projects / feed / packages.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
unbound: make option interface_auto default on
[feed/packages.git] / net / unbound / files / unbound.sh
1 #!/bin/sh
2 ##############################################################################
3 #
4 # This program is free software; you can redistribute it and/or modify
5 # it under the terms of the GNU General Public License version 2 as
6 # published by the Free Software Foundation.
7 #
8 # This program is distributed in the hope that it will be useful,
9 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # GNU General Public License for more details.
12 #
13 # Copyright (C) 2016 Eric Luehrsen
14 #
15 ##############################################################################
16 #
17 # Unbound is a full featured recursive server with many options. The UCI
18 # provided tries to simplify and bundle options. This should make Unbound
19 # easier to deploy. Even light duty routers may resolve recursively instead of
20 # depending on a stub with the ISP. The UCI also attempts to replicate dnsmasq
21 # features as used in base LEDE/OpenWrt. If there is a desire for more
22 # detailed tuning, then manual conf file overrides are also made available.
23 #
24 ##############################################################################
25
26 UB_B_SLAAC6_MAC=0
27 UB_B_DNSSEC=0
28 UB_B_DNS64=0
29 UB_B_EXT_STATS=0
30 UB_B_GATE_NAME=0
31 UB_B_HIDE_BIND=1
32 UB_B_LOCL_BLCK=0
33 UB_B_LOCL_SERV=1
34 UB_B_MAN_CONF=0
35 UB_B_NTP_BOOT=1
36 UB_B_QUERY_MIN=0
37 UB_B_QRY_MINST=0
38 UB_B_AUTH_ROOT=0
39 UB_B_IF_AUTO=1
40
41 UB_D_CONTROL=0
42 UB_D_DOMAIN_TYPE=static
43 UB_D_DHCP_LINK=none
44 UB_D_EXTRA_DNS=0
45 UB_D_LAN_FQDN=0
46 UB_D_PRIV_BLCK=1
47 UB_D_PROTOCOL=mixed
48 UB_D_RESOURCE=small
49 UB_D_RECURSION=passive
50 UB_D_VERBOSE=1
51 UB_D_WAN_FQDN=0
52
53 UB_IP_DNS64="64:ff9b::/96"
54
55 UB_N_EDNS_SIZE=1280
56 UB_N_RX_PORT=53
57 UB_N_ROOT_AGE=9
58 UB_N_THREADS=1
59
60 UB_TTL_MIN=120
61 UB_TXT_DOMAIN=lan
62 UB_TXT_HOSTNAME=thisrouter
63
64 ##############################################################################
65
66 # reset as a combo with UB_B_NTP_BOOT and some time stamp files
67 UB_B_READY=1
68
69 # keep track of assignments during inserted resource records
70 UB_LIST_NETW_ALL=""
71 UB_LIST_NETW_LAN=""
72 UB_LIST_NETW_WAN=""
73 UB_LIST_INSECURE=""
74 UB_LIST_ZONE_SERVERS=""
75 UB_LIST_ZONE_NAMES=""
76
77 ##############################################################################
78
79 . /lib/functions.sh
80 . /lib/functions/network.sh
81
82 . /usr/lib/unbound/defaults.sh
83 . /usr/lib/unbound/dnsmasq.sh
84 . /usr/lib/unbound/iptools.sh
85
86 ##############################################################################
87
88 bundle_all_networks() {
89 local cfg="$1"
90 local ifname ifdashname validip
91 local subnet subnets subnets4 subnets6
92
93 network_get_subnets subnets4 "$cfg"
94 network_get_subnets6 subnets6 "$cfg"
95 network_get_device ifname "$cfg"
96
97 ifdashname="${ifname//./-}"
98 subnets="$subnets4 $subnets6"
99
100
101 if [ -n "$subnets" ] ; then
102 for subnet in $subnets ; do
103 validip=$( valid_subnet_any $subnet )
104
105
106 if [ "$validip" = "ok" ] ; then
107 UB_LIST_NETW_ALL="$UB_LIST_NETW_ALL $ifdashname@$subnet"
108 fi
109 done
110 fi
111 }
112
113 ##############################################################################
114
115 bundle_lan_networks() {
116 local cfg="$1"
117 local interface ifsubnet ifname ifdashname ignore
118
119 config_get_bool ignore "$cfg" ignore 0
120 config_get interface "$cfg" interface ""
121 network_get_device ifname "$interface"
122 ifdashname="${ifname//./-}"
123
124
125 if [ "$ignore" -eq 0 ] && [ -n "$ifdashname" ] \
126 && [ -n "$UB_LIST_NETW_ALL" ] ; then
127 for ifsubnet in $UB_LIST_NETW_ALL ; do
128 case $ifsubnet in
129 "${ifdashname}"@*)
130 # Special GLA protection for local block; ULA protected default
131 UB_LIST_NETW_LAN="$UB_LIST_NETW_LAN $ifsubnet"
132 ;;
133 esac
134 done
135 fi
136 }
137
138 ##############################################################################
139
140 bundle_wan_networks() {
141 local ifsubnet
142
143
144 if [ -n "$UB_LIST_NETW_ALL" ] ; then
145 for ifsubnet in $UB_LIST_NETW_ALL ; do
146 case $UB_LIST_NETW_LAN in
147 *"${ifsubnet}"*)
148 # If LAN, then not WAN ...
