projects / feed / packages.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Merge pull request #4825 from nxhack/node-hid_fix_depends
[feed/packages.git] / net / unbound / files / unbound.sh
1 #!/bin/sh
2 ##############################################################################
3 #
4 # This program is free software; you can redistribute it and/or modify
5 # it under the terms of the GNU General Public License version 2 as
6 # published by the Free Software Foundation.
7 #
8 # This program is distributed in the hope that it will be useful,
9 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # GNU General Public License for more details.
12 #
13 # Copyright (C) 2016 Eric Luehrsen
14 #
15 ##############################################################################
16 #
17 # Unbound is a full featured recursive server with many options. The UCI
18 # provided tries to simplify and bundle options. This should make Unbound
19 # easier to deploy. Even light duty routers may resolve recursively instead of
20 # depending on a stub with the ISP. The UCI also attempts to replicate dnsmasq
21 # features as used in base LEDE/OpenWrt. If there is a desire for more
22 # detailed tuning, then manual conf file overrides are also made available.
23 #
24 ##############################################################################
25
26 UNBOUND_B_SLAAC6_MAC=0
27 UNBOUND_B_DNSSEC=0
28 UNBOUND_B_DNS64=0
29 UNBOUND_B_EXT_STATS=0
30 UNBOUND_B_GATE_NAME=0
31 UNBOUND_B_HIDE_BIND=1
32 UNBOUND_B_LOCL_BLCK=0
33 UNBOUND_B_LOCL_SERV=1
34 UNBOUND_B_MAN_CONF=0
35 UNBOUND_B_NTP_BOOT=1
36 UNBOUND_B_PRIV_BLCK=1
37 UNBOUND_B_QUERY_MIN=0
38 UNBOUND_B_QRY_MINST=0
39
40 UNBOUND_D_CONTROL=0
41 UNBOUND_D_DOMAIN_TYPE=static
42 UNBOUND_D_DHCP_LINK=none
43 UNBOUND_D_EXTRA_DNS=0
44 UNBOUND_D_LAN_FQDN=0
45 UNBOUND_D_PROTOCOL=mixed
46 UNBOUND_D_RESOURCE=small
47 UNBOUND_D_RECURSION=passive
48 UNBOUND_D_WAN_FQDN=0
49
50 UNBOUND_IP_DNS64="64:ff9b::/96"
51
52 UNBOUND_N_EDNS_SIZE=1280
53 UNBOUND_N_FWD_PORTS=""
54 UNBOUND_N_RX_PORT=53
55 UNBOUND_N_ROOT_AGE=9
56
57 UNBOUND_TTL_MIN=120
58
59 UNBOUND_TXT_DOMAIN=lan
60 UNBOUND_TXT_FWD_ZONE=""
61 UNBOUND_TXT_HOSTNAME=thisrouter
62
63 ##############################################################################
64
65 # keep track of local-domain: assignments during inserted resource records
66 UNBOUND_LIST_DOMAINS=""
67
68 ##############################################################################
69
70 UNBOUND_LIBDIR=/usr/lib/unbound
71 UNBOUND_VARDIR=/var/lib/unbound
72
73 UNBOUND_PIDFILE=/var/run/unbound.pid
74
75 UNBOUND_SRV_CONF=$UNBOUND_VARDIR/unbound_srv.conf
76 UNBOUND_EXT_CONF=$UNBOUND_VARDIR/unbound_ext.conf
77 UNBOUND_DHCP_CONF=$UNBOUND_VARDIR/unbound_dhcp.conf
78 UNBOUND_CONFFILE=$UNBOUND_VARDIR/unbound.conf
79
80 UNBOUND_KEYFILE=$UNBOUND_VARDIR/root.key
81 UNBOUND_HINTFILE=$UNBOUND_VARDIR/root.hints
82 UNBOUND_TIMEFILE=$UNBOUND_VARDIR/hotplug.time
83
84 UNBOUND_CTLKEY_FILE=$UNBOUND_VARDIR/unbound_control.key
85 UNBOUND_CTLPEM_FILE=$UNBOUND_VARDIR/unbound_control.pem
86 UNBOUND_SRVKEY_FILE=$UNBOUND_VARDIR/unbound_server.key
87 UNBOUND_SRVPEM_FILE=$UNBOUND_VARDIR/unbound_server.pem
88
89 ##############################################################################
90
91 UNBOUND_ANCHOR=/usr/sbin/unbound-anchor
92 UNBOUND_CONTROL=/usr/sbin/unbound-control
93 UNBOUND_CONTROL_CFG="$UNBOUND_CONTROL -c $UNBOUND_CONFFILE"
94
95 ##############################################################################
96
97 . /lib/functions.sh
98 . /lib/functions/network.sh
99
100 . $UNBOUND_LIBDIR/dnsmasq.sh
101 . $UNBOUND_LIBDIR/iptools.sh
102 . $UNBOUND_LIBDIR/rootzone.sh
103
104 ##############################################################################
105
106 copy_dash_update() {
107 # TODO: remove this function and use builtins when this issues is resovled.
108 # Due to OpenWrt/LEDE divergence "cp -u" isn't yet universally available.
