net/unbound/files/unbound.sh

   1 #!/bin/sh
   2 ##############################################################################
   3 #
   4 # This program is free software; you can redistribute it and/or modify
   5 # it under the terms of the GNU General Public License version 2 as
   6 # published by the Free Software Foundation.
   7 #
   8 # This program is distributed in the hope that it will be useful,
   9 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  10 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11 # GNU General Public License for more details.
  12 #
  13 # Copyright (C) 2016 Eric Luehrsen
  14 #
  15 ##############################################################################
  16 #
  17 # This builds the basic UCI components currently supported for Unbound. It is
  18 # intentionally NOT comprehensive and bundles a lot of options. The UCI is to
  19 # be a simpler presentation of the total Unbound conf set.
  20 #
  21 ##############################################################################
  22
  23 UNBOUND_B_CONTROL=0
  24 UNBOUND_B_SLAAC6_MAC=0
  25 UNBOUND_B_DNSSEC=0
  26 UNBOUND_B_DNS64=0
  27 UNBOUND_B_GATE_NAME=0
  28 UNBOUND_B_HIDE_BIND=1
  29 UNBOUND_B_LOCL_BLCK=0
  30 UNBOUND_B_LOCL_SERV=1
  31 UNBOUND_B_MAN_CONF=0
  32 UNBOUND_B_NTP_BOOT=1
  33 UNBOUND_B_PRIV_BLCK=1
  34 UNBOUND_B_QUERY_MIN=0
  35 UNBOUND_B_QRY_MINST=0
  36
  37 UNBOUND_D_DOMAIN_TYPE=static
  38 UNBOUND_D_DHCP_LINK=none
  39 UNBOUND_D_LAN_FQDN=0
  40 UNBOUND_D_PROTOCOL=mixed
  41 UNBOUND_D_RESOURCE=small
  42 UNBOUND_D_RECURSION=passive
  43 UNBOUND_D_WAN_FQDN=0
  44
  45 UNBOUND_IP_DNS64="64:ff9b::/96"
  46
  47 UNBOUND_N_EDNS_SIZE=1280
  48 UNBOUND_N_FWD_PORTS=""
  49 UNBOUND_N_RX_PORT=53
  50 UNBOUND_N_ROOT_AGE=28
  51
  52 UNBOUND_TTL_MIN=120
  53
  54 UNBOUND_TXT_DOMAIN=lan
  55 UNBOUND_TXT_FWD_ZONE=""
  56 UNBOUND_TXT_HOSTNAME=thisrouter
  57
  58 ##############################################################################
  59
  60 UNBOUND_LIBDIR=/usr/lib/unbound
  61 UNBOUND_VARDIR=/var/lib/unbound
  62
  63 UNBOUND_PIDFILE=/var/run/unbound.pid
  64
  65 UNBOUND_SRV_CONF=$UNBOUND_VARDIR/unbound_srv.conf
  66 UNBOUND_EXT_CONF=$UNBOUND_VARDIR/unbound_ext.conf
  67 UNBOUND_DHCP_CONF=$UNBOUND_VARDIR/unbound_dhcp.conf
  68 UNBOUND_CONFFILE=$UNBOUND_VARDIR/unbound.conf
  69
  70 UNBOUND_KEYFILE=$UNBOUND_VARDIR/root.key
  71 UNBOUND_HINTFILE=$UNBOUND_VARDIR/root.hints
  72 UNBOUND_TIMEFILE=$UNBOUND_VARDIR/unbound.time
  73
  74 ##############################################################################
  75
  76 UNBOUND_ANCHOR=/usr/sbin/unbound-anchor
  77 UNBOUND_CONTROL=/usr/sbin/unbound-control
  78 UNBOUND_CONTROL_CFG="$UNBOUND_CONTROL -c $UNBOUND_CONFFILE"
  79
  80 ##############################################################################
  81
  82 . /lib/functions.sh
  83 . /lib/functions/network.sh
  84
  85 . $UNBOUND_LIBDIR/dnsmasq.sh
  86 . $UNBOUND_LIBDIR/iptools.sh
  87 . $UNBOUND_LIBDIR/rootzone.sh
  88
  89 ##############################################################################
  90
  91 create_interface_dns() {
  92   local cfg="$1"
  93   local ipcommand logint ignore ifname ifdashname
  94   local name names address addresses
  95   local ulaprefix if_fqdn host_fqdn mode mode_ptr
  96
  97   # Create local-data: references for this hosts interfaces (router).