149 ;;
150
151 *)
152 UB_LIST_NETW_WAN="$UB_LIST_NETW_WAN $ifsubnet"
153 ;;
154 esac
155 done
156 fi
157 }
158
159 ##############################################################################
160
161 bundle_resolv_conf_servers() {
162 local resolvers=$( awk '/nameserver/ { print $2 }' /tmp/resolv.conf.auto )
163 UB_LIST_ZONE_SERVERS="$UB_LIST_ZONE_SERVERS $resolvers"
164 }
165
166 ##############################################################################
167
168 bundle_zone_names() {
169 UB_LIST_ZONE_NAMES="$UB_LIST_ZONE_NAMES $1"
170 }
171
172 ##############################################################################
173
174 bundle_zone_servers() {
175 UB_LIST_ZONE_SERVERS="$UB_LIST_ZONE_SERVERS $1"
176 }
177
178 ##############################################################################
179
180 bundle_domain_insecure() {
181 UB_LIST_INSECURE="$UB_LIST_INSECURE $1"
182 }
183
184 ##############################################################################
185
186 unbound_mkdir() {
187 local filestuff
188
189
190 if [ "$UB_D_DHCP_LINK" = "odhcpd" ] ; then
191 local dhcp_origin=$( uci_get dhcp.@odhcpd[0].leasefile )
192 local dhcp_dir=$( dirname $dhcp_origin )
193
194
195 if [ ! -d "$dhcp_dir" ] ; then
196 # make sure odhcpd has a directory to write (not done itself, yet)
197 mkdir -p "$dhcp_dir"
198 fi
199 fi
200
201
202 if [ -f $UB_RKEY_FILE ] ; then
203 filestuff=$( cat $UB_RKEY_FILE )
204
205
206 case "$filestuff" in
207 *"state=2 [ VALID ]"*)
208 # Lets not lose RFC 5011 tracking if we don't have to
209 cp -p $UB_RKEY_FILE $UB_RKEY_FILE.keep
210 ;;
211 esac
212 fi
213
214
215 # Blind copy /etc/unbound to /var/lib/unbound
216 mkdir -p $UB_VARDIR
217 rm -f $UB_VARDIR/dhcp_*
218 touch $UB_TOTAL_CONF
219 cp -p /etc/unbound/* $UB_VARDIR/
220
221
222 if [ ! -f $UB_RHINT_FILE ] ; then
223 if [ -f /usr/share/dns/root.hints ] ; then
224 # Debian-like package dns-root-data
225 cp -p /usr/share/dns/root.hints $UB_RHINT_FILE
226
227 elif [ "$UB_B_READY" -eq 0 ] ; then
228 logger -t unbound -s "default root hints (built in root-servers.net)"
229 fi
230 fi
231
232
233 if [ ! -f $UB_RKEY_FILE ] ; then
234 if [ -f /usr/share/dns/root.key ] ; then
235 # Debian-like package dns-root-data
236 cp -p /usr/share/dns/root.key $UB_RKEY_FILE
237
238 elif [ -x $UB_ANCHOR ] ; then
239 $UB_ANCHOR -a $UB_RKEY_FILE
240
241 elif [ "$UB_B_READY" -eq 0 ] ; then
242 logger -t unbound -s "default trust anchor (built in root DS record)"
243 fi
244 fi
245
246
247 if [ -f $UB_RKEY_FILE.keep ] ; then
248 # root.key.keep is reused if newest
249 cp -u $UB_RKEY_FILE.keep $UB_RKEY_FILE
250 rm -f $UB_RKEY_FILE.keep
251 fi
252
253
254 if [ -f $UB_TLS_ETC_FILE ] ; then
255 # copy the cert bundle into jail
256 cp -p $UB_TLS_ETC_FILE $UB_TLS_FWD_FILE
257 fi
258
259
260 # Ensure access and prepare to jail
261 chown -R unbound:unbound $UB_VARDIR
262 chmod 755 $UB_VARDIR
263 chmod 644 $UB_VARDIR/*
264
265
266 if [ -f $UB_CTLKEY_FILE ] || [ -f $UB_CTLPEM_FILE ] \
267 || [ -f $UB_SRVKEY_FILE ] || [ -f $UB_SRVPEM_FILE ] ; then
268 # Keys (some) exist already; do not create new ones
269 chmod 640 $UB_CTLKEY_FILE $UB_CTLPEM_FILE \
270 $UB_SRVKEY_FILE $UB_SRVPEM_FILE
271
272 elif [ -x /usr/sbin/unbound-control-setup ] ; then
273 case "$UB_D_CONTROL" in
274 [2-3])
275 # unbound-control-setup for encrypt opt. 2 and 3, but not 4 "static"
276 /usr/sbin/unbound-control-setup -d $UB_VARDIR
277
278 chown -R unbound:unbound $UB_CTLKEY_FILE $UB_CTLPEM_FILE \
279 $UB_SRVKEY_FILE $UB_SRVPEM_FILE
280
281 chmod 640 $UB_CTLKEY_FILE $UB_CTLPEM_FILE \
282 $UB_SRVKEY_FILE $UB_SRVPEM_FILE
283
284 cp -p $UB_CTLKEY_FILE /etc/unbound/unbound_control.key
285 cp -p $UB_CTLPEM_FILE /etc/unbound/unbound_control.pem
286 cp -p $UB_SRVKEY_FILE /etc/unbound/unbound_server.key
287 cp -p $UB_SRVPEM_FILE /etc/unbound/unbound_server.pem
288 ;;
289 esac
290 fi
291
292
293 if [ -f "$UB_TIME_FILE" ] ; then
294 # NTP is done so its like you actually had an RTC
295 UB_B_READY=1
296 UB_B_NTP_BOOT=0
297
298 elif [ "$UB_B_NTP_BOOT" -eq 0 ] ; then
299 # time is considered okay on this device (ignore /etc/hotplug/ntpd/unbound)
300 date -Is > $UB_TIME_FILE
301 UB_B_READY=0
302 UB_B_NTP_BOOT=0
303
304 else
305 # DNSSEC-TIME will not reconcile
306 UB_B_READY=0
307 UB_B_NTP_BOOT=1
308 fi
309 }
310
311 ##############################################################################
312
313 unbound_control() {
314 echo "# $UB_CTRL_CONF generated by UCI $( date -Is )" > $UB_CTRL_CONF
315
316
317 if [ "$UB_D_CONTROL" -gt 1 ] ; then
318 if [ ! -f $UB_CTLKEY_FILE ] || [ ! -f $UB_CTLPEM_FILE ] \
319 || [ ! -f $UB_SRVKEY_FILE ] || [ ! -f $UB_SRVPEM_FILE ] ; then
320 # Key files need to be present; if unbound-control-setup was found, then
321 # they might have been made during unbound_makedir() above.
