net/unbound/files/unbound.sh

   1 #!/bin/sh
   2 ##############################################################################
   3 #
   4 # This program is free software; you can redistribute it and/or modify
   5 # it under the terms of the GNU General Public License version 2 as
   6 # published by the Free Software Foundation.
   7 #
   8 # This program is distributed in the hope that it will be useful,
   9 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  10 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11 # GNU General Public License for more details.
  12 #
  13 # Copyright (C) 2016 Eric Luehrsen
  14 #
  15 ##############################################################################
  16 #
  17 # Unbound is a full featured recursive server with many options. The UCI
  18 # provided tries to simplify and bundle options. This should make Unbound
  19 # easier to deploy. Even light duty routers may resolve recursively instead of
  20 # depending on a stub with the ISP. The UCI also attempts to replicate dnsmasq
  21 # features as used in base LEDE/OpenWrt. If there is a desire for more
  22 # detailed tuning, then manual conf file overrides are also made available.
  23 #
  24 ##############################################################################
  25
  26 UNBOUND_B_CONTROL=0
  27 UNBOUND_B_SLAAC6_MAC=0
  28 UNBOUND_B_DNSSEC=0
  29 UNBOUND_B_DNS64=0
  30 UNBOUND_B_GATE_NAME=0
  31 UNBOUND_B_HIDE_BIND=1
  32 UNBOUND_B_LOCL_BLCK=0
  33 UNBOUND_B_LOCL_SERV=1
  34 UNBOUND_B_MAN_CONF=0
  35 UNBOUND_B_NTP_BOOT=1
  36 UNBOUND_B_PRIV_BLCK=1
  37 UNBOUND_B_QUERY_MIN=0
  38 UNBOUND_B_QRY_MINST=0
  39
  40 UNBOUND_D_DOMAIN_TYPE=static
  41 UNBOUND_D_DHCP_LINK=none
  42 UNBOUND_D_EXTRA_DNS=0
  43 UNBOUND_D_LAN_FQDN=0
  44 UNBOUND_D_PROTOCOL=mixed
  45 UNBOUND_D_RESOURCE=small
  46 UNBOUND_D_RECURSION=passive
  47 UNBOUND_D_WAN_FQDN=0
  48
  49 UNBOUND_IP_DNS64="64:ff9b::/96"
  50
  51 UNBOUND_N_EDNS_SIZE=1280
  52 UNBOUND_N_FWD_PORTS=""
  53 UNBOUND_N_RX_PORT=53
  54 UNBOUND_N_ROOT_AGE=9
  55
  56 UNBOUND_TTL_MIN=120
  57
  58 UNBOUND_TXT_DOMAIN=lan
  59 UNBOUND_TXT_FWD_ZONE=""
  60 UNBOUND_TXT_HOSTNAME=thisrouter
  61
  62 ##############################################################################
  63
  64 # keep track of local-domain: assignments during inserted resource records
  65 UNBOUND_LIST_DOMAINS=""
  66
  67 ##############################################################################
  68
  69 UNBOUND_LIBDIR=/usr/lib/unbound
  70 UNBOUND_VARDIR=/var/lib/unbound
  71
  72 UNBOUND_PIDFILE=/var/run/unbound.pid
  73
  74 UNBOUND_SRV_CONF=$UNBOUND_VARDIR/unbound_srv.conf
  75 UNBOUND_EXT_CONF=$UNBOUND_VARDIR/unbound_ext.conf
  76 UNBOUND_DHCP_CONF=$UNBOUND_VARDIR/unbound_dhcp.conf
  77 UNBOUND_CONFFILE=$UNBOUND_VARDIR/unbound.conf
  78
  79 UNBOUND_KEYFILE=$UNBOUND_VARDIR/root.key
  80 UNBOUND_HINTFILE=$UNBOUND_VARDIR/root.hints
  81 UNBOUND_TIMEFILE=$UNBOUND_VARDIR/hotplug.time
  82
  83 ##############################################################################
  84
  85 UNBOUND_ANCHOR=/usr/sbin/unbound-anchor
  86 UNBOUND_CONTROL=/usr/sbin/unbound-control
  87 UNBOUND_CONTROL_CFG="$UNBOUND_CONTROL -c $UNBOUND_CONFFILE"
  88
  89 ##############################################################################
  90
  91 . /lib/functions.sh
  92 . /lib/functions/network.sh
  93
  94 . $UNBOUND_LIBDIR/dnsmasq.sh
  95 . $UNBOUND_LIBDIR/iptools.sh
  96 . $UNBOUND_LIBDIR/rootzone.sh
  97
  98 ##############################################################################
  99
 100 copy_dash_update() {
 101   # TODO: remove this function and use builtins when this issues is resovled.
 102   # Due to OpenWrt/LEDE divergence "cp -u" isn't yet universally available.
