tech-userlevel archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Add a minimal instance of named early in the boot
From time to time, there has been discussion about dependency loops
between providing name service and time service early in the boot.
The problem is that named needs reasonably accurate time for DNSSEC
signatures, and ntpdate needs a name server to look up host names
mentioned in its configuration; so which one should we start first?
I have now implemented the suggestion that I made in
<http://mail-index.netbsd.org/tech-userlevel/2005/03/16/0010.html>.
This does the following:
* Early in the boot, run an instance of named with a minimal
configuration that makes it act only as a caching resolver
providing service to the local host. This is done in a new
rc.d script, /etc/rc.d/resolver.
* Run ntpdate after that caching resolver has started. This is
done in /etc/rc.d/ntpdate, almost exactly as before, but now
"resolver" is added to the REQUIRE list.
* Run a full-featured instance of named later, and kill the
minimal instance of named when the full-featured instance
starts. This is done in /ec/rc.d/named, much as before, but
now with "REQUIRE: SERVERS ntpdate", as compared with the old
"REQUIRE: SERVERS", or the "REQUIRE: NETWORKING mountcritremote
syslogd" that was introduced in a recent change by Perry.
I append a patch relative to -current.
--apb (Alan Barrett)
Index: share/man/man5/rc.conf.5
--- a/share/man/man5/rc.conf.5
+++ b/share/man/man5/rc.conf.5
@@ -55,7 +55,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd July 25, 2009
+.Dd August 10, 2009
.Dt RC.CONF 5
.Os
.Sh NAME
@@ -956,14 +956,22 @@ flag will turn on extra logging.
.Sq YES
or
.Sq NO .
-Runs
+Runs a full-featured instance of
.Xr named 8
and passes
.Sy named_flags .
+The full-featured instance of
+.Xr named 8 is run fairly late in the boot sequence; see
+.Sy resolver
+for a minimal instance of
+.Xr named 8
+which is run early in the boot sequence.
.It Sy named_chrootdir
A string.
-If non-blank and
+If non-blank and either
.Sy named
+or
+.Sy resolver
is
.Sq YES ,
run
@@ -1014,6 +1022,34 @@ or
Starts
.Xr postfix 1
mail system.
+.It Sy resolver
+.Sq YES
+or
+.Sq NO .
+Runs
+a minimal caching-only instance of
+.Xr named 8
+and passes
+.Sy resolver_flags .
+This instance of
+.Xr named 8
+is run early in the boot sequence, before
+.Xr ntpdate 8 .
+It uses
+.Pa /etc/named-resolver.conf
+as its configuration file, instead of the default
+.Pa /etc/named.conf .
+If
+.Sy named
+is
+.Sq YES ,
+then the minimal instance of
+.Xr named 8
+will be stopped when the full-featured instance of
+.Xr named 8
+is started.
+See
+.Sy named_chrootdir .
.It Sy sshd
.Sq YES
or
Index: etc/rc.d/resolver
--- /dev/null
+++ b/etc/rc.d/resolver
@@ -0,0 +1,38 @@
+#!/bin/sh
+#
+# $NetBSD$
+#
+
+# PROVIDE: resolver
+# REQUIRE: NETWORKING syslogd
+# BEFORE: named
+# KEYWORD: chrootdir
+#
+# Provide a minimal caching-only name server, early in the
+# boot sequence. It will be killed later by /etc/rc.d/named.
+#
+# ntpdate requires resolver, so resolver cannot require ntpdate.
+#
+
+$_rc_subr_loaded . /etc/rc.subr
+
+name="resolver"
+rcvar=$name
+command="/usr/sbin/named"
+conf_file="/etc/named-resolver.conf"
+command_args="-c ${conf_file}"
+pidfile="/var/run/named/resolver.pid" # must be specified in ${conf_file}
+start_precmd="named_precmd"
+extra_commands="reload"
+required_dirs="${named_chrootdir}" # if it is set, it must exist
+required_files="${conf_file}"
+
+# This little dance allows us to use the "named_precmd" function defined in
+# /etc/rc.d/named, which sets up the chroot directory if necessary.
+args="$*"
+set -- noop
+. /etc/rc.d/named noop
+set -- $args
+
+load_rc_config $name
+run_rc_command "$1"
Index: etc/rc.d/named
--- a/etc/rc.d/named
+++ b/etc/rc.d/named
@@ -4,19 +4,31 @@
#
# PROVIDE: named
-# REQUIRE: NETWORKING mountcritremote syslogd
+# REQUIRE: SERVERS ntpdate
# BEFORE: DAEMON
# KEYWORD: chrootdir
+#
+# Provide a full-featured name server. This happens fairly late
+# in the boot sequence. A minimal caching-only name server
+# is started much earlier by /etc/rc.d/resolver, and that
+# server is killed when the full-featured name server is started
+# here.
+#
-$_rc_subr_loaded . /etc/rc.subr
+# If invoked with $1 = "noop" then don't do anything except
+# define some shell functions. /etc/rc.d/resolver uses this.