109 local filetime keeptime
110
111
112 if [ -f $UNBOUND_KEYFILE.keep ] ; then
113 # root.key.keep is reused if newest
114 filetime=$( date -r $UNBOUND_KEYFILE +%s )
115 keeptime=$( date -r $UNBOUND_KEYFILE.keep +%s )
116
117
118 if [ $keeptime -gt $filetime ] ; then
119 cp $UNBOUND_KEYFILE.keep $UNBOUND_KEYFILE
120 fi
121
122
123 rm -f $UNBOUND_KEYFILE.keep
124 fi
125 }
126
127 ##############################################################################
128
129 create_interface_dns() {
130 local cfg="$1"
131 local ipcommand logint ignore ifname ifdashname
132 local name names address addresses
133 local ulaprefix if_fqdn host_fqdn mode mode_ptr
134
135 # Create local-data: references for this hosts interfaces (router).
136 config_get logint "$cfg" interface
137 config_get_bool ignore "$cfg" ignore 0
138 network_get_device ifname "$cfg"
139
140 ifdashname="${ifname//./-}"
141 ipcommand="ip -o address show $ifname"
142 addresses=$( $ipcommand | awk '/inet/{sub(/\/.*/,"",$4); print $4}' )
143 ulaprefix=$( uci_get network.@globals[0].ula_prefix )
144 host_fqdn="$UNBOUND_TXT_HOSTNAME.$UNBOUND_TXT_DOMAIN"
145 if_fqdn="$ifdashname.$host_fqdn"
146
147
148 if [ -z "${ulaprefix%%:/*}" ] ; then
149 # Nonsense so this option isn't globbed below
150 ulaprefix="fdno:such:addr::/48"
151 fi
152
153
154 if [ "$ignore" -gt 0 ] ; then
155 mode="$UNBOUND_D_WAN_FQDN"
156 else
157 mode="$UNBOUND_D_LAN_FQDN"
158 fi
159
160
161 case "$mode" in
162 3)
163 mode_ptr="$host_fqdn"
164 names="$host_fqdn $UNBOUND_TXT_HOSTNAME"
165 ;;
166
167 4)
168 if [ -z "$ifdashname" ] ; then
169 # race conditions at init can rarely cause a blank device return
170 # the record format is invalid and Unbound won't load the conf file
171 mode_ptr="$host_fqdn"
172 names="$host_fqdn $UNBOUND_TXT_HOSTNAME"
173 else
174 mode_ptr="$if_fqdn"
175 names="$if_fqdn $host_fqdn $UNBOUND_TXT_HOSTNAME"
176 fi
177 ;;
178
179 *)
180 mode_ptr="$UNBOUND_TXT_HOSTNAME"
181 names="$UNBOUND_TXT_HOSTNAME"
182 ;;
183 esac
184
185
186 if [ "$mode" -gt 1 ] ; then
187 {
188 for address in $addresses ; do
189 case $address in
190 fe80:*|169.254.*)
191 echo " # note link address $address"
192 ;;
193
194 [1-9a-f]*:*[0-9a-f])
195 # GA and ULA IP6 for HOST IN AAA records (ip command is robust)
196 for name in $names ; do
197 echo " local-data: \"$name. 120 IN AAAA $address\""
198 done
199 echo " local-data-ptr: \"$address 120 $mode_ptr\""
200 ;;
201
202 [1-9]*.*[0-9])
203 # Old fashioned HOST IN A records
204 for name in $names ; do
205 echo " local-data: \"$name. 120 IN A $address\""
206 done
207 echo " local-data-ptr: \"$address 120 $mode_ptr\""
208 ;;
209 esac
210 done
211 echo
212 } >> $UNBOUND_CONFFILE
213
214 elif [ "$mode" -gt 0 ] ; then
215 {
216 for address in $addresses ; do
217 case $address in
218 fe80:*|169.254.*)
219 echo " # note link address $address"
220 ;;
221
222 "${ulaprefix%%:/*}"*)
223 # Only this networks ULA and only hostname
224 echo " local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN AAAA $address\""
225 echo " local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
226 ;;
227
228 [1-9]*.*[0-9])
229 echo " local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN A $address\""
230 echo " local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
231 ;;
232 esac
233 done
234 echo
235 } >> $UNBOUND_CONFFILE
236 fi
237 }
238
239 ##############################################################################
240
241 create_local_zone() {
242 local target="$1"
243 local partial domain found
244
245
246 if [ -n "$UNBOUND_LIST_DOMAINS" ] ; then
247 for domain in $UNBOUND_LIST_DOMAINS ; do
248 case $target in
249 *"${domain}")
250 found=1
251 break
252 ;;
253
254 [A-Za-z0-9]*.[A-Za-z0-9]*)
255 found=0
256 ;;
257
258 *) # no dots
259 found=1
260 break
261 ;;
262 esac
263 done
264 else
265 found=0
266 fi
267
268
269 if [ $found -eq 0 ] ; then
270 # New Zone! Bundle local-zones: by first two name tiers "abcd.tld."