322 UB_D_CONTROL=0
323 fi
324 fi
325
326
327 case "$UB_D_CONTROL" in
328 1)
329 {
330 # Local Host Only Unencrypted Remote Control
331 echo "remote-control:"
332 echo " control-enable: yes"
333 echo " control-use-cert: no"
334 echo " control-interface: 127.0.0.1"
335 echo " control-interface: ::1"
336 echo
337 } >> $UB_CTRL_CONF
338 ;;
339
340 2)
341 {
342 # Local Host Only Encrypted Remote Control
343 echo "remote-control:"
344 echo " control-enable: yes"
345 echo " control-use-cert: yes"
346 echo " control-interface: 127.0.0.1"
347 echo " control-interface: ::1"
348 echo " server-key-file: $UB_SRVKEY_FILE"
349 echo " server-cert-file: $UB_SRVPEM_FILE"
350 echo " control-key-file: $UB_CTLKEY_FILE"
351 echo " control-cert-file: $UB_CTLPEM_FILE"
352 echo
353 } >> $UB_CTRL_CONF
354 ;;
355
356 [3-4])
357 {
358 # Network Encrypted Remote Control
359 # (3) may auto setup and (4) must have static key/pem files
360 # TODO: add UCI list for interfaces to bind
361 echo "remote-control:"
362 echo " control-enable: yes"
363 echo " control-use-cert: yes"
364 echo " control-interface: 0.0.0.0"
365 echo " control-interface: ::0"
366 echo " server-key-file: $UB_SRVKEY_FILE"
367 echo " server-cert-file: $UB_SRVPEM_FILE"
368 echo " control-key-file: $UB_CTLKEY_FILE"
369 echo " control-cert-file: $UB_CTLPEM_FILE"
370 echo
371 } >> $UB_CTRL_CONF
372 ;;
373 esac
374 }
375
376 ##############################################################################
377
378 unbound_zone() {
379 local cfg=$1
380 local servers_ip=""
381 local servers_host=""
382 local zone_sym zone_name zone_type zone_enabled zone_file
383 local tls_upstream fallback
384 local server port tls_port tls_index tls_suffix url_dir
385
386 if [ ! -f "$UB_ZONE_CONF" ] ; then
387 echo "# $UB_ZONE_CONF generated by UCI $( date -Is )" > $UB_ZONE_CONF
388 fi
389
390
391 config_get_bool zone_enabled "$cfg" enabled 0
392
393
394 if [ "$zone_enabled" -eq 1 ] ; then
395 # these lists are built for each zone; empty to start
396 UB_LIST_ZONE_NAMES=""
397 UB_LIST_ZONE_SERVERS=""
398
399 config_get zone_type "$cfg" zone_type ""
400 config_get port "$cfg" port ""
401 config_get tls_index "$cfg" tls_index ""
402 config_get tls_port "$cfg" tls_port 853
403 config_get url_dir "$cfg" url_dir ""
404
405 config_get_bool resolv_conf "$cfg" resolv_conf 0
406 config_get_bool fallback "$cfg" fallback 1
407 config_get_bool tls_upstream "$cfg" tls_upstream 0
408
409 config_list_foreach "$cfg" zone_name bundle_zone_names
410 config_list_foreach "$cfg" server bundle_zone_servers
411
412 # string formating for Unbound syntax
413 tls_suffix="${tls_port:+@${tls_port}${tls_index:+#${tls_index}}}"
414 [ "$fallback" -eq 0 ] && fallback=no || fallback=yes
415 [ "$tls_upstream" -eq 0 ] && tls_upstream=no || tls_upstream=yes
416
417
418 if [ $resolv_conf -eq 1 ] ; then
419 bundle_resolv_conf_servers
420 fi
421
422 else
423 zone_type=skip
424 fi
425
426
427 case $zone_type in
428 auth_zone)
429 if [ "$UB_B_NTP_BOOT" -eq 0 ] && [ -n "$UB_LIST_ZONE_NAMES" ] \
430 && { [ -n "$url_dir" ] || [ -n "$UB_LIST_ZONE_SERVERS" ] ; } ; then
431 # Note AXFR may have large downloads. If NTP restart is configured,
432 # then this can cause procd to force a process kill.
433 for zone_name in $UB_LIST_ZONE_NAMES ; do
434 if [ "$zone_name" = "." ] ; then
435 zone_sym=.
436 zone_name=root
437 zone_file=root.zone
438 else
439 zone_sym=$zone_name
440 zone_file=$zone_name.zone
441 zone_file=${zone_file//../.}
442 fi
443
444
445 {
446 # generate an auth-zone: with switches for prefetch cache
447 echo "auth-zone:"
448 echo " name: $zone_sym"
449 for server in $UB_LIST_ZONE_SERVERS ; do
450 echo " master: $server${port:+@${port}}"
451 done
452 if [ -n "$url_dir" ] ; then
453 echo " url: $url_dir$zone_file"
454 fi
455 echo " fallback-enabled: $fallback"
456 echo " for-downstream: no"
457 echo " for-upstream: yes"
458 echo " zonefile: $zone_file"
459 echo
460 } >> $UB_ZONE_CONF
461 done
462 fi
463 ;;
464
465 forward_zone)
466 if [ ! -f $UB_TLS_FWD_FILE ] && [ "$tls_upstream" = "yes" ] ; then
467 logger -p 4 -t unbound -s \
468 "Forward-zone TLS benefits from authentication in package 'ca-bundle'"
469 fi
470
471
472 if [ -n "$UB_LIST_ZONE_NAMES" ] && [ -n "$UB_LIST_ZONE_SERVERS" ] ; then
473 for server in $UB_LIST_ZONE_SERVERS ; do
474 if [ "$( valid_subnet_any $server )" = "not" ] ; then
475 case $server in
476 *@[0-9]*|*#[A-Za-z0-9]*)
477 # unique Unbound option for server host name
478 servers_host="$servers_host $server"
479 ;;
480
481 *)
482 if [ "$tls_upstream" = "yes" ] ; then
483 servers_host="$servers_host $server${tls_port:+@${tls_port}}"
484 else
485 servers_host="$servers_host $server${port:+@${port}}"
486 fi
487 ;;
488 esac
489
490 else
491 case $server in
492 *@[0-9]*|*#[A-Za-z0-9]*)
493 # unique Unbound option for server address
494 servers_ip="$servers_ip $server"
495 ;;
496
497 *)
498 if [ "$tls_upstream" = "yes" ] ; then
499 servers_ip="$servers_ip $server$tls_suffix"
500 else
501 servers_ip="$servers_ip $server${port:+@${port}}"
502 fi
503 ;;
504 esac
505 fi
506 done
507
508
509 for zonename in $UB_LIST_ZONE_NAMES ; do
510 {
511 # generate a forward-zone with or without tls
512 echo "forward-zone:"
513 echo " name: $zonename"
514 for server in $servers_host ; do
515 echo " forward-host: $server"
516 done
517 for server in $servers_ip ; do
518 echo " forward-addr: $server"
519 done
520 echo " forward-first: $fallback"
521 echo " forward-tls-upstream: $tls_upstream"
522 echo
523 } >> $UB_ZONE_CONF
524 done
