-to-create-nameserver-record "Unexpected IP '${PALUDIS_BIND_NAMESERVER_IP:-$(${PRINTF:-printf} '%s\n' "$PALUDIS_HOST_IP" | ${GREP:-grep} -o "^.* " | ${SED:-sed} "s/\ //")}' has been provided in logic that creates the A/AAAA record"
|
|
esac
|
|
|
|
# Set up Keys
|
|
# FIXME-QA(Krey): Command 'dnssec-keygen' doesn not support non-shorthands for arguments, submit patch upstream to improve readability
|
|
if option dnssec; then
|
|
# Create key directory
|
|
[ -d "${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain" ] || { ${MKDIR:-mkdir} --parent "${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain" || die false "Unable to create a new directory in '${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain'" ;}
|
|
|
|
# Use command 'dnssec-keygen' from compiled target unless set by the end-user
|
|
DNSSEC_KEYGEN="${DNSSEC_KEYGEN:-"/usr/$(exhost --target)/bin/dnssec-keygen"}"
|
|
|
|
# Generate Key-Signing Key (KSK)
|
|
${DNSSEC_KEYGEN:-dnssec-keygen} -a "${PALUDIS_BIND_PREFFERED_KEYGEN_ALGORITHM_KSK:-ECDSAP384SHA384}" -f KSK -c IN -L "${PALUDIS_BIND_KSK_MINTTL:-300}" -K "${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain" "$domain" || die false "Unable to generate Key-Signing Key (KSK)"
|
|
|
|
# Generate Zone-Signing Key (ZSK)
|
|
${DNSSEC_KEYGEN:-dnssec-keygen} -a "${PALUDIS_BIND_PREFFERED_KEYGEN_ALGORITHM_ZSK:-ECDSAP384SHA384}" -n ZONE -c IN -L "${PALUDIS_BIND_ZSK_MINTTL:-300}" -K "${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain" "$domain" || die false "Unable to generate Zone-Signing Key (ZSK)"
|
|
|
|
${PRINF:-printf} '%s\n' ";; Include keys as suggested in https://downloads.isc.org/isc/bind9/$PV/doc/arm/html/advanced.html#generating-keys" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
|
|
# shellcheck disable=SC2010 # Krey: Do not use 'ls \ grep' use glob expansion is invalid here as we are working with ls output
|
|
for keyfile in $(${LS:-ls} "${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain" | ${GREP:-grep} ".*\.key$" | ${TR:-tr} '\n' ' '); do
|
|
${PRINTF:-printf} "\$INCLUDE \"/${PALUDIS_BIND_KEYDIR:-${PALUDIS_BIND_DATA_DIR:-/var/named}/keys}/$domain/%s\" $domain\n" "$keyfile" >> "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain"
|
|
done
|
|
|
|
NAMED_CHECKZONE="${NAMED_CHECKZONE:-"$WORKBASE/$PN-$PV/bin/check/named-checkzone"}"
|
|
|
|
# Check zonefiles on demand
|
|
# FIXME-QA(Krey): This should be probably part of post-install tests
|
|
case "$PALUDIS_BIND_CHECK_ZONEFILE" in
|
|
check)
|
|
$NAMED_CHECKZONE "$domain" "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain" || die false "Command '$NAMED_CHECKZONE' returned non-true while checking zone-file for zone '$domain' located at '${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain'"
|
|
;;
|
|
"" | "skip" | *) einfo "Variable 'PALUDIS_BIND_CHECK_ZONEFILE' is storing value '$PALUDIS_BIND_CHECK_ZONEFILE', skipping checking zone files.."
|
|
esac
|
|
|
|
# Use command 'dnssec-signzone' from compiled target unless set by the end-user
|
|
DNSSEC_SIGNZONE="${DNSSEC_SIGNZONE:-"${WORKBASE}/$PNV/bin/dnssec/dnssec-signzone"}"
|
|
|
|
# FIXME-QA: Expand arguments, avoid shorthands
|
|
# FIXME(Krey): We are unable to create the signed zones from sandbox which is allegedly not supported, report upstream?
|
|
# [ -f "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain.signed" ] || ${DNSSEC_SIGNZONE:-dnssec-signzone} \
|
|
# -g \
|
|
# -K "${IMAGE}/$PALUDIS_BIND_KEYDIR/$domain" \
|
|
# -T "${PALUDIS_BIND_DNSSEC_SIGNZONE_TTL:-300}" \
|
|
# -n "${PALUDIS_BIND_DNSSEC_NCPUS:-$(nproc || printf 1)}" \
|
|
# "${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain" || die 1 "Unable to sign zonefile in '${IMAGE}/$PALUDIS_BIND_ZONEFILE_DIR/$domain/$domain'"
|
|
else
|
|
einfo "Option 'dnssec' is not enabled, skipping creation of keys.."
|
|
fi
|
|
done
|
|
elif [ -z "$PALUDIS_BIND_AUTH_DOMAIN" ]; then
|
|
einfo "Variable 'PALUDIS_BIND_AUTH_DOMAIN' is storing '${PALUDIS_BIND_AUTH_DOMAIN:-<BLANK>}', skipping configuration of authoritative server.."
|
|
else
|
|
# DNM(Krey)
|
|
die unexpected "..."
|
|
fi
|
|
elif ! option authoritative; then
|
|
einfo "Option 'authoritative' is not set, skipping configuration of authority server.."
|
|
else
|
|
# DNM(Krey)
|
|
die unexpected "..."
|
|
fi
|
|
|
|
# Transfer ownership to bind
|
|
# FIXME-QA(Krey): Sanitize
|
|
# FIXME-QA(Krey): Expand arguments
|
|
${CHOWN:-chown} -R "$PALUDIS_BIND_USER":"$PALUDIS_BIND_GROUP" "${IMAGE}/$PALUDIS_BIND_CONFDIR"
|
|
${CHOWN:-chown} -R "$PALUDIS_BIND_USER":"$PALUDIS_BIND_GROUP" "${IMAGE}/$PALUDIS_BIND_DATA_DIR"
|
|
}
|
|
|
|
bind_pkg_postinst() {
|
|
return 0 # DNM(Krey): Process
|
|
if [[ ! -f /etc/bind/rndc.key ]]; then
|
|
if [[ -c /dev/urandom ]]; then
|
|
nonfatal edo /usr/${host}/bin/rndc-confgen -r /dev/urandom -a -u named
|
|
else
|
|
nonfatal edo /usr/${host}/bin/rndc-confgen -a -u named
|
|
fi
|
|
fi
|
|
}
|
|
|