projects / feed / packages.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
bash: version bump to 4.4.12
[feed/packages.git] / net / unbound / files / unbound.sh
1 #!/bin/sh
2 ##############################################################################
3 #
4 # This program is free software; you can redistribute it and/or modify
5 # it under the terms of the GNU General Public License version 2 as
6 # published by the Free Software Foundation.
7 #
8 # This program is distributed in the hope that it will be useful,
9 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # GNU General Public License for more details.
12 #
13 # Copyright (C) 2016 Eric Luehrsen
14 #
15 ##############################################################################
16 #
17 # Unbound is a full featured recursive server with many options. The UCI
18 # provided tries to simplify and bundle options. This should make Unbound
19 # easier to deploy. Even light duty routers may resolve recursively instead of
20 # depending on a stub with the ISP. The UCI also attempts to replicate dnsmasq
21 # features as used in base LEDE/OpenWrt. If there is a desire for more
22 # detailed tuning, then manual conf file overrides are also made available.
23 #
24 ##############################################################################
25
26 UNBOUND_B_CONTROL=0
27 UNBOUND_B_SLAAC6_MAC=0
28 UNBOUND_B_DNSSEC=0
29 UNBOUND_B_DNS64=0
30 UNBOUND_B_GATE_NAME=0
31 UNBOUND_B_HIDE_BIND=1
32 UNBOUND_B_LOCL_BLCK=0
33 UNBOUND_B_LOCL_SERV=1
34 UNBOUND_B_MAN_CONF=0
35 UNBOUND_B_NTP_BOOT=1
36 UNBOUND_B_PRIV_BLCK=1
37 UNBOUND_B_QUERY_MIN=0
38 UNBOUND_B_QRY_MINST=0
39
40 UNBOUND_D_DOMAIN_TYPE=static
41 UNBOUND_D_DHCP_LINK=none
42 UNBOUND_D_EXTRA_DNS=0
43 UNBOUND_D_LAN_FQDN=0
44 UNBOUND_D_PROTOCOL=mixed
45 UNBOUND_D_RESOURCE=small
46 UNBOUND_D_RECURSION=passive
47 UNBOUND_D_WAN_FQDN=0
48
49 UNBOUND_IP_DNS64="64:ff9b::/96"
50
51 UNBOUND_N_EDNS_SIZE=1280
52 UNBOUND_N_FWD_PORTS=""
53 UNBOUND_N_RX_PORT=53
54 UNBOUND_N_ROOT_AGE=9
55
56 UNBOUND_TTL_MIN=120
57
58 UNBOUND_TXT_DOMAIN=lan
59 UNBOUND_TXT_FWD_ZONE=""
60 UNBOUND_TXT_HOSTNAME=thisrouter
61
62 ##############################################################################
63
64 # keep track of local-domain: assignments during inserted resource records
65 UNBOUND_LIST_DOMAINS=""
66
67 ##############################################################################
68
69 UNBOUND_LIBDIR=/usr/lib/unbound
70 UNBOUND_VARDIR=/var/lib/unbound
71
72 UNBOUND_PIDFILE=/var/run/unbound.pid
73
74 UNBOUND_SRV_CONF=$UNBOUND_VARDIR/unbound_srv.conf
75 UNBOUND_EXT_CONF=$UNBOUND_VARDIR/unbound_ext.conf
76 UNBOUND_DHCP_CONF=$UNBOUND_VARDIR/unbound_dhcp.conf
77 UNBOUND_CONFFILE=$UNBOUND_VARDIR/unbound.conf
78
79 UNBOUND_KEYFILE=$UNBOUND_VARDIR/root.key
80 UNBOUND_HINTFILE=$UNBOUND_VARDIR/root.hints
81 UNBOUND_TIMEFILE=$UNBOUND_VARDIR/hotplug.time
82
83 ##############################################################################
84
85 UNBOUND_ANCHOR=/usr/sbin/unbound-anchor
86 UNBOUND_CONTROL=/usr/sbin/unbound-control
87 UNBOUND_CONTROL_CFG="$UNBOUND_CONTROL -c $UNBOUND_CONFFILE"
88
89 ##############################################################################
90
91 . /lib/functions.sh
92 . /lib/functions/network.sh
93
94 . $UNBOUND_LIBDIR/dnsmasq.sh
95 . $UNBOUND_LIBDIR/iptools.sh
96 . $UNBOUND_LIBDIR/rootzone.sh
97
98 ##############################################################################
99
100 copy_dash_update() {
101 # TODO: remove this function and use builtins when this issues is resovled.
102 # Due to OpenWrt/LEDE divergence "cp -u" isn't yet universally available.