525 fi
526 ;;
527
528 stub_zone)
529 if [ -n "$UB_LIST_ZONE_NAMES" ] && [ -n "$UB_LIST_ZONE_SERVERS" ] ; then
530 for zonename in $UB_LIST_ZONE_NAMES ; do
531 {
532 # generate a stub-zone: or ensure short cut to authority NS
533 echo "stub-zone:"
534 echo " name: $zonename"
535 for server in $UB_LIST_ZONE_SERVERS ; do
536 echo " stub-addr: $server${port:+@${port}}"
537 done
538 echo " stub-first: $fallback"
539 echo
540 } >> $UB_ZONE_CONF
541 done
542 fi
543 ;;
544 esac
545 }
546
547 ##############################################################################
548
549 unbound_conf() {
550 local rt_mem rt_conn rt_buff modulestring domain ifsubnet
551
552 {
553 # server: for this whole function
554 echo "# $UB_CORE_CONF generated by UCI $( date -Is )"
555 echo "server:"
556 echo " username: unbound"
557 echo " chroot: $UB_VARDIR"
558 echo " directory: $UB_VARDIR"
559 echo " pidfile: $UB_PIDFILE"
560 } > $UB_CORE_CONF
561
562
563 if [ -f "$UB_TLS_FWD_FILE" ] ; then
564 # TLS cert bundle for upstream forwarder and https zone files
565 # This is loaded before drop to root, so pull from /etc/ssl
566 echo " tls-cert-bundle: $UB_TLS_FWD_FILE" >> $UB_CORE_CONF
567 fi
568
569
570 if [ -f "$UB_RHINT_FILE" ] ; then
571 # Optional hints if found
572 echo " root-hints: $UB_RHINT_FILE" >> $UB_CORE_CONF
573 fi
574
575
576 if [ "$UB_B_DNSSEC" -gt 0 ] && [ -f "$UB_RKEY_FILE" ] ; then
577 {
578 echo " auto-trust-anchor-file: $UB_RKEY_FILE"
579 echo
580 } >> $UB_CORE_CONF
581
582 else
583 echo >> $UB_CORE_CONF
584 fi
585
586
587 if [ "$UB_N_THREADS" -gt 1 ] \
588 && $PROG -V | grep -q "Linked libs:.*libevent" ; then
589 # heavy variant using "threads" may need substantial resources
590 echo " num-threads: 2" >> $UB_CORE_CONF
591 else
592 # light variant with one "process" is much more efficient with light traffic
593 echo " num-threads: 1" >> $UB_CORE_CONF
594 fi
595
596
597 {
598 # Limited threading (2) with one shared slab
599 echo " msg-cache-slabs: 1"
600 echo " rrset-cache-slabs: 1"
601 echo " infra-cache-slabs: 1"
602 echo " key-cache-slabs: 1"
603 echo
604 # Logging
605 echo " use-syslog: yes"
606 echo " statistics-interval: 0"
607 echo " statistics-cumulative: no"
608 } >> $UB_CORE_CONF
609
610
611 if [ "$UB_D_VERBOSE" -ge 0 ] && [ "$UB_D_VERBOSE" -le 5 ] ; then
612 echo " verbosity: $UB_D_VERBOSE" >> $UB_CORE_CONF
613 fi
614
615
616 if [ "$UB_B_EXT_STATS" -gt 0 ] ; then
617 {
618 # Log More
619 echo " extended-statistics: yes"
620 echo
621 } >> $UB_CORE_CONF
622
623 else
624 {
625 # Log Less
626 echo " extended-statistics: no"
627 echo
628 } >> $UB_CORE_CONF
629 fi
630
631
632 case "$UB_D_PROTOCOL" in
633 ip4_only)
634 {
635 echo " edns-buffer-size: $UB_N_EDNS_SIZE"
636 echo " port: $UB_N_RX_PORT"
637 echo " outgoing-port-permit: 10240-65535"
638 echo " interface: 0.0.0.0"
639 echo " outgoing-interface: 0.0.0.0"
640 echo " do-ip4: yes"
641 echo " do-ip6: no"
642 echo
643 } >> $UB_CORE_CONF
644 ;;
645
646 ip6_only)
647 {
648 echo " edns-buffer-size: $UB_N_EDNS_SIZE"
649 echo " port: $UB_N_RX_PORT"
650 echo " outgoing-port-permit: 10240-65535"
651 echo " interface: ::0"
652 echo " outgoing-interface: ::0"
653 echo " do-ip4: no"
654 echo " do-ip6: yes"
655 echo
656 } >> $UB_CORE_CONF
657 ;;
658
659 ip6_local)
660 {
661 echo " edns-buffer-size: $UB_N_EDNS_SIZE"
662 echo " port: $UB_N_RX_PORT"
663 echo " outgoing-port-permit: 10240-65535"
664 echo " interface: 0.0.0.0"
665 echo " interface: ::0"
666 echo " outgoing-interface: 0.0.0.0"
667 echo " do-ip4: yes"
668 echo " do-ip6: yes"
669 echo
670 } >> $UB_CORE_CONF
671 ;;
672
673 ip6_prefer)
674 {
675 echo " edns-buffer-size: $UB_N_EDNS_SIZE"
676 echo " port: $UB_N_RX_PORT"
677 echo " outgoing-port-permit: 10240-65535"
678 echo " interface: 0.0.0.0"
679 echo " interface: ::0"
680 echo " outgoing-interface: 0.0.0.0"
681 echo " outgoing-interface: ::0"
682 echo " do-ip4: yes"
683 echo " do-ip6: yes"
684 echo " prefer-ip6: yes"
685 echo
686 } >> $UB_CORE_CONF
687 ;;
688
689 mixed)
690 {
691 # Interface Wildcard (access contol handled by "option local_service")
692 echo " edns-buffer-size: $UB_N_EDNS_SIZE"
693 echo " port: $UB_N_RX_PORT"
694 echo " outgoing-port-permit: 10240-65535"
695 echo " interface: 0.0.0.0"
696 echo " interface: ::0"
697 echo " outgoing-interface: 0.0.0.0"
698 echo " outgoing-interface: ::0"
699 echo " do-ip4: yes"
700 echo " do-ip6: yes"
701 echo
702 } >> $UB_CORE_CONF
703 ;;
704
705 *)
706 if [ "$UB_B_READY" -eq 0 ] ; then
707 logger -t unbound -s "default protocol configuration"
708 fi
709
710
711 {
712 # outgoing-interface has useful defaults; incoming is localhost though
713 echo " edns-buffer-size: $UB_N_EDNS_SIZE"
714 echo " port: $UB_N_RX_PORT"
715 echo " outgoing-port-permit: 10240-65535"
716 echo " interface: 0.0.0.0"
717 echo " interface: ::0"
718 echo
719 } >> $UB_CORE_CONF
720 ;;
721 esac
722
723
724 if [ "$UB_B_IF_AUTO" -gt 0 ] ; then
725 echo " interface-automatic: yes" >> $UB_CORE_CONF
726 fi
727
728
729 case "$UB_D_RESOURCE" in
730 # Tiny - Unbound's recommended cheap hardware config
731 tiny) rt_mem=1 ; rt_conn=2 ; rt_buff=1 ;;
732 # Small - Half RRCACHE and open ports
733 small) rt_mem=8 ; rt_conn=10 ; rt_buff=2 ;;
734 # Medium - Nearly default but with some added balancintg
735 medium) rt_mem=16 ; rt_conn=15 ; rt_buff=4 ;;
736 # Large - Double medium
737 large) rt_mem=32 ; rt_conn=20 ; rt_buff=4 ;;
738 # Whatever unbound does
739 *) rt_mem=0 ; rt_conn=0 ;;
740 esac
741
742
743 if [ "$rt_mem" -gt 0 ] ; then
744 {