  98   config_get logint "$cfg" interface
  99   config_get_bool ignore "$cfg" ignore 0
 100   network_get_device ifname "$cfg"
 101
 102   ifdashname="${ifname//./-}"
 103   ipcommand="ip -o address show $ifname"
 104   addresses="$($ipcommand | awk '/inet/{sub(/\/.*/,"",$4); print $4}')"
 105   ulaprefix="$(uci_get network @globals[0] ula_prefix)"
 106   host_fqdn="$UNBOUND_TXT_HOSTNAME.$UNBOUND_TXT_DOMAIN"
 107   if_fqdn="$ifdashname.$host_fqdn"
 108
 109
 110   if [ -z "${ulaprefix%%:/*}" ] ; then
 111     # Nonsense so this option isn't globbed below
 112     ulaprefix="fdno:such:addr::/48"
 113   fi
 114
 115
 116   if [ "$ignore" -gt 0 ] ; then
 117     mode="$UNBOUND_D_WAN_FQDN"
 118
 119   else
 120     mode="$UNBOUND_D_LAN_FQDN"
 121   fi
 122
 123
 124   case "$mode" in
 125   3)
 126     mode_ptr="$host_fqdn"
 127     names="$host_fqdn  $UNBOUND_TXT_HOSTNAME"
 128     ;;
 129
 130   4)
 131     mode_ptr="$if_fqdn"
 132     names="$if_fqdn  $host_fqdn  $UNBOUND_TXT_HOSTNAME"
 133     ;;
 134
 135   *)
 136     mode_ptr="$UNBOUND_TXT_HOSTNAME"
 137     names="$UNBOUND_TXT_HOSTNAME"
 138     ;;
 139   esac
 140
 141
 142   if [ "$mode" -gt 1 ] ; then
 143     {
 144       for address in $addresses ; do
 145         case $address in
 146         fe80:*|169.254.*)
 147           echo "  # note link address $address"
 148           ;;
 149
 150         [1-9a-f]*:*[0-9a-f])
 151           # GA and ULA IP6 for HOST IN AAA records (ip command is robust)
 152           for name in $names ; do
 153             echo "  local-data: \"$name. 120 IN AAAA $address\""
 154           done
 155           echo "  local-data-ptr: \"$address 120 $mode_ptr\""
 156           ;;
 157
 158         [1-9]*.*[0-9])
 159           # Old fashioned HOST IN A records
 160           for name in $names ; do
 161             echo "  local-data: \"$name. 120 IN A $address\""
 162           done
 163           echo "  local-data-ptr: \"$address 120 $mode_ptr\""
 164           ;;
 165         esac
 166       done
 167       echo
 168     } >> $UNBOUND_CONFFILE
 169
 170   elif [ "$mode" -gt 0 ] ; then
 171     {
 172       for address in $addresses ; do
 173         case $address in
 174         fe80:*|169.254.*)
 175           echo "  # note link address $address"
 176           ;;
 177
 178         "${ulaprefix%%:/*}"*)
 179           # Only this networks ULA and only hostname
 180           echo "  local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN AAAA $address\""
 181           echo "  local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
 182           ;;
 183
 184         [1-9]*.*[0-9])
 185           echo "  local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN A $address\""
 186           echo "  local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
 187           ;;
 188         esac
 189       done
 190       echo
 191     } >> $UNBOUND_CONFFILE
 192   fi
 193 }
 194
 195 ##############################################################################
 196
 197 create_access_control() {
 198   local cfg="$1"
 199   local subnets subnets4 subnets6
 200   local validip4 validip6
 201
 202   network_get_subnets  subnets4 "$cfg"
 203   network_get_subnets6 subnets6 "$cfg"
 204   subnets="$subnets4 $subnets6"
 205
 206
 207   if [ -n "$subnets" ] ; then
 208     for subnet in $subnets ; do
 209       validip4=$( valid_subnet4 $subnet )
 210       validip6=$( valid_subnet6 $subnet )
 211
 212
 213       if [ "$validip4" = "ok" -o "$validip6" = "ok" ] ; then
 214         # For each "network" UCI add "access-control:" white list for queries
 215         echo "  access-control: $subnet allow" >> $UNBOUND_CONFFILE
 216       fi
 217     done
 218   fi
 219 }
 220
 221 ##############################################################################
 222
 223 create_domain_insecure() {
 224   echo "  domain-insecure: \"$1\"" >> $UNBOUND_CONFFILE
 225 }
 226
 227 ##############################################################################
 228
 229 unbound_mkdir() {
 230   local resolvsym=0
 231   local dhcp_origin=$( uci get dhcp.@odhcpd[0].leasefile )
 232   local dhcp_dir=$( dirname "$dhcp_origin" )
 233
 234
 235   if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
 236     resolvsym=1
 237   else
 238     /etc/init.d/dnsmasq enabled || resolvsym=1
 239   fi
 240
 241
 242   if [ "$resolvsym" -gt 0 ] ; then
 243     rm -f /tmp/resolv.conf
 244
 245
 246     {
 247       # Set resolver file to local but not if /etc/init.d/dnsmasq will do it.