 103   local filetime keeptime
 104
 105
 106   if [ -f $UNBOUND_KEYFILE.keep ] ; then
 107     # root.key.keep is reused if newest
 108     filetime=$( date -r $UNBOUND_KEYFILE +%s )
 109     keeptime=$( date -r $UNBOUND_KEYFILE.keep +%s )
 110
 111
 112     if [ $keeptime -gt $filetime ] ; then
 113       cp $UNBOUND_KEYFILE.keep $UNBOUND_KEYFILE
 114     fi
 115
 116
 117     rm -f $UNBOUND_KEYFILE.keep
 118   fi
 119 }
 120
 121 ##############################################################################
 122
 123 create_interface_dns() {
 124   local cfg="$1"
 125   local ipcommand logint ignore ifname ifdashname
 126   local name names address addresses
 127   local ulaprefix if_fqdn host_fqdn mode mode_ptr
 128
 129   # Create local-data: references for this hosts interfaces (router).
 130   config_get logint "$cfg" interface
 131   config_get_bool ignore "$cfg" ignore 0
 132   network_get_device ifname "$cfg"
 133
 134   ifdashname="${ifname//./-}"
 135   ipcommand="ip -o address show $ifname"
 136   addresses=$( $ipcommand | awk '/inet/{sub(/\/.*/,"",$4); print $4}' )
 137   ulaprefix=$( uci_get network.@globals[0].ula_prefix )
 138   host_fqdn="$UNBOUND_TXT_HOSTNAME.$UNBOUND_TXT_DOMAIN"
 139   if_fqdn="$ifdashname.$host_fqdn"
 140
 141
 142   if [ -z "${ulaprefix%%:/*}" ] ; then
 143     # Nonsense so this option isn't globbed below
 144     ulaprefix="fdno:such:addr::/48"
 145   fi
 146
 147
 148   if [ "$ignore" -gt 0 ] ; then
 149     mode="$UNBOUND_D_WAN_FQDN"
 150   else
 151     mode="$UNBOUND_D_LAN_FQDN"
 152   fi
 153
 154
 155   case "$mode" in
 156   3)
 157     mode_ptr="$host_fqdn"
 158     names="$host_fqdn  $UNBOUND_TXT_HOSTNAME"
 159     ;;
 160
 161   4)
 162     if [ -z "$ifdashname" ] ; then
 163       # race conditions at init can rarely cause a blank device return
 164       # the record format is invalid and Unbound won't load the conf file
 165       mode_ptr="$host_fqdn"
 166       names="$host_fqdn  $UNBOUND_TXT_HOSTNAME"
 167     else
 168       mode_ptr="$if_fqdn"
 169       names="$if_fqdn  $host_fqdn  $UNBOUND_TXT_HOSTNAME"
 170     fi
 171     ;;
 172
 173   *)
 174     mode_ptr="$UNBOUND_TXT_HOSTNAME"
 175     names="$UNBOUND_TXT_HOSTNAME"
 176     ;;
 177   esac
 178
 179
 180   if [ "$mode" -gt 1 ] ; then
 181     {
 182       for address in $addresses ; do
 183         case $address in
 184         fe80:*|169.254.*)
 185           echo "  # note link address $address"
 186           ;;
 187
 188         [1-9a-f]*:*[0-9a-f])
 189           # GA and ULA IP6 for HOST IN AAA records (ip command is robust)
 190           for name in $names ; do
 191             echo "  local-data: \"$name. 120 IN AAAA $address\""
 192           done
 193           echo "  local-data-ptr: \"$address 120 $mode_ptr\""
 194           ;;
 195
 196         [1-9]*.*[0-9])
 197           # Old fashioned HOST IN A records
 198           for name in $names ; do
 199             echo "  local-data: \"$name. 120 IN A $address\""
 200           done
 201           echo "  local-data-ptr: \"$address 120 $mode_ptr\""
 202           ;;
 203         esac
 204       done
 205       echo
 206     } >> $UNBOUND_CONFFILE
 207
 208   elif [ "$mode" -gt 0 ] ; then
 209     {
 210       for address in $addresses ; do
 211         case $address in
 212         fe80:*|169.254.*)
 213           echo "  # note link address $address"
 214           ;;
 215
 216         "${ulaprefix%%:/*}"*)
 217           # Only this networks ULA and only hostname
 218           echo "  local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN AAAA $address\""
 219           echo "  local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
 220           ;;
 221
 222         [1-9]*.*[0-9])
 223           echo "  local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN A $address\""
 224           echo "  local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
 225           ;;
 226         esac
 227       done
 228       echo
 229     } >> $UNBOUND_CONFFILE
 230   fi
 231 }
 232
 233 ##############################################################################
 234
 235 create_local_zone() {
 236   local target="$1"
 237   local partial domain found
 238
 239
 240   if [ -n "$UNBOUND_LIST_DOMAINS" ] ; then
 241     for domain in $UNBOUND_LIST_DOMAINS ; do
 242       case $target in
 243       *"${domain}")
 244         found=1
 245         break
 246         ;;
 247
 248       [A-Za-z0-9]*.[A-Za-z0-9]*)
 249         found=0
 250         ;;
 251
 252       *) # no dots
 253         found=1
 254         break
 255         ;;
 256       esac
 257     done
 258   else
 259     found=0
 260   fi
 261
 262
 263   if [ $found -eq 0 ] ; then
 264     # New Zone! Bundle local-zones: by first two name tiers "abcd.tld."