745 # Other harding and options for an embedded router
746 echo " harden-short-bufsize: yes"
747 echo " harden-large-queries: yes"
748 echo " harden-glue: yes"
749 echo " use-caps-for-id: no"
750 echo
751 # Set memory sizing parameters
752 echo " msg-buffer-size: $(($rt_buff*8192))"
753 echo " outgoing-range: $(($rt_conn*32))"
754 echo " num-queries-per-thread: $(($rt_conn*16))"
755 echo " outgoing-num-tcp: $(($rt_conn))"
756 echo " incoming-num-tcp: $(($rt_conn))"
757 echo " rrset-cache-size: $(($rt_mem*256))k"
758 echo " msg-cache-size: $(($rt_mem*128))k"
759 echo " key-cache-size: $(($rt_mem*128))k"
760 echo " neg-cache-size: $(($rt_mem*64))k"
761 echo " infra-cache-numhosts: $(($rt_mem*256))"
762 echo
763 } >> $UB_CORE_CONF
764
765 elif [ "$UB_B_READY" -eq 0 ] ; then
766 logger -t unbound -s "default memory configuration"
767 fi
768
769
770 # Assembly of module-config: options is tricky; order matters
771 modulestring="iterator"
772
773
774 if [ "$UB_B_DNSSEC" -gt 0 ] ; then
775 if [ "$UB_B_NTP_BOOT" -gt 0 ] ; then
776 # DNSSEC chicken and egg with getting NTP time
777 echo " val-override-date: -1" >> $UB_CORE_CONF
778 fi
779
780
781 {
782 echo " harden-dnssec-stripped: yes"
783 echo " val-clean-additional: yes"
784 echo " ignore-cd-flag: yes"
785 } >> $UB_CORE_CONF
786
787
788 modulestring="validator $modulestring"
789 fi
790
791
792 if [ "$UB_B_DNS64" -gt 0 ] ; then
793 echo " dns64-prefix: $UB_IP_DNS64" >> $UB_CORE_CONF
794
795 modulestring="dns64 $modulestring"
796 fi
797
798
799 {
800 # Print final module string
801 echo " module-config: \"$modulestring\""
802 echo
803 } >> $UB_CORE_CONF
804
805
806 case "$UB_D_RECURSION" in
807 passive)
808 {
809 # Some query privacy but "strict" will break some servers
810 if [ "$UB_B_QRY_MINST" -gt 0 ] && [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
811 echo " qname-minimisation: yes"
812 echo " qname-minimisation-strict: yes"
813 elif [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
814 echo " qname-minimisation: yes"
815 else
816 echo " qname-minimisation: no"
817 fi
818 # Use DNSSEC to quickly understand NXDOMAIN ranges
819 if [ "$UB_B_DNSSEC" -gt 0 ] ; then
820 echo " aggressive-nsec: yes"
821 echo " prefetch-key: no"
822 fi
823 # On demand fetching
824 echo " prefetch: no"
825 echo " target-fetch-policy: \"0 0 0 0 0\""
826 echo
827 } >> $UB_CORE_CONF
828 ;;
829
830 aggressive)
831 {
832 # Some query privacy but "strict" will break some servers
833 if [ "$UB_B_QRY_MINST" -gt 0 ] && [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
834 echo " qname-minimisation: yes"
835 echo " qname-minimisation-strict: yes"
836 elif [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
837 echo " qname-minimisation: yes"
838 else
839 echo " qname-minimisation: no"
840 fi
841 # Use DNSSEC to quickly understand NXDOMAIN ranges
842 if [ "$UB_B_DNSSEC" -gt 0 ] ; then
843 echo " aggressive-nsec: yes"
844 echo " prefetch-key: yes"
845 fi
846 # Prefetch what can be
847 echo " prefetch: yes"
848 echo " target-fetch-policy: \"3 2 1 0 0\""
849 echo
850 } >> $UB_CORE_CONF
851 ;;
852
853 *)
854 if [ "$UB_B_READY" -eq 0 ] ; then
855 logger -t unbound -s "default recursion configuration"
856 fi
857 ;;
858 esac
859
860
861 {
862 # Reload records more than 20 hours old
863 # DNSSEC 5 minute bogus cool down before retry
864 # Adaptive infrastructure info kept for 15 minutes
865 echo " cache-min-ttl: $UB_TTL_MIN"
866 echo " cache-max-ttl: 72000"
867 echo " val-bogus-ttl: 300"
868 echo " infra-host-ttl: 900"
869 echo
870 } >> $UB_CORE_CONF
871
872
873 if [ "$UB_B_HIDE_BIND" -gt 0 ] ; then
874 {
875 # Block server id and version DNS TXT records
876 echo " hide-identity: yes"
877 echo " hide-version: yes"
878 echo
879 } >> $UB_CORE_CONF
880 fi
881
882
883 if [ "$UB_D_PRIV_BLCK" -gt 0 ] ; then
884 {
885 # Remove _upstream_ or global reponses with private addresses.
886 # Unbounds own "local zone" and "forward zone" may still use these.
887 # RFC1918, RFC3927, RFC4291, RFC6598, RFC6890
888 echo " private-address: 10.0.0.0/8"
889 echo " private-address: 100.64.0.0/10"
890 echo " private-address: 169.254.0.0/16"
891 echo " private-address: 172.16.0.0/12"
892 echo " private-address: 192.168.0.0/16"
893 echo " private-address: fc00::/7"
894 echo " private-address: fe80::/10"
895 echo
896 } >> $UB_CORE_CONF
897 fi
898
899
900 if [ -n "$UB_LIST_NETW_LAN" ] && [ "$UB_D_PRIV_BLCK" -gt 1 ] ; then
901 {
902 for ifsubnet in $UB_LIST_NETW_LAN ; do
903 case $ifsubnet in
904 *@[1-9][0-9a-f][0-9a-f][0-9a-f]:*:[0-9a-f]*)
905 # Remove global DNS responses with your local network IP6 GLA
906 echo " private-address: ${ifsubnet#*@}"
907 ;;
908 esac
909 done
910 echo
911 } >> $UB_CORE_CONF
912 fi
913
914
915 if [ "$UB_B_LOCL_BLCK" -gt 0 ] ; then
916 {
917 # Remove DNS reponses from upstream with loopback IP
918 # Black hole DNS method for ad blocking, so consider...
919 echo " private-address: 127.0.0.0/8"
920 echo " private-address: ::1/128"
921 echo
922 } >> $UB_CORE_CONF
923 fi
924
925
926 if [ -n "$UB_LIST_INSECURE" ] ; then
927 {
928 for domain in $UB_LIST_INSECURE ; do
929 # Except and accept domains without (DNSSEC); work around broken domains
930 echo " domain-insecure: $domain"
931 done
932 echo
933 } >> $UB_CORE_CONF
934 fi
935
936
937 if [ "$UB_B_LOCL_SERV" -gt 0 ] && [ -n "$UB_LIST_NETW_ALL" ] ; then
938 {
939 for ifsubnet in $UB_LIST_NETW_ALL ; do
940 # Only respond to queries from subnets which have an interface.
941 # Prevent DNS amplification attacks by not responding to the universe.
