#
##############################################################################
-UNBOUND_B_SLAAC6_MAC=0
-UNBOUND_B_DNSSEC=0
-UNBOUND_B_DNS64=0
-UNBOUND_B_EXT_STATS=0
-UNBOUND_B_GATE_NAME=0
-UNBOUND_B_HIDE_BIND=1
-UNBOUND_B_LOCL_BLCK=0
-UNBOUND_B_LOCL_SERV=1
-UNBOUND_B_MAN_CONF=0
-UNBOUND_B_NTP_BOOT=1
-UNBOUND_B_QUERY_MIN=0
-UNBOUND_B_QRY_MINST=0
-UNBOUND_B_AUTH_ROOT=0
-
-UNBOUND_D_CONTROL=0
-UNBOUND_D_DOMAIN_TYPE=static
-UNBOUND_D_DHCP_LINK=none
-UNBOUND_D_EXTRA_DNS=0
-UNBOUND_D_LAN_FQDN=0
-UNBOUND_D_PRIV_BLCK=1
-UNBOUND_D_PROTOCOL=mixed
-UNBOUND_D_RESOURCE=small
-UNBOUND_D_RECURSION=passive
-UNBOUND_D_WAN_FQDN=0
-
-UNBOUND_IP_DNS64="64:ff9b::/96"
-
-UNBOUND_N_EDNS_SIZE=1280
-UNBOUND_N_FWD_PORTS=""
-UNBOUND_N_RX_PORT=53
-UNBOUND_N_ROOT_AGE=9
-
-UNBOUND_TTL_MIN=120
-
-UNBOUND_TXT_DOMAIN=lan
-UNBOUND_TXT_FWD_ZONE=""
-UNBOUND_TXT_HOSTNAME=thisrouter
-
-UNBOUND_LIST_FORWARD=""
-UNBOUND_LIST_INSECURE=""
+UB_B_SLAAC6_MAC=0
+UB_B_DNSSEC=0
+UB_B_DNS64=0
+UB_B_EXT_STATS=0
+UB_B_GATE_NAME=0
+UB_B_HIDE_BIND=1
+UB_B_LOCL_BLCK=0
+UB_B_LOCL_SERV=1
+UB_B_MAN_CONF=0
+UB_B_NTP_BOOT=1
+UB_B_QUERY_MIN=0
+UB_B_QRY_MINST=0
+UB_B_AUTH_ROOT=0
+
+UB_D_CONTROL=0
+UB_D_DOMAIN_TYPE=static
+UB_D_DHCP_LINK=none
+UB_D_EXTRA_DNS=0
+UB_D_LAN_FQDN=0
+UB_D_PRIV_BLCK=1
+UB_D_PROTOCOL=mixed
+UB_D_RESOURCE=small
+UB_D_RECURSION=passive
+UB_D_VERBOSE=1
+UB_D_WAN_FQDN=0
+
+UB_IP_DNS64="64:ff9b::/96"
+
+UB_N_EDNS_SIZE=1280
+UB_N_RX_PORT=53
+UB_N_ROOT_AGE=9
+
+UB_TTL_MIN=120
+UB_TXT_DOMAIN=lan
+UB_TXT_HOSTNAME=thisrouter
##############################################################################
# keep track of assignments during inserted resource records
-UNBOUND_LIST_DOMAINS=""
-UNBOUND_LIST_IFACE=""
-UNBOUND_LIST_PRV_IP6GLA=""
-UNBOUND_LIST_LAN_NET=""
-
-# Similar default SOA / NS RR as Unbound uses for private ARPA zones
-UNBOUND_XSOA="3600 IN SOA localhost. nobody.invalid. 1 3600 1200 7200 600"
-UNBOUND_XNS="3600 IN NS localhost."
+UB_LIST_NETW_ALL=""
+UB_LIST_NETW_LAN=""
+UB_LIST_NETW_WAN=""
+UB_LIST_INSECURE=""
+UB_LIST_ZONE_SERVERS=""
+UB_LIST_ZONE_NAMES=""
##############################################################################
. /usr/lib/unbound/defaults.sh
. /usr/lib/unbound/dnsmasq.sh
. /usr/lib/unbound/iptools.sh
-. /usr/lib/unbound/rootzone.sh
##############################################################################
-create_interface_dns() {
+bundle_all_networks() {
local cfg="$1"
- local ipcommand logint ignore ifname ifdashname
- local name names address addresses
- local ulaprefix if_fqdn host_fqdn
- local mode_ptr="$UNBOUND_TXT_HOSTNAME"
- local names="$UNBOUND_TXT_HOSTNAME"
-
- # Create local-data: references for this hosts interfaces (router).