103 local filetime keeptime
104
105
106 if [ -f $UNBOUND_KEYFILE.keep ] ; then
107 # root.key.keep is reused if newest
108 filetime=$( date -r $UNBOUND_KEYFILE +%s )
109 keeptime=$( date -r $UNBOUND_KEYFILE.keep +%s )
110
111
112 if [ $keeptime -gt $filetime ] ; then
113 cp $UNBOUND_KEYFILE.keep $UNBOUND_KEYFILE
114 fi
115
116
117 rm -f $UNBOUND_KEYFILE.keep
118 fi
119 }
120
121 ##############################################################################
122
123 create_interface_dns() {
124 local cfg="$1"
125 local ipcommand logint ignore ifname ifdashname
126 local name names address addresses
127 local ulaprefix if_fqdn host_fqdn mode mode_ptr
128
129 # Create local-data: references for this hosts interfaces (router).
130 config_get logint "$cfg" interface
131 config_get_bool ignore "$cfg" ignore 0
132 network_get_device ifname "$cfg"
133
134 ifdashname="${ifname//./-}"
135 ipcommand="ip -o address show $ifname"
136 addresses=$( $ipcommand | awk '/inet/{sub(/\/.*/,"",$4); print $4}' )
137 ulaprefix=$( uci_get network.@globals[0].ula_prefix )
138 host_fqdn="$UNBOUND_TXT_HOSTNAME.$UNBOUND_TXT_DOMAIN"
139 if_fqdn="$ifdashname.$host_fqdn"
140
141
142 if [ -z "${ulaprefix%%:/*}" ] ; then
143 # Nonsense so this option isn't globbed below
144 ulaprefix="fdno:such:addr::/48"
145 fi
146
147
148 if [ "$ignore" -gt 0 ] ; then
149 mode="$UNBOUND_D_WAN_FQDN"
150 else
151 mode="$UNBOUND_D_LAN_FQDN"
152 fi
153
154
155 case "$mode" in
156 3)
157 mode_ptr="$host_fqdn"
158 names="$host_fqdn $UNBOUND_TXT_HOSTNAME"
159 ;;
160
161 4)
162 if [ -z "$ifdashname" ] ; then
163 # race conditions at init can rarely cause a blank device return
164 # the record format is invalid and Unbound won't load the conf file
165 mode_ptr="$host_fqdn"
166 names="$host_fqdn $UNBOUND_TXT_HOSTNAME"
167 else
168 mode_ptr="$if_fqdn"
169 names="$if_fqdn $host_fqdn $UNBOUND_TXT_HOSTNAME"
170 fi
171 ;;
172
173 *)
174 mode_ptr="$UNBOUND_TXT_HOSTNAME"
175 names="$UNBOUND_TXT_HOSTNAME"
176 ;;
177 esac
178
179
180 if [ "$mode" -gt 1 ] ; then
181 {
182 for address in $addresses ; do
183 case $address in
184 fe80:*|169.254.*)
185 echo " # note link address $address"
186 ;;
187
188 [1-9a-f]*:*[0-9a-f])
189 # GA and ULA IP6 for HOST IN AAA records (ip command is robust)
190 for name in $names ; do
191 echo " local-data: \"$name. 120 IN AAAA $address\""
192 done
193 echo " local-data-ptr: \"$address 120 $mode_ptr\""
194 ;;
195
196 [1-9]*.*[0-9])
197 # Old fashioned HOST IN A records
198 for name in $names ; do
199 echo " local-data: \"$name. 120 IN A $address\""
200 done
201 echo " local-data-ptr: \"$address 120 $mode_ptr\""
202 ;;
203 esac
204 done
205 echo
206 } >> $UNBOUND_CONFFILE
207
208 elif [ "$mode" -gt 0 ] ; then
209 {
210 for address in $addresses ; do
211 case $address in
212 fe80:*|169.254.*)
213 echo " # note link address $address"
214 ;;
215
216 "${ulaprefix%%:/*}"*)
217 # Only this networks ULA and only hostname
218 echo " local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN AAAA $address\""
219 echo " local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
220 ;;
221
222 [1-9]*.*[0-9])
223 echo " local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN A $address\""
224 echo " local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
225 ;;
226 esac
227 done
228 echo
229 } >> $UNBOUND_CONFFILE
230 fi
231 }
232
233 ##############################################################################
234
235 create_local_zone() {
236 local target="$1"
237 local partial domain found
238
239
240 if [ -n "$UNBOUND_LIST_DOMAINS" ] ; then
241 for domain in $UNBOUND_LIST_DOMAINS ; do
242 case $target in
243 *"${domain}")
244 found=1
245 break
246 ;;
247
248 [A-Za-z0-9]*.[A-Za-z0-9]*)
249 found=0
250 ;;
251
252 *) # no dots
253 found=1
254 break
255 ;;
256 esac
257 done
258 else
259 found=0
260 fi
261
262
263 if [ $found -eq 0 ] ; then
264 # New Zone! Bundle local-zones: by first two name tiers "abcd.tld."