 265     partial=$( echo "$target" | awk -F. '{ j=NF ; i=j-1; print $i"."$j }' )
 266     UNBOUND_LIST_DOMAINS="$UNBOUND_LIST_DOMAINS $partial"
 267     echo "  local-zone: $partial. transparent" >> $UNBOUND_CONFFILE
 268   fi
 269 }
 270
 271 ##############################################################################
 272
 273 create_host_record() {
 274   local cfg="$1"
 275   local ip name
 276
 277   # basefiles dhcp "domain" clause which means host A, AAAA, and PRT record
 278   config_get ip   "$cfg" ip
 279   config_get name "$cfg" name
 280
 281
 282   if [ -n "$name" -a -n "$ip" ] ; then
 283     create_local_zone "$name"
 284
 285     {
 286       case $ip in
 287       fe80:*|169.254.*)
 288         echo "  # note link address $ip for host $name"
 289         ;;
 290
 291       [1-9a-f]*:*[0-9a-f])
 292         echo "  local-data: \"$name. 120 IN AAAA $ip\""
 293         echo "  local-data-ptr: \"$ip 120 $name\""
 294         ;;
 295
 296       [1-9]*.*[0-9])
 297         echo "  local-data: \"$name. 120 IN A $ip\""
 298         echo "  local-data-ptr: \"$ip 120 $name\""
 299         ;;
 300       esac
 301     } >> $UNBOUND_CONFFILE
 302   fi
 303 }
 304
 305 ##############################################################################
 306
 307 create_mx_record() {
 308   local cfg="$1"
 309   local domain relay pref
 310
 311   # Insert a static MX record
 312   config_get domain "$cfg" domain
 313   config_get relay  "$cfg" relay
 314   config_get pref   "$cfg" pref 10
 315
 316
 317   if [ -n "$domain" -a -n "$relay" ] ; then
 318     create_local_zone "$domain"
 319     echo "  local-data: \"$domain. 120 IN MX $pref $relay.\"" \
 320           >> $UNBOUND_CONFFILE
 321   fi
 322 }
 323
 324 ##############################################################################
 325
 326 create_srv_record() {
 327   local cfg="$1"
 328   local srv target port class weight
 329
 330   # Insert a static SRV record such as SIP server
 331   config_get srv    "$cfg" srv
 332   config_get target "$cfg" target
 333   config_get port   "$cfg" port
 334   config_get class  "$cfg" class 10
 335   config_get weight "$cfg" weight 10
 336
 337
 338   if [ -n "$srv" -a -n "$target" -a -n "$port" ] ; then
 339     create_local_zone "$srv"
 340     echo "  local-data: \"$srv. 120 IN SRV $class $weight $port $target.\"" \
 341           >> $UNBOUND_CONFFILE
 342   fi
 343 }
 344
 345 ##############################################################################
 346
 347 create_cname_record() {
 348   local cfg="$1"
 349   local cname target
 350
 351   # Insert static CNAME record
 352   config_get cname  "$cfg" cname
 353   config_get target "$cfg" target
 354
 355
 356   if [ -n "$cname" -a -n "$target" ] ; then
 357     create_local_zone "$cname"
 358     echo "  local-data: \"$cname. 120 IN CNAME $target.\"" >> $UNBOUND_CONFFILE
 359   fi
 360 }
 361
 362 ##############################################################################
 363
 364 create_access_control() {
 365   local cfg="$1"
 366   local subnets subnets4 subnets6
 367   local validip4 validip6
 368
 369   network_get_subnets  subnets4 "$cfg"
 370   network_get_subnets6 subnets6 "$cfg"
 371   subnets="$subnets4 $subnets6"
 372
 373
 374   if [ -n "$subnets" ] ; then
 375     for subnet in $subnets ; do
 376       validip4=$( valid_subnet4 $subnet )
 377       validip6=$( valid_subnet6 $subnet )
 378
 379
 380       if [ "$validip4" = "ok" -o "$validip6" = "ok" ] ; then
 381         # For each "network" UCI add "access-control:" white list for queries
 382         echo "  access-control: $subnet allow" >> $UNBOUND_CONFFILE
 383       fi
 384     done
 385   fi
 386 }
 387
 388 ##############################################################################
 389
 390 create_domain_insecure() {
 391   echo "  domain-insecure: \"$1\"" >> $UNBOUND_CONFFILE
 392 }
 393
 394 ##############################################################################
 395
 396 unbound_mkdir() {
 397   local resolvsym=0
 398   local dhcp_origin=$( uci_get dhcp.@odhcpd[0].leasefile )
 399   local dhcp_dir=$( dirname $dhcp_origin )
 400   local filestuff
 401
 402
 403   if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
 404     resolvsym=1
 405   else
 406     /etc/init.d/dnsmasq enabled || resolvsym=1
 407   fi
 408
 409
 410   if [ "$resolvsym" -gt 0 ] ; then
 411     rm -f /tmp/resolv.conf
 412
 413
 414     {
 415       # Set resolver file to local but not if /etc/init.d/dnsmasq will do it.
