mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
a76c5b0966
fips-dns-setup wrote the .fips server= drop-in for standalone dnsmasq and then ran `systemctl reload dnsmasq`. A reload is a SIGHUP, and dnsmasq does not re-read its configuration on SIGHUP, so the forward was never loaded: .fips names did not resolve until dnsmasq was restarted by hand, even though the reload reported success. The removal paths had the mirror defect and left the forward live after the drop-in was deleted. The FreeBSD scripts behaved the same way, since the port's rc script implements reload as a SIGHUP. Setup now restarts dnsmasq. fips-dns-teardown, the Debian postrm and uninstall.sh use try-restart, which acts only on a running dnsmasq. The FreeBSD setup uses onerestart, and its teardown restarts dnsmasq only when onestatus reports it running. The dns-resolver suite's standalone dnsmasq case only checked that the file was written, and its reload always failed in the container because the image lacked /bin/kill. The image now has procps and dig, runs a stand-in .fips responder on ::1#5354, and the case asserts that a query through dnsmasq is forwarded after setup and no longer forwarded after teardown, dumping the dnsmasq unit status and journal when it is not. The teardown check is skipped when the setup check failed, and fails if the stand-in no longer answers directly, so it cannot pass without testing anything. The image tag changes with the Dockerfile so a concurrent run of the old Dockerfile cannot overwrite it. The packaging text test now pins `try-restart dnsmasq` in postrm and uninstall.sh.
92 lines
2.6 KiB
Bash
Executable File
92 lines
2.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# fips-dns-teardown — Remove DNS routing for the .fips domain.
|
|
#
|
|
# Reverses whatever fips-dns-setup configured. Reads the backend from
|
|
# the state file, or cleans up all possible backends if state is missing.
|
|
|
|
set -e
|
|
|
|
FIPS_INTERFACE="fips0"
|
|
DNS_DELEGATE_FILE="/etc/systemd/dns-delegate.d/fips.dns-delegate"
|
|
RESOLVED_DROPIN_FILE="/etc/systemd/resolved.conf.d/fips.conf"
|
|
DNSMASQ_CONF="/etc/dnsmasq.d/fips.conf"
|
|
NM_DNSMASQ_CONF="/etc/NetworkManager/dnsmasq.d/fips.conf"
|
|
STATE_FILE="/run/fips/dns-backend"
|
|
|
|
log() { echo "fips-dns: $*"; }
|
|
|
|
is_active() {
|
|
systemctl is-active --quiet "$1" 2>/dev/null
|
|
}
|
|
|
|
teardown_dns_delegate() {
|
|
[ -f "$DNS_DELEGATE_FILE" ] || return 0
|
|
log "Removing dns-delegate config"
|
|
rm -f "$DNS_DELEGATE_FILE"
|
|
is_active systemd-resolved.service && systemctl restart systemd-resolved
|
|
return 0
|
|
}
|
|
|
|
teardown_resolvectl() {
|
|
command -v resolvectl >/dev/null 2>&1 || return 0
|
|
is_active systemd-resolved.service || return 0
|
|
ip link show "$FIPS_INTERFACE" >/dev/null 2>&1 || return 0
|
|
log "Reverting resolvectl config"
|
|
resolvectl revert "$FIPS_INTERFACE" 2>/dev/null || true
|
|
return 0
|
|
}
|
|
|
|
teardown_global_drop_in() {
|
|
[ -f "$RESOLVED_DROPIN_FILE" ] || return 0
|
|
log "Removing global resolved.conf.d drop-in"
|
|
rm -f "$RESOLVED_DROPIN_FILE"
|
|
is_active systemd-resolved.service && systemctl restart systemd-resolved || true
|
|
return 0
|
|
}
|
|
|
|
teardown_dnsmasq() {
|
|
[ -f "$DNSMASQ_CONF" ] || return 0
|
|
log "Removing dnsmasq config"
|
|
rm -f "$DNSMASQ_CONF"
|
|
# A reload (SIGHUP) does not make dnsmasq re-read its configuration,
|
|
# so only a restart drops the forward. try-restart leaves a dnsmasq
|
|
# that stopped meanwhile stopped.
|
|
is_active dnsmasq.service && systemctl try-restart dnsmasq || true
|
|
return 0
|
|
}
|
|
|
|
teardown_nm_dnsmasq() {
|
|
[ -f "$NM_DNSMASQ_CONF" ] || return 0
|
|
log "Removing NetworkManager dnsmasq config"
|
|
rm -f "$NM_DNSMASQ_CONF"
|
|
is_active NetworkManager.service && nmcli general reload 2>/dev/null || true
|
|
return 0
|
|
}
|
|
|
|
# --- Main ---
|
|
|
|
backend=""
|
|
if [ -f "$STATE_FILE" ]; then
|
|
backend=$(cat "$STATE_FILE")
|
|
fi
|
|
|
|
case "$backend" in
|
|
dns-delegate) teardown_dns_delegate ;;
|
|
global-drop-in) teardown_global_drop_in ;;
|
|
resolvectl) teardown_resolvectl ;;
|
|
dnsmasq) teardown_dnsmasq ;;
|
|
nm-dnsmasq) teardown_nm_dnsmasq ;;
|
|
none) ;; # Nothing was configured
|
|
*)
|
|
# State unknown — clean up everything
|
|
teardown_dns_delegate
|
|
teardown_global_drop_in
|
|
teardown_resolvectl
|
|
teardown_dnsmasq
|
|
teardown_nm_dnsmasq
|
|
;;
|
|
esac
|
|
|
|
rm -f "$STATE_FILE"
|
|
exit 0
|