 248       echo "nameserver 127.0.0.1"
 249       echo "nameserver ::1"
 250       echo "search $UNBOUND_TXT_DOMAIN"
 251     } > /tmp/resolv.conf
 252   fi
 253
 254
 255   if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" -a ! -d "$dhcp_dir" ] ; then
 256     # make sure odhcpd has a directory to write (not done itself, yet)
 257     mkdir -p "$dhcp_dir"
 258   fi
 259
 260
 261   mkdir -p $UNBOUND_VARDIR
 262   rm -f $UNBOUND_VARDIR/dhcp_*
 263   touch $UNBOUND_CONFFILE
 264   touch $UNBOUND_SRV_CONF
 265   touch $UNBOUND_EXT_CONF
 266   cp -p /etc/unbound/* $UNBOUND_VARDIR/
 267
 268
 269   if [ ! -f $UNBOUND_HINTFILE ] ; then
 270     if [ -f /usr/share/dns/root.hints ] ; then
 271       # Debian-like package dns-root-data
 272       cp -p /usr/share/dns/root.hints $UNBOUND_HINTFILE
 273
 274     else
 275       logger -t unbound -s "iterator will use built-in root hints"
 276     fi
 277   fi
 278
 279
 280   if [ ! -f $UNBOUND_KEYFILE ] ; then
 281     if [ -f /usr/share/dns/root.key ] ; then
 282       # Debian-like package dns-root-data
 283       cp -p /usr/share/dns/root.key $UNBOUND_KEYFILE
 284
 285     elif [ -x "$UNBOUND_ANCHOR" ] ; then
 286       $UNBOUND_ANCHOR -a $UNBOUND_KEYFILE
 287
 288     else
 289       logger -t unbound -s "validator will use built-in trust anchor"
 290     fi
 291   fi
 292
 293
 294   # Ensure access and prepare to jail
 295   chown -R unbound:unbound $UNBOUND_VARDIR
 296   chmod 775 $UNBOUND_VARDIR
 297   chmod 664 $UNBOUND_VARDIR/*
 298 }
 299
 300 ##############################################################################
 301
 302 unbound_control() {
 303   if [ "$UNBOUND_B_CONTROL" -gt 0 ] ; then
 304     {
 305       # Enable remote control tool, but only at local host for security
 306       # You can hand write fancier encrypted access with /etc/..._ext.conf
 307       echo "remote-control:"
 308       echo "  control-enable: yes"
 309       echo "  control-use-cert: no"
 310       echo "  control-interface: 127.0.0.1"
 311       echo "  control-interface: ::1"
 312       echo
 313     } >> $UNBOUND_CONFFILE
 314   fi
 315
 316
 317   {
 318     # Amend your own extended clauses here like forward zones or disable
 319     # above (local, no encryption) and amend your own remote encrypted control
 320     echo
 321     echo "include: $UNBOUND_EXT_CONF" >> $UNBOUND_CONFFILE
 322     echo
 323   } >> $UNBOUND_CONFFILE
 324 }
 325
 326 ##############################################################################
 327
 328 unbound_conf() {
 329   local cfg="$1"
 330   local rt_mem rt_conn modulestring
 331
 332
 333   {
 334     # Make fresh conf file
 335     echo "# $UNBOUND_CONFFILE generated by UCI $( date )"
 336     echo
 337   } > $UNBOUND_CONFFILE
 338
 339
 340   {
 341     # No threading
 342     echo "server:"
 343     echo "  username: unbound"
 344     echo "  num-threads: 1"
 345     echo "  msg-cache-slabs: 1"
 346     echo "  rrset-cache-slabs: 1"
 347     echo "  infra-cache-slabs: 1"
 348     echo "  key-cache-slabs: 1"
 349     echo
 350   } >> $UNBOUND_CONFFILE
 351
 352
 353   {
 354     # Logging
 355     echo "  verbosity: 1"
 356     echo "  statistics-interval: 0"
 357     echo "  statistics-cumulative: no"
 358     echo "  extended-statistics: no"
 359     echo
