net/unbound/files/unbound.sh

   1 #!/bin/sh
   2 ##############################################################################
   3 #
   4 # This program is free software; you can redistribute it and/or modify
   5 # it under the terms of the GNU General Public License version 2 as
   6 # published by the Free Software Foundation.
   7 #
   8 # This program is distributed in the hope that it will be useful,
   9 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  10 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11 # GNU General Public License for more details.
  12 #
  13 # Copyright (C) 2016 Eric Luehrsen
  14 #
  15 ##############################################################################
  16 #
  17 # This builds the basic UCI components currently supported for Unbound. It is
  18 # intentionally NOT comprehensive and bundles a lot of options. The UCI is to
  19 # be a simpler presentation of the total Unbound conf set.
  20 #
  21 ##############################################################################
  22
  23 UNBOUND_B_CONTROL=0
  24 UNBOUND_B_DNSMASQ=0
  25 UNBOUND_B_DNSSEC=0
  26 UNBOUND_B_GATE_NAME=0
  27 UNBOUND_B_LOCL_BLCK=0
  28 UNBOUND_B_LOCL_NAME=0
  29 UNBOUND_B_LOCL_SERV=1
  30 UNBOUND_B_MAN_CONF=0
  31 UNBOUND_B_NTP_BOOT=1
  32 UNBOUND_B_PRIV_BLCK=1
  33 UNBOUND_B_QUERY_MIN=0
  34
  35 UNBOUND_D_RESOURCE=small
  36 UNBOUND_D_RECURSION=passive
  37
  38 UNBOUND_TXT_FWD_ZONE=""
  39 UNBOUND_TTL_MIN=120
  40
  41 UNBOUND_N_EDNS_SIZE=1280
  42 UNBOUND_N_FWD_PORTS=""
  43 UNBOUND_N_RX_PORT=53
  44 UNBOUND_N_ROOT_AGE=28
  45
  46 ##############################################################################
  47
  48 UNBOUND_ANCHOR=/usr/bin/unbound-anchor
  49 UNBOUND_CONTROL=/usr/bin/unbound-control
  50
  51 UNBOUND_LIBDIR=/usr/lib/unbound
  52
  53 UNBOUND_PIDFILE=/var/run/unbound.pid
  54
  55 UNBOUND_VARDIR=/var/lib/unbound
  56 UNBOUND_CONFFILE=$UNBOUND_VARDIR/unbound.conf
  57 UNBOUND_KEYFILE=$UNBOUND_VARDIR/root.key
  58 UNBOUND_HINTFILE=$UNBOUND_VARDIR/root.hints
  59 UNBOUND_TIMEFILE=$UNBOUND_VARDIR/unbound.time
  60 UNBOUND_CHECKFILE=$UNBOUND_VARDIR/unbound.check
  61
  62 ##############################################################################
  63
  64 . /lib/functions.sh
  65 . /lib/functions/network.sh
  66
  67 . $UNBOUND_LIBDIR/dnsmasq.sh
  68 . $UNBOUND_LIBDIR/iptools.sh
  69 . $UNBOUND_LIBDIR/rootzone.sh
  70
  71 ##############################################################################
  72
  73 create_access_control() {
  74   local cfg="$1"
  75   local subnets subnets4 subnets6
  76   local validip4 validip6
  77
  78   network_get_subnets  subnets4 "$cfg"
  79   network_get_subnets6 subnets6 "$cfg"
  80   subnets="$subnets4 $subnets6"
  81
  82
  83   if [ -n "$subnets" ] ; then
  84     for subnet in $subnets ; do
  85       validip4=$( valid_subnet4 $subnet )
  86       validip6=$( valid_subnet6 $subnet )
  87
  88
  89       if [ "$validip4" = "ok" -o "$validip6" = "ok" ] ; then
  90         # For each "network" UCI add "access-control:" white list for queries
  91         echo "  access-control: $subnet allow" >> $UNBOUND_CONFFILE
  92       fi
  93     done
  94   fi
  95 }
  96
  97 ##############################################################################
  98
  99 create_domain_insecure() {