- config_get logint "$cfg" interface
- config_get_bool ignore "$cfg" ignore 0
- network_get_device ifname "$cfg"
-
- ifdashname="${ifname//./-}"
- ipcommand="ip -o address show $ifname"
- addresses=$( $ipcommand | awk '/inet/{sub(/\/.*/,"",$4); print $4}' )
- ulaprefix=$( uci_get network.@globals[0].ula_prefix )
- host_fqdn="$UNBOUND_TXT_HOSTNAME.$UNBOUND_TXT_DOMAIN"
- if_fqdn="$ifdashname.$host_fqdn"
-
-
- if [ -z "$ifdashname" ] ; then
- # race conditions at init can rarely cause a blank device return
- # the record format is invalid and Unbound won't load the conf file
- mode=0
-
- elif [ -n "$UNBOUND_LIST_IFACE" ] ; then
- case "$UNBOUND_LIST_IFACE" in
- *$ifdashname*)
- # repeat such as dual WAN (eth0-1) and WAN6 (eth0-1)
- mode=0
- ;;
-
- *)
- mode=1
- ;;
- esac
-
- else
- mode=1
- fi
-
-
- if [ $mode -gt 0 ] ; then
- UNBOUND_LIST_IFACE="$UNBOUND_LIST_IFACE $ifdashname"
-
-
- if [ -z "${ulaprefix%%:/*}" ] ; then
- # Nonsense so this option isn't globbed below
- ulaprefix="fdno:such:addr::/48"
- fi
-
-
- if [ "$ignore" -gt 0 ] ; then
- mode="$UNBOUND_D_WAN_FQDN"
- else
- mode="$UNBOUND_D_LAN_FQDN"
- fi
- fi
-
-
- if [ "$mode" -gt 1 ] ; then
- case "$mode" in
- 3)
- mode_ptr="$host_fqdn"
- names="$host_fqdn $UNBOUND_TXT_HOSTNAME"
- ;;
-
- 4)
- mode_ptr="$if_fqdn"
- names="$if_fqdn $host_fqdn $UNBOUND_TXT_HOSTNAME"
- ;;
- esac
-
-
- {
- for address in $addresses ; do
- case $address in
- fe80:*|169.254.*)
- echo " # note link address $address"
- ;;
-
- [1-9a-f]*:*[0-9a-f])
- # GA and ULA IP6 for HOST IN AAA records (ip command is robust)
- for name in $names ; do
- echo " local-data: \"$name. 120 IN AAAA $address\""
- done
- echo " local-data-ptr: \"$address 120 $mode_ptr\""
- ;;
-
- [1-9]*.*[0-9])
- # Old fashioned HOST IN A records
- for name in $names ; do
- echo " local-data: \"$name. 120 IN A $address\""
- done
- echo " local-data-ptr: \"$address 120 $mode_ptr\""
- ;;
- esac
- done
- echo
- } >> $UNBOUND_CONFFILE
-
- elif [ "$mode" -gt 0 ] ; then
- {
- for address in $addresses ; do
- case $address in
- fe80:*|169.254.*)
- echo " # note link address $address"
- ;;
-
- "${ulaprefix%%:/*}"*)
- # Only this networks ULA and only hostname
- echo " local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN AAAA $address\""
- echo " local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
- ;;
-
- [1-9]*.*[0-9])
- echo " local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN A $address\""
- echo " local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
- ;;
- esac
- done
- echo
- } >> $UNBOUND_CONFFILE
- fi
-}
+ local ifname ifdashname
+ local subnet subnets subnets4 subnets6
+ local validip4 validip6
-##############################################################################
+ network_get_subnets subnets4 "$cfg"
+ network_get_subnets6 subnets6 "$cfg"
+ network_get_device ifname "$cfg"
-create_local_zone() {
- local target="$1"
- local partial domain found
+ ifdashname="${ifname//./-}"
+ subnets="$subnets4 $subnets6"
- if [ -n "$UNBOUND_LIST_DOMAINS" ] ; then
- for domain in $UNBOUND_LIST_DOMAINS ; do
- case $target in
- *"${domain}")
- found=1
- break
- ;;
+ if [ -n "$subnets" ] ; then
+ for subnet in $subnets ; do
+ validip4=$( valid_subnet4 $subnet )
+ validip6=$( valid_subnet6 $subnet )
- [A-Za-z0-9]*.[A-Za-z0-9]*)
- found=0
- ;;
- *) # no dots
- found=1
- break
- ;;
- esac
+ if [ "$validip4" = "ok" -o "$validip6" = "ok" ] ; then
+ UB_LIST_NETW_ALL="$UB_LIST_NETW_ALL $ifdashname@$subnet"
+ fi
done
- else
- found=0
- fi
-
-
- if [ $found -eq 0 ] ; then
- # New Zone! Bundle local-zones: by first two name tiers "abcd.tld."