 416       echo "nameserver 127.0.0.1"
 417       echo "nameserver ::1"
 418       echo "search $UNBOUND_TXT_DOMAIN"
 419     } > /tmp/resolv.conf
 420   fi
 421
 422
 423   if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" -a ! -d "$dhcp_dir" ] ; then
 424     # make sure odhcpd has a directory to write (not done itself, yet)
 425     mkdir -p "$dhcp_dir"
 426   fi
 427
 428
 429   if [ -f $UNBOUND_KEYFILE ] ; then
 430     filestuff=$( cat $UNBOUND_KEYFILE )
 431
 432
 433     case "$filestuff" in
 434       *"state=2 [  VALID  ]"*)
 435         # Lets not lose RFC 5011 tracking if we don't have to
 436         cp -p $UNBOUND_KEYFILE $UNBOUND_KEYFILE.keep
 437         ;;
 438     esac
 439   fi
 440
 441
 442   # Blind copy /etc/ to /var/lib/
 443   mkdir -p $UNBOUND_VARDIR
 444   rm -f $UNBOUND_VARDIR/dhcp_*
 445   touch $UNBOUND_CONFFILE
 446   touch $UNBOUND_SRV_CONF
 447   touch $UNBOUND_EXT_CONF
 448   cp -p /etc/unbound/* $UNBOUND_VARDIR/
 449
 450
 451   if [ ! -f $UNBOUND_HINTFILE ] ; then
 452     if [ -f /usr/share/dns/root.hints ] ; then
 453       # Debian-like package dns-root-data
 454       cp -p /usr/share/dns/root.hints $UNBOUND_HINTFILE
 455
 456     elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 457       logger -t unbound -s "iterator will use built-in root hints"
 458     fi
 459   fi
 460
 461
 462   if [ ! -f $UNBOUND_KEYFILE ] ; then
 463     if [ -f /usr/share/dns/root.key ] ; then
 464       # Debian-like package dns-root-data
 465       cp -p /usr/share/dns/root.key $UNBOUND_KEYFILE
 466
 467     elif [ -x $UNBOUND_ANCHOR ] ; then
 468       $UNBOUND_ANCHOR -a $UNBOUND_KEYFILE
 469
 470     elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 471       logger -t unbound -s "validator will use built-in trust anchor"
 472     fi
 473   fi
 474
 475
 476   copy_dash_update
 477
 478
 479   # Ensure access and prepare to jail
 480   chown -R unbound:unbound $UNBOUND_VARDIR
 481   chmod 775 $UNBOUND_VARDIR
 482   chmod 664 $UNBOUND_VARDIR/*
 483 }
 484
 485 ##############################################################################
 486
 487 unbound_control() {
 488   if [ "$UNBOUND_B_CONTROL" -gt 0 ] ; then
 489     {
 490       # Enable remote control tool, but only at local host for security
 491       # You can hand write fancier encrypted access with /etc/..._ext.conf
 492       echo "remote-control:"
 493       echo "  control-enable: yes"
 494       echo "  control-use-cert: no"
 495       echo "  control-interface: 127.0.0.1"
 496       echo "  control-interface: ::1"
 497       echo
 498     } >> $UNBOUND_CONFFILE
 499   fi
 500
 501
 502   {
 503     # Amend your own extended clauses here like forward zones or disable
 504     # above (local, no encryption) and amend your own remote encrypted control
 505     echo
 506     echo "include: $UNBOUND_EXT_CONF" >> $UNBOUND_CONFFILE
 507     echo
 508   } >> $UNBOUND_CONFFILE
 509 }
 510
 511 ##############################################################################
 512
 513 unbound_conf() {
 514   local cfg="$1"
 515   local rt_mem rt_conn modulestring
 516
 517
 518   {
 519     # Make fresh conf file
 520     echo "# $UNBOUND_CONFFILE generated by UCI $( date )"
 521     echo
 522   } > $UNBOUND_CONFFILE
 523
 524
 525   {
 526     # No threading
 527     echo "server:"
 528     echo "  username: unbound"
 529     echo "  num-threads: 1"
 530     echo "  msg-cache-slabs: 1"
 531     echo "  rrset-cache-slabs: 1"
 532     echo "  infra-cache-slabs: 1"
 533     echo "  key-cache-slabs: 1"
 534     echo
 535   } >> $UNBOUND_CONFFILE
 536
 537
 538   {
 539     # Logging
 540     echo "  verbosity: 1"
 541     echo "  statistics-interval: 0"
 542     echo "  statistics-cumulative: no"
 543     echo "  extended-statistics: no"
 544     echo
 545   } >> $UNBOUND_CONFFILE
 546
 547
 548   {
 549     # Interfaces (access contol "option local_service")
 550     echo "  interface: 0.0.0.0"
 551     echo "  interface: ::0"
 552     echo "  outgoing-interface: 0.0.0.0"
 553     echo "  outgoing-interface: ::0"
 554     echo
 555   } >> $UNBOUND_CONFFILE
