projects / feed / packages.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
unbound: bugfix init race condition invalid FQDN
[feed/packages.git] / net / unbound / files / unbound.sh
1 #!/bin/sh
2 ##############################################################################
3 #
4 # This program is free software; you can redistribute it and/or modify
5 # it under the terms of the GNU General Public License version 2 as
6 # published by the Free Software Foundation.
7 #
8 # This program is distributed in the hope that it will be useful,
9 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # GNU General Public License for more details.
12 #
13 # Copyright (C) 2016 Eric Luehrsen
14 #
15 ##############################################################################
16 #
17 # This builds the basic UCI components currently supported for Unbound. It is
18 # intentionally NOT comprehensive and bundles a lot of options. The UCI is to
19 # be a simpler presentation of the total Unbound conf set.
20 #
21 ##############################################################################
22
23 UNBOUND_B_CONTROL=0
24 UNBOUND_B_SLAAC6_MAC=0
25 UNBOUND_B_DNSSEC=0
26 UNBOUND_B_DNS64=0
27 UNBOUND_B_GATE_NAME=0
28 UNBOUND_B_HIDE_BIND=1
29 UNBOUND_B_LOCL_BLCK=0
30 UNBOUND_B_LOCL_SERV=1
31 UNBOUND_B_MAN_CONF=0
32 UNBOUND_B_NTP_BOOT=1
33 UNBOUND_B_PRIV_BLCK=1
34 UNBOUND_B_QUERY_MIN=0
35 UNBOUND_B_QRY_MINST=0
36
37 UNBOUND_D_DOMAIN_TYPE=static
38 UNBOUND_D_DHCP_LINK=none
39 UNBOUND_D_LAN_FQDN=0
40 UNBOUND_D_PROTOCOL=mixed
41 UNBOUND_D_RESOURCE=small
42 UNBOUND_D_RECURSION=passive
43 UNBOUND_D_WAN_FQDN=0
44
45 UNBOUND_IP_DNS64="64:ff9b::/96"
46
47 UNBOUND_N_EDNS_SIZE=1280
48 UNBOUND_N_FWD_PORTS=""
49 UNBOUND_N_RX_PORT=53
50 UNBOUND_N_ROOT_AGE=9
51
52 UNBOUND_TTL_MIN=120
53
54 UNBOUND_TXT_DOMAIN=lan
55 UNBOUND_TXT_FWD_ZONE=""
56 UNBOUND_TXT_HOSTNAME=thisrouter
57
58 ##############################################################################
59
60 UNBOUND_LIBDIR=/usr/lib/unbound
61 UNBOUND_VARDIR=/var/lib/unbound
62
63 UNBOUND_PIDFILE=/var/run/unbound.pid
64
65 UNBOUND_SRV_CONF=$UNBOUND_VARDIR/unbound_srv.conf
66 UNBOUND_EXT_CONF=$UNBOUND_VARDIR/unbound_ext.conf
67 UNBOUND_DHCP_CONF=$UNBOUND_VARDIR/unbound_dhcp.conf
68 UNBOUND_CONFFILE=$UNBOUND_VARDIR/unbound.conf
69
70 UNBOUND_KEYFILE=$UNBOUND_VARDIR/root.key
71 UNBOUND_HINTFILE=$UNBOUND_VARDIR/root.hints
72 UNBOUND_TIMEFILE=$UNBOUND_VARDIR/unbound.time
73
74 ##############################################################################
75
76 UNBOUND_ANCHOR=/usr/sbin/unbound-anchor
77 UNBOUND_CONTROL=/usr/sbin/unbound-control
78 UNBOUND_CONTROL_CFG="$UNBOUND_CONTROL -c $UNBOUND_CONFFILE"
79
80 ##############################################################################
81
82 . /lib/functions.sh
83 . /lib/functions/network.sh
84
85 . $UNBOUND_LIBDIR/dnsmasq.sh
86 . $UNBOUND_LIBDIR/iptools.sh
87 . $UNBOUND_LIBDIR/rootzone.sh
88
89 ##############################################################################
90
91 create_interface_dns() {
92 local cfg="$1"
93 local ipcommand logint ignore ifname ifdashname
94 local name names address addresses
95 local ulaprefix if_fqdn host_fqdn mode mode_ptr
96
97 # Create local-data: references for this hosts interfaces (router).