265 partial=$( echo "$target" | awk -F. '{ j=NF ; i=j-1; print $i"."$j }' )
266 UNBOUND_LIST_DOMAINS="$UNBOUND_LIST_DOMAINS $partial"
267 echo " local-zone: $partial. transparent" >> $UNBOUND_CONFFILE
268 fi
269 }
270
271 ##############################################################################
272
273 create_host_record() {
274 local cfg="$1"
275 local ip name
276
277 # basefiles dhcp "domain" clause which means host A, AAAA, and PRT record
278 config_get ip "$cfg" ip
279 config_get name "$cfg" name
280
281
282 if [ -n "$name" -a -n "$ip" ] ; then
283 create_local_zone "$name"
284
285 {
286 case $ip in
287 fe80:*|169.254.*)
288 echo " # note link address $ip for host $name"
289 ;;
290
291 [1-9a-f]*:*[0-9a-f])
292 echo " local-data: \"$name. 120 IN AAAA $ip\""
293 echo " local-data-ptr: \"$ip 120 $name\""
294 ;;
295
296 [1-9]*.*[0-9])
297 echo " local-data: \"$name. 120 IN A $ip\""
298 echo " local-data-ptr: \"$ip 120 $name\""
299 ;;
300 esac
301 } >> $UNBOUND_CONFFILE
302 fi
303 }
304
305 ##############################################################################
306
307 create_mx_record() {
308 local cfg="$1"
309 local domain relay pref
310
311 # Insert a static MX record
312 config_get domain "$cfg" domain
313 config_get relay "$cfg" relay
314 config_get pref "$cfg" pref 10
315
316
317 if [ -n "$domain" -a -n "$relay" ] ; then
318 create_local_zone "$domain"
319 echo " local-data: \"$domain. 120 IN MX $pref $relay.\"" \
320 >> $UNBOUND_CONFFILE
321 fi
322 }
323
324 ##############################################################################
325
326 create_srv_record() {
327 local cfg="$1"
328 local srv target port class weight
329
330 # Insert a static SRV record such as SIP server
331 config_get srv "$cfg" srv
332 config_get target "$cfg" target
333 config_get port "$cfg" port
334 config_get class "$cfg" class 10
335 config_get weight "$cfg" weight 10
336
337
338 if [ -n "$srv" -a -n "$target" -a -n "$port" ] ; then
339 create_local_zone "$srv"
340 echo " local-data: \"$srv. 120 IN SRV $class $weight $port $target.\"" \
341 >> $UNBOUND_CONFFILE
342 fi
343 }
344
345 ##############################################################################
346
347 create_cname_record() {
348 local cfg="$1"
349 local cname target
350
351 # Insert static CNAME record
352 config_get cname "$cfg" cname
353 config_get target "$cfg" target
354
355
356 if [ -n "$cname" -a -n "$target" ] ; then
357 create_local_zone "$cname"
358 echo " local-data: \"$cname. 120 IN CNAME $target.\"" >> $UNBOUND_CONFFILE
359 fi
360 }
361
362 ##############################################################################
363
364 create_access_control() {
365 local cfg="$1"
366 local subnets subnets4 subnets6
367 local validip4 validip6
368
369 network_get_subnets subnets4 "$cfg"
370 network_get_subnets6 subnets6 "$cfg"
371 subnets="$subnets4 $subnets6"
372
373
374 if [ -n "$subnets" ] ; then
375 for subnet in $subnets ; do
376 validip4=$( valid_subnet4 $subnet )
377 validip6=$( valid_subnet6 $subnet )
378
379
380 if [ "$validip4" = "ok" -o "$validip6" = "ok" ] ; then
381 # For each "network" UCI add "access-control:" white list for queries
382 echo " access-control: $subnet allow" >> $UNBOUND_CONFFILE
383 fi
384 done
385 fi
386 }
387
388 ##############################################################################
389
390 create_domain_insecure() {
391 echo " domain-insecure: \"$1\"" >> $UNBOUND_CONFFILE
392 }
393
394 ##############################################################################
395
396 unbound_mkdir() {
397 local dhcp_origin=$( uci_get dhcp.@odhcpd[0].leasefile )
398 local dhcp_dir=$( dirname $dhcp_origin )
399 local filestuff
400
401
402 if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" -a ! -d "$dhcp_dir" ] ; then
403 # make sure odhcpd has a directory to write (not done itself, yet)
404 mkdir -p "$dhcp_dir"
405 fi
406
407
408 if [ -f $UNBOUND_KEYFILE ] ; then
409 filestuff=$( cat $UNBOUND_KEYFILE )
410
411
412 case "$filestuff" in
413 *"state=2 [ VALID ]"*)
414 # Lets not lose RFC 5011 tracking if we don't have to
415 cp -p $UNBOUND_KEYFILE $UNBOUND_KEYFILE.keep
416 ;;
417 esac
418 fi
419