 556
 557
 558   case "$UNBOUND_D_PROTOCOL" in
 559     ip4_only)
 560       {
 561         echo "  do-ip4: yes"
 562         echo "  do-ip6: no"
 563       } >> $UNBOUND_CONFFILE
 564       ;;
 565
 566     ip6_only)
 567       {
 568         echo "  do-ip4: no"
 569         echo "  do-ip6: yes"
 570       } >> $UNBOUND_CONFFILE
 571       ;;
 572
 573     ip6_prefer)
 574       {
 575         echo "  do-ip4: yes"
 576         echo "  do-ip6: yes"
 577         echo "  prefer-ip6: yes"
 578       } >> $UNBOUND_CONFFILE
 579       ;;
 580
 581     *)
 582       {
 583         echo "  do-ip4: yes"
 584         echo "  do-ip6: yes"
 585       } >> $UNBOUND_CONFFILE
 586       ;;
 587   esac
 588
 589
 590   {
 591     # protocol level tuning
 592     echo "  edns-buffer-size: $UNBOUND_N_EDNS_SIZE"
 593     echo "  msg-buffer-size: 8192"
 594     echo "  port: $UNBOUND_N_RX_PORT"
 595     echo "  outgoing-port-permit: 10240-65535"
 596     echo
 597   } >> $UNBOUND_CONFFILE
 598
 599
 600   {
 601     # Other harding and options for an embedded router
 602     echo "  harden-short-bufsize: yes"
 603     echo "  harden-large-queries: yes"
 604     echo "  harden-glue: yes"
 605     echo "  harden-below-nxdomain: no"
 606     echo "  harden-referral-path: no"
 607     echo "  use-caps-for-id: no"
 608     echo
 609   } >> $UNBOUND_CONFFILE
 610
 611
 612   {
 613     # Default Files
 614     echo "  use-syslog: yes"
 615     echo "  chroot: \"$UNBOUND_VARDIR\""
 616     echo "  directory: \"$UNBOUND_VARDIR\""
 617     echo "  pidfile: \"$UNBOUND_PIDFILE\""
 618   } >> $UNBOUND_CONFFILE
 619
 620
 621   if [ -f "$UNBOUND_HINTFILE" ] ; then
 622     # Optional hints if found
 623     echo "  root-hints: \"$UNBOUND_HINTFILE\"" >> $UNBOUND_CONFFILE
 624   fi
 625
 626
 627   if [ "$UNBOUND_B_DNSSEC" -gt 0 -a -f "$UNBOUND_KEYFILE" ] ; then
 628     {
 629       echo "  auto-trust-anchor-file: \"$UNBOUND_KEYFILE\""
 630       echo
 631     } >> $UNBOUND_CONFFILE
 632
 633   else
 634     echo >> $UNBOUND_CONFFILE
 635   fi
 636
 637
 638   case "$UNBOUND_D_RESOURCE" in
 639     # Tiny - Unbound's recommended cheap hardware config
 640     tiny)   rt_mem=1  ; rt_conn=1 ;;
 641     # Small - Half RRCACHE and open ports
 642     small)  rt_mem=8  ; rt_conn=5 ;;
 643     # Medium - Nearly default but with some added balancintg
 644     medium) rt_mem=16 ; rt_conn=10 ;;
 645     # Large - Double medium
 646     large)  rt_mem=32 ; rt_conn=10 ;;
 647     # Whatever unbound does
 648     *) rt_mem=0 ; rt_conn=0 ;;
 649   esac
 650
 651
 652   if [ "$rt_mem" -gt 0 ] ; then
 653     {
 654       # Set memory sizing parameters
 655       echo "  outgoing-range: $(($rt_conn*64))"
 656       echo "  num-queries-per-thread: $(($rt_conn*32))"
 657       echo "  outgoing-num-tcp: $(($rt_conn))"
 658       echo "  incoming-num-tcp: $(($rt_conn))"
 659       echo "  rrset-cache-size: $(($rt_mem*256))k"
 660       echo "  msg-cache-size: $(($rt_mem*128))k"
 661       echo "  key-cache-size: $(($rt_mem*128))k"
 662       echo "  neg-cache-size: $(($rt_mem*64))k"
 663       echo "  infra-cache-numhosts: $(($rt_mem*256))"
 664       echo
 665     } >> $UNBOUND_CONFFILE
 666
 667   elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 668     logger -t unbound -s "default memory resource consumption"
 669   fi
 670
 671   # Assembly of module-config: options is tricky; order matters
 672   modulestring="iterator"
 673
 674
 675   if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
 676     if [ ! -f "$UNBOUND_TIMEFILE" -a "$UNBOUND_B_NTP_BOOT" -gt 0 ] ; then
 677       # DNSSEC chicken and egg with getting NTP time
 678       echo "  val-override-date: -1" >> $UNBOUND_CONFFILE
 679     fi
 680
 681
 682     {
 683       echo "  harden-dnssec-stripped: yes"
 684       echo "  val-clean-additional: yes"
 685       echo "  ignore-cd-flag: yes"
 686     } >> $UNBOUND_CONFFILE
 687
 688
 689     modulestring="validator $modulestring"
 690   fi
 691
 692
 693   if [ "$UNBOUND_B_DNS64" -gt 0 ] ; then
 694     echo "  dns64-prefix: $UNBOUND_IP_DNS64" >> $UNBOUND_CONFFILE