- partial=$( echo "$target" | awk -F. '{ j=NF ; i=j-1; print $i"."$j }' )
- UNBOUND_LIST_DOMAINS="$UNBOUND_LIST_DOMAINS $partial"
- echo " local-zone: $partial transparent" >> $UNBOUND_CONFFILE
fi
}
##############################################################################
-create_host_record() {
+bundle_lan_networks() {
local cfg="$1"
- local ip name
-
- # basefiles dhcp "domain" clause which means host A, AAAA, and PRT record
- config_get ip "$cfg" ip
- config_get name "$cfg" name
-
+ local ifsubnet ifname ifdashname ignore
- if [ -n "$name" -a -n "$ip" ] ; then
- create_local_zone "$name"
-
- {
- case $ip in
- fe80:*|169.254.*)
- echo " # note link address $ip for host $name"
- ;;
+ config_get_bool ignore "$cfg" ignore 0
+ network_get_device ifname "$cfg"
+ ifdashname="${ifname//./-}"
- [1-9a-f]*:*[0-9a-f])
- echo " local-data: \"$name. 120 IN AAAA $ip\""
- echo " local-data-ptr: \"$ip 120 $name\""
- ;;
- [1-9]*.*[0-9])
- echo " local-data: \"$name. 120 IN A $ip\""
- echo " local-data-ptr: \"$ip 120 $name\""
- ;;
+ if [ "$ignore" -eq 0 -a -n "$ifdashname" -a -n "$UB_LIST_NETW_ALL" ] ; then
+ for ifsubnet in $UB_LIST_NETW_ALL ; do
+ case $ifsubnet in
+ "${ifdashname}"@*)
+ # Special GLA protection for local block; ULA protected as a catagory
+ UB_LIST_NETW_LAN="$UB_LIST_NETW_LAN $ifsubnet"
+ ;;
esac
- } >> $UNBOUND_CONFFILE
- fi
-}
-
-##############################################################################
-
-create_mx_record() {
- local cfg="$1"
- local domain relay pref
-
- # Insert a static MX record
- config_get domain "$cfg" domain
- config_get relay "$cfg" relay
- config_get pref "$cfg" pref 10
-
-
- if [ -n "$domain" -a -n "$relay" ] ; then
- create_local_zone "$domain"
- echo " local-data: \"$domain. 120 IN MX $pref $relay.\"" \
- >> $UNBOUND_CONFFILE
+ done
fi
}
##############################################################################
-create_srv_record() {
- local cfg="$1"
- local srv target port class weight
+bundle_wan_networks() {
+ local ifsubnet
- # Insert a static SRV record such as SIP server
- config_get srv "$cfg" srv
- config_get target "$cfg" target
- config_get port "$cfg" port
- config_get class "$cfg" class 10
- config_get weight "$cfg" weight 10
+ if [ -n "$UB_LIST_NETW_ALL" ] ; then
+ for ifsubnet in $UB_LIST_NETW_ALL ; do
+ case $UB_LIST_NETW_LAN in
+ *"${ifsubnet}"*)
+ # If LAN, then not WAN ...