420
421 # Blind copy /etc/ to /var/lib/
422 mkdir -p $UNBOUND_VARDIR
423 rm -f $UNBOUND_VARDIR/dhcp_*
424 touch $UNBOUND_CONFFILE
425 touch $UNBOUND_SRV_CONF
426 touch $UNBOUND_EXT_CONF
427 cp -p /etc/unbound/* $UNBOUND_VARDIR/
428
429
430 if [ ! -f $UNBOUND_HINTFILE ] ; then
431 if [ -f /usr/share/dns/root.hints ] ; then
432 # Debian-like package dns-root-data
433 cp -p /usr/share/dns/root.hints $UNBOUND_HINTFILE
434
435 elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
436 logger -t unbound -s "iterator will use built-in root hints"
437 fi
438 fi
439
440
441 if [ ! -f $UNBOUND_KEYFILE ] ; then
442 if [ -f /usr/share/dns/root.key ] ; then
443 # Debian-like package dns-root-data
444 cp -p /usr/share/dns/root.key $UNBOUND_KEYFILE
445
446 elif [ -x $UNBOUND_ANCHOR ] ; then
447 $UNBOUND_ANCHOR -a $UNBOUND_KEYFILE
448
449 elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
450 logger -t unbound -s "validator will use built-in trust anchor"
451 fi
452 fi
453
454
455 copy_dash_update
456
457
458 # Ensure access and prepare to jail
459 chown -R unbound:unbound $UNBOUND_VARDIR
460 chmod 775 $UNBOUND_VARDIR
461 chmod 664 $UNBOUND_VARDIR/*
462 }
463
464 ##############################################################################
465
466 unbound_control() {
467 if [ "$UNBOUND_B_CONTROL" -gt 0 ] ; then
468 {
469 # Enable remote control tool, but only at local host for security
470 # You can hand write fancier encrypted access with /etc/..._ext.conf
471 echo "remote-control:"
472 echo " control-enable: yes"
473 echo " control-use-cert: no"
474 echo " control-interface: 127.0.0.1"
475 echo " control-interface: ::1"
476 echo
477 } >> $UNBOUND_CONFFILE
478 fi
479
480
481 {
482 # Amend your own extended clauses here like forward zones or disable
483 # above (local, no encryption) and amend your own remote encrypted control
484 echo
485 echo "include: $UNBOUND_EXT_CONF" >> $UNBOUND_CONFFILE
486 echo
487 } >> $UNBOUND_CONFFILE
488 }
489
490 ##############################################################################
491
492 unbound_conf() {
493 local cfg="$1"
494 local rt_mem rt_conn modulestring
495
496
497 {
498 # Make fresh conf file
499 echo "# $UNBOUND_CONFFILE generated by UCI $( date )"
500 echo
501 } > $UNBOUND_CONFFILE
502
503
504 {
505 # No threading
506 echo "server:"
507 echo " username: unbound"
508 echo " num-threads: 1"
509 echo " msg-cache-slabs: 1"
510 echo " rrset-cache-slabs: 1"
511 echo " infra-cache-slabs: 1"
512 echo " key-cache-slabs: 1"
513 echo
514 } >> $UNBOUND_CONFFILE
515
516
517 {
518 # Logging
519 echo " verbosity: 1"
520 echo " statistics-interval: 0"
521 echo " statistics-cumulative: no"
522 echo " extended-statistics: no"
523 echo
524 } >> $UNBOUND_CONFFILE
525
526
527 {
528 # Interfaces (access contol "option local_service")
529 echo " interface: 0.0.0.0"
530 echo " interface: ::0"
531 echo " outgoing-interface: 0.0.0.0"
532 echo " outgoing-interface: ::0"
533 echo
534 } >> $UNBOUND_CONFFILE
535
536
537 case "$UNBOUND_D_PROTOCOL" in
538 ip4_only)
539 {
540 echo " do-ip4: yes"
541 echo " do-ip6: no"
542 } >> $UNBOUND_CONFFILE
543 ;;
544
545 ip6_only)
546 {
547 echo " do-ip4: no"
548 echo " do-ip6: yes"
549 } >> $UNBOUND_CONFFILE
550 ;;
551
552 ip6_prefer)
553 {
554 echo " do-ip4: yes"
555 echo " do-ip6: yes"
556 echo " prefer-ip6: yes"
557 } >> $UNBOUND_CONFFILE
558 ;;
559
560 *)
561 {
562 echo " do-ip4: yes"
563 echo " do-ip6: yes"
564 } >> $UNBOUND_CONFFILE
565 ;;
566 esac
567
568
569 {
570 # protocol level tuning
571 echo " edns-buffer-size: $UNBOUND_N_EDNS_SIZE"
572 echo " msg-buffer-size: 8192"
573 echo " port: $UNBOUND_N_RX_PORT"
574 echo " outgoing-port-permit: 10240-65535"
575 echo
576 } >> $UNBOUND_CONFFILE
577
578
579 {
580 # Other harding and options for an embedded router
581 echo " harden-short-bufsize: yes"
582 echo " harden-large-queries: yes"
583 echo " harden-glue: yes"
584 echo " harden-below-nxdomain: no"
585 echo " harden-referral-path: no"
586 echo " use-caps-for-id: no"
587 echo
588 } >> $UNBOUND_CONFFILE
589
590
591 {
592 # Default Files
593 echo " use-syslog: yes"
594 echo " chroot: \"$UNBOUND_VARDIR\""
595 echo " directory: \"$UNBOUND_VARDIR\""