 695
 696     modulestring="dns64 $modulestring"
 697   fi
 698
 699
 700   {
 701     # Print final module string
 702     echo "  module-config: \"$modulestring\""
 703     echo
 704   }  >> $UNBOUND_CONFFILE
 705
 706
 707   if [ "$UNBOUND_B_QRY_MINST" -gt 0 -a "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
 708     {
 709       # Some query privacy but "strict" will break some name servers
 710       echo "  qname-minimisation: yes"
 711       echo "  qname-minimisation-strict: yes"
 712     } >> $UNBOUND_CONFFILE
 713
 714   elif [ "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
 715     # Minor improvement on query privacy
 716     echo "  qname-minimisation: yes" >> $UNBOUND_CONFFILE
 717
 718   else
 719     echo "  qname-minimisation: no" >> $UNBOUND_CONFFILE
 720   fi
 721
 722
 723   case "$UNBOUND_D_RECURSION" in
 724     passive)
 725       {
 726         echo "  prefetch: no"
 727         echo "  prefetch-key: no"
 728         echo "  target-fetch-policy: \"0 0 0 0 0\""
 729         echo
 730       } >> $UNBOUND_CONFFILE
 731       ;;
 732
 733     aggressive)
 734       {
 735         echo "  prefetch: yes"
 736         echo "  prefetch-key: yes"
 737         echo "  target-fetch-policy: \"3 2 1 0 0\""
 738         echo
 739       } >> $UNBOUND_CONFFILE
 740       ;;
 741
 742     *)
 743       if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 744         logger -t unbound -s "default recursion configuration"
 745       fi
 746       ;;
 747   esac
 748
 749
 750   {
 751     # Reload records more than 10 hours old
 752     # DNSSEC 5 minute bogus cool down before retry
 753     # Adaptive infrastructure info kept for 15 minutes
 754     echo "  cache-min-ttl: $UNBOUND_TTL_MIN"
 755     echo "  cache-max-ttl: 36000"
 756     echo "  val-bogus-ttl: 300"
 757     echo "  infra-host-ttl: 900"
 758     echo
 759   } >> $UNBOUND_CONFFILE
 760
 761
 762   if [ "$UNBOUND_B_HIDE_BIND" -gt 0 ] ; then
 763     {
 764       # Block server id and version DNS TXT records
 765       echo "  hide-identity: yes"
 766       echo "  hide-version: yes"
 767       echo
 768     } >> $UNBOUND_CONFFILE
 769   fi
 770
 771
 772   if [ "$UNBOUND_B_PRIV_BLCK" -gt 0 ] ; then
 773     {
 774       # Remove _upstream_ or global reponses with private addresses.
 775       # Unbounds own "local zone" and "forward zone" may still use these.
 776       # RFC1918, RFC3927, RFC4291, RFC6598, RFC6890
 777       echo "  private-address: 10.0.0.0/8"
 778       echo "  private-address: 100.64.0.0/10"
 779       echo "  private-address: 169.254.0.0/16"
 780       echo "  private-address: 172.16.0.0/12"
 781       echo "  private-address: 192.168.0.0/16"
 782       echo "  private-address: fc00::/8"
 783       echo "  private-address: fd00::/8"
 784       echo "  private-address: fe80::/10"
 785     } >> $UNBOUND_CONFFILE
 786   fi
 787
 788
 789   if [ "$UNBOUND_B_LOCL_BLCK" -gt 0 ] ; then
 790     {
 791       # Remove DNS reponses from upstream with loopback IP
 792       # Black hole DNS method for ad blocking, so consider...
 793       echo "  private-address: 127.0.0.0/8"
 794       echo "  private-address: ::1/128"
 795       echo
 796     } >> $UNBOUND_CONFFILE
 797
 798   else
 799     echo >> $UNBOUND_CONFFILE
 800   fi
 801
 802
 803   # Except and accept domains as insecure (DNSSEC); work around broken domains
 804   config_list_foreach "$cfg" "domain_insecure" create_domain_insecure
 805   echo >> $UNBOUND_CONFFILE
 806 }
 807
 808 ##############################################################################
 809
 810 unbound_access() {
 811   # TODO: Unbound 1.6.0 added "tags" and "views", so we can add tags to
 812   # each access-control IP block, and then divert access.
 813   # -- "guest" WIFI will not be allowed to see local zone data
 814   # -- "child" LAN can black whole a list of domains to http~deadpixel
 815
 816
 817   if [ "$UNBOUND_B_LOCL_SERV" -gt 0 ] ; then
 818     # Only respond to queries from which this device has an interface.
 819     # Prevent DNS amplification attacks by not responding to the universe.