 360   } >> $UNBOUND_CONFFILE
 361
 362
 363   {
 364     # Interfaces (access contol "option local_service")
 365     echo "  interface: 0.0.0.0"
 366     echo "  interface: ::0"
 367     echo "  outgoing-interface: 0.0.0.0"
 368     echo "  outgoing-interface: ::0"
 369     echo
 370   } >> $UNBOUND_CONFFILE
 371
 372
 373   case "$UNBOUND_D_PROTOCOL" in
 374     ip4_only)
 375       {
 376         echo "  do-ip4: yes"
 377         echo "  do-ip6: no"
 378       } >> $UNBOUND_CONFFILE
 379       ;;
 380
 381     ip6_only)
 382       {
 383         echo "  do-ip4: no"
 384         echo "  do-ip6: yes"
 385       } >> $UNBOUND_CONFFILE
 386       ;;
 387
 388     ip6_prefer)
 389       {
 390         echo "  do-ip4: yes"
 391         echo "  do-ip6: yes"
 392         echo "  prefer-ip6: yes"
 393       } >> $UNBOUND_CONFFILE
 394       ;;
 395
 396     *)
 397       {
 398         echo "  do-ip4: yes"
 399         echo "  do-ip6: yes"
 400       } >> $UNBOUND_CONFFILE
 401       ;;
 402   esac
 403
 404
 405   {
 406     # protocol level tuning
 407     echo "  edns-buffer-size: $UNBOUND_N_EDNS_SIZE"
 408     echo "  msg-buffer-size: 8192"
 409     echo "  port: $UNBOUND_N_RX_PORT"
 410     echo "  outgoing-port-permit: 10240-65535"
 411     echo
 412   } >> $UNBOUND_CONFFILE
 413
 414
 415   {
 416     # Other harding and options for an embedded router
 417     echo "  harden-short-bufsize: yes"
 418     echo "  harden-large-queries: yes"
 419     echo "  harden-glue: yes"
 420     echo "  harden-below-nxdomain: no"
 421     echo "  harden-referral-path: no"
 422     echo "  use-caps-for-id: no"
 423     echo
 424   } >> $UNBOUND_CONFFILE
 425
 426
 427   {
 428     # Default Files
 429     echo "  use-syslog: yes"
 430     echo "  chroot: \"$UNBOUND_VARDIR\""
 431     echo "  directory: \"$UNBOUND_VARDIR\""
 432     echo "  pidfile: \"$UNBOUND_PIDFILE\""
 433   } >> $UNBOUND_CONFFILE
 434
 435
 436   if [ -f "$UNBOUND_HINTFILE" ] ; then
 437     # Optional hints if found
 438     echo "  root-hints: \"$UNBOUND_HINTFILE\"" >> $UNBOUND_CONFFILE
 439   fi
 440
 441
 442   if [ "$UNBOUND_B_DNSSEC" -gt 0 -a -f "$UNBOUND_KEYFILE" ] ; then
 443     {
 444       echo "  auto-trust-anchor-file: \"$UNBOUND_KEYFILE\""
 445       echo
 446     } >> $UNBOUND_CONFFILE
 447
 448   else
 449     echo >> $UNBOUND_CONFFILE
 450   fi
 451
 452
 453   case "$UNBOUND_D_RESOURCE" in
 454     # Tiny - Unbound's recommended cheap hardware config
 455     tiny)   rt_mem=1  ; rt_conn=1 ;;
 456     # Small - Half RRCACHE and open ports
 457     small)  rt_mem=8  ; rt_conn=5 ;;
 458     # Medium - Nearly default but with some added balancintg
 459     medium) rt_mem=16 ; rt_conn=10 ;;
 460     # Large - Double medium
 461     large)  rt_mem=32 ; rt_conn=10 ;;
 462     # Whatever unbound does
 463     *) rt_mem=0 ; rt_conn=0 ;;
 464   esac
 465
 466
 467   if [ "$rt_mem" -gt 0 ] ; then
 468     {
 469       # Set memory sizing parameters
 470       echo "  outgoing-range: $(($rt_conn*64))"
 471       echo "  num-queries-per-thread: $(($rt_conn*32))"
 472       echo "  outgoing-num-tcp: $(($rt_conn))"
 473       echo "  incoming-num-tcp: $(($rt_conn))"
 474       echo "  rrset-cache-size: $(($rt_mem*256))k"
 475       echo "  msg-cache-size: $(($rt_mem*128))k"