271 partial=$( echo "$target" | awk -F. '{ j=NF ; i=j-1; print $i"."$j }' )
272 UNBOUND_LIST_DOMAINS="$UNBOUND_LIST_DOMAINS $partial"
273 echo " local-zone: $partial. transparent" >> $UNBOUND_CONFFILE
274 fi
275 }
276
277 ##############################################################################
278
279 create_host_record() {
280 local cfg="$1"
281 local ip name
282
283 # basefiles dhcp "domain" clause which means host A, AAAA, and PRT record
284 config_get ip "$cfg" ip
285 config_get name "$cfg" name
286
287
288 if [ -n "$name" -a -n "$ip" ] ; then
289 create_local_zone "$name"
290
291 {
292 case $ip in
293 fe80:*|169.254.*)
294 echo " # note link address $ip for host $name"
295 ;;
296
297 [1-9a-f]*:*[0-9a-f])
298 echo " local-data: \"$name. 120 IN AAAA $ip\""
299 echo " local-data-ptr: \"$ip 120 $name\""
300 ;;
301
302 [1-9]*.*[0-9])
303 echo " local-data: \"$name. 120 IN A $ip\""
304 echo " local-data-ptr: \"$ip 120 $name\""
305 ;;
306 esac
307 } >> $UNBOUND_CONFFILE
308 fi
309 }
310
311 ##############################################################################
312
313 create_mx_record() {
314 local cfg="$1"
315 local domain relay pref
316
317 # Insert a static MX record
318 config_get domain "$cfg" domain
319 config_get relay "$cfg" relay
320 config_get pref "$cfg" pref 10
321
322
323 if [ -n "$domain" -a -n "$relay" ] ; then
324 create_local_zone "$domain"
325 echo " local-data: \"$domain. 120 IN MX $pref $relay.\"" \
326 >> $UNBOUND_CONFFILE
327 fi
328 }
329
330 ##############################################################################
331
332 create_srv_record() {
333 local cfg="$1"
334 local srv target port class weight
335
336 # Insert a static SRV record such as SIP server
337 config_get srv "$cfg" srv
338 config_get target "$cfg" target
339 config_get port "$cfg" port
340 config_get class "$cfg" class 10
341 config_get weight "$cfg" weight 10
342
343
344 if [ -n "$srv" -a -n "$target" -a -n "$port" ] ; then
345 create_local_zone "$srv"
346 echo " local-data: \"$srv. 120 IN SRV $class $weight $port $target.\"" \
347 >> $UNBOUND_CONFFILE
348 fi
349 }
350
351 ##############################################################################
352
353 create_cname_record() {
354 local cfg="$1"
355 local cname target
356
357 # Insert static CNAME record
358 config_get cname "$cfg" cname
359 config_get target "$cfg" target
360
361
362 if [ -n "$cname" -a -n "$target" ] ; then
363 create_local_zone "$cname"
364 echo " local-data: \"$cname. 120 IN CNAME $target.\"" >> $UNBOUND_CONFFILE
365 fi
366 }
367
368 ##############################################################################
369
370 create_access_control() {
371 local cfg="$1"
372 local subnets subnets4 subnets6
373 local validip4 validip6
374
375 network_get_subnets subnets4 "$cfg"
376 network_get_subnets6 subnets6 "$cfg"
377 subnets="$subnets4 $subnets6"
378
379
380 if [ -n "$subnets" ] ; then
381 for subnet in $subnets ; do
382 validip4=$( valid_subnet4 $subnet )
383 validip6=$( valid_subnet6 $subnet )
384
385
386 if [ "$validip4" = "ok" -o "$validip6" = "ok" ] ; then
387 # For each "network" UCI add "access-control:" white list for queries
388 echo " access-control: $subnet allow" >> $UNBOUND_CONFFILE
389 fi
390 done
391 fi
392 }
393
394 ##############################################################################
395
396 create_domain_insecure() {
397 echo " domain-insecure: \"$1\"" >> $UNBOUND_CONFFILE
398 }
399
400 ##############################################################################
401
402 unbound_mkdir() {
403 local dhcp_origin=$( uci_get dhcp.@odhcpd[0].leasefile )
404 local dhcp_dir=$( dirname $dhcp_origin )
405 local filestuff
406
407
408 if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" -a ! -d "$dhcp_dir" ] ; then
409 # make sure odhcpd has a directory to write (not done itself, yet)
410 mkdir -p "$dhcp_dir"
411 fi
412
413
414 if [ -f $UNBOUND_KEYFILE ] ; then
415 filestuff=$( cat $UNBOUND_KEYFILE )
416
417
418 case "$filestuff" in
419 *"state=2 [ VALID ]"*)
420 # Lets not lose RFC 5011 tracking if we don't have to
421 cp -p $UNBOUND_KEYFILE $UNBOUND_KEYFILE.keep
422 ;;
423 esac
424 fi
425
426