98 config_get logint "$cfg" interface
99 config_get_bool ignore "$cfg" ignore 0
100 network_get_device ifname "$cfg"
101
102 ifdashname="${ifname//./-}"
103 ipcommand="ip -o address show $ifname"
104 addresses="$($ipcommand | awk '/inet/{sub(/\/.*/,"",$4); print $4}')"
105 ulaprefix="$(uci_get network @globals[0] ula_prefix)"
106 host_fqdn="$UNBOUND_TXT_HOSTNAME.$UNBOUND_TXT_DOMAIN"
107 if_fqdn="$ifdashname.$host_fqdn"
108
109
110 if [ -z "${ulaprefix%%:/*}" ] ; then
111 # Nonsense so this option isn't globbed below
112 ulaprefix="fdno:such:addr::/48"
113 fi
114
115
116 if [ "$ignore" -gt 0 ] ; then
117 mode="$UNBOUND_D_WAN_FQDN"
118 else
119 mode="$UNBOUND_D_LAN_FQDN"
120 fi
121
122
123 case "$mode" in
124 3)
125 mode_ptr="$host_fqdn"
126 names="$host_fqdn $UNBOUND_TXT_HOSTNAME"
127 ;;
128
129 4)
130 if [ -z "$ifdashname" ] ; then
131 # race conditions at init can rarely cause a blank device return
132 # the record format is invalid and Unbound won't load the conf file
133 mode_ptr="$host_fqdn"
134 names="$host_fqdn $UNBOUND_TXT_HOSTNAME"
135 else
136 mode_ptr="$if_fqdn"
137 names="$if_fqdn $host_fqdn $UNBOUND_TXT_HOSTNAME"
138 fi
139 ;;
140
141 *)
142 mode_ptr="$UNBOUND_TXT_HOSTNAME"
143 names="$UNBOUND_TXT_HOSTNAME"
144 ;;
145 esac
146
147
148 if [ "$mode" -gt 1 ] ; then
149 {
150 for address in $addresses ; do
151 case $address in
152 fe80:*|169.254.*)
153 echo " # note link address $address"
154 ;;
155
156 [1-9a-f]*:*[0-9a-f])
157 # GA and ULA IP6 for HOST IN AAA records (ip command is robust)
158 for name in $names ; do
159 echo " local-data: \"$name. 120 IN AAAA $address\""
160 done
161 echo " local-data-ptr: \"$address 120 $mode_ptr\""
162 ;;
163
164 [1-9]*.*[0-9])
165 # Old fashioned HOST IN A records
166 for name in $names ; do
167 echo " local-data: \"$name. 120 IN A $address\""
168 done
169 echo " local-data-ptr: \"$address 120 $mode_ptr\""
170 ;;
171 esac
172 done
173 echo
174 } >> $UNBOUND_CONFFILE
175
176 elif [ "$mode" -gt 0 ] ; then
177 {
178 for address in $addresses ; do
179 case $address in
180 fe80:*|169.254.*)
181 echo " # note link address $address"
182 ;;
183
184 "${ulaprefix%%:/*}"*)
185 # Only this networks ULA and only hostname
186 echo " local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN AAAA $address\""
187 echo " local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
188 ;;
189
190 [1-9]*.*[0-9])
191 echo " local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN A $address\""
192 echo " local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
193 ;;
194 esac
195 done
196 echo
197 } >> $UNBOUND_CONFFILE
198 fi
199 }
200
201 ##############################################################################
202
203 create_access_control() {
204 local cfg="$1"
205 local subnets subnets4 subnets6
206 local validip4 validip6
207
208 network_get_subnets subnets4 "$cfg"
209 network_get_subnets6 subnets6 "$cfg"
210 subnets="$subnets4 $subnets6"
211
212
213 if [ -n "$subnets" ] ; then
214 for subnet in $subnets ; do
215 validip4=$( valid_subnet4 $subnet )
216 validip6=$( valid_subnet6 $subnet )
217
218
219 if [ "$validip4" = "ok" -o "$validip6" = "ok" ] ; then
220 # For each "network" UCI add "access-control:" white list for queries
221 echo " access-control: $subnet allow" >> $UNBOUND_CONFFILE
222 fi
223 done
224 fi
225 }
226
227 ##############################################################################
228
229 create_domain_insecure() {
230 echo " domain-insecure: \"$1\"" >> $UNBOUND_CONFFILE
231 }
232
233 ##############################################################################
234
235 unbound_mkdir() {
236 local resolvsym=0
237 local dhcp_origin=$( uci get dhcp.@odhcpd[0].leasefile )
238 local dhcp_dir=$( dirname "$dhcp_origin" )
239
240
241 if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
242 resolvsym=1
243 else
244 /etc/init.d/dnsmasq enabled || resolvsym=1
245 fi
246
247
248 if [ "$resolvsym" -gt 0 ] ; then
249 rm -f /tmp/resolv.conf
250
251
252 {
253 # Set resolver file to local but not if /etc/init.d/dnsmasq will do it.