 100   echo "  domain-insecure: \"$1\"" >> $UNBOUND_CONFFILE
 101 }
 102
 103 ##############################################################################
 104
 105 unbound_mkdir() {
 106   mkdir -p $UNBOUND_VARDIR
 107
 108
 109   if [ -f /etc/unbound/root.hints ] ; then
 110     # Your own local copy of root.hints
 111     cp -p /etc/unbound/root.hints $UNBOUND_HINTFILE
 112
 113   elif [ -f /usr/share/dns/root.hints ] ; then
 114     # Debian-like package dns-root-data
 115     cp -p /usr/share/dns/root.hints $UNBOUND_HINTFILE
 116
 117   else
 118     logger -t unbound -s "iterator will use built-in root hints"
 119   fi
 120
 121
 122   if [ -f /etc/unbound/root.key ] ; then
 123     # Your own local copy of a root.key
 124     cp -p /etc/unbound/root.key $UNBOUND_KEYFILE
 125
 126   elif [ -f /usr/share/dns/root.key ] ; then
 127     # Debian-like package dns-root-data
 128     cp -p /usr/share/dns/root.key $UNBOUND_KEYFILE
 129
 130   elif [ -x "$UNBOUND_ANCHOR" ] ; then
 131     $UNBOUND_ANCHOR -a $UNBOUND_KEYFILE
 132
 133   else
 134     logger -t unbound -s "validator will use built-in trust anchor"
 135   fi
 136 }
 137
 138 ##############################################################################
 139
 140 unbound_conf() {
 141   local cfg=$1
 142   local rt_mem rt_conn
 143
 144   {
 145     # Make fresh conf file
 146     echo "# $UNBOUND_CONFFILE generated by UCI $( date )"
 147     echo
 148   } > $UNBOUND_CONFFILE
 149
 150
 151   if [ "$UNBOUND_B_CONTROL" -gt 0 ] ; then
 152     {
 153       # Enable remote control tool, but only at local host for security
 154       echo "remote-control:"
 155       echo "  control-enable: yes"
 156       echo "  control-use-cert: no"
 157       echo "  control-interface: 127.0.0.1"
 158       echo "  control-interface: ::1"
 159       echo
 160     } >> $UNBOUND_CONFFILE
 161
 162   else
 163     {
 164       # "control:" clause is seperate before "server:" so we can append
 165       # dnsmasq "server:" parts and "forward:" cluases towards the end.
 166       echo "remote-control:"
 167       echo "  control-enable: no"
 168       echo
 169     } >> $UNBOUND_CONFFILE
 170   fi
 171
 172
 173   {
 174     # No threading
 175     echo "server:"
 176     echo "  username: unbound"
 177     echo "  num-threads: 1"
 178     echo "  msg-cache-slabs: 1"
 179     echo "  rrset-cache-slabs: 1"
 180     echo "  infra-cache-slabs: 1"
 181     echo "  key-cache-slabs: 1"
 182     echo
 183   } >> $UNBOUND_CONFFILE
 184
 185
 186   {
 187     # Logging
 188     echo "  verbosity: 1"
 189     echo "  statistics-interval: 0"
 190     echo "  statistics-cumulative: no"
 191     echo "  extended-statistics: no"
 192     echo
 193   } >> $UNBOUND_CONFFILE
 194
 195
 196   {
 197     # Interfaces (access contol "option local_service")
 198     echo "  interface: 0.0.0.0"
 199     echo "  interface: ::0"
 200     echo "  outgoing-interface: 0.0.0.0"
 201     echo "  outgoing-interface: ::0"
 202     echo
 203   } >> $UNBOUND_CONFFILE
 204
 205
 206   {
 207     # protocol level tuning
 208     echo "  edns-buffer-size: $UNBOUND_N_EDNS_SIZE"
 209     echo "  msg-buffer-size: 8192"
 210     echo "  port: $UNBOUND_N_RX_PORT"
 211     echo "  outgoing-port-permit: 10240-65535"
 212     echo
 213   } >> $UNBOUND_CONFFILE
 214
 215
 216   {