 476       echo "  key-cache-size: $(($rt_mem*128))k"
 477       echo "  neg-cache-size: $(($rt_mem*64))k"
 478       echo "  infra-cache-numhosts: $(($rt_mem*256))"
 479       echo
 480     } >> $UNBOUND_CONFFILE
 481
 482   else
 483     logger -t unbound -s "default memory resource consumption"
 484   fi
 485
 486   # Assembly of module-config: options is tricky; order matters
 487   modulestring="iterator"
 488
 489
 490   if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
 491     if [ ! -f "$UNBOUND_TIMEFILE" -a "$UNBOUND_B_NTP_BOOT" -gt 0 ] ; then
 492       # DNSSEC chicken and egg with getting NTP time
 493       echo "  val-override-date: -1" >> $UNBOUND_CONFFILE
 494     fi
 495
 496
 497     {
 498       echo "  harden-dnssec-stripped: yes"
 499       echo "  val-clean-additional: yes"
 500       echo "  ignore-cd-flag: yes"
 501     } >> $UNBOUND_CONFFILE
 502
 503
 504     modulestring="validator $modulestring"
 505   fi
 506
 507
 508   if [ "$UNBOUND_B_DNS64" -gt 0 ] ; then
 509     echo "  dns64-prefix: $UNBOUND_IP_DNS64" >> $UNBOUND_CONFFILE
 510
 511     modulestring="dns64 $modulestring"
 512   fi
 513
 514
 515   {
 516     # Print final module string
 517     echo "  module-config: \"$modulestring\""
 518     echo
 519   }  >> $UNBOUND_CONFFILE
 520
 521
 522   if [ "$UNBOUND_B_QRY_MINST" -gt 0 -a "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
 523     {
 524       # Some query privacy but "strict" will break some name servers
 525       echo "  qname-minimisation: yes"
 526       echo "  qname-minimisation-strict: yes"
 527     } >> $UNBOUND_CONFFILE
 528
 529   elif [ "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
 530     # Minor improvement on query privacy
 531     echo "  qname-minimisation: yes" >> $UNBOUND_CONFFILE
 532
 533   else
 534     echo "  qname-minimisation: no" >> $UNBOUND_CONFFILE
 535   fi
 536
 537
 538   case "$UNBOUND_D_RECURSION" in
 539     passive)
 540       {
 541         echo "  prefetch: no"
 542         echo "  prefetch-key: no"
 543         echo "  target-fetch-policy: \"0 0 0 0 0\""
 544         echo
 545       } >> $UNBOUND_CONFFILE
 546       ;;
 547
 548     aggressive)
 549       {
 550         echo "  prefetch: yes"
 551         echo "  prefetch-key: yes"
 552         echo "  target-fetch-policy: \"3 2 1 0 0\""
 553         echo
 554       } >> $UNBOUND_CONFFILE
 555       ;;
 556
 557     *)
 558       logger -t unbound -s "default recursion configuration"
 559       ;;
 560   esac
 561
 562
 563   {
 564     # Reload records more than 10 hours old
 565     # DNSSEC 5 minute bogus cool down before retry
 566     # Adaptive infrastructure info kept for 15 minutes
 567     echo "  cache-min-ttl: $UNBOUND_TTL_MIN"
 568     echo "  cache-max-ttl: 36000"
 569     echo "  val-bogus-ttl: 300"
 570     echo "  infra-host-ttl: 900"
 571     echo
 572   } >> $UNBOUND_CONFFILE
 573
 574
 575   if [ "$UNBOUND_B_HIDE_BIND" -gt 0 ] ; then
 576     {
 577       # Block server id and version DNS TXT records
 578       echo "  hide-identity: yes"
 579       echo "  hide-version: yes"
 580       echo
 581     } >> $UNBOUND_CONFFILE
 582   fi
 583
 584
 585   if [ "$UNBOUND_B_PRIV_BLCK" -gt 0 ] ; then
 586     {
 587       # Remove _upstream_ or global reponses with private addresses.