254 echo "nameserver 127.0.0.1"
255 echo "nameserver ::1"
256 echo "search $UNBOUND_TXT_DOMAIN"
257 } > /tmp/resolv.conf
258 fi
259
260
261 if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" -a ! -d "$dhcp_dir" ] ; then
262 # make sure odhcpd has a directory to write (not done itself, yet)
263 mkdir -p "$dhcp_dir"
264 fi
265
266
267 if [ -f $UNBOUND_KEYFILE ] ; then
268 # Lets not lose RFC 5011 tracking if we don't have to
269 cp -p $UNBOUND_KEYFILE $UNBOUND_KEYFILE.keep
270 fi
271
272
273 # Blind copy /etc/ to /var/lib/
274 mkdir -p $UNBOUND_VARDIR
275 rm -f $UNBOUND_VARDIR/dhcp_*
276 touch $UNBOUND_CONFFILE
277 touch $UNBOUND_SRV_CONF
278 touch $UNBOUND_EXT_CONF
279 cp -p /etc/unbound/* $UNBOUND_VARDIR/
280
281
282 if [ ! -f $UNBOUND_HINTFILE ] ; then
283 if [ -f /usr/share/dns/root.hints ] ; then
284 # Debian-like package dns-root-data
285 cp -p /usr/share/dns/root.hints $UNBOUND_HINTFILE
286
287 else
288 logger -t unbound -s "iterator will use built-in root hints"
289 fi
290 fi
291
292
293 if [ ! -f $UNBOUND_KEYFILE ] ; then
294 if [ -f /usr/share/dns/root.key ] ; then
295 # Debian-like package dns-root-data
296 cp -p /usr/share/dns/root.key $UNBOUND_KEYFILE
297
298 elif [ -x $UNBOUND_ANCHOR ] ; then
299 $UNBOUND_ANCHOR -a $UNBOUND_KEYFILE
300
301 else
302 logger -t unbound -s "validator will use built-in trust anchor"
303 fi
304 fi
305
306
307 if [ -f $UNBOUND_KEYFILE.keep ] ; then
308 # root.key.keep is reused if newest
309 cp -u $UNBOUND_KEYFILE.keep $UNBOUND_KEYFILE
310 rm -f $UNBOUND_KEYFILE.keep
311 fi
312
313
314 # Ensure access and prepare to jail
315 chown -R unbound:unbound $UNBOUND_VARDIR
316 chmod 775 $UNBOUND_VARDIR
317 chmod 664 $UNBOUND_VARDIR/*
318 }
319
320 ##############################################################################
321
322 unbound_control() {
323 if [ "$UNBOUND_B_CONTROL" -gt 0 ] ; then
324 {
325 # Enable remote control tool, but only at local host for security
326 # You can hand write fancier encrypted access with /etc/..._ext.conf
327 echo "remote-control:"
328 echo " control-enable: yes"
329 echo " control-use-cert: no"
330 echo " control-interface: 127.0.0.1"
331 echo " control-interface: ::1"
332 echo
333 } >> $UNBOUND_CONFFILE
334 fi
335
336
337 {
338 # Amend your own extended clauses here like forward zones or disable
339 # above (local, no encryption) and amend your own remote encrypted control
340 echo
341 echo "include: $UNBOUND_EXT_CONF" >> $UNBOUND_CONFFILE
342 echo
343 } >> $UNBOUND_CONFFILE
344 }
345
346 ##############################################################################
347
348 unbound_conf() {
349 local cfg="$1"
350 local rt_mem rt_conn modulestring
351
352
353 {
354 # Make fresh conf file
355 echo "# $UNBOUND_CONFFILE generated by UCI $( date )"
356 echo
357 } > $UNBOUND_CONFFILE
358
359
360 {
361 # No threading
362 echo "server:"
363 echo " username: unbound"
364 echo " num-threads: 1"