596 echo " pidfile: \"$UNBOUND_PIDFILE\""
597 } >> $UNBOUND_CONFFILE
598
599
600 if [ -f "$UNBOUND_HINTFILE" ] ; then
601 # Optional hints if found
602 echo " root-hints: \"$UNBOUND_HINTFILE\"" >> $UNBOUND_CONFFILE
603 fi
604
605
606 if [ "$UNBOUND_B_DNSSEC" -gt 0 -a -f "$UNBOUND_KEYFILE" ] ; then
607 {
608 echo " auto-trust-anchor-file: \"$UNBOUND_KEYFILE\""
609 echo
610 } >> $UNBOUND_CONFFILE
611
612 else
613 echo >> $UNBOUND_CONFFILE
614 fi
615
616
617 case "$UNBOUND_D_RESOURCE" in
618 # Tiny - Unbound's recommended cheap hardware config
619 tiny) rt_mem=1 ; rt_conn=1 ;;
620 # Small - Half RRCACHE and open ports
621 small) rt_mem=8 ; rt_conn=5 ;;
622 # Medium - Nearly default but with some added balancintg
623 medium) rt_mem=16 ; rt_conn=10 ;;
624 # Large - Double medium
625 large) rt_mem=32 ; rt_conn=10 ;;
626 # Whatever unbound does
627 *) rt_mem=0 ; rt_conn=0 ;;
628 esac
629
630
631 if [ "$rt_mem" -gt 0 ] ; then
632 {
633 # Set memory sizing parameters
634 echo " outgoing-range: $(($rt_conn*64))"
635 echo " num-queries-per-thread: $(($rt_conn*32))"
636 echo " outgoing-num-tcp: $(($rt_conn))"
637 echo " incoming-num-tcp: $(($rt_conn))"
638 echo " rrset-cache-size: $(($rt_mem*256))k"
639 echo " msg-cache-size: $(($rt_mem*128))k"
640 echo " key-cache-size: $(($rt_mem*128))k"
641 echo " neg-cache-size: $(($rt_mem*64))k"
642 echo " infra-cache-numhosts: $(($rt_mem*256))"
643 echo
644 } >> $UNBOUND_CONFFILE
645
646 elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
647 logger -t unbound -s "default memory resource consumption"
648 fi
649
650 # Assembly of module-config: options is tricky; order matters
651 modulestring="iterator"
652
653
654 if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
655 if [ ! -f "$UNBOUND_TIMEFILE" -a "$UNBOUND_B_NTP_BOOT" -gt 0 ] ; then
656 # DNSSEC chicken and egg with getting NTP time
657 echo " val-override-date: -1" >> $UNBOUND_CONFFILE
658 fi
659
660
661 {
662 echo " harden-dnssec-stripped: yes"
663 echo " val-clean-additional: yes"
664 echo " ignore-cd-flag: yes"
665 } >> $UNBOUND_CONFFILE
666
667
668 modulestring="validator $modulestring"
669 fi
670
671
672 if [ "$UNBOUND_B_DNS64" -gt 0 ] ; then
673 echo " dns64-prefix: $UNBOUND_IP_DNS64" >> $UNBOUND_CONFFILE
674
675 modulestring="dns64 $modulestring"
676 fi
677
678
679 {
680 # Print final module string
681 echo " module-config: \"$modulestring\""
682 echo
683 } >> $UNBOUND_CONFFILE
684
685
686 if [ "$UNBOUND_B_QRY_MINST" -gt 0 -a "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
687 {
688 # Some query privacy but "strict" will break some name servers
689 echo " qname-minimisation: yes"
690 echo " qname-minimisation-strict: yes"
691 } >> $UNBOUND_CONFFILE
692
693 elif [ "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
694 # Minor improvement on query privacy
695 echo " qname-minimisation: yes" >> $UNBOUND_CONFFILE
696
697 else
698 echo " qname-minimisation: no" >> $UNBOUND_CONFFILE
699 fi
700
701
702 case "$UNBOUND_D_RECURSION" in
703 passive)
704 {
705 echo " prefetch: no"
706 echo " prefetch-key: no"
707 echo " target-fetch-policy: \"0 0 0 0 0\""
708 echo
709 } >> $UNBOUND_CONFFILE
710 ;;
711
712 aggressive)
713 {
714 echo " prefetch: yes"
715 echo " prefetch-key: yes"
716 echo " target-fetch-policy: \"3 2 1 0 0\""
717 echo
718 } >> $UNBOUND_CONFFILE
719 ;;
720
721 *)
722 if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
723 logger -t unbound -s "default recursion configuration"
724 fi
725 ;;
726 esac
727
728
729 {
730 # Reload records more than 10 hours old
731 # DNSSEC 5 minute bogus cool down before retry
732 # Adaptive infrastructure info kept for 15 minutes
733 echo " cache-min-ttl: $UNBOUND_TTL_MIN"
734 echo " cache-max-ttl: 36000"
735 echo " val-bogus-ttl: 300"
736 echo " infra-host-ttl: 900"
737 echo
738 } >> $UNBOUND_CONFFILE
739
740
741 if [ "$UNBOUND_B_HIDE_BIND" -gt 0 ] ; then
742 {
743 # Block server id and version DNS TXT records
744 echo " hide-identity: yes"
745 echo " hide-version: yes"
746 echo
747 } >> $UNBOUND_CONFFILE
748 fi
749
750
751 if [ "$UNBOUND_B_PRIV_BLCK" -gt 0 ] ; then
752 {
753 # Remove _upstream_ or global reponses with private addresses.