427 # Blind copy /etc/ to /var/lib/
428 mkdir -p $UNBOUND_VARDIR
429 rm -f $UNBOUND_VARDIR/dhcp_*
430 touch $UNBOUND_CONFFILE
431 touch $UNBOUND_SRV_CONF
432 touch $UNBOUND_EXT_CONF
433 cp -p /etc/unbound/* $UNBOUND_VARDIR/
434
435
436 if [ ! -f $UNBOUND_HINTFILE ] ; then
437 if [ -f /usr/share/dns/root.hints ] ; then
438 # Debian-like package dns-root-data
439 cp -p /usr/share/dns/root.hints $UNBOUND_HINTFILE
440
441 elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
442 logger -t unbound -s "iterator will use built-in root hints"
443 fi
444 fi
445
446
447 if [ ! -f $UNBOUND_KEYFILE ] ; then
448 if [ -f /usr/share/dns/root.key ] ; then
449 # Debian-like package dns-root-data
450 cp -p /usr/share/dns/root.key $UNBOUND_KEYFILE
451
452 elif [ -x $UNBOUND_ANCHOR ] ; then
453 $UNBOUND_ANCHOR -a $UNBOUND_KEYFILE
454
455 elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
456 logger -t unbound -s "validator will use built-in trust anchor"
457 fi
458 fi
459
460
461 copy_dash_update
462
463
464 # Ensure access and prepare to jail
465 chown -R unbound:unbound $UNBOUND_VARDIR
466 chmod 755 $UNBOUND_VARDIR
467 chmod 644 $UNBOUND_VARDIR/*
468
469
470 if [ -f $UNBOUND_CTLKEY_FILE -o -f $UNBOUND_CTLPEM_FILE \
471 -o -f $UNBOUND_SRVKEY_FILE -o -f $UNBOUND_SRVPEM_FILE ] ; then
472 # Keys (some) exist already; do not create new ones
473 chmod 640 $UNBOUND_CTLKEY_FILE $UNBOUND_CTLPEM_FILE \
474 $UNBOUND_SRVKEY_FILE $UNBOUND_SRVPEM_FILE
475
476 elif [ -x /usr/sbin/unbound-control-setup ] ; then
477 case "$UNBOUND_D_CONTROL" in
478 [2-3])
479 # unbound-control-setup for encrypt opt. 2 and 3, but not 4 "static"
480 /usr/sbin/unbound-control-setup -d $UNBOUND_VARDIR
481
482 chown -R unbound:unbound $UNBOUND_CTLKEY_FILE $UNBOUND_CTLPEM_FILE \
483 $UNBOUND_SRVKEY_FILE $UNBOUND_SRVPEM_FILE
484
485 chmod 640 $UNBOUND_CTLKEY_FILE $UNBOUND_CTLPEM_FILE \
486 $UNBOUND_SRVKEY_FILE $UNBOUND_SRVPEM_FILE
487
488 cp -p $UNBOUND_CTLKEY_FILE /etc/unbound/unbound_control.key
489 cp -p $UNBOUND_CTLPEM_FILE /etc/unbound/unbound_control.pem
490 cp -p $UNBOUND_SRVKEY_FILE /etc/unbound/unbound_server.key
491 cp -p $UNBOUND_SRVPEM_FILE /etc/unbound/unbound_server.pem
492 ;;
493 esac
494 fi
495 }
496
497 ##############################################################################
498
499 unbound_control() {
500 if [ "$UNBOUND_D_CONTROL" -gt 1 ] ; then
501 if [ ! -f $UNBOUND_CTLKEY_FILE -o ! -f $UNBOUND_CTLPEM_FILE \
502 -o ! -f $UNBOUND_SRVKEY_FILE -o ! -f $UNBOUND_SRVPEM_FILE ] ; then
503 # Key files need to be present; if unbound-control-setup was found, then
504 # they might have been made during unbound_makedir() above.
505 UNBOUND_D_CONTROL=0
506 fi
507 fi
508
509
510 case "$UNBOUND_D_CONTROL" in
511 1)
512 {
513 # Local Host Only Unencrypted Remote Control
514 echo "remote-control:"
515 echo " control-enable: yes"
516 echo " control-use-cert: no"
517 echo " control-interface: 127.0.0.1"
518 echo " control-interface: ::1"
519 echo
520 } >> $UNBOUND_CONFFILE
521 ;;
522
523 2)
524 {
525 # Local Host Only Encrypted Remote Control
526 echo "remote-control:"
527 echo " control-enable: yes"
528 echo " control-use-cert: yes"
529 echo " control-interface: 127.0.0.1"
530 echo " control-interface: ::1"
531 echo " server-key-file: \"$UNBOUND_SRVKEY_FILE\""
532 echo " server-cert-file: \"$UNBOUND_SRVPEM_FILE\""
533 echo " control-key-file: \"$UNBOUND_CTLKEY_FILE\""
534 echo " control-cert-file: \"$UNBOUND_CTLPEM_FILE\""
535 echo
536 } >> $UNBOUND_CONFFILE
537 ;;
538
539 [3-4])
540 {
541 # Network Encrypted Remote Control
542 # (3) may auto setup and (4) must have static key/pem files
543 # TODO: add UCI list for interfaces to bind
544 echo "remote-control:"
545 echo " control-enable: yes"
546 echo " control-use-cert: yes"
547 echo " control-interface: 0.0.0.0"
548 echo " control-interface: ::0"
549 echo " server-key-file: \"$UNBOUND_SRVKEY_FILE\""
550 echo " server-cert-file: \"$UNBOUND_SRVPEM_FILE\""
551 echo " control-key-file: \"$UNBOUND_CTLKEY_FILE\""
552 echo " control-cert-file: \"$UNBOUND_CTLPEM_FILE\""
553 echo
554 } >> $UNBOUND_CONFFILE
555 ;;
556 esac
557
558
559 {
560 # Amend your own extended clauses here like forward zones or disable