365 echo " msg-cache-slabs: 1"
366 echo " rrset-cache-slabs: 1"
367 echo " infra-cache-slabs: 1"
368 echo " key-cache-slabs: 1"
369 echo
370 } >> $UNBOUND_CONFFILE
371
372
373 {
374 # Logging
375 echo " verbosity: 1"
376 echo " statistics-interval: 0"
377 echo " statistics-cumulative: no"
378 echo " extended-statistics: no"
379 echo
380 } >> $UNBOUND_CONFFILE
381
382
383 {
384 # Interfaces (access contol "option local_service")
385 echo " interface: 0.0.0.0"
386 echo " interface: ::0"
387 echo " outgoing-interface: 0.0.0.0"
388 echo " outgoing-interface: ::0"
389 echo
390 } >> $UNBOUND_CONFFILE
391
392
393 case "$UNBOUND_D_PROTOCOL" in
394 ip4_only)
395 {
396 echo " do-ip4: yes"
397 echo " do-ip6: no"
398 } >> $UNBOUND_CONFFILE
399 ;;
400
401 ip6_only)
402 {
403 echo " do-ip4: no"
404 echo " do-ip6: yes"
405 } >> $UNBOUND_CONFFILE
406 ;;
407
408 ip6_prefer)
409 {
410 echo " do-ip4: yes"
411 echo " do-ip6: yes"
412 echo " prefer-ip6: yes"
413 } >> $UNBOUND_CONFFILE
414 ;;
415
416 *)
417 {
418 echo " do-ip4: yes"
419 echo " do-ip6: yes"
420 } >> $UNBOUND_CONFFILE
421 ;;
422 esac
423
424
425 {
426 # protocol level tuning
427 echo " edns-buffer-size: $UNBOUND_N_EDNS_SIZE"
428 echo " msg-buffer-size: 8192"
429 echo " port: $UNBOUND_N_RX_PORT"
430 echo " outgoing-port-permit: 10240-65535"
431 echo
432 } >> $UNBOUND_CONFFILE
433
434
435 {
436 # Other harding and options for an embedded router
437 echo " harden-short-bufsize: yes"
438 echo " harden-large-queries: yes"
439 echo " harden-glue: yes"
440 echo " harden-below-nxdomain: no"
441 echo " harden-referral-path: no"
442 echo " use-caps-for-id: no"
443 echo
444 } >> $UNBOUND_CONFFILE
445
446
447 {
448 # Default Files
449 echo " use-syslog: yes"
450 echo " chroot: \"$UNBOUND_VARDIR\""
451 echo " directory: \"$UNBOUND_VARDIR\""
452 echo " pidfile: \"$UNBOUND_PIDFILE\""
453 } >> $UNBOUND_CONFFILE
454
455
456 if [ -f "$UNBOUND_HINTFILE" ] ; then
457 # Optional hints if found
458 echo " root-hints: \"$UNBOUND_HINTFILE\"" >> $UNBOUND_CONFFILE
459 fi
460
461
462 if [ "$UNBOUND_B_DNSSEC" -gt 0 -a -f "$UNBOUND_KEYFILE" ] ; then
463 {
464 echo " auto-trust-anchor-file: \"$UNBOUND_KEYFILE\""
465 echo
466 } >> $UNBOUND_CONFFILE
467
468 else
469 echo >> $UNBOUND_CONFFILE
470 fi
471
472
473 case "$UNBOUND_D_RESOURCE" in
474 # Tiny - Unbound's recommended cheap hardware config
475 tiny) rt_mem=1 ; rt_conn=1 ;;
476 # Small - Half RRCACHE and open ports
477 small) rt_mem=8 ; rt_conn=5 ;;
478 # Medium - Nearly default but with some added balancintg
479 medium) rt_mem=16 ; rt_conn=10 ;;
480 # Large - Double medium
481 large) rt_mem=32 ; rt_conn=10 ;;
482 # Whatever unbound does
483 *) rt_mem=0 ; rt_conn=0 ;;
484 esac
485
486
487 if [ "$rt_mem" -gt 0 ] ; then
488 {
489 # Set memory sizing parameters
490 echo " outgoing-range: $(($rt_conn*64))"
491 echo " num-queries-per-thread: $(($rt_conn*32))"
492 echo " outgoing-num-tcp: $(($rt_conn))"