 820     config_load network
 821     config_foreach create_access_control interface
 822
 823
 824     {
 825       echo "  access-control: 127.0.0.0/8 allow"
 826       echo "  access-control: ::1/128 allow"
 827       echo "  access-control: fe80::/10 allow"
 828       echo
 829     } >> $UNBOUND_CONFFILE
 830
 831   else
 832     {
 833       echo "  access-control: 0.0.0.0/0 allow"
 834       echo "  access-control: ::0/0 allow"
 835       echo
 836     } >> $UNBOUND_CONFFILE
 837   fi
 838
 839
 840   {
 841     # Amend your own "server:" stuff here
 842     echo "  include: $UNBOUND_SRV_CONF"
 843     echo
 844   } >> $UNBOUND_CONFFILE
 845 }
 846
 847 ##############################################################################
 848
 849 unbound_adblock() {
 850   # TODO: Unbound 1.6.0 added "tags" and "views"; lets work with adblock team
 851   local adb_enabled adb_file
 852
 853   if [ ! -x /usr/bin/adblock.sh -o ! -x /etc/init.d/adblock ] ; then
 854     adb_enabled=0
 855   else
 856     /etc/init.d/adblock enabled && adb_enabled=1 || adb_enabled=0
 857   fi
 858
 859
 860   if [ "$adb_enabled" -gt 0 ] ; then
 861     {
 862       # Pull in your selected openwrt/pacakges/net/adblock generated lists
 863       for adb_file in $UNBOUND_VARDIR/adb_list.* ; do
 864         echo "  include: $adb_file"
 865       done
 866       echo
 867     } >> $UNBOUND_CONFFILE
 868   fi
 869 }
 870
 871 ##############################################################################
 872
 873 unbound_hostname() {
 874   if [ -n "$UNBOUND_TXT_DOMAIN" ] ; then
 875     {
 876       # TODO: Unbound 1.6.0 added "tags" and "views" and we could make
 877       # domains by interface to prevent DNS from "guest" to "home"
 878       echo "  local-zone: $UNBOUND_TXT_DOMAIN. $UNBOUND_D_DOMAIN_TYPE"
 879       echo "  domain-insecure: $UNBOUND_TXT_DOMAIN"
 880       echo "  private-domain: $UNBOUND_TXT_DOMAIN"
 881       echo
 882       echo "  local-zone: $UNBOUND_TXT_HOSTNAME. $UNBOUND_D_DOMAIN_TYPE"
 883       echo "  domain-insecure: $UNBOUND_TXT_HOSTNAME"
 884       echo "  private-domain: $UNBOUND_TXT_HOSTNAME"
 885       echo
 886     } >> $UNBOUND_CONFFILE
 887
 888
 889     case "$UNBOUND_D_DOMAIN_TYPE" in
 890     deny|inform_deny|refuse|static)
 891       {
 892         # avoid upstream involvement in RFC6762 like responses (link only)
 893         echo "  local-zone: local. $UNBOUND_D_DOMAIN_TYPE"
 894         echo "  domain-insecure: local"
 895         echo "  private-domain: local"
 896         echo
 897       } >> $UNBOUND_CONFFILE
 898       ;;
 899     esac
 900
 901
 902     if [ "$UNBOUND_D_LAN_FQDN" -gt 0 -o "$UNBOUND_D_WAN_FQDN" -gt 0 ] ; then
 903       config_load dhcp
 904       config_foreach create_interface_dns dhcp
 905     fi
 906
 907
 908     if [ -f "$UNBOUND_DHCP_CONF" ] ; then
 909       {
 910         # Seed DHCP records because dhcp scripts trigger externally
 911         # Incremental Unbound restarts may drop unbound-control add records
 912         echo "  include: $UNBOUND_DHCP_CONF"
 913         echo
 914       } >> $UNBOUND_CONFFILE
 915     fi
 916   fi
 917 }
 918
 919 ##############################################################################
 920
 921 unbound_records() {
 922   if [ "$UNBOUND_D_EXTRA_DNS" -gt 0 ] ; then
 923     # Parasite from the uci.dhcp.domain clauses
 924     config_load dhcp
 925     config_foreach create_host_record domain
 926   fi
 927
 928
 929   if [ "$UNBOUND_D_EXTRA_DNS" -gt 1 ] ; then
 930     config_foreach create_srv_record srvhost
 931     config_foreach create_mx_record mxhost
 932   fi
 933
 934
 935   if [ "$UNBOUND_D_EXTRA_DNS" -gt 2 ] ; then
 936     config_foreach create_cname_record cname
 937   fi
 938
 939
 940   echo >> $UNBOUND_CONFFILE
 941 }
 942
 943 ##############################################################################
 944
 945 unbound_uci() {
 946   local cfg="$1"
 947   local dnsmasqpath hostnm
 948
 949   hostnm=$( uci_get system.@system[0].hostname | awk '{print tolower($0)}' )
 950   UNBOUND_TXT_HOSTNAME=${hostnm:-thisrouter}
 951
 952   config_get_bool UNBOUND_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
 953   config_get_bool UNBOUND_B_DNS64      "$cfg" dns64 0
 954   config_get_bool UNBOUND_B_HIDE_BIND  "$cfg" hide_binddata 1
 955   config_get_bool UNBOUND_B_LOCL_SERV  "$cfg" localservice 1
 956   config_get_bool UNBOUND_B_MAN_CONF   "$cfg" manual_conf 0