754 # Unbounds own "local zone" and "forward zone" may still use these.
755 # RFC1918, RFC3927, RFC4291, RFC6598, RFC6890
756 echo " private-address: 10.0.0.0/8"
757 echo " private-address: 100.64.0.0/10"
758 echo " private-address: 169.254.0.0/16"
759 echo " private-address: 172.16.0.0/12"
760 echo " private-address: 192.168.0.0/16"
761 echo " private-address: fc00::/8"
762 echo " private-address: fd00::/8"
763 echo " private-address: fe80::/10"
764 } >> $UNBOUND_CONFFILE
765 fi
766
767
768 if [ "$UNBOUND_B_LOCL_BLCK" -gt 0 ] ; then
769 {
770 # Remove DNS reponses from upstream with loopback IP
771 # Black hole DNS method for ad blocking, so consider...
772 echo " private-address: 127.0.0.0/8"
773 echo " private-address: ::1/128"
774 echo
775 } >> $UNBOUND_CONFFILE
776
777 else
778 echo >> $UNBOUND_CONFFILE
779 fi
780
781
782 # Except and accept domains as insecure (DNSSEC); work around broken domains
783 config_list_foreach "$cfg" "domain_insecure" create_domain_insecure
784 echo >> $UNBOUND_CONFFILE
785 }
786
787 ##############################################################################
788
789 unbound_access() {
790 # TODO: Unbound 1.6.0 added "tags" and "views", so we can add tags to
791 # each access-control IP block, and then divert access.
792 # -- "guest" WIFI will not be allowed to see local zone data
793 # -- "child" LAN can black whole a list of domains to http~deadpixel
794
795
796 if [ "$UNBOUND_B_LOCL_SERV" -gt 0 ] ; then
797 # Only respond to queries from which this device has an interface.
798 # Prevent DNS amplification attacks by not responding to the universe.
799 config_load network
800 config_foreach create_access_control interface
801
802
803 {
804 echo " access-control: 127.0.0.0/8 allow"
805 echo " access-control: ::1/128 allow"
806 echo " access-control: fe80::/10 allow"
807 echo
808 } >> $UNBOUND_CONFFILE
809
810 else
811 {
812 echo " access-control: 0.0.0.0/0 allow"
813 echo " access-control: ::0/0 allow"
814 echo
815 } >> $UNBOUND_CONFFILE
816 fi
817
818
819 {
820 # Amend your own "server:" stuff here
821 echo " include: $UNBOUND_SRV_CONF"
822 echo
823 } >> $UNBOUND_CONFFILE
824 }
825
826 ##############################################################################
827
828 unbound_adblock() {
829 # TODO: Unbound 1.6.0 added "tags" and "views"; lets work with adblock team
830 local adb_enabled adb_file
831
832 if [ ! -x /usr/bin/adblock.sh -o ! -x /etc/init.d/adblock ] ; then
833 adb_enabled=0
834 else
835 /etc/init.d/adblock enabled && adb_enabled=1 || adb_enabled=0
836 fi
837
838
839 if [ "$adb_enabled" -gt 0 ] ; then
840 {
841 # Pull in your selected openwrt/pacakges/net/adblock generated lists
842 for adb_file in $UNBOUND_VARDIR/adb_list.* ; do
843 echo " include: $adb_file"
844 done
845 echo
846 } >> $UNBOUND_CONFFILE
847 fi
848 }
849
850 ##############################################################################
851
852 unbound_hostname() {
853 if [ -n "$UNBOUND_TXT_DOMAIN" ] ; then
854 {
855 # TODO: Unbound 1.6.0 added "tags" and "views" and we could make
856 # domains by interface to prevent DNS from "guest" to "home"
857 echo " local-zone: $UNBOUND_TXT_DOMAIN. $UNBOUND_D_DOMAIN_TYPE"
858 echo " domain-insecure: $UNBOUND_TXT_DOMAIN"
859 echo " private-domain: $UNBOUND_TXT_DOMAIN"
860 echo
861 echo " local-zone: $UNBOUND_TXT_HOSTNAME. $UNBOUND_D_DOMAIN_TYPE"
862 echo " domain-insecure: $UNBOUND_TXT_HOSTNAME"
863 echo " private-domain: $UNBOUND_TXT_HOSTNAME"
864 echo
865 } >> $UNBOUND_CONFFILE
866
867
868 case "$UNBOUND_D_DOMAIN_TYPE" in
869 deny|inform_deny|refuse|static)
