94 lines
2.5 KiB
Bash
Executable File
94 lines
2.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# ==============================================================================
|
|
# 06-configure-dns.sh
|
|
#
|
|
# Configure dnsmasq in sys-fips so .fips queries are forwarded to local
|
|
# FIPS DNS resolver on 127.0.0.1:5354, and all other DNS goes upstream.
|
|
#
|
|
# Usage:
|
|
# sudo bash 06-configure-dns.sh
|
|
# ==============================================================================
|
|
set -euo pipefail
|
|
|
|
echo "=== sys-fips DNS Configuration ==="
|
|
echo ""
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "✗ This script must be run as root (sudo)"
|
|
exit 1
|
|
fi
|
|
|
|
systemctl stop dnsmasq 2>/dev/null || true
|
|
killall dnsmasq 2>/dev/null || true
|
|
|
|
UPSTREAM_DNS=$(grep '^nameserver' /etc/resolv.conf | awk '{print $2}' | head -1)
|
|
UPSTREAM_DNS="${UPSTREAM_DNS:-10.139.1.1}"
|
|
|
|
echo " Upstream DNS: $UPSTREAM_DNS"
|
|
|
|
mkdir -p /etc/dnsmasq.d
|
|
cat > /etc/dnsmasq.d/fips.conf << EOF
|
|
# sys-fips DNS resolution
|
|
port=53
|
|
listen-address=0.0.0.0
|
|
bind-interfaces
|
|
|
|
# .fips domains -> FIPS resolver
|
|
server=/fips/127.0.0.1#5354
|
|
|
|
# everything else -> upstream
|
|
server=$UPSTREAM_DNS
|
|
|
|
no-resolv
|
|
no-hosts
|
|
# log-queries
|
|
EOF
|
|
|
|
if [ ! -f /etc/dnsmasq.conf ]; then
|
|
touch /etc/dnsmasq.conf
|
|
fi
|
|
if ! grep -q 'conf-dir=/etc/dnsmasq.d/,*.conf' /etc/dnsmasq.conf; then
|
|
echo 'conf-dir=/etc/dnsmasq.d/,*.conf' >> /etc/dnsmasq.conf
|
|
fi
|
|
|
|
if ! dnsmasq --test >/dev/null 2>&1; then
|
|
echo "✗ dnsmasq config failed validation"
|
|
exit 1
|
|
fi
|
|
|
|
# Qubes AppVMs often use /32 point-to-point addressing.
|
|
# Debian's dnsmasq systemd-helper adds --local-service by default,
|
|
# which can reject DNS queries from downstream AppVMs in this topology.
|
|
DNSMASQ_HELPER="/usr/share/dnsmasq/systemd-helper"
|
|
if [ -f "$DNSMASQ_HELPER" ] && grep -q -- '--local-service' "$DNSMASQ_HELPER"; then
|
|
cp "$DNSMASQ_HELPER" "${DNSMASQ_HELPER}.bak"
|
|
sed -i 's/--local-service//g' "$DNSMASQ_HELPER"
|
|
echo " Patched dnsmasq helper: removed --local-service for Qubes /32 compatibility"
|
|
fi
|
|
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
systemctl restart dnsmasq || true
|
|
fi
|
|
|
|
if ! pgrep -x dnsmasq >/dev/null 2>&1; then
|
|
dnsmasq
|
|
fi
|
|
|
|
echo ""
|
|
echo "Verifying DNS..."
|
|
if dig @127.0.0.1 google.com A +short +time=2 >/dev/null 2>&1; then
|
|
echo " Upstream DNS: OK"
|
|
else
|
|
echo " Upstream DNS: WARN (may be expected in isolated setup)"
|
|
fi
|
|
|
|
STATUS=$(dig @127.0.0.1 test.fips AAAA +time=2 2>&1 | grep 'status:' || true)
|
|
if echo "$STATUS" | grep -qE 'NXDOMAIN|SERVFAIL|NOERROR'; then
|
|
echo " .fips forwarding: OK"
|
|
else
|
|
echo " .fips forwarding: WARN"
|
|
fi
|
|
|
|
echo ""
|
|
echo "✓ DNS configured"
|