+ ;;
- if [ -n "$srv" -a -n "$target" -a -n "$port" ] ; then
- create_local_zone "$srv"
- echo " local-data: \"$srv. 120 IN SRV $class $weight $port $target.\"" \
- >> $UNBOUND_CONFFILE
+ *)
+ UB_LIST_NETW_WAN="$UB_LIST_NETW_WAN $ifsubnet"
+ ;;
+ esac
+ done
fi
}
##############################################################################
-create_cname_record() {
- local cfg="$1"
- local cname target
-
- # Insert static CNAME record
- config_get cname "$cfg" cname
- config_get target "$cfg" target
-
-
- if [ -n "$cname" -a -n "$target" ] ; then
- create_local_zone "$cname"
- echo " local-data: \"$cname. 120 IN CNAME $target.\"" >> $UNBOUND_CONFFILE
- fi
+bundle_resolv_conf_servers() {
+ local resolvers=$( awk '/nameserver/ { print $2 }' /tmp/resolv.conf.auto )
+ UB_LIST_ZONE_SERVERS="$UB_LIST_ZONE_SERVERS $resolvers"
}
##############################################################################
-create_access_control() {
- local cfg="$1"
- local subnets subnets4 subnets6
- local validip4 validip6
-
- network_get_subnets subnets4 "$cfg"
- network_get_subnets6 subnets6 "$cfg"
- subnets="$subnets4 $subnets6"
-
-
- if [ -n "$subnets" ] ; then
- for subnet in $subnets ; do
- validip4=$( valid_subnet4 $subnet )
- validip6=$( valid_subnet6 $subnet )
-
-
- if [ "$validip4" = "ok" -o "$validip6" = "ok" ] ; then
- # For each "network" UCI add "access-control:" white list for queries
- echo " access-control: $subnet allow" >> $UNBOUND_CONFFILE
- fi
- done
- fi
+bundle_zone_names() {
+ UB_LIST_ZONE_NAMES="$UB_LIST_ZONE_NAMES $1"
}
##############################################################################
-bundle_domain_forward() {
- UNBOUND_LIST_FORWARD="$UNBOUND_LIST_FORWARD $1"
+bundle_zone_servers() {
+ UB_LIST_ZONE_SERVERS="$UB_LIST_ZONE_SERVERS $1"
}
##############################################################################
bundle_domain_insecure() {
- UNBOUND_LIST_INSECURE="$UNBOUND_LIST_INSECURE $1"
-}
-
-##############################################################################
-
-bundle_private_interface() {
- local ipcommand ifsubnet ifsubnets ifname validip4
-
- network_get_device ifname $1
-
-
- if [ -n "$ifname" ] ; then
- ipcommand="ip -o address show $ifname"
- ifsubnets=$( $ipcommand | awk '/inet/{ print $4 }' )
-
-
- if [ -n "$ifsubnets" ] ; then
- for ifsubnet in $ifsubnets ; do
- case $ifsubnet in
- [1-9][0-9a-f][0-9a-f][0-9a-f]:*[0-9a-f])
- # Special GLA protection for local block; ULA protected as a catagory
- UNBOUND_LIST_PRV_IP6GLA="$UNBOUND_LIST_PRV_IP6GLA $ifsubnet"
- ;;
-
- f[dc][0-9a-f][0-9a-f]:*[0-9a-f])
- # Used to configure specific local-zone: data
- UNBOUND_LIST_LAN_NET="$UNBOUND_LIST_LAN_NET $ifsubnet"
- ;;
-
- *)
- validip4=$( valid_subnet4 $ifsubnet )
-
-
- if [ "$validip4" = "ok" ] ; then
- UNBOUND_LIST_LAN_NET="$UNBOUND_LIST_LAN_NET $ifsubnet"
- fi
- ;;
- esac
- done
- fi
- fi
+ UB_LIST_INSECURE="$UB_LIST_INSECURE $1"
}
##############################################################################
local filestuff
- if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" ] ; then
+ if [ "$UB_D_DHCP_LINK" = "odhcpd" ] ; then