 588       # Unbounds own "local zone" and "forward zone" may still use these.
 589       # RFC1918, RFC3927, RFC4291, RFC6598, RFC6890
 590       echo "  private-address: 10.0.0.0/8"
 591       echo "  private-address: 100.64.0.0/10"
 592       echo "  private-address: 169.254.0.0/16"
 593       echo "  private-address: 172.16.0.0/12"
 594       echo "  private-address: 192.168.0.0/16"
 595       echo "  private-address: fc00::/8"
 596       echo "  private-address: fd00::/8"
 597       echo "  private-address: fe80::/10"
 598     } >> $UNBOUND_CONFFILE
 599   fi
 600
 601
 602   if [ "$UNBOUND_B_LOCL_BLCK" -gt 0 ] ; then
 603     {
 604       # Remove DNS reponses from upstream with loopback IP
 605       # Black hole DNS method for ad blocking, so consider...
 606       echo "  private-address: 127.0.0.0/8"
 607       echo "  private-address: ::1/128"
 608       echo
 609     } >> $UNBOUND_CONFFILE
 610
 611   else
 612     echo >> $UNBOUND_CONFFILE
 613   fi
 614
 615
 616   # Except and accept domains as insecure (DNSSEC); work around broken domains
 617   config_list_foreach "$cfg" "domain_insecure" create_domain_insecure
 618   echo >> $UNBOUND_CONFFILE
 619 }
 620
 621 ##############################################################################
 622
 623 unbound_access() {
 624   # TODO: Unbound 1.6.0 added "tags" and "views", so we can add tags to
 625   # each access-control IP block, and then divert access.
 626   # -- "guest" WIFI will not be allowed to see local zone data
 627   # -- "child" LAN can black whole a list of domains to http~deadpixel
 628
 629
 630   if [ "$UNBOUND_B_LOCL_SERV" -gt 0 ] ; then
 631     # Only respond to queries from which this device has an interface.
 632     # Prevent DNS amplification attacks by not responding to the universe.
 633     config_load network
 634     config_foreach create_access_control interface
 635
 636
 637     {
 638       echo "  access-control: 127.0.0.0/8 allow"
 639       echo "  access-control: ::1/128 allow"
 640       echo "  access-control: fe80::/10 allow"
 641       echo
 642     } >> $UNBOUND_CONFFILE
 643
 644   else
 645     {
 646       echo "  access-control: 0.0.0.0/0 allow"
 647       echo "  access-control: ::0/0 allow"
 648       echo
 649     } >> $UNBOUND_CONFFILE
 650   fi
 651
 652
 653   {
 654     # Amend your own "server:" stuff here
 655     echo "  include: $UNBOUND_SRV_CONF"
 656     echo
 657   } >> $UNBOUND_CONFFILE
 658 }
 659
 660 ##############################################################################
 661
 662 unbound_adblock() {
 663   # TODO: Unbound 1.6.0 added "tags" and "views"; lets work with adblock team
 664   local adb_enabled adb_file
 665
 666   if [ ! -x /usr/bin/adblock.sh -o ! -x /etc/init.d/adblock ] ; then
 667     adb_enabled=0
 668   else
 669     /etc/init.d/adblock enabled && adb_enabled=1 || adb_enabled=0
 670   fi
 671
 672
 673   if [ "$adb_enabled" -gt 0 ] ; then
 674     {
 675       # Pull in your selected openwrt/pacakges/net/adblock generated lists
 676       for adb_file in $UNBOUND_VARDIR/adb_list.* ; do
 677         echo "  include: $adb_file"
 678       done
 679       echo
 680     } >> $UNBOUND_CONFFILE
 681   fi
 682 }
 683
 684 ##############################################################################
 685