870 {
871 # avoid upstream involvement in RFC6762 like responses (link only)
872 echo " local-zone: local. $UNBOUND_D_DOMAIN_TYPE"
873 echo " domain-insecure: local"
874 echo " private-domain: local"
875 echo
876 } >> $UNBOUND_CONFFILE
877 ;;
878 esac
879
880
881 if [ "$UNBOUND_D_LAN_FQDN" -gt 0 -o "$UNBOUND_D_WAN_FQDN" -gt 0 ] ; then
882 config_load dhcp
883 config_foreach create_interface_dns dhcp
884 fi
885
886
887 if [ -f "$UNBOUND_DHCP_CONF" ] ; then
888 {
889 # Seed DHCP records because dhcp scripts trigger externally
890 # Incremental Unbound restarts may drop unbound-control add records
891 echo " include: $UNBOUND_DHCP_CONF"
892 echo
893 } >> $UNBOUND_CONFFILE
894 fi
895 fi
896 }
897
898 ##############################################################################
899
900 unbound_records() {
901 if [ "$UNBOUND_D_EXTRA_DNS" -gt 0 ] ; then
902 # Parasite from the uci.dhcp.domain clauses
903 config_load dhcp
904 config_foreach create_host_record domain
905 fi
906
907
908 if [ "$UNBOUND_D_EXTRA_DNS" -gt 1 ] ; then
909 config_foreach create_srv_record srvhost
910 config_foreach create_mx_record mxhost
911 fi
912
913
914 if [ "$UNBOUND_D_EXTRA_DNS" -gt 2 ] ; then
915 config_foreach create_cname_record cname
916 fi
917
918
919 echo >> $UNBOUND_CONFFILE
920 }
921
922 ##############################################################################
923
924 unbound_uci() {
925 local cfg="$1"
926 local dnsmasqpath hostnm
927
928 hostnm=$( uci_get system.@system[0].hostname | awk '{print tolower($0)}' )
929 UNBOUND_TXT_HOSTNAME=${hostnm:-thisrouter}
930
931 config_get_bool UNBOUND_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
932 config_get_bool UNBOUND_B_DNS64 "$cfg" dns64 0
933 config_get_bool UNBOUND_B_HIDE_BIND "$cfg" hide_binddata 1
934 config_get_bool UNBOUND_B_LOCL_SERV "$cfg" localservice 1
935 config_get_bool UNBOUND_B_MAN_CONF "$cfg" manual_conf 0
936 config_get_bool UNBOUND_B_QUERY_MIN "$cfg" query_minimize 0
937 config_get_bool UNBOUND_B_QRY_MINST "$cfg" query_min_strict 0
938 config_get_bool UNBOUND_B_PRIV_BLCK "$cfg" rebind_protection 1
939 config_get_bool UNBOUND_B_LOCL_BLCK "$cfg" rebind_localhost 0
940 config_get_bool UNBOUND_B_CONTROL "$cfg" unbound_control 0
941 config_get_bool UNBOUND_B_DNSSEC "$cfg" validator 0
942 config_get_bool UNBOUND_B_NTP_BOOT "$cfg" validator_ntp 1
943
944 config_get UNBOUND_IP_DNS64 "$cfg" dns64_prefix "64:ff9b::/96"
945
946 config_get UNBOUND_N_EDNS_SIZE "$cfg" edns_size 1280
947 config_get UNBOUND_N_RX_PORT "$cfg" listen_port 53
948 config_get UNBOUND_N_ROOT_AGE "$cfg" root_age 9
949
950 config_get UNBOUND_D_DOMAIN_TYPE "$cfg" domain_type static
951 config_get UNBOUND_D_DHCP_LINK "$cfg" dhcp_link none
952 config_get UNBOUND_D_EXTRA_DNS "$cfg" add_extra_dns 0
953 config_get UNBOUND_D_LAN_FQDN "$cfg" add_local_fqdn 0
954 config_get UNBOUND_D_PROTOCOL "$cfg" protocol mixed
955 config_get UNBOUND_D_RECURSION "$cfg" recursion passive
956 config_get UNBOUND_D_RESOURCE "$cfg" resource small
957 config_get UNBOUND_D_WAN_FQDN "$cfg" add_wan_fqdn 0
958
959 config_get UNBOUND_TTL_MIN "$cfg" ttl_min 120
960 config_get UNBOUND_TXT_DOMAIN "$cfg" domain lan
961
962 UNBOUND_LIST_DOMAINS="nowhere $UNBOUND_TXT_DOMAIN"
963
964 if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
965 config_get_bool UNBOUND_B_DNSMASQ "$cfg" dnsmasq_link_dns 0
966
967
968 if [ "$UNBOUND_B_DNSMASQ" -gt 0 ] ; then
969 UNBOUND_D_DHCP_LINK=dnsmasq
970
971
972 if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
973 logger -t unbound -s "Please use 'dhcp_link' selector instead"
974 fi
975 fi
976 fi