local dhcp_origin=$( uci_get dhcp.@odhcpd[0].leasefile )
local dhcp_dir=$( dirname $dhcp_origin )
fi
- if [ -f $UNBOUND_KEYFILE ] ; then
- filestuff=$( cat $UNBOUND_KEYFILE )
+ if [ -f $UB_RKEY_FILE ] ; then
+ filestuff=$( cat $UB_RKEY_FILE )
case "$filestuff" in
*"state=2 [ VALID ]"*)
# Lets not lose RFC 5011 tracking if we don't have to
- cp -p $UNBOUND_KEYFILE $UNBOUND_KEYFILE.keep
+ cp -p $UB_RKEY_FILE $UB_RKEY_FILE.keep
;;
esac
fi
- # Blind copy /etc/ to /var/lib/
- mkdir -p $UNBOUND_VARDIR
- rm -f $UNBOUND_VARDIR/dhcp_*
- touch $UNBOUND_CONFFILE
- touch $UNBOUND_SRV_CONF
- touch $UNBOUND_EXT_CONF
- cp -p /etc/unbound/* $UNBOUND_VARDIR/
+ # Blind copy /etc/unbound to /var/lib/unbound
+ mkdir -p $UB_VARDIR
+ rm -f $UB_VARDIR/dhcp_*
+ touch $UB_TOTAL_CONF
+ cp -p /etc/unbound/* $UB_VARDIR/
- if [ ! -f $UNBOUND_HINTFILE ] ; then
+ if [ ! -f $UB_RHINT_FILE ] ; then
if [ -f /usr/share/dns/root.hints ] ; then
# Debian-like package dns-root-data
- cp -p /usr/share/dns/root.hints $UNBOUND_HINTFILE
+ cp -p /usr/share/dns/root.hints $UB_RHINT_FILE
- elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
- logger -t unbound -s "default root hints (built in rootservers.net)"
+ elif [ ! -f "$UB_TIME_FILE" ] ; then
+ logger -t unbound -s "default root hints (built in root-servers.net)"
fi
fi
- if [ ! -f $UNBOUND_KEYFILE ] ; then
+ if [ ! -f $UB_RKEY_FILE ] ; then
if [ -f /usr/share/dns/root.key ] ; then
# Debian-like package dns-root-data
- cp -p /usr/share/dns/root.key $UNBOUND_KEYFILE
+ cp -p /usr/share/dns/root.key $UB_RKEY_FILE
- elif [ -x $UNBOUND_ANCHOR ] ; then
- $UNBOUND_ANCHOR -a $UNBOUND_KEYFILE
+ elif [ -x $UB_ANCHOR ] ; then
+ $UB_ANCHOR -a $UB_RKEY_FILE
- elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
+ elif [ ! -f "$UB_TIME_FILE" ] ; then
logger -t unbound -s "default trust anchor (built in root DS record)"
fi
fi
- if [ -f $UNBOUND_KEYFILE.keep ] ; then
+ if [ -f $UB_RKEY_FILE.keep ] ; then
# root.key.keep is reused if newest
- cp -u $UNBOUND_KEYFILE.keep $UNBOUND_KEYFILE
- rm -f $UNBOUND_KEYFILE.keep
+ cp -u $UB_RKEY_FILE.keep $UB_RKEY_FILE
+ rm -f $UB_RKEY_FILE.keep
+ fi
+
+
+ if [ -f $UB_TLS_ETC_FILE ] ; then
+ # copy the cert bundle into jail
+ cp -p $UB_TLS_ETC_FILE $UB_TLS_FWD_FILE
fi
# Ensure access and prepare to jail
- chown -R unbound:unbound $UNBOUND_VARDIR
- chmod 755 $UNBOUND_VARDIR
- chmod 644 $UNBOUND_VARDIR/*
+ chown -R unbound:unbound $UB_VARDIR
+ chmod 755 $UB_VARDIR
+ chmod 644 $UB_VARDIR/*
- if [ -f $UNBOUND_CTLKEY_FILE -o -f $UNBOUND_CTLPEM_FILE \
- -o -f $UNBOUND_SRVKEY_FILE -o -f $UNBOUND_SRVPEM_FILE ] ; then
+ if [ -f $UB_CTLKEY_FILE -o -f $UB_CTLPEM_FILE \
+ -o -f $UB_SRVKEY_FILE -o -f $UB_SRVPEM_FILE ] ; then
# Keys (some) exist already; do not create new ones
- chmod 640 $UNBOUND_CTLKEY_FILE $UNBOUND_CTLPEM_FILE \
- $UNBOUND_SRVKEY_FILE $UNBOUND_SRVPEM_FILE
+ chmod 640 $UB_CTLKEY_FILE $UB_CTLPEM_FILE \
+ $UB_SRVKEY_FILE $UB_SRVPEM_FILE
elif [ -x /usr/sbin/unbound-control-setup ] ; then
- case "$UNBOUND_D_CONTROL" in
- [2-3])
- # unbound-control-setup for encrypt opt. 2 and 3, but not 4 "static"