+#
+if [ "$1" != "noop" ]; then
+ $_rc_subr_loaded . /etc/rc.subr
-name="named"
-rcvar=$name
-command="/usr/sbin/${name}"
-pidfile="/var/run/${name}/${name}.pid"
-start_precmd="named_precmd"
-extra_commands="reload"
-required_dirs="$named_chrootdir" # if it is set, it must exist
+ name="named"
+ rcvar=$name
+ command="/usr/sbin/${name}"
+ pidfile="/var/run/named/${name}.pid"
+ start_precmd="named_precmd"
+ extra_commands="reload"
+ required_dirs="$named_chrootdir" # if it is set, it must exist
+fi
named_migrate()
{
@@ -58,6 +70,16 @@ named_migrate()
named_precmd()
{
+ case "$name" in
+ resolver) ;;
+ *)
+ # Kill the resolver instance of named, if there is one.
+ if /etc/rc.d/resolver status >/dev/null; then
+ /etc/rc.d/resolver forcestop
+ fi
+ ;;
+ esac
+
if [ -z "$named_chrootdir" ]; then
return 0;
fi
@@ -99,16 +121,20 @@ named_precmd()
if [ ! -h /etc/namedb ]; then
named_migrate /etc/namedb ${named_chrootdir}
fi
- if [ \( -r /etc/named.conf \) -a \( ! -h /etc/named.conf \) -a \
- \( ! -r ${named_chrootdir}/etc/named.conf \) ]
- then
- mv /etc/named.conf ${named_chrootdir}/etc/named.conf
- ln -s ${named_chrootdir}/etc/named.conf /etc/named.conf
- fi
- if [ \( ! -r ${named_chrootdir}/etc/named.conf \) -a \
- \( -r ${named_chrootdir}/etc/namedb/named.conf \) ]; then
- ln -s namedb/named.conf ${named_chrootdir}/etc
- fi
+ for file in named.conf named-resolver.conf
+ do
+ if [ \( -r /etc/${file} \) -a \( ! -h /etc/${file} \) -a \
+ \( ! -r ${named_chrootdir}/etc/${file} \) ]
+ then
+ mv /etc/${file} ${named_chrootdir}/etc/${file}
+ ln -s ${named_chrootdir}/etc/${file} /etc/${file}
+ fi
+ if [ \( ! -r ${named_chrootdir}/etc/${file} \) -a \
+ \( -r ${named_chrootdir}/etc/namedb/${file} \) ]
+ then
+ ln -s namedb/${file} ${named_chrootdir}/etc/${file}
+ fi
+ done
if [ -f /etc/localtime ]; then
cmp -s /etc/localtime "${named_chrootdir}/etc/localtime" || \
@@ -126,5 +152,7 @@ named_precmd()
rc_flags="-u named -t ${named_chrootdir} $rc_flags"
}
-load_rc_config $name
-run_rc_command "$1"
+if [ "$1" != "noop" ]; then
+ load_rc_config $name
+ run_rc_command "$1"
+fi
Index: etc/rc.d/mountall
--- a/etc/rc.d/mountall
+++ b/etc/rc.d/mountall
@@ -3,7 +3,7 @@
# $NetBSD: mountall,v 1.6 2008/12/01 14:47:14 tsutsui Exp $
#
-# REQUIRE: mountcritremote named ypbind
+# REQUIRE: mountcritremote ntpdate resolver ypbind
# PROVIDE: mountall
$_rc_subr_loaded . /etc/rc.subr
Index: etc/rc.d/mountcritremote
--- a/etc/rc.d/mountcritremote
+++ b/etc/rc.d/mountcritremote
@@ -5,6 +5,19 @@
# PROVIDE: mountcritremote
# REQUIRE: NETWORKING root mountcritlocal
+#
+# ntpdate requires mountcritremote, so mountcritremote cannot
+# require ntpdate. Manual intervention may be required if the
+# system time is so inaccurate that remote file systems cannot be
+# mounted.
+#
+# resolver requires mountcritremote, so mountcritremote cannot
+# require resolver. Therefore, any file systems listed in
+# $critical_filesystems_remote must reside on servers specified by
+# IP address in /etc/fstab, or there must be some way of resolving
+# the remote server names before the local resolver is running,
+# such as by listing the server names in /etc/hosts, or by listing
+# non-local resolvers in /etc/resolv.conf.