977
978
979 if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
980 if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
981 UNBOUND_D_DHCP_LINK=none
982 else
983 /etc/init.d/dnsmasq enabled || UNBOUND_D_DHCP_LINK=none
984 fi
985
986
987 if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
988 logger -t unbound -s "cannot forward to dnsmasq"
989 fi
990 fi
991
992
993 if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" ] ; then
994 if [ ! -x /usr/sbin/odhcpd -o ! -x /etc/init.d/odhcpd ] ; then
995 UNBOUND_D_DHCP_LINK=none
996 else
997 /etc/init.d/odhcpd enabled || UNBOUND_D_DHCP_LINK=none
998 fi
999
1000
1001 if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
1002 logger -t unbound -s "cannot receive records from odhcpd"
1003 fi
1004 fi
1005
1006
1007 if [ "$UNBOUND_N_EDNS_SIZE" -lt 512 \
1008 -o 4096 -lt "$UNBOUND_N_EDNS_SIZE" ] ; then
1009 logger -t unbound -s "edns_size exceeds range, using default"
1010 UNBOUND_N_EDNS_SIZE=1280
1011 fi
1012
1013
1014 if [ "$UNBOUND_N_RX_PORT" -ne 53 ] \
1015 && [ "$UNBOUND_N_RX_PORT" -lt 1024 -o 10240 -lt "$UNBOUND_N_RX_PORT" ] ; then
1016 logger -t unbound -s "privileged port or in 5 digits, using default"
1017 UNBOUND_N_RX_PORT=53
1018 fi
1019
1020
1021 if [ "$UNBOUND_TTL_MIN" -gt 1800 ] ; then
1022 logger -t unbound -s "ttl_min could have had awful side effects, using 300"
1023 UNBOUND_TTL_MIN=300
1024 fi
1025 }
1026
1027 ##############################################################################
1028
1029 _resolv_setup() {
1030 if [ "$UNBOUND_N_RX_PORT" != "53" ] ; then
1031 return
1032 fi
1033
1034 if [ -x /etc/init.d/dnsmasq ] && /etc/init.d/dnsmasq enabled \
1035 && nslookup localhost 127.0.0.1#53 >/dev/null 2>&1 ; then
1036 # unbound is configured for port 53, but dnsmasq is enabled and a resolver
1037 # listens on localhost:53, lets assume dnsmasq manages the resolver file.
1038 # TODO:
1039 # really check if dnsmasq runs a local (main) resolver in stead of using
1040 # nslookup that times out when no resolver listens on localhost:53.
1041 return
1042 fi
1043
1044 # unbound is designated to listen on 127.0.0.1#53,
1045 # set resolver file to local.
1046 rm -f /tmp/resolv.conf
1047 {
1048 echo "# /tmp/resolv.conf generated by Unbound UCI $( date )"
1049 echo "nameserver 127.0.0.1"
1050 echo "nameserver ::1"
1051 echo "search $UNBOUND_TXT_DOMAIN"
1052 } > /tmp/resolv.conf
1053 }
1054
1055 ##############################################################################
1056
1057 _resolv_teardown() {
1058 case $( cat /tmp/resolv.conf ) in
1059 *"generated by Unbound UCI"*)
1060 # our resolver file, reset to auto resolver file.
1061 rm -f /tmp/resolv.conf
1062 ln -s /tmp/resolv.conf.auto /tmp/resolv.conf
1063 ;;
1064 esac
1065 }
1066
1067 ##############################################################################
1068
1069 unbound_start() {
1070 config_load unbound
1071 config_foreach unbound_uci unbound
1072
1073
1074 unbound_mkdir
1075
1076
1077 if [ "$UNBOUND_B_MAN_CONF" -eq 0 ] ; then
1078 unbound_conf
1079 unbound_access
1080 unbound_adblock
1081
1082 if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
1083 dnsmasq_link
1084 else
1085 unbound_hostname
1086 unbound_records
1087 fi
1088
1089 unbound_control
1090 fi
1091
1092
1093 _resolv_setup
1094 }
1095
1096 ##############################################################################
1097
1098 unbound_stop() {
1099 _resolv_teardown
1100
1101
1102 rootzone_update
1103 }
1104
1105 ##############################################################################
1106
Mirror of packages feed