 217     # Other harding and options for an embedded router
 218     echo "  harden-short-bufsize: yes"
 219     echo "  harden-large-queries: yes"
 220     echo "  harden-glue: yes"
 221     echo "  harden-below-nxdomain: no"
 222     echo "  harden-referral-path: no"
 223     echo "  use-caps-for-id: no"
 224     echo
 225   } >> $UNBOUND_CONFFILE
 226
 227
 228   {
 229     # Default Files
 230     echo "  use-syslog: yes"
 231     echo "  chroot: \"$UNBOUND_VARDIR\""
 232     echo "  directory: \"$UNBOUND_VARDIR\""
 233     echo "  pidfile: \"$UNBOUND_PIDFILE\""
 234   } >> $UNBOUND_CONFFILE
 235
 236
 237   if [ -f "$UNBOUND_HINTFILE" ] ; then
 238     # Optional hints if found
 239     echo "  root-hints: \"$UNBOUND_HINTFILE\"" >> $UNBOUND_CONFFILE
 240   fi
 241
 242
 243   if [ "$UNBOUND_B_DNSSEC" -gt 0 -a -f "$UNBOUND_KEYFILE" ] ; then
 244     {
 245       echo "  auto-trust-anchor-file: \"$UNBOUND_KEYFILE\""
 246       echo
 247     } >> $UNBOUND_CONFFILE
 248
 249   else
 250     echo >> $UNBOUND_CONFFILE
 251   fi
 252
 253
 254   case "$UNBOUND_D_RESOURCE" in
 255     # Tiny - Unbound's recommended cheap hardware config
 256     tiny)   rt_mem=1  ; rt_conn=1 ;;
 257     # Small - Half RRCACHE and open ports
 258     small)  rt_mem=8  ; rt_conn=5 ;;
 259     # Medium - Nearly default but with some added balancintg
 260     medium) rt_mem=16 ; rt_conn=10 ;;
 261     # Large - Double medium
 262     large)  rt_mem=32 ; rt_conn=10 ;;
 263     # Whatever unbound does
 264     *) rt_mem=0 ; rt_conn=0 ;;
 265   esac
 266
 267
 268   if [ "$rt_mem" -gt 0 ] ; then
 269     {
 270       # Set memory sizing parameters
 271       echo "  outgoing-range: $(($rt_conn*64))"
 272       echo "  num-queries-per-thread: $(($rt_conn*32))"
 273       echo "  outgoing-num-tcp: $(($rt_conn))"
 274       echo "  incoming-num-tcp: $(($rt_conn))"
 275       echo "  rrset-cache-size: $(($rt_mem*256))k"
 276       echo "  msg-cache-size: $(($rt_mem*128))k"
 277       echo "  key-cache-size: $(($rt_mem*128))k"
 278       echo "  neg-cache-size: $(($rt_mem*64))k"
 279       echo "  infra-cache-numhosts: $(($rt_mem*256))"
 280       echo
 281     } >> $UNBOUND_CONFFILE
 282
 283   else
 284     logger -t unbound -s "default memory resource consumption"
 285   fi
 286
 287
 288   if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
 289     if [ ! -f "$UNBOUND_TIMEFILE" -a "$UNBOUND_B_NTP_BOOT" -gt 0 ] ; then
 290       # DNSSEC chicken and egg with getting NTP time
 291       echo "  val-override-date: -1" >> $UNBOUND_CONFFILE
 292     fi
 293
 294
 295     {
 296       # Validation of DNSSEC
 297       echo "  module-config: \"validator iterator\""
 298       echo "  harden-dnssec-stripped: yes"
 299       echo "  val-clean-additional: yes"
 300       echo "  ignore-cd-flag: yes"
 301       echo
 302     } >> $UNBOUND_CONFFILE
 303
 304   else
 305     {
 306       # Just iteration without DNSSEC
 307       echo "  module-config: \"iterator\""
 308       echo
 309     } >> $UNBOUND_CONFFILE
 310   fi
 311
 312
 313   if [ "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
 314     # Minor improvement on query privacy
 315     echo "  qname-minimisation: yes" >> $UNBOUND_CONFFILE
 316
 317   else
 318     echo "  qname-minimisation: no" >> $UNBOUND_CONFFILE
 319   fi
 320
 321
 322   case "$UNBOUND_D_RECURSION" in