 957   config_get_bool UNBOUND_B_QUERY_MIN  "$cfg" query_minimize 0
 958   config_get_bool UNBOUND_B_QRY_MINST  "$cfg" query_min_strict 0
 959   config_get_bool UNBOUND_B_PRIV_BLCK  "$cfg" rebind_protection 1
 960   config_get_bool UNBOUND_B_LOCL_BLCK  "$cfg" rebind_localhost 0
 961   config_get_bool UNBOUND_B_CONTROL    "$cfg" unbound_control 0
 962   config_get_bool UNBOUND_B_DNSSEC     "$cfg" validator 0
 963   config_get_bool UNBOUND_B_NTP_BOOT   "$cfg" validator_ntp 1
 964
 965   config_get UNBOUND_IP_DNS64    "$cfg" dns64_prefix "64:ff9b::/96"
 966
 967   config_get UNBOUND_N_EDNS_SIZE "$cfg" edns_size 1280
 968   config_get UNBOUND_N_RX_PORT   "$cfg" listen_port 53
 969   config_get UNBOUND_N_ROOT_AGE  "$cfg" root_age 9
 970
 971   config_get UNBOUND_D_DOMAIN_TYPE "$cfg" domain_type static
 972   config_get UNBOUND_D_DHCP_LINK   "$cfg" dhcp_link none
 973   config_get UNBOUND_D_EXTRA_DNS   "$cfg" add_extra_dns 0
 974   config_get UNBOUND_D_LAN_FQDN    "$cfg" add_local_fqdn 0
 975   config_get UNBOUND_D_PROTOCOL    "$cfg" protocol mixed
 976   config_get UNBOUND_D_RECURSION   "$cfg" recursion passive
 977   config_get UNBOUND_D_RESOURCE    "$cfg" resource small
 978   config_get UNBOUND_D_WAN_FQDN    "$cfg" add_wan_fqdn 0
 979
 980   config_get UNBOUND_TTL_MIN     "$cfg" ttl_min 120
 981   config_get UNBOUND_TXT_DOMAIN  "$cfg" domain lan
 982
 983   UNBOUND_LIST_DOMAINS="nowhere $UNBOUND_TXT_DOMAIN"
 984
 985   if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
 986     config_get_bool UNBOUND_B_DNSMASQ   "$cfg" dnsmasq_link_dns 0
 987
 988
 989     if [ "$UNBOUND_B_DNSMASQ" -gt 0 ] ; then
 990       UNBOUND_D_DHCP_LINK=dnsmasq
 991
 992
 993       if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 994         logger -t unbound -s "Please use 'dhcp_link' selector instead"
 995       fi
 996     fi
 997   fi
 998
 999
1000   if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
1001     if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
1002       UNBOUND_D_DHCP_LINK=none
1003     else
1004       /etc/init.d/dnsmasq enabled || UNBOUND_D_DHCP_LINK=none
1005     fi
1006
1007
1008     if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
1009       logger -t unbound -s "cannot forward to dnsmasq"
1010     fi
1011   fi
1012
1013
1014   if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" ] ; then
1015     if [ ! -x /usr/sbin/odhcpd -o ! -x /etc/init.d/odhcpd ] ; then
1016       UNBOUND_D_DHCP_LINK=none
1017     else
1018       /etc/init.d/odhcpd enabled || UNBOUND_D_DHCP_LINK=none
1019     fi
1020
1021
1022     if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
1023       logger -t unbound -s "cannot receive records from odhcpd"
1024     fi
1025   fi
1026
1027
1028   if [ "$UNBOUND_N_EDNS_SIZE" -lt 512 \
1029     -o 4096 -lt "$UNBOUND_N_EDNS_SIZE" ] ; then
1030     # exceeds range, back to default
1031     UNBOUND_N_EDNS_SIZE=1280
1032   fi
1033
1034
1035   if [ "$UNBOUND_N_RX_PORT" -lt 1024 \
1036     -o 10240 -lt "$UNBOUND_N_RX_PORT" ] ; then
1037     # special port or in 5 digits, back to default
1038     UNBOUND_N_RX_PORT=53
1039   fi
1040
1041
1042   if [ "$UNBOUND_TTL_MIN" -gt 1800 ] ; then
1043     # that could have had awful side effects
1044     UNBOUND_TTL_MIN=300
1045   fi
1046 }
1047
1048 ##############################################################################
1049
1050 unbound_start() {
1051   config_load unbound
1052   config_foreach unbound_uci unbound
1053   unbound_mkdir
1054
1055
1056   if [ "$UNBOUND_B_MAN_CONF" -eq 0 ] ; then
1057     unbound_conf
1058     unbound_access
1059     unbound_adblock
1060
1061     if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
1062       dnsmasq_link
1063     else
1064       unbound_hostname
1065       unbound_records
1066     fi
1067
1068     unbound_control
1069   fi
1070 }
1071
1072 ##############################################################################
1073
1074 unbound_stop() {
1075   local resolvsym=0
1076
1077   rootzone_update
1078
1079
1080   if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
1081     resolvsym=1
1082   else
1083     /etc/init.d/dnsmasq enabled || resolvsym=1
1084   fi
1085
1086
1087   if [ "$resolvsym" -gt 0 ] ; then
1088     # set resolver file to normal, but don't stomp on dnsmasq
1089     rm -f /tmp/resolv.conf
1090     ln -s /tmp/resolv.conf.auto /tmp/resolv.conf
1091   fi
1092 }
1093
1094 ##############################################################################
1095