561 # above (local, no encryption) and amend your own remote encrypted control
562 echo
563 echo "include: $UNBOUND_EXT_CONF" >> $UNBOUND_CONFFILE
564 echo
565 } >> $UNBOUND_CONFFILE
566 }
567
568 ##############################################################################
569
570 unbound_conf() {
571 local cfg="$1"
572 local rt_mem rt_conn modulestring
573
574 # Make fresh conf file
575 echo > $UNBOUND_CONFFILE
576
577
578 {
579 # Make fresh conf file
580 echo "# $UNBOUND_CONFFILE generated by UCI $( date )"
581 echo
582 # No threading
583 echo "server:"
584 echo " username: unbound"
585 echo " num-threads: 1"
586 echo " msg-cache-slabs: 1"
587 echo " rrset-cache-slabs: 1"
588 echo " infra-cache-slabs: 1"
589 echo " key-cache-slabs: 1"
590 echo
591 # Interface Wildcard (access contol handled by "option local_service")
592 echo " interface: 0.0.0.0"
593 echo " interface: ::0"
594 echo " outgoing-interface: 0.0.0.0"
595 echo " outgoing-interface: ::0"
596 echo
597 # Logging
598 echo " verbosity: 1"
599 echo " statistics-interval: 0"
600 echo " statistics-cumulative: no"
601 } >> $UNBOUND_CONFFILE
602
603
604 if [ "$UNBOUND_B_EXT_STATS" -gt 0 ] ; then
605 {
606 # Log More
607 echo " extended-statistics: yes"
608 echo
609 } >> $UNBOUND_CONFFILE
610
611 else
612 {
613 # Log Less
614 echo " extended-statistics: no"
615 echo
616 } >> $UNBOUND_CONFFILE
617 fi
618
619
620 case "$UNBOUND_D_PROTOCOL" in
621 ip4_only)
622 {
623 echo " do-ip4: yes"
624 echo " do-ip6: no"
625 } >> $UNBOUND_CONFFILE
626 ;;
627
628 ip6_only)
629 {
630 echo " do-ip4: no"
631 echo " do-ip6: yes"
632 } >> $UNBOUND_CONFFILE
633 ;;
634
635 ip6_prefer)
636 {
637 echo " do-ip4: yes"
638 echo " do-ip6: yes"
639 echo " prefer-ip6: yes"
640 } >> $UNBOUND_CONFFILE
641 ;;
642
643 *)
644 {
645 echo " do-ip4: yes"
646 echo " do-ip6: yes"
647 } >> $UNBOUND_CONFFILE
648 ;;
649 esac
650
651
652 {
653 # protocol level tuning
654 echo " edns-buffer-size: $UNBOUND_N_EDNS_SIZE"
655 echo " msg-buffer-size: 8192"
656 echo " port: $UNBOUND_N_RX_PORT"
657 echo " outgoing-port-permit: 10240-65535"
658 echo
659 } >> $UNBOUND_CONFFILE
660
661
662 {
663 # Other harding and options for an embedded router
664 echo " harden-short-bufsize: yes"
665 echo " harden-large-queries: yes"
666 echo " harden-glue: yes"
667 echo " harden-below-nxdomain: no"
668 echo " harden-referral-path: no"
669 echo " use-caps-for-id: no"
670 echo
671 } >> $UNBOUND_CONFFILE
672
673
674 {
675 # Default Files
676 echo " use-syslog: yes"
677 echo " chroot: \"$UNBOUND_VARDIR\""
678 echo " directory: \"$UNBOUND_VARDIR\""
679 echo " pidfile: \"$UNBOUND_PIDFILE\""
680 } >> $UNBOUND_CONFFILE
681
682
683 if [ -f "$UNBOUND_HINTFILE" ] ; then
684 # Optional hints if found
685 echo " root-hints: \"$UNBOUND_HINTFILE\"" >> $UNBOUND_CONFFILE
686 fi
687
688
689 if [ "$UNBOUND_B_DNSSEC" -gt 0 -a -f "$UNBOUND_KEYFILE" ] ; then
690 {
691 echo " auto-trust-anchor-file: \"$UNBOUND_KEYFILE\""
692 echo
693 } >> $UNBOUND_CONFFILE
694
695 else
696 echo >> $UNBOUND_CONFFILE
697 fi
698
699
700 case "$UNBOUND_D_RESOURCE" in
701 # Tiny - Unbound's recommended cheap hardware config
702 tiny) rt_mem=1 ; rt_conn=1 ;;
703 # Small - Half RRCACHE and open ports
704 small) rt_mem=8 ; rt_conn=5 ;;
705 # Medium - Nearly default but with some added balancintg
706 medium) rt_mem=16 ; rt_conn=10 ;;
707 # Large - Double medium
708 large) rt_mem=32 ; rt_conn=10 ;;
709 # Whatever unbound does
710 *) rt_mem=0 ; rt_conn=0 ;;
711 esac
712
713
714 if [ "$rt_mem" -gt 0 ] ; then
715 {
716 # Set memory sizing parameters
717 echo " outgoing-range: $(($rt_conn*64))"
718 echo " num-queries-per-thread: $(($rt_conn*32))"
719 echo " outgoing-num-tcp: $(($rt_conn))"
720 echo " incoming-num-tcp: $(($rt_conn))"
721 echo " rrset-cache-size: $(($rt_mem*256))k"
722 echo " msg-cache-size: $(($rt_mem*128))k"
723 echo " key-cache-size: $(($rt_mem*128))k"
724 echo " neg-cache-size: $(($rt_mem*64))k"
725 echo " infra-cache-numhosts: $(($rt_mem*256))"
726 echo
727 } >> $UNBOUND_CONFFILE
728
729 elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
730 logger -t unbound -s "default memory resource consumption"
731 fi
732