 323     passive)
 324       {
 325         echo "  prefetch: no"
 326         echo "  prefetch-key: no"
 327         echo "  target-fetch-policy: \"0 0 0 0 0\""
 328         echo
 329       } >> $UNBOUND_CONFFILE
 330       ;;
 331
 332     aggressive)
 333       {
 334         echo "  prefetch: yes"
 335         echo "  prefetch-key: yes"
 336         echo "  target-fetch-policy: \"3 2 1 0 0\""
 337         echo
 338       } >> $UNBOUND_CONFFILE
 339       ;;
 340
 341     *)
 342       logger -t unbound -s "default recursion configuration"
 343       ;;
 344   esac
 345
 346
 347   {
 348     # Reload records more than 10 hours old
 349     # DNSSEC 5 minute bogus cool down before retry
 350     # Adaptive infrastructure info kept for 15 minutes
 351     echo "  cache-min-ttl: $UNBOUND_TTL_MIN"
 352     echo "  cache-max-ttl: 36000"
 353     echo "  val-bogus-ttl: 300"
 354     echo "  infra-host-ttl: 900"
 355     echo
 356   } >> $UNBOUND_CONFFILE
 357
 358
 359   if [ "$UNBOUND_B_PRIV_BLCK" -gt 0 ] ; then
 360     {
 361       # Remove DNS reponses from upstream with private IP
 362       echo "  private-address: 10.0.0.0/8"
 363       echo "  private-address: 169.254.0.0/16"
 364       echo "  private-address: 172.16.0.0/12"
 365       echo "  private-address: 192.168.0.0/16"
 366       echo "  private-address: fc00::/8"
 367       echo "  private-address: fd00::/8"
 368       echo "  private-address: fe80::/10"
 369     } >> $UNBOUND_CONFFILE
 370   fi
 371
 372
 373   if [ "$UNBOUND_B_LOCL_BLCK" -gt 0 ] ; then
 374     {
 375       # Remove DNS reponses from upstream with loopback IP
 376       # Black hole DNS method for ad blocking, so consider...
 377       echo "  private-address: 127.0.0.0/8"
 378       echo "  private-address: ::1/128"
 379       echo
 380     } >> $UNBOUND_CONFFILE
 381
 382   else
 383     echo >> $UNBOUND_CONFFILE
 384   fi
 385
 386
 387   # Domain Exceptions
 388   config_list_foreach "$cfg" "domain_insecure" create_domain_insecure
 389   echo >> $UNBOUND_CONFFILE
 390
 391
 392   ####################
 393   # UCI @ network    #
 394   ####################
 395
 396
 397   if [ "$UNBOUND_B_LOCL_SERV" -gt 0 ] ; then
 398     # Only respond to queries from which this device has an interface.
 399     # Prevent DNS amplification attacks by not responding to the universe.
 400     config_load network
 401     config_foreach create_access_control interface
 402
 403     {
 404       echo "  access-control: 127.0.0.0/8 allow"
 405       echo "  access-control: ::1/128 allow"
 406       echo "  access-control: fe80::/10 allow"
 407       echo
 408     } >> $UNBOUND_CONFFILE
 409
 410   else
 411     {
 412       echo "  access-control: 0.0.0.0/0 allow"
 413       echo "  access-control: ::0/0 allow"
 414       echo
 415     } >> $UNBOUND_CONFFILE
 416   fi
 417 }
 418
 419 ##############################################################################
 420
 421 unbound_uci() {
 422   local cfg=$1
 423   local dnsmasqpath
 424
 425   ####################
 426   # UCI @ unbound    #
 427   ####################
 428
 429   config_get_bool UNBOUND_B_GATE_NAME "$cfg" dnsmsaq_gate_name 0
 430   config_get_bool UNBOUND_B_DNSMASQ   "$cfg" dnsmasq_link_dns 0
 431   config_get_bool UNBOUND_B_LOCL_NAME "$cfg" dnsmasq_only_local 0
 432   config_get_bool UNBOUND_B_LOCL_SERV "$cfg" localservice 1