942 echo " access-control: ${ifsubnet#*@} allow"
943 done
944 echo " access-control: 127.0.0.0/8 allow"
945 echo " access-control: ::1/128 allow"
946 echo " access-control: fe80::/10 allow"
947 echo
948 } >> $UB_CORE_CONF
949
950 else
951 {
952 echo " access-control: 0.0.0.0/0 allow"
953 echo " access-control: ::0/0 allow"
954 echo
955 } >> $UB_CORE_CONF
956 fi
957 }
958
959 ##############################################################################
960
961 unbound_hostname() {
962 local ifsubnet ifarpa ifaddr ifname iffqdn
963 local ulaprefix hostfqdn name names namerec ptrrec
964 local zonetype=0
965
966 echo "# $UB_HOST_CONF generated by UCI $( date -Is )" > $UB_HOST_CONF
967
968
969 if [ "$UB_D_DHCP_LINK" = "dnsmasq" ] ; then
970 {
971 echo "# Local zone is handled by dnsmasq"
972 echo
973 } >> $UB_HOST_CONF
974
975 elif [ -n "$UB_TXT_DOMAIN" ] \
976 && { [ "$UB_D_WAN_FQDN" -gt 0 ] || [ "$UB_D_LAN_FQDN" -gt 0 ] ; } ; then
977 case "$UB_D_DOMAIN_TYPE" in
978 deny|inform_deny|refuse|static)
979 {
980 # type static means only this router has your domain
981 echo " domain-insecure: $UB_TXT_DOMAIN"
982 echo " private-domain: $UB_TXT_DOMAIN"
983 echo " local-zone: $UB_TXT_DOMAIN $UB_D_DOMAIN_TYPE"
984 echo " local-data: \"$UB_TXT_DOMAIN. $UB_XSOA\""
985 echo " local-data: \"$UB_TXT_DOMAIN. $UB_XNS\""
986 echo " local-data: '$UB_TXT_DOMAIN. $UB_XTXT'"
987 echo
988 if [ "$UB_TXT_DOMAIN" != "local" ] ; then
989 # avoid involvement in RFC6762, unless it is the local zone name
990 echo " local-zone: local always_nxdomain"
991 echo
992 fi
993 } >> $UB_HOST_CONF
994 zonetype=2
995 ;;
996
997 inform|transparent|typetransparent)
998 {
999 # transparent will permit forward-zone: or stub-zone: clauses
1000 echo " private-domain: $UB_TXT_DOMAIN"
1001 echo " local-zone: $UB_TXT_DOMAIN $UB_D_DOMAIN_TYPE"
1002 echo
1003 } >> $UB_HOST_CONF
1004 zonetype=1
1005 ;;
1006 esac
1007
1008
1009 {
1010 # Hostname as TLD works, but not transparent through recursion (singular)
1011 echo " domain-insecure: $UB_TXT_HOSTNAME"
1012 echo " private-domain: $UB_TXT_HOSTNAME"
1013 echo " local-zone: $UB_TXT_HOSTNAME static"
1014 echo " local-data: \"$UB_TXT_HOSTNAME. $UB_XSOA\""
1015 echo " local-data: \"$UB_TXT_HOSTNAME. $UB_XNS\""
1016 echo " local-data: '$UB_TXT_HOSTNAME. $UB_XTXT'"
1017 echo
1018 } >> $UB_HOST_CONF
1019
1020
1021 if [ -n "$UB_LIST_NETW_WAN" ] ; then
1022 for ifsubnet in $UB_LIST_NETW_WAN ; do
1023 ifaddr=${ifsubnet#*@}
1024 ifaddr=${ifaddr%/*}
1025 ifarpa=$( host_ptr_any "$ifaddr" )
1026
1027
1028 if [ -n "$ifarpa" ] ; then
1029 if [ "$UB_D_WAN_FQDN" -gt 0 ] ; then
1030 {
1031 # Create a static zone for WAN host record only (singular)
1032 echo " domain-insecure: $ifarpa"
1033 echo " private-address: $ifaddr"
1034 echo " local-zone: $ifarpa static"
1035 echo " local-data: \"$ifarpa. $UB_XSOA\""
1036 echo " local-data: \"$ifarpa. $UB_XNS\""
1037 echo " local-data: '$ifarpa. $UB_MTXT'"
1038 echo
1039 } >> $UB_HOST_CONF
1040
1041 elif [ "$zonetype" -gt 0 ] ; then
1042 {
1043 echo " local-zone: $ifarpa transparent"
1044 echo
1045 } >> $UB_HOST_CONF
1046 fi
1047 fi
1048 done
1049 fi
1050
1051
1052 if [ -n "$UB_LIST_NETW_LAN" ] ; then
1053 for ifsubnet in $UB_LIST_NETW_LAN ; do
1054 ifarpa=$( domain_ptr_any "${ifsubnet#*@}" )
1055
1056
1057 if [ -n "$ifarpa" ] ; then
1058 if [ "$zonetype" -eq 2 ] ; then
1059 {
1060 # Do NOT forward queries with your ip6.arpa or in-addr.arpa
1061 echo " domain-insecure: $ifarpa"
1062 echo " local-zone: $ifarpa static"
1063 echo " local-data: \"$ifarpa. $UB_XSOA\""
1064 echo " local-data: \"$ifarpa. $UB_XNS\""
1065 echo " local-data: '$ifarpa. $UB_XTXT'"
1066 echo
1067 } >> $UB_HOST_CONF
1068
1069 elif [ "$zonetype" -eq 1 ] && [ "$UB_D_PRIV_BLCK" -eq 0 ] ; then
1070 {
1071 echo " local-zone: $ifarpa transparent"
1072 echo
1073 } >> $UB_HOST_CONF
1074 fi
1075 fi
1076 done
1077 fi
1078
1079
1080 ulaprefix=$( uci_get network.@globals[0].ula_prefix )
1081 ulaprefix=${ulaprefix%%:/*}
1082 hostfqdn="$UB_TXT_HOSTNAME.$UB_TXT_DOMAIN"
1083
1084
1085 if [ -z "$ulaprefix" ] ; then
1086 # Nonsense so this option isn't globbed below
1087 ulaprefix="fdno:such:addr::"
1088 fi
1089
1090
1091 if [ "$UB_LIST_NETW_LAN" ] && [ "$UB_D_LAN_FQDN" -gt 0 ] ; then
1092 for ifsubnet in $UB_LIST_NETW_LAN ; do
1093 ifaddr=${ifsubnet#*@}
1094 ifaddr=${ifaddr%/*}
1095 ifname=${ifsubnet%@*}
1096 iffqdn="$ifname.$hostfqdn"
1097
1098
1099 if [ "$UB_D_LAN_FQDN" -eq 4 ] ; then
1100 names="$iffqdn $hostfqdn $UB_TXT_HOSTNAME"
1101 ptrrec=" local-data-ptr: \"$ifaddr 300 $iffqdn\""
1102 echo "$ptrrec" >> $UB_HOST_CONF
1103
1104 elif [ "$UB_D_LAN_FQDN" -eq 3 ] ; then
1105 names="$hostfqdn $UB_TXT_HOSTNAME"
1106 ptrrec=" local-data-ptr: \"$ifaddr 300 $hostfqdn\""
1107 echo "$ptrrec" >> $UB_HOST_CONF
1108
1109 else
1110 names="$UB_TXT_HOSTNAME"
1111 ptrrec=" local-data-ptr: \"$ifaddr 300 $UB_TXT_HOSTNAME\""
1112 echo "$ptrrec" >> $UB_HOST_CONF
1113 fi
1114
1115
1116 for name in $names ; do
1117 case $ifaddr in
1118 "${ulaprefix}"*)
1119 # IP6 ULA only is assigned for OPTION 1
1120 namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
1121 echo "$namerec" >> $UB_HOST_CONF
1122 ;;
1123
1124 [1-9]*.*[0-9])
1125 namerec=" local-data: \"$name. 300 IN A $ifaddr\""
1126 echo "$namerec" >> $UB_HOST_CONF
1127 ;;
1128
1129 *)
1130 if [ "$UB_D_LAN_FQDN" -gt 1 ] ; then
1131 # IP6 GLA is assigned for higher options
1132 namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
1133 echo "$namerec" >> $UB_HOST_CONF
1134 fi
1135 ;;
1136 esac
1137 done
1138 echo >> $UB_HOST_CONF
1139 done
1140 fi
1141
1142
1143 if [ -n "$UB_LIST_NETW_WAN" ] && [ "$UB_D_WAN_FQDN" -gt 0 ] ; then