$_rc_subr_loaded . /etc/rc.subr
Index: etc/rc.d/ntpd
--- a/etc/rc.d/ntpd
+++ b/etc/rc.d/ntpd
@@ -4,7 +4,7 @@
#
# PROVIDE: ntpd
-# REQUIRE: DAEMON
+# REQUIRE: DAEMON resolver
# BEFORE: LOGIN
# KEYWORD: chrootdir
Index: etc/rc.d/ntpdate
--- a/etc/rc.d/ntpdate
+++ b/etc/rc.d/ntpdate
@@ -4,7 +4,7 @@
#
# PROVIDE: ntpdate
-# REQUIRE: NETWORKING mountcritremote syslogd named
+# REQUIRE: NETWORKING mountcritremote resolver syslogd
# BEFORE: ntpd
$_rc_subr_loaded . /etc/rc.subr
Index: etc/rc.d/rpcbind
--- a/etc/rc.d/rpcbind
+++ b/etc/rc.d/rpcbind
@@ -4,7 +4,7 @@
#
# PROVIDE: rpcbind
-# REQUIRE: NETWORKING ntpdate syslogd named ppp
+# REQUIRE: NETWORKING ntpdate resolver syslogd ppp
$_rc_subr_loaded . /etc/rc.subr
Index: etc/rc.d/DAEMON
--- a/etc/rc.d/DAEMON
+++ b/etc/rc.d/DAEMON
@@ -4,7 +4,7 @@
#
# PROVIDE: DAEMON
-# REQUIRE: NETWORKING SERVERS
+# REQUIRE: NETWORKING SERVERS ntpdate resolver
# This is a dummy dependency, to ensure that general purpose daemons
# are run _after_ the above are.
Index: etc/rc.d/Makefile
--- a/etc/rc.d/Makefile
+++ b/etc/rc.d/Makefile
@@ -31,8 +31,9 @@ CONFIGFILES=\
named ndbootd network newsyslog nfsd nfslocking ntpd ntpdate \
perusertmp pf pf_boot pflogd postfix powerd ppp pwcheck \
quota \
- racoon rpcbind raidframe raidframeparity rarpd rbootd rndctl \
- root route6d routed rtadvd rtclocaltime rtsold rwho \
+ racoon rpcbind raidframe raidframeparity rarpd rbootd \
+ resolver rndctl root route6d routed rtadvd rtclocaltime \
+ rtsold rwho \
savecore screenblank sdpd securelevel sshd \
staticroute swap1 swap2 sysctl sysdb syslogd \
timed tpctl ttys \
Index: etc/Makefile
--- a/etc/Makefile
+++ b/etc/Makefile
@@ -91,8 +91,9 @@ UTMPGRP= utmp
BIN1+= bootptab changelist csh.cshrc csh.login \
csh.logout daily daily.conf dm.conf envsys.conf floppytab ftpchroot \
ftpusers gettytab gpio.conf group hosts hosts.lpd inetd.conf \
- locate.conf login.conf mailer.conf man.conf monthly monthly.conf \
- mrouted.conf named.conf netconfig networks newsyslog.conf \
+ locate.conf login.conf \
+ mailer.conf man.conf monthly monthly.conf mrouted.conf \
+ named.conf named-resolver.conf netconfig networks newsyslog.conf \
nsswitch.conf ntp.conf passwd.conf phones printcap profile protocols \
rbootd.conf rc rc.conf rc.local rc.subr rc.shutdown remote rpc \
security security.conf services shells shrc sysctl.conf syslog.conf \
Index: etc/defaults/rc.conf
--- a/etc/defaults/rc.conf
+++ b/etc/defaults/rc.conf
@@ -202,6 +202,7 @@ rpcbind=NO rpcbind_flags="-l" # -l logs
libwrap
syslogd=YES syslogd_flags="-s" # -s "secure" unix domain only
cron=YES
named=NO named_flags="" # see below for named_chrootdir
+resolver=NO resolver_flags="" # also uses named_chrootdir
timed=NO timed_flags=""
ntpd=NO ntpd_flags="" # see below for
ntpd_chrootdir
# The default setting for postfix here is YES, but gets re-examined by
Index: etc/named-resolver.conf
--- /dev/null
+++ b/etc/named-resolver.conf
@@ -0,0 +1,47 @@
+# $NetBSD$
+
+# This simple configuration is used by the instance of named that is
+# started by /etc/rc.d/resolver. It is intended only to provide a
+# recursive resolver service to the local host, to enable "nameserver
+# 127.0.0.1" in /etc/resolv.conf to work correctly.
+#
+# For more complex requirements, such as providing name service to
+# others, do not edit this file. Instead, edit the /etc/named.conf
+# file, which is used by the instance of named that is started by
+# /etc/rc.d/named, or configure and use name server software other than
+# named.
+
+options {
+ directory "/etc/namedb";
+ pid-file "/var/run/named/resolver.pid";
+ listen-on port 53 { 127.0.0.1; };
+ listen-on-v6 port 53 { ::1; };
+ allow-recursion { localhost; };
+
+ #
+ # This forces all queries to come from port 53; might be
+ # needed for firewall traversals but should be avoided if
+ # at all possible because of the risk of spoofing attacks.
+ #
+ #query-source address * port 53;
+};
+
+zone "." {
+ type hint;
+ file "root.cache";
+};
+
+zone "localhost" {
+ type master;
+ file "localhost";
+};
+
+zone "127.IN-ADDR.ARPA" {
+ type master;
+ file "127";
+};
+
+zone
"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" {
+ type master;
+ file "loopback.v6";
+};
Index: etc/named.conf
--- a/etc/named.conf
+++ b/etc/named.conf
@@ -5,6 +5,7 @@
options {
directory "/etc/namedb";
+ pid-file "/var/run/named/named.pid";
allow-recursion { localhost; localnets; };
#
Home |
Main Index |
Thread Index |
Old Index