733 # Assembly of module-config: options is tricky; order matters
734 modulestring="iterator"
735
736
737 if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
738 if [ ! -f "$UNBOUND_TIMEFILE" -a "$UNBOUND_B_NTP_BOOT" -gt 0 ] ; then
739 # DNSSEC chicken and egg with getting NTP time
740 echo " val-override-date: -1" >> $UNBOUND_CONFFILE
741 fi
742
743
744 {
745 echo " harden-dnssec-stripped: yes"
746 echo " val-clean-additional: yes"
747 echo " ignore-cd-flag: yes"
748 } >> $UNBOUND_CONFFILE
749
750
751 modulestring="validator $modulestring"
752 fi
753
754
755 if [ "$UNBOUND_B_DNS64" -gt 0 ] ; then
756 echo " dns64-prefix: $UNBOUND_IP_DNS64" >> $UNBOUND_CONFFILE
757
758 modulestring="dns64 $modulestring"
759 fi
760
761
762 {
763 # Print final module string
764 echo " module-config: \"$modulestring\""
765 echo
766 } >> $UNBOUND_CONFFILE
767
768
769 if [ "$UNBOUND_B_QRY_MINST" -gt 0 -a "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
770 {
771 # Some query privacy but "strict" will break some name servers
772 echo " qname-minimisation: yes"
773 echo " qname-minimisation-strict: yes"
774 } >> $UNBOUND_CONFFILE
775
776 elif [ "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
777 # Minor improvement on query privacy
778 echo " qname-minimisation: yes" >> $UNBOUND_CONFFILE
779
780 else
781 echo " qname-minimisation: no" >> $UNBOUND_CONFFILE
782 fi
783
784
785 case "$UNBOUND_D_RECURSION" in
786 passive)
787 {
788 echo " prefetch: no"
789 echo " prefetch-key: no"
790 echo " target-fetch-policy: \"0 0 0 0 0\""
791 echo
792 } >> $UNBOUND_CONFFILE
793 ;;
794
795 aggressive)
796 {
797 echo " prefetch: yes"
798 echo " prefetch-key: yes"
799 echo " target-fetch-policy: \"3 2 1 0 0\""
800 echo
801 } >> $UNBOUND_CONFFILE
802 ;;
803
804 *)
805 if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
806 logger -t unbound -s "default recursion configuration"
807 fi
808 ;;
809 esac
810
811
812 {
813 # Reload records more than 10 hours old
814 # DNSSEC 5 minute bogus cool down before retry
815 # Adaptive infrastructure info kept for 15 minutes
816 echo " cache-min-ttl: $UNBOUND_TTL_MIN"
817 echo " cache-max-ttl: 36000"
818 echo " val-bogus-ttl: 300"
819 echo " infra-host-ttl: 900"
820 echo
821 } >> $UNBOUND_CONFFILE
822
823
824 if [ "$UNBOUND_B_HIDE_BIND" -gt 0 ] ; then
825 {
826 # Block server id and version DNS TXT records
827 echo " hide-identity: yes"
828 echo " hide-version: yes"
829 echo
830 } >> $UNBOUND_CONFFILE
831 fi
832
833
834 if [ "$UNBOUND_B_PRIV_BLCK" -gt 0 ] ; then
835 {
836 # Remove _upstream_ or global reponses with private addresses.
837 # Unbounds own "local zone" and "forward zone" may still use these.
838 # RFC1918, RFC3927, RFC4291, RFC6598, RFC6890
839 echo " private-address: 10.0.0.0/8"
840 echo " private-address: 100.64.0.0/10"
841 echo " private-address: 169.254.0.0/16"
842 echo " private-address: 172.16.0.0/12"
843 echo " private-address: 192.168.0.0/16"
844 echo " private-address: fc00::/8"
845 echo " private-address: fd00::/8"
846 echo " private-address: fe80::/10"
847 } >> $UNBOUND_CONFFILE
848 fi
849
850
851 if [ "$UNBOUND_B_LOCL_BLCK" -gt 0 ] ; then
852 {
853 # Remove DNS reponses from upstream with loopback IP
854 # Black hole DNS method for ad blocking, so consider...
855 echo " private-address: 127.0.0.0/8"
856 echo " private-address: ::1/128"
857 echo
858 } >> $UNBOUND_CONFFILE
859
860 else
861 echo >> $UNBOUND_CONFFILE
862 fi
863
864
865 # Except and accept domains as insecure (DNSSEC); work around broken domains
866 config_list_foreach "$cfg" "domain_insecure" create_domain_insecure
867 echo >> $UNBOUND_CONFFILE
868 }
869
870 ##############################################################################
871
872 unbound_access() {
873 # TODO: Unbound 1.6.0 added "tags" and "views", so we can add tags to
874 # each access-control IP block, and then divert access.
875 # -- "guest" WIFI will not be allowed to see local zone data
876 # -- "child" LAN can black whole a list of domains to http~deadpixel
877
878
879 if [ "$UNBOUND_B_LOCL_SERV" -gt 0 ] ; then
880 # Only respond to queries from which this device has an interface.
881 # Prevent DNS amplification attacks by not responding to the universe.