1144 for ifsubnet in $UB_LIST_NETW_WAN ; do
1145 ifaddr=${ifsubnet#*@}
1146 ifaddr=${ifaddr%/*}
1147 ifname=${ifsubnet%@*}
1148 iffqdn="$ifname.$hostfqdn"
1149
1150
1151 if [ "$UB_D_WAN_FQDN" -eq 4 ] ; then
1152 names="$iffqdn $hostfqdn $UB_TXT_HOSTNAME"
1153 ptrrec=" local-data-ptr: \"$ifaddr 300 $iffqdn\""
1154 echo "$ptrrec" >> $UB_HOST_CONF
1155
1156 elif [ "$UB_D_WAN_FQDN" -eq 3 ] ; then
1157 names="$hostfqdn $UB_TXT_HOSTNAME"
1158 ptrrec=" local-data-ptr: \"$ifaddr 300 $hostfqdn\""
1159 echo "$ptrrec" >> $UB_HOST_CONF
1160
1161 else
1162 names="$UB_TXT_HOSTNAME"
1163 ptrrec=" local-data-ptr: \"$ifaddr 300 $UB_TXT_HOSTNAME\""
1164 echo "$ptrrec" >> $UB_HOST_CONF
1165 fi
1166
1167
1168 for name in $names ; do
1169 case $ifaddr in
1170 "${ulaprefix}"*)
1171 # IP6 ULA only is assigned for OPTION 1
1172 namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
1173 echo "$namerec" >> $UB_HOST_CONF
1174 ;;
1175
1176 [1-9]*.*[0-9])
1177 namerec=" local-data: \"$name. 300 IN A $ifaddr\""
1178 echo "$namerec" >> $UB_HOST_CONF
1179 ;;
1180
1181 *)
1182 if [ "$UB_D_WAN_FQDN" -gt 1 ] ; then
1183 # IP6 GLA is assigned for higher options
1184 namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
1185 echo "$namerec" >> $UB_HOST_CONF
1186 fi
1187 ;;
1188 esac
1189 done
1190 echo >> $UB_HOST_CONF
1191 done
1192 fi
1193 fi # end if uci valid
1194 }
1195
1196 ##############################################################################
1197
1198 unbound_uci() {
1199 local cfg="$1"
1200 local hostnm
1201
1202 hostnm=$( uci_get system.@system[0].hostname | awk '{print tolower($0)}' )
1203 UB_TXT_HOSTNAME=${hostnm:-thisrouter}
1204
1205 config_get_bool UB_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
1206 config_get_bool UB_B_DNS64 "$cfg" dns64 0
1207 config_get_bool UB_B_EXT_STATS "$cfg" extended_stats 0
1208 config_get_bool UB_B_HIDE_BIND "$cfg" hide_binddata 1
1209 config_get_bool UB_B_LOCL_SERV "$cfg" localservice 1
1210 config_get_bool UB_B_MAN_CONF "$cfg" manual_conf 0
1211 config_get_bool UB_B_QUERY_MIN "$cfg" query_minimize 0
1212 config_get_bool UB_B_QRY_MINST "$cfg" query_min_strict 0
1213 config_get_bool UB_B_AUTH_ROOT "$cfg" prefetch_root 0
1214 config_get_bool UB_B_LOCL_BLCK "$cfg" rebind_localhost 0
1215 config_get_bool UB_B_DNSSEC "$cfg" validator 0
1216 config_get_bool UB_B_NTP_BOOT "$cfg" validator_ntp 1
1217 config_get_bool UB_B_IF_AUTO "$cfg" interface_auto 1
1218
1219 config_get UB_IP_DNS64 "$cfg" dns64_prefix "64:ff9b::/96"
1220
1221 config_get UB_N_EDNS_SIZE "$cfg" edns_size 1280
1222 config_get UB_N_RX_PORT "$cfg" listen_port 53
1223 config_get UB_N_ROOT_AGE "$cfg" root_age 9
1224 config_get UB_N_THREADS "$cfg" num_threads 1
1225
1226 config_get UB_D_CONTROL "$cfg" unbound_control 0
1227 config_get UB_D_DOMAIN_TYPE "$cfg" domain_type static
1228 config_get UB_D_DHCP_LINK "$cfg" dhcp_link none
1229 config_get UB_D_EXTRA_DNS "$cfg" add_extra_dns 0
1230 config_get UB_D_LAN_FQDN "$cfg" add_local_fqdn 0
1231 config_get UB_D_PRIV_BLCK "$cfg" rebind_protection 1
1232 config_get UB_D_PROTOCOL "$cfg" protocol mixed
1233 config_get UB_D_RECURSION "$cfg" recursion passive
1234 config_get UB_D_RESOURCE "$cfg" resource small
1235 config_get UB_D_VERBOSE "$cfg" verbosity 1
1236 config_get UB_D_WAN_FQDN "$cfg" add_wan_fqdn 0
1237
1238 config_get UB_TTL_MIN "$cfg" ttl_min 120
1239 config_get UB_TXT_DOMAIN "$cfg" domain lan
1240
1241 config_list_foreach "$cfg" domain_insecure bundle_domain_insecure
1242
1243
1244 if [ "$UB_D_DHCP_LINK" = "none" ] ; then
1245 config_get_bool UB_B_DNSMASQ "$cfg" dnsmasq_link_dns 0
1246
1247
1248 if [ "$UB_B_DNSMASQ" -gt 0 ] ; then
1249 UB_D_DHCP_LINK=dnsmasq
1250
1251
1252 if [ "$UB_B_READY" -eq 0 ] ; then
1253 logger -t unbound -s "Please use 'dhcp_link' selector instead"
1254 fi
1255 fi
1256 fi
1257
1258
1259 if [ "$UB_D_DHCP_LINK" = "dnsmasq" ] ; then
1260 if [ ! -x /usr/sbin/dnsmasq ] || [ ! -x /etc/init.d/dnsmasq ] ; then
1261 UB_D_DHCP_LINK=none
1262 else
1263 /etc/init.d/dnsmasq enabled || UB_D_DHCP_LINK=none
1264 fi
1265
1266
1267 if [ "$UB_B_READY" -eq 0 ] && [ "$UB_D_DHCP_LINK" = "none" ] ; then
1268 logger -t unbound -s "cannot forward to dnsmasq"
1269 fi
1270 fi
1271
1272
1273 if [ "$UB_D_DHCP_LINK" = "odhcpd" ] ; then
1274 if [ ! -x /usr/sbin/odhcpd ] || [ ! -x /etc/init.d/odhcpd ] ; then
1275 UB_D_DHCP_LINK=none
1276 else
1277 /etc/init.d/odhcpd enabled || UB_D_DHCP_LINK=none
1278 fi
1279
1280
1281 if [ "$UB_B_READY" -eq 0 ] && [ "$UB_D_DHCP_LINK" = "none" ] ; then
1282 logger -t unbound -s "cannot receive records from odhcpd"
1283 fi
1284 fi
1285
1286
1287 if [ "$UB_N_EDNS_SIZE" -lt 512 ] || [ 4096 -lt "$UB_N_EDNS_SIZE" ] ; then
1288 logger -t unbound -s "edns_size exceeds range, using default"
1289 UB_N_EDNS_SIZE=1280
1290 fi
1291
1292
1293 if [ "$UB_N_RX_PORT" -ne 53 ] \
1294 && { [ "$UB_N_RX_PORT" -lt 1024 ] || [ 10240 -lt "$UB_N_RX_PORT" ] ; } ; then
1295 logger -t unbound -s "privileged port or in 5 digits, using default"
1296 UB_N_RX_PORT=53
1297 fi
1298
1299
1300 if [ "$UB_TTL_MIN" -gt 1800 ] ; then
1301 logger -t unbound -s "ttl_min could have had awful side effects, using 300"
1302 UB_TTL_MIN=300
1303 fi
1304 }
1305
1306 ##############################################################################
1307
1308 unbound_include() {
1309 local adb_enabled
1310 local adb_files=$( ls $UB_VARDIR/adb_list.* 2>/dev/null )
1311
1312 echo "# $UB_TOTAL_CONF generated by UCI $( date -Is )" > $UB_TOTAL_CONF
1313
1314
1315 if [ -f "$UB_CORE_CONF" ] ; then
1316 # Yes this all looks busy, but it is in TMPFS. Working on separate files
1317 # and piecing together is easier. UCI order is less constrained.