493 echo " incoming-num-tcp: $(($rt_conn))"
494 echo " rrset-cache-size: $(($rt_mem*256))k"
495 echo " msg-cache-size: $(($rt_mem*128))k"
496 echo " key-cache-size: $(($rt_mem*128))k"
497 echo " neg-cache-size: $(($rt_mem*64))k"
498 echo " infra-cache-numhosts: $(($rt_mem*256))"
499 echo
500 } >> $UNBOUND_CONFFILE
501
502 else
503 logger -t unbound -s "default memory resource consumption"
504 fi
505
506 # Assembly of module-config: options is tricky; order matters
507 modulestring="iterator"
508
509
510 if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
511 if [ ! -f "$UNBOUND_TIMEFILE" -a "$UNBOUND_B_NTP_BOOT" -gt 0 ] ; then
512 # DNSSEC chicken and egg with getting NTP time
513 echo " val-override-date: -1" >> $UNBOUND_CONFFILE
514 fi
515
516
517 {
518 echo " harden-dnssec-stripped: yes"
519 echo " val-clean-additional: yes"
520 echo " ignore-cd-flag: yes"
521 } >> $UNBOUND_CONFFILE
522
523
524 modulestring="validator $modulestring"
525 fi
526
527
528 if [ "$UNBOUND_B_DNS64" -gt 0 ] ; then
529 echo " dns64-prefix: $UNBOUND_IP_DNS64" >> $UNBOUND_CONFFILE
530
531 modulestring="dns64 $modulestring"
532 fi
533
534
535 {
536 # Print final module string
537 echo " module-config: \"$modulestring\""
538 echo
539 } >> $UNBOUND_CONFFILE
540
541
542 if [ "$UNBOUND_B_QRY_MINST" -gt 0 -a "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
543 {
544 # Some query privacy but "strict" will break some name servers
545 echo " qname-minimisation: yes"
546 echo " qname-minimisation-strict: yes"
547 } >> $UNBOUND_CONFFILE
548
549 elif [ "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
550 # Minor improvement on query privacy
551 echo " qname-minimisation: yes" >> $UNBOUND_CONFFILE
552
553 else
554 echo " qname-minimisation: no" >> $UNBOUND_CONFFILE
555 fi
556
557
558 case "$UNBOUND_D_RECURSION" in
559 passive)
560 {
561 echo " prefetch: no"
562 echo " prefetch-key: no"
563 echo " target-fetch-policy: \"0 0 0 0 0\""
564 echo
565 } >> $UNBOUND_CONFFILE
566 ;;
567
568 aggressive)
569 {
570 echo " prefetch: yes"
571 echo " prefetch-key: yes"
572 echo " target-fetch-policy: \"3 2 1 0 0\""
573 echo
574 } >> $UNBOUND_CONFFILE
575 ;;
576
577 *)
578 logger -t unbound -s "default recursion configuration"
579 ;;
580 esac
581
582
583 {
584 # Reload records more than 10 hours old
585 # DNSSEC 5 minute bogus cool down before retry
586 # Adaptive infrastructure info kept for 15 minutes
587 echo " cache-min-ttl: $UNBOUND_TTL_MIN"
588 echo " cache-max-ttl: 36000"
589 echo " val-bogus-ttl: 300"
590 echo " infra-host-ttl: 900"
591 echo
592 } >> $UNBOUND_CONFFILE
593
594
595 if [ "$UNBOUND_B_HIDE_BIND" -gt 0 ] ; then
596 {
597 # Block server id and version DNS TXT records
598 echo " hide-identity: yes"
599 echo " hide-version: yes"
600 echo
601 } >> $UNBOUND_CONFFILE
602 fi
603
604
605 if [ "$UNBOUND_B_PRIV_BLCK" -gt 0 ] ; then
606 {
607 # Remove _upstream_ or global reponses with private addresses.