882 config_load network
883 config_foreach create_access_control interface
884
885
886 {
887 echo " access-control: 127.0.0.0/8 allow"
888 echo " access-control: ::1/128 allow"
889 echo " access-control: fe80::/10 allow"
890 echo
891 } >> $UNBOUND_CONFFILE
892
893 else
894 {
895 echo " access-control: 0.0.0.0/0 allow"
896 echo " access-control: ::0/0 allow"
897 echo
898 } >> $UNBOUND_CONFFILE
899 fi
900
901
902 {
903 # Amend your own "server:" stuff here
904 echo " include: $UNBOUND_SRV_CONF"
905 echo
906 } >> $UNBOUND_CONFFILE
907 }
908
909 ##############################################################################
910
911 unbound_adblock() {
912 # TODO: Unbound 1.6.0 added "tags" and "views"; lets work with adblock team
913 local adb_enabled adb_file
914
915 if [ ! -x /usr/bin/adblock.sh -o ! -x /etc/init.d/adblock ] ; then
916 adb_enabled=0
917 else
918 /etc/init.d/adblock enabled && adb_enabled=1 || adb_enabled=0
919 fi
920
921
922 if [ "$adb_enabled" -gt 0 ] ; then
923 {
924 # Pull in your selected openwrt/pacakges/net/adblock generated lists
925 for adb_file in $UNBOUND_VARDIR/adb_list.* ; do
926 echo " include: $adb_file"
927 done
928 echo
929 } >> $UNBOUND_CONFFILE
930 fi
931 }
932
933 ##############################################################################
934
935 unbound_hostname() {
936 if [ -n "$UNBOUND_TXT_DOMAIN" ] ; then
937 {
938 # TODO: Unbound 1.6.0 added "tags" and "views" and we could make
939 # domains by interface to prevent DNS from "guest" to "home"
940 echo " local-zone: $UNBOUND_TXT_DOMAIN. $UNBOUND_D_DOMAIN_TYPE"
941 echo " domain-insecure: $UNBOUND_TXT_DOMAIN"
942 echo " private-domain: $UNBOUND_TXT_DOMAIN"
943 echo
944 echo " local-zone: $UNBOUND_TXT_HOSTNAME. $UNBOUND_D_DOMAIN_TYPE"
945 echo " domain-insecure: $UNBOUND_TXT_HOSTNAME"
946 echo " private-domain: $UNBOUND_TXT_HOSTNAME"
947 echo
948 } >> $UNBOUND_CONFFILE
949
950
951 case "$UNBOUND_D_DOMAIN_TYPE" in
952 deny|inform_deny|refuse|static)
953 {
954 # avoid upstream involvement in RFC6762 like responses (link only)
955 echo " local-zone: local. $UNBOUND_D_DOMAIN_TYPE"
956 echo " domain-insecure: local"
957 echo " private-domain: local"
958 echo
959 } >> $UNBOUND_CONFFILE
960 ;;
961 esac
962
963
964 if [ "$UNBOUND_D_LAN_FQDN" -gt 0 -o "$UNBOUND_D_WAN_FQDN" -gt 0 ] ; then
965 config_load dhcp
966 config_foreach create_interface_dns dhcp
967 fi
968
969
970 if [ -f "$UNBOUND_DHCP_CONF" ] ; then
971 {
972 # Seed DHCP records because dhcp scripts trigger externally
973 # Incremental Unbound restarts may drop unbound-control add records
974 echo " include: $UNBOUND_DHCP_CONF"
975 echo
976 } >> $UNBOUND_CONFFILE
977 fi
978 fi
979 }
980
981 ##############################################################################
982
983 unbound_records() {
984 if [ "$UNBOUND_D_EXTRA_DNS" -gt 0 ] ; then
985 # Parasite from the uci.dhcp.domain clauses
986 config_load dhcp
987 config_foreach create_host_record domain
988 fi
989
990
991 if [ "$UNBOUND_D_EXTRA_DNS" -gt 1 ] ; then
992 config_foreach create_srv_record srvhost
993 config_foreach create_mx_record mxhost
994 fi
995
996
997 if [ "$UNBOUND_D_EXTRA_DNS" -gt 2 ] ; then
998 config_foreach create_cname_record cname
999 fi
1000
1001
1002 echo >> $UNBOUND_CONFFILE
1003 }
1004
1005 ##############################################################################
1006
1007 unbound_uci() {
1008 local cfg="$1"
1009 local dnsmasqpath hostnm
1010
1011 hostnm=$( uci_get system.@system[0].hostname | awk '{print tolower($0)}' )
1012 UNBOUND_TXT_HOSTNAME=${hostnm:-thisrouter}
1013
1014 config_get_bool UNBOUND_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
1015 config_get_bool UNBOUND_B_DNS64 "$cfg" dns64 0
1016 config_get_bool UNBOUND_B_EXT_STATS "$cfg" extended_stats 0
1017 config_get_bool UNBOUND_B_HIDE_BIND "$cfg" hide_binddata 1
1018 config_get_bool UNBOUND_B_LOCL_SERV "$cfg" localservice 1
1019 config_get_bool UNBOUND_B_MAN_CONF "$cfg" manual_conf 0
1020 config_get_bool UNBOUND_B_QUERY_MIN "$cfg" query_minimize 0
1021 config_get_bool UNBOUND_B_QRY_MINST "$cfg" query_min_strict 0
1022 config_get_bool UNBOUND_B_PRIV_BLCK "$cfg" rebind_protection 1
1023 config_get_bool UNBOUND_B_LOCL_BLCK "$cfg" rebind_localhost 0
1024 config_get_bool UNBOUND_B_DNSSEC "$cfg" validator 0
1025 config_get_bool UNBOUND_B_NTP_BOOT "$cfg" validator_ntp 1
1026
1027 config_get UNBOUND_IP_DNS64 "$cfg" dns64_prefix "64:ff9b::/96"
1028
1029 config_get UNBOUND_N_EDNS_SIZE "$cfg" edns_size 1280
1030 config_get UNBOUND_N_RX_PORT "$cfg" listen_port 53
1031 config_get UNBOUND_N_ROOT_AGE "$cfg" root_age 9
1032
1033 config_get UNBOUND_D_CONTROL "$cfg" unbound_control 0