1318 cat $UB_CORE_CONF >> $UB_TOTAL_CONF
1319 rm $UB_CORE_CONF
1320 fi
1321
1322
1323 if [ -f "$UB_HOST_CONF" ] ; then
1324 # UCI definitions of local host or local subnet
1325 cat $UB_HOST_CONF >> $UB_TOTAL_CONF
1326 rm $UB_HOST_CONF
1327 fi
1328
1329
1330 if [ -f $UB_SRVMASQ_CONF ] ; then
1331 # UCI found link to dnsmasq
1332 cat $UB_SRVMASQ_CONF >> $UB_TOTAL_CONF
1333 rm $UB_SRVMASQ_CONF
1334 fi
1335
1336
1337 if [ -f "$UB_DHCP_CONF" ] ; then
1338 {
1339 # Seed DHCP records because dhcp scripts trigger externally
1340 # Incremental Unbound restarts may drop unbound-control records
1341 echo "include: $UB_DHCP_CONF"
1342 echo
1343 }>> $UB_TOTAL_CONF
1344 fi
1345
1346
1347 if [ -z "$adb_files" ] || [ ! -x /usr/bin/adblock.sh ] \
1348 || [ ! -x /etc/init.d/adblock ] ; then
1349 adb_enabled=0
1350
1351 elif /etc/init.d/adblock enabled ; then
1352 adb_enabled=1
1353 {
1354 # Pull in your selected openwrt/pacakges/net/adblock generated lists
1355 echo "include: $UB_VARDIR/adb_list.*"
1356 echo
1357 } >> $UB_TOTAL_CONF
1358
1359 else
1360 adb_enabled=0
1361 fi
1362
1363
1364 if [ -f $UB_SRV_CONF ] ; then
1365 {
1366 # Pull your own "server:" options here
1367 echo "include: $UB_SRV_CONF"
1368 echo
1369 }>> $UB_TOTAL_CONF
1370 fi
1371
1372
1373 if [ -f "$UB_ZONE_CONF" ] ; then
1374 # UCI defined forward, stub, and auth zones
1375 cat $UB_ZONE_CONF >> $UB_TOTAL_CONF
1376 rm $UB_ZONE_CONF
1377 fi
1378
1379
1380 if [ -f "$UB_CTRL_CONF" ] ; then
1381 # UCI defined control application connection
1382 cat $UB_CTRL_CONF >> $UB_TOTAL_CONF
1383 rm $UB_CTRL_CONF
1384 fi
1385
1386
1387 if [ -f "$UB_EXTMASQ_CONF" ] ; then
1388 # UCI found link to dnsmasq
1389 cat $UB_EXTMASQ_CONF >> $UB_TOTAL_CONF
1390 rm $UB_EXTMASQ_CONF
1391 fi
1392
1393
1394 if [ -f "$UB_EXT_CONF" ] ; then
1395 {
1396 # Pull your own extend feature clauses here
1397 echo "include: $UB_EXT_CONF"
1398 echo
1399 } >> $UB_TOTAL_CONF
1400 fi
1401 }
1402
1403 ##############################################################################
1404
1405 resolv_setup() {
1406 if [ "$UB_N_RX_PORT" != "53" ] ; then
1407 return
1408
1409 elif [ -x /etc/init.d/dnsmasq ] \
1410 && /etc/init.d/dnsmasq enabled \
1411 && nslookup localhost 127.0.0.1#53 >/dev/null 2>&1 ; then
1412 # unbound is configured for port 53, but dnsmasq is enabled and a resolver
1413 # listens on localhost:53, lets assume dnsmasq manages the resolver file.
1414 # TODO:
1415 # really check if dnsmasq runs a local (main) resolver in stead of using
1416 # nslookup that times out when no resolver listens on localhost:53.
1417 return
1418 fi
1419
1420
1421 # unbound is designated to listen on 127.0.0.1#53,
1422 # set resolver file to local.
1423 rm -f /tmp/resolv.conf
1424
1425 {
1426 echo "# /tmp/resolv.conf generated by Unbound UCI $( date -Is )"
1427 echo "nameserver 127.0.0.1"
1428 echo "nameserver ::1"
1429 echo "search $UB_TXT_DOMAIN."
1430 } > /tmp/resolv.conf
1431 }
1432
1433 ##############################################################################
1434
1435 unbound_start() {
1436 config_load unbound
1437 config_foreach unbound_uci unbound
1438 unbound_mkdir
1439
1440
1441 if [ "$UB_B_MAN_CONF" -eq 0 ] ; then
1442 # iterate zones before we load other UCI
1443 # forward-zone: auth-zone: and stub-zone:
1444 config_foreach unbound_zone zone
1445 # associate potential DNS RR with interfaces
1446 config_load network
1447 config_foreach bundle_all_networks interface
1448 config_load dhcp
1449 config_foreach bundle_lan_networks dhcp
1450 bundle_wan_networks
1451 # server:
1452 unbound_conf
1453 unbound_hostname
1454 # control:
1455 unbound_control
1456 # dnsmasq
1457 dnsmasq_link
1458 # merge
1459 unbound_include
1460 fi
1461
1462
1463 resolv_setup
1464 }
1465
1466 ##############################################################################
1467
Mirror of packages feed