608 # Unbounds own "local zone" and "forward zone" may still use these.
609 # RFC1918, RFC3927, RFC4291, RFC6598, RFC6890
610 echo " private-address: 10.0.0.0/8"
611 echo " private-address: 100.64.0.0/10"
612 echo " private-address: 169.254.0.0/16"
613 echo " private-address: 172.16.0.0/12"
614 echo " private-address: 192.168.0.0/16"
615 echo " private-address: fc00::/8"
616 echo " private-address: fd00::/8"
617 echo " private-address: fe80::/10"
618 } >> $UNBOUND_CONFFILE
619 fi
620
621
622 if [ "$UNBOUND_B_LOCL_BLCK" -gt 0 ] ; then
623 {
624 # Remove DNS reponses from upstream with loopback IP
625 # Black hole DNS method for ad blocking, so consider...
626 echo " private-address: 127.0.0.0/8"
627 echo " private-address: ::1/128"
628 echo
629 } >> $UNBOUND_CONFFILE
630
631 else
632 echo >> $UNBOUND_CONFFILE
633 fi
634
635
636 # Except and accept domains as insecure (DNSSEC); work around broken domains
637 config_list_foreach "$cfg" "domain_insecure" create_domain_insecure
638 echo >> $UNBOUND_CONFFILE
639 }
640
641 ##############################################################################
642
643 unbound_access() {
644 # TODO: Unbound 1.6.0 added "tags" and "views", so we can add tags to
645 # each access-control IP block, and then divert access.
646 # -- "guest" WIFI will not be allowed to see local zone data
647 # -- "child" LAN can black whole a list of domains to http~deadpixel
648
649
650 if [ "$UNBOUND_B_LOCL_SERV" -gt 0 ] ; then
651 # Only respond to queries from which this device has an interface.
652 # Prevent DNS amplification attacks by not responding to the universe.