1034 config_get UNBOUND_D_DOMAIN_TYPE "$cfg" domain_type static
1035 config_get UNBOUND_D_DHCP_LINK "$cfg" dhcp_link none
1036 config_get UNBOUND_D_EXTRA_DNS "$cfg" add_extra_dns 0
1037 config_get UNBOUND_D_LAN_FQDN "$cfg" add_local_fqdn 0
1038 config_get UNBOUND_D_PROTOCOL "$cfg" protocol mixed
1039 config_get UNBOUND_D_RECURSION "$cfg" recursion passive
1040 config_get UNBOUND_D_RESOURCE "$cfg" resource small
1041 config_get UNBOUND_D_WAN_FQDN "$cfg" add_wan_fqdn 0
1042
1043 config_get UNBOUND_TTL_MIN "$cfg" ttl_min 120
1044 config_get UNBOUND_TXT_DOMAIN "$cfg" domain lan
1045
1046 UNBOUND_LIST_DOMAINS="nowhere $UNBOUND_TXT_DOMAIN"
1047
1048 if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
1049 config_get_bool UNBOUND_B_DNSMASQ "$cfg" dnsmasq_link_dns 0
1050
1051
1052 if [ "$UNBOUND_B_DNSMASQ" -gt 0 ] ; then
1053 UNBOUND_D_DHCP_LINK=dnsmasq
1054
1055
1056 if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
1057 logger -t unbound -s "Please use 'dhcp_link' selector instead"
1058 fi
1059 fi
1060 fi
1061
1062
1063 if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
1064 if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
1065 UNBOUND_D_DHCP_LINK=none
1066 else
1067 /etc/init.d/dnsmasq enabled || UNBOUND_D_DHCP_LINK=none
1068 fi
1069
1070
1071 if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
1072 logger -t unbound -s "cannot forward to dnsmasq"
1073 fi
1074 fi
1075
1076
1077 if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" ] ; then
1078 if [ ! -x /usr/sbin/odhcpd -o ! -x /etc/init.d/odhcpd ] ; then
1079 UNBOUND_D_DHCP_LINK=none
1080 else
1081 /etc/init.d/odhcpd enabled || UNBOUND_D_DHCP_LINK=none
1082 fi
1083
1084
1085 if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
1086 logger -t unbound -s "cannot receive records from odhcpd"
1087 fi
1088 fi
1089
1090
1091 if [ "$UNBOUND_N_EDNS_SIZE" -lt 512 \
1092 -o 4096 -lt "$UNBOUND_N_EDNS_SIZE" ] ; then
1093 logger -t unbound -s "edns_size exceeds range, using default"
1094 UNBOUND_N_EDNS_SIZE=1280
1095 fi
1096
1097
1098 if [ "$UNBOUND_N_RX_PORT" -ne 53 ] \
1099 && [ "$UNBOUND_N_RX_PORT" -lt 1024 -o 10240 -lt "$UNBOUND_N_RX_PORT" ] ; then
1100 logger -t unbound -s "privileged port or in 5 digits, using default"
1101 UNBOUND_N_RX_PORT=53
1102 fi
1103
1104
1105 if [ "$UNBOUND_TTL_MIN" -gt 1800 ] ; then
1106 logger -t unbound -s "ttl_min could have had awful side effects, using 300"
1107 UNBOUND_TTL_MIN=300
1108 fi
1109 }
1110
1111 ##############################################################################
1112
1113 _resolv_setup() {
1114 if [ "$UNBOUND_N_RX_PORT" != "53" ] ; then
1115 return
1116 fi
1117
1118 if [ -x /etc/init.d/dnsmasq ] && /etc/init.d/dnsmasq enabled \
1119 && nslookup localhost 127.0.0.1#53 >/dev/null 2>&1 ; then
1120 # unbound is configured for port 53, but dnsmasq is enabled and a resolver
1121 # listens on localhost:53, lets assume dnsmasq manages the resolver file.
1122 # TODO:
1123 # really check if dnsmasq runs a local (main) resolver in stead of using
1124 # nslookup that times out when no resolver listens on localhost:53.
1125 return
1126 fi
1127
1128 # unbound is designated to listen on 127.0.0.1#53,
1129 # set resolver file to local.
1130 rm -f /tmp/resolv.conf
1131 {
1132 echo "# /tmp/resolv.conf generated by Unbound UCI $( date )"
1133 echo "nameserver 127.0.0.1"
1134 echo "nameserver ::1"
1135 echo "search $UNBOUND_TXT_DOMAIN"
1136 } > /tmp/resolv.conf
1137 }
1138
1139 ##############################################################################
1140
1141 _resolv_teardown() {
1142 case $( cat /tmp/resolv.conf ) in
1143 *"generated by Unbound UCI"*)
1144 # our resolver file, reset to auto resolver file.
1145 rm -f /tmp/resolv.conf
1146 ln -s /tmp/resolv.conf.auto /tmp/resolv.conf
1147 ;;
1148 esac
1149 }
1150
1151 ##############################################################################
1152
1153 unbound_start() {
1154 config_load unbound
1155 config_foreach unbound_uci unbound
1156
1157
1158 unbound_mkdir
1159
1160
1161 if [ "$UNBOUND_B_MAN_CONF" -eq 0 ] ; then
1162 unbound_conf
1163 unbound_access
1164 unbound_adblock
1165
1166 if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
1167 dnsmasq_link
1168 else
1169 unbound_hostname
1170 unbound_records
1171 fi
1172
1173 unbound_control
1174 fi
1175
1176
1177 _resolv_setup
1178 }
1179
1180 ##############################################################################
1181
1182 unbound_stop() {
1183 _resolv_teardown
1184
1185
1186 rootzone_update
1187 }
1188
1189 ##############################################################################
1190
Mirror of packages feed