 686 unbound_hostname() {
 687   if [ -n "$UNBOUND_TXT_DOMAIN" ] ; then
 688     {
 689       # TODO: Unbound 1.6.0 added "tags" and "views" and we could make
 690       # domains by interface to prevent DNS from "guest" to "home"
 691       echo "  local-zone: $UNBOUND_TXT_DOMAIN. $UNBOUND_D_DOMAIN_TYPE"
 692       echo "  domain-insecure: $UNBOUND_TXT_DOMAIN"
 693       echo "  private-domain: $UNBOUND_TXT_DOMAIN"
 694       echo
 695       echo "  local-zone: $UNBOUND_TXT_HOSTNAME. $UNBOUND_D_DOMAIN_TYPE"
 696       echo "  domain-insecure: $UNBOUND_TXT_HOSTNAME"
 697       echo "  private-domain: $UNBOUND_TXT_HOSTNAME"
 698       echo
 699     } >> $UNBOUND_CONFFILE
 700
 701
 702     case "$UNBOUND_D_DOMAIN_TYPE" in
 703     deny|inform_deny|refuse|static)
 704       {
 705         # avoid upstream involvement in RFC6762 like responses (link only)
 706         echo "  local-zone: local. $UNBOUND_D_DOMAIN_TYPE"
 707         echo "  domain-insecure: local"
 708         echo "  private-domain: local"
 709         echo
 710       } >> $UNBOUND_CONFFILE
 711       ;;
 712     esac
 713
 714
 715     if [ "$UNBOUND_D_LAN_FQDN" -gt 0 -o "$UNBOUND_D_WAN_FQDN" -gt 0 ] ; then
 716       config_load dhcp
 717       config_foreach create_interface_dns dhcp
 718     fi
 719
 720
 721     if [ -f "$UNBOUND_DHCP_CONF" ] ; then
 722       {
 723         # Seed DHCP records because dhcp scripts trigger externally
 724         # Incremental Unbound restarts may drop unbound-control add records
 725         echo "  include: $UNBOUND_DHCP_CONF"
 726         echo
 727       } >> $UNBOUND_CONFFILE
 728     fi
 729   fi
 730 }
 731
 732 ##############################################################################
 733
 734 unbound_uci() {
 735   local cfg="$1"
 736   local dnsmasqpath hostnm
 737
 738   hostnm="$(uci_get system.@system[0].hostname | awk '{print tolower($0)}')"
 739   UNBOUND_TXT_HOSTNAME=${hostnm:-thisrouter}
 740
 741   config_get_bool UNBOUND_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
 742   config_get_bool UNBOUND_B_DNS64      "$cfg" dns64 0
 743   config_get_bool UNBOUND_B_HIDE_BIND  "$cfg" hide_binddata 1
 744   config_get_bool UNBOUND_B_LOCL_SERV  "$cfg" localservice 1
 745   config_get_bool UNBOUND_B_MAN_CONF   "$cfg" manual_conf 0
 746   config_get_bool UNBOUND_B_QUERY_MIN  "$cfg" query_minimize 0
 747   config_get_bool UNBOUND_B_QRY_MINST  "$cfg" query_min_strict 0
 748   config_get_bool UNBOUND_B_PRIV_BLCK  "$cfg" rebind_protection 1
 749   config_get_bool UNBOUND_B_LOCL_BLCK  "$cfg" rebind_localhost 0
 750   config_get_bool UNBOUND_B_CONTROL    "$cfg" unbound_control 0
 751   config_get_bool UNBOUND_B_DNSSEC     "$cfg" validator 0
 752   config_get_bool UNBOUND_B_NTP_BOOT   "$cfg" validator_ntp 1
 753
 754   config_get UNBOUND_IP_DNS64    "$cfg" dns64_prefix "64:ff9b::/96"
 755
 756   config_get UNBOUND_N_EDNS_SIZE "$cfg" edns_size 1280
 757   config_get UNBOUND_N_RX_PORT   "$cfg" listen_port 53
 758   config_get UNBOUND_N_ROOT_AGE  "$cfg" root_age 7
 759
 760   config_get UNBOUND_D_DOMAIN_TYPE "$cfg" domain_type static
 761   config_get UNBOUND_D_DHCP_LINK   "$cfg" dhcp_link none
 762   config_get UNBOUND_D_LAN_FQDN    "$cfg" add_local_fqdn 0
 763   config_get UNBOUND_D_PROTOCOL    "$cfg" protocol mixed
 764   config_get UNBOUND_D_RECURSION   "$cfg" recursion passive