653 config_load network
654 config_foreach create_access_control interface
655
656
657 {
658 echo " access-control: 127.0.0.0/8 allow"
659 echo " access-control: ::1/128 allow"
660 echo " access-control: fe80::/10 allow"
661 echo
662 } >> $UNBOUND_CONFFILE
663
664 else
665 {
666 echo " access-control: 0.0.0.0/0 allow"
667 echo " access-control: ::0/0 allow"
668 echo
669 } >> $UNBOUND_CONFFILE
670 fi
671
672
673 {
674 # Amend your own "server:" stuff here
675 echo " include: $UNBOUND_SRV_CONF"
676 echo
677 } >> $UNBOUND_CONFFILE
678 }
679
680 ##############################################################################
681
682 unbound_adblock() {
683 # TODO: Unbound 1.6.0 added "tags" and "views"; lets work with adblock team
684 local adb_enabled adb_file
685
686 if [ ! -x /usr/bin/adblock.sh -o ! -x /etc/init.d/adblock ] ; then
687 adb_enabled=0
688 else
689 /etc/init.d/adblock enabled && adb_enabled=1 || adb_enabled=0
690 fi
691
692
693 if [ "$adb_enabled" -gt 0 ] ; then
694 {
695 # Pull in your selected openwrt/pacakges/net/adblock generated lists
696 for adb_file in $UNBOUND_VARDIR/adb_list.* ; do
697 echo " include: $adb_file"
698 done
699 echo
700 } >> $UNBOUND_CONFFILE
701 fi
702 }
703
704 ##############################################################################
705
706 unbound_hostname() {
707 if [ -n "$UNBOUND_TXT_DOMAIN" ] ; then
708 {
709 # TODO: Unbound 1.6.0 added "tags" and "views" and we could make
710 # domains by interface to prevent DNS from "guest" to "home"
711 echo " local-zone: $UNBOUND_TXT_DOMAIN. $UNBOUND_D_DOMAIN_TYPE"
712 echo " domain-insecure: $UNBOUND_TXT_DOMAIN"
713 echo " private-domain: $UNBOUND_TXT_DOMAIN"
714 echo
715 echo " local-zone: $UNBOUND_TXT_HOSTNAME. $UNBOUND_D_DOMAIN_TYPE"
716 echo " domain-insecure: $UNBOUND_TXT_HOSTNAME"
717 echo " private-domain: $UNBOUND_TXT_HOSTNAME"
718 echo
719 } >> $UNBOUND_CONFFILE
720
721
722 case "$UNBOUND_D_DOMAIN_TYPE" in
723 deny|inform_deny|refuse|static)
724 {
725 # avoid upstream involvement in RFC6762 like responses (link only)
726 echo " local-zone: local. $UNBOUND_D_DOMAIN_TYPE"
727 echo " domain-insecure: local"
728 echo " private-domain: local"
729 echo
730 } >> $UNBOUND_CONFFILE
731 ;;
732 esac
733
734
735 if [ "$UNBOUND_D_LAN_FQDN" -gt 0 -o "$UNBOUND_D_WAN_FQDN" -gt 0 ] ; then
736 config_load dhcp
737 config_foreach create_interface_dns dhcp
738 fi
739
740
741 if [ -f "$UNBOUND_DHCP_CONF" ] ; then
742 {
743 # Seed DHCP records because dhcp scripts trigger externally
744 # Incremental Unbound restarts may drop unbound-control add records
745 echo " include: $UNBOUND_DHCP_CONF"
746 echo
747 } >> $UNBOUND_CONFFILE
748 fi
749 fi
750 }
751
752 ##############################################################################
753
754 unbound_uci() {
755 local cfg="$1"
756 local dnsmasqpath hostnm
757
758 hostnm="$(uci_get system.@system[0].hostname | awk '{print tolower($0)}')"
759 UNBOUND_TXT_HOSTNAME=${hostnm:-thisrouter}
760
761 config_get_bool UNBOUND_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
762 config_get_bool UNBOUND_B_DNS64 "$cfg" dns64 0
763 config_get_bool UNBOUND_B_HIDE_BIND "$cfg" hide_binddata 1
764 config_get_bool UNBOUND_B_LOCL_SERV "$cfg" localservice 1
765 config_get_bool UNBOUND_B_MAN_CONF "$cfg" manual_conf 0
766 config_get_bool UNBOUND_B_QUERY_MIN "$cfg" query_minimize 0
767 config_get_bool UNBOUND_B_QRY_MINST "$cfg" query_min_strict 0
768 config_get_bool UNBOUND_B_PRIV_BLCK "$cfg" rebind_protection 1
769 config_get_bool UNBOUND_B_LOCL_BLCK "$cfg" rebind_localhost 0
770 config_get_bool UNBOUND_B_CONTROL "$cfg" unbound_control 0
