adamandClaude Opus 5.5
66dcf53684
jarl encrypted-dns setup (and the Encrypted DNS page) finds or obtains a certificate for the host name, checks that nothing else listens on the DoT and DoH ports at the chosen addresses (offering a free DoH port), and stages named's tls statement and listeners as one change, keeping port 53 where it was when there was no listen-on, plus the host name's records in the private views (local to the view in a linked zone). Status shows what to give Android, Linux, Firefox, Chrome and Windows clients. A tls statement with missing files is refused (tls_file_missing), and a certificate named uses can't be deleted. docs/encrypted-dns.md, e2e with real DoT and DoH queries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.0 KiB
Go
35 lines
1.0 KiB
Go
package validate
|
|
|
|
import (
|
|
"errors"
|
|
"io/fs"
|
|
"os"
|
|
|
|
"jarl/internal/model"
|
|
"jarl/internal/namedconf"
|
|
)
|
|
|
|
// checkTLSFiles checks that the files a top-level tls statement names
|
|
// exist: named fails to load the whole configuration otherwise. (Files
|
|
// jarld can't look at are left to named.)
|
|
func (c *checker) checkTLSFiles() {
|
|
for _, o := range c.s.ScopedOptions(model.ScopeTopLevel, 0) {
|
|
if o.Name != "tls" {
|
|
continue
|
|
}
|
|
stmt, err := namedconf.ParseOptionValue("tls", o.Value)
|
|
if err != nil || stmt.FirstBlock() == nil {
|
|
continue
|
|
}
|
|
for _, s := range stmt.FirstBlock().Stmts {
|
|
switch s.Keyword() {
|
|
case "cert-file", "key-file", "ca-file", "dhparam-file":
|
|
path := s.Arg(0)
|
|
if _, err := os.Stat(path); errors.Is(err, fs.ErrNotExist) {
|
|
c.errf("tls_file_missing", "option", o.ID, "tls %s: %s %s doesn't exist, and named won't load its configuration without it (a certificate Jarl obtains is written once it has been obtained: jarl cert list)", stmt.Arg(0), s.Keyword(), path)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|