 433   config_get_bool UNBOUND_B_MAN_CONF  "$cfg" manual_conf 0
 434   config_get_bool UNBOUND_B_QUERY_MIN "$cfg" query_minimize 0
 435   config_get_bool UNBOUND_B_PRIV_BLCK "$cfg" rebind_protection 1
 436   config_get_bool UNBOUND_B_LOCL_BLCK "$cfg" rebind_localhost 0
 437   config_get_bool UNBOUND_B_CONTROL   "$cfg" unbound_control 0
 438   config_get_bool UNBOUND_B_DNSSEC    "$cfg" validator  0
 439   config_get_bool UNBOUND_B_NTP_BOOT  "$cfg" validator_ntp 1
 440
 441   config_get UNBOUND_N_EDNS_SIZE "$cfg" edns_size 1280
 442   config_get UNBOUND_N_RX_PORT   "$cfg" listen_port 53
 443   config_get UNBOUND_D_RECURSION "$cfg" recursion passive
 444   config_get UNBOUND_D_RESOURCE  "$cfg" resource small
 445   config_get UNBOUND_N_ROOT_AGE  "$cfg" root_age 7
 446   config_get UNBOUND_TTL_MIN     "$cfg" ttl_min 120
 447
 448
 449   if [ "$UNBOUND_B_DNSMASQ" -gt 0 ] ; then
 450     dnsmasqpath=$( which dnsmasq )
 451
 452
 453     if [ ! -x "$dnsmasqpath" ] ; then
 454       logger -t unbound -s "cannot forward to dnsmasq"
 455       UNBOUND_B_DNSMASQ=0
 456     fi
 457   fi
 458
 459
 460   if [ "$UNBOUND_N_EDNS_SIZE" -lt 512 \
 461     -o 4096 -lt "$UNBOUND_N_EDNS_SIZE" ] ; then
 462     # exceeds range, back to default
 463     UNBOUND_N_EDNS_SIZE=1280
 464   fi
 465
 466
 467   if [ "$UNBOUND_N_RX_PORT" -lt 1024 \
 468     -o 10240 -lt "$UNBOUND_N_RX_PORT" ] ; then
 469     # special port or in 5 digits, back to default
 470     UNBOUND_N_RX_PORT=53
 471   fi
 472
 473
 474   if [ "$UNBOUND_TTL_MIN" -gt 1800 ] ; then
 475     # that could have had awful side effects
 476     UNBOUND_TTL_MIN=300
 477   fi
 478
 479
 480   if [ "$UNBOUND_B_MAN_CONF" -gt 0 ] ; then
 481     if [ -f /etc/unbound/unbound.conf ] ; then
 482       # You don't want UCI and use your own manual configuration
 483       # or with no base file whatever Unbound defaults are.
 484       cp -p /etc/unbound/unbound.conf $UNBOUND_CONFFILE
 485     fi
 486
 487
 488     # Don't want this being triggered. Maybe we could, but then the
 489     # base conf you provide would need to be just right.
 490     UNBOUND_B_DNSMASQ=0
 491
 492   else
 493     unbound_conf $cfg
 494   fi
 495 }
 496
 497 ##############################################################################
 498
 499 unbound_own () {
 500   # Debug UCI
 501   {
 502     echo "# $UNBOUND_CHECKFILE generated by UCI $( date )"
 503     echo
 504     set | grep ^UNBOUND_
 505   } > $UNBOUND_CHECKFILE
 506
 507
 508   if [ ! -f "$UNBOUND_CONFFILE" ] ; then
 509     # if somehow this happened
 510     touch $UNBOUND_CONFFILE
 511   fi
 512
 513
 514   # Ensure Access
 515   chown -R unbound:unbound $UNBOUND_VARDIR
 516   chmod 775 $UNBOUND_VARDIR
 517   chmod 664 $UNBOUND_VARDIR/*
 518 }
 519
 520 ##############################################################################
 521
 522 unbound_prepare() {
 523   # Make a home for Unbound in /var/lib/unbound
 524   unbound_mkdir
 525
 526   # Load up the chunks of UCI
 527   config_load unbound
 528   config_foreach unbound_uci unbound
 529
 530   # Unbound primary DNS, and dnsmasq side service DHCP-DNS (dnsmasq.sh)
 531   dnsmasq_link
 532
 533   # Unbound needs chroot ownership
 534   unbound_own
 535 }
 536
 537 ##############################################################################
 538