771 config_get_bool UNBOUND_B_DNSSEC "$cfg" validator 0
772 config_get_bool UNBOUND_B_NTP_BOOT "$cfg" validator_ntp 1
773
774 config_get UNBOUND_IP_DNS64 "$cfg" dns64_prefix "64:ff9b::/96"
775
776 config_get UNBOUND_N_EDNS_SIZE "$cfg" edns_size 1280
777 config_get UNBOUND_N_RX_PORT "$cfg" listen_port 53
778 config_get UNBOUND_N_ROOT_AGE "$cfg" root_age 9
779
780 config_get UNBOUND_D_DOMAIN_TYPE "$cfg" domain_type static
781 config_get UNBOUND_D_DHCP_LINK "$cfg" dhcp_link none
782 config_get UNBOUND_D_LAN_FQDN "$cfg" add_local_fqdn 0
783 config_get UNBOUND_D_PROTOCOL "$cfg" protocol mixed
784 config_get UNBOUND_D_RECURSION "$cfg" recursion passive
785 config_get UNBOUND_D_RESOURCE "$cfg" resource small
786 config_get UNBOUND_D_WAN_FQDN "$cfg" add_wan_fqdn 0
787
788 config_get UNBOUND_TTL_MIN "$cfg" ttl_min 120
789 config_get UNBOUND_TXT_DOMAIN "$cfg" domain lan
790
791
792 if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
793 config_get_bool UNBOUND_B_DNSMASQ "$cfg" dnsmasq_link_dns 0
794
795
796 if [ "$UNBOUND_B_DNSMASQ" -gt 0 ] ; then
797 UNBOUND_D_DHCP_LINK=dnsmasq
798 logger -t unbound -s "Please use 'dhcp_link' selector instead"
799 fi
800 fi
801
802
803 if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
804 if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
805 UNBOUND_D_DHCP_LINK=none
806 else
807 /etc/init.d/dnsmasq enabled || UNBOUND_D_DHCP_LINK=none
808 fi
809
810
811 if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
812 logger -t unbound -s "cannot forward to dnsmasq"
813 fi
814 fi
815
816
817 if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" ] ; then
818 if [ ! -x /usr/sbin/odhcpd -o ! -x /etc/init.d/odhcpd ] ; then
819 UNBOUND_D_DHCP_LINK=none
820 else
821 /etc/init.d/odhcpd enabled || UNBOUND_D_DHCP_LINK=none
822 fi
823
824
825 if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
826 logger -t unbound -s "cannot receive records from odhcpd"
827 fi
828 fi
829
830
831 if [ "$UNBOUND_N_EDNS_SIZE" -lt 512 \
832 -o 4096 -lt "$UNBOUND_N_EDNS_SIZE" ] ; then
833 # exceeds range, back to default
834 UNBOUND_N_EDNS_SIZE=1280
835 fi
836
837
838 if [ "$UNBOUND_N_RX_PORT" -lt 1024 \
839 -o 10240 -lt "$UNBOUND_N_RX_PORT" ] ; then
840 # special port or in 5 digits, back to default
841 UNBOUND_N_RX_PORT=53
842 fi
843
844
845 if [ "$UNBOUND_TTL_MIN" -gt 1800 ] ; then
846 # that could have had awful side effects
847 UNBOUND_TTL_MIN=300
848 fi
849 }
850
851 ##############################################################################
852
853 unbound_start() {
854 config_load unbound
855 config_foreach unbound_uci unbound
856 unbound_mkdir
857
858
859 if [ "$UNBOUND_B_MAN_CONF" -eq 0 ] ; then
860 unbound_conf
861 unbound_access
862 unbound_adblock
863
864 if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
865 dnsmasq_link
866 else
867 unbound_hostname
868 fi
869
870 unbound_control
871 fi
872 }
873
874 ##############################################################################
875
876 unbound_stop() {
877 local resolvsym=0
878
879 rootzone_update
880
881
882 if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
883 resolvsym=1
884 else
885 /etc/init.d/dnsmasq enabled || resolvsym=1
886 fi
887
888
889 if [ "$resolvsym" -gt 0 ] ; then
890 # set resolver file to normal, but don't stomp on dnsmasq
891 rm -f /tmp/resolv.conf
892 ln -s /tmp/resolv.conf.auto /tmp/resolv.conf
893 fi
894
895
896 # Unbound has a log dump which takes time; don't overlap a "restart"
897 sleep 1
898 }
899
900 ##############################################################################
901
Mirror of packages feed