 765   config_get UNBOUND_D_RESOURCE    "$cfg" resource small
 766   config_get UNBOUND_D_WAN_FQDN    "$cfg" add_wan_fqdn 0
 767
 768   config_get UNBOUND_TTL_MIN     "$cfg" ttl_min 120
 769   config_get UNBOUND_TXT_DOMAIN  "$cfg" domain lan
 770
 771
 772   if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
 773     config_get_bool UNBOUND_B_DNSMASQ   "$cfg" dnsmasq_link_dns 0
 774
 775
 776     if [ "$UNBOUND_B_DNSMASQ" -gt 0 ] ; then
 777       UNBOUND_D_DHCP_LINK=dnsmasq
 778       logger -t unbound -s "Please use 'dhcp_link' selector instead"
 779     fi
 780   fi
 781
 782
 783   if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
 784     if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
 785       UNBOUND_D_DHCP_LINK=none
 786     else
 787       /etc/init.d/dnsmasq enabled || UNBOUND_D_DHCP_LINK=none
 788     fi
 789
 790
 791     if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
 792       logger -t unbound -s "cannot forward to dnsmasq"
 793     fi
 794   fi
 795
 796
 797   if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" ] ; then
 798     if [ ! -x /usr/sbin/odhcpd -o ! -x /etc/init.d/odhcpd ] ; then
 799       UNBOUND_D_DHCP_LINK=none
 800     else
 801       /etc/init.d/odhcpd enabled || UNBOUND_D_DHCP_LINK=none
 802     fi
 803
 804
 805     if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
 806       logger -t unbound -s "cannot receive records from odhcpd"
 807     fi
 808   fi
 809
 810
 811   if [ "$UNBOUND_N_EDNS_SIZE" -lt 512 \
 812     -o 4096 -lt "$UNBOUND_N_EDNS_SIZE" ] ; then
 813     # exceeds range, back to default
 814     UNBOUND_N_EDNS_SIZE=1280
 815   fi
 816
 817
 818   if [ "$UNBOUND_N_RX_PORT" -lt 1024 \
 819     -o 10240 -lt "$UNBOUND_N_RX_PORT" ] ; then
 820     # special port or in 5 digits, back to default
 821     UNBOUND_N_RX_PORT=53
 822   fi
 823
 824
 825   if [ "$UNBOUND_TTL_MIN" -gt 1800 ] ; then
 826     # that could have had awful side effects
 827     UNBOUND_TTL_MIN=300
 828   fi
 829 }
 830
 831 ##############################################################################
 832
 833 unbound_start() {
 834   config_load unbound
 835   config_foreach unbound_uci unbound
 836   unbound_mkdir
 837
 838
 839   if [ "$UNBOUND_B_MAN_CONF" -eq 0 ] ; then
 840     unbound_conf
 841     unbound_access
 842     unbound_adblock
 843
 844     if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
 845       dnsmasq_link
 846     else
 847       unbound_hostname
 848     fi
 849
 850     unbound_control
 851   fi
 852 }
 853
 854 ##############################################################################
 855
 856 unbound_stop() {
 857   local resolvsym=0
 858
 859   rootzone_update
 860
 861
 862   if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
 863     resolvsym=1
 864   else
 865     /etc/init.d/dnsmasq enabled || resolvsym=1
 866   fi
 867
 868
 869   if [ "$resolvsym" -gt 0 ] ; then
 870     # set resolver file to normal, but don't stomp on dnsmasq
 871     rm -f /tmp/resolv.conf
 872     ln -s /tmp/resolv.conf.auto /tmp/resolv.conf
 873   fi
 874
 875
 876   # Unbound has a log dump which takes time; don't overlap a "restart"
 877   sleep 1
 878 }
 879
 880 ##############################################################################
 881