- /usr/sbin/unbound-control-setup -d $UNBOUND_VARDIR
+ case "$UB_D_CONTROL" in
+ [2-3])
+ # unbound-control-setup for encrypt opt. 2 and 3, but not 4 "static"
+ /usr/sbin/unbound-control-setup -d $UB_VARDIR
- chown -R unbound:unbound $UNBOUND_CTLKEY_FILE $UNBOUND_CTLPEM_FILE \
- $UNBOUND_SRVKEY_FILE $UNBOUND_SRVPEM_FILE
+ chown -R unbound:unbound $UB_CTLKEY_FILE $UB_CTLPEM_FILE \
+ $UB_SRVKEY_FILE $UB_SRVPEM_FILE
- chmod 640 $UNBOUND_CTLKEY_FILE $UNBOUND_CTLPEM_FILE \
- $UNBOUND_SRVKEY_FILE $UNBOUND_SRVPEM_FILE
+ chmod 640 $UB_CTLKEY_FILE $UB_CTLPEM_FILE \
+ $UB_SRVKEY_FILE $UB_SRVPEM_FILE
- cp -p $UNBOUND_CTLKEY_FILE /etc/unbound/unbound_control.key
- cp -p $UNBOUND_CTLPEM_FILE /etc/unbound/unbound_control.pem
- cp -p $UNBOUND_SRVKEY_FILE /etc/unbound/unbound_server.key
- cp -p $UNBOUND_SRVPEM_FILE /etc/unbound/unbound_server.pem
- ;;
+ cp -p $UB_CTLKEY_FILE /etc/unbound/unbound_control.key
+ cp -p $UB_CTLPEM_FILE /etc/unbound/unbound_control.pem
+ cp -p $UB_SRVKEY_FILE /etc/unbound/unbound_server.key
+ cp -p $UB_SRVPEM_FILE /etc/unbound/unbound_server.pem
+ ;;
esac
fi
+
+
+ if [ "$UB_B_NTP_BOOT" -eq 0 ] ; then
+ # time is considered okay on this device (skip /etc/hotplug/ntpd/unbound)
+ date -Is > $UB_TIME_FILE
+ fi
}
##############################################################################
unbound_control() {
- if [ "$UNBOUND_D_CONTROL" -gt 1 ] ; then
- if [ ! -f $UNBOUND_CTLKEY_FILE -o ! -f $UNBOUND_CTLPEM_FILE \
- -o ! -f $UNBOUND_SRVKEY_FILE -o ! -f $UNBOUND_SRVPEM_FILE ] ; then
+ echo "# $UB_CTRL_CONF generated by UCI $( date -Is )" > $UB_CTRL_CONF
+
+
+ if [ "$UB_D_CONTROL" -gt 1 ] ; then
+ if [ ! -f $UB_CTLKEY_FILE -o ! -f $UB_CTLPEM_FILE \
+ -o ! -f $UB_SRVKEY_FILE -o ! -f $UB_SRVPEM_FILE ] ; then
# Key files need to be present; if unbound-control-setup was found, then
# they might have been made during unbound_makedir() above.
- UNBOUND_D_CONTROL=0
+ UB_D_CONTROL=0
fi
fi
- case "$UNBOUND_D_CONTROL" in
- 1)
- {
- # Local Host Only Unencrypted Remote Control
- echo "remote-control:"
- echo " control-enable: yes"
- echo " control-use-cert: no"
- echo " control-interface: 127.0.0.1"
- echo " control-interface: ::1"
- echo
- } >> $UNBOUND_CONFFILE
- ;;
+ case "$UB_D_CONTROL" in
+ 1)
+ {
+ # Local Host Only Unencrypted Remote Control
+ echo "remote-control:"
+ echo " control-enable: yes"
+ echo " control-use-cert: no"
+ echo " control-interface: 127.0.0.1"
+ echo " control-interface: ::1"
+ echo
+ } >> $UB_CTRL_CONF
+ ;;
- 2)
- {
- # Local Host Only Encrypted Remote Control
- echo "remote-control:"
- echo " control-enable: yes"
- echo " control-use-cert: yes"
- echo " control-interface: 127.0.0.1"
- echo " control-interface: ::1"
- echo " server-key-file: $UNBOUND_SRVKEY_FILE"
- echo " server-cert-file: $UNBOUND_SRVPEM_FILE"
- echo " control-key-file: $UNBOUND_CTLKEY_FILE"
- echo " control-cert-file: $UNBOUND_CTLPEM_FILE"
- echo
- } >> $UNBOUND_CONFFILE
- ;;
+ 2)
+ {
+ # Local Host Only Encrypted Remote Control
+ echo "remote-control:"
+ echo " control-enable: yes"
+ echo " control-use-cert: yes"
+ echo " control-interface: 127.0.0.1"
+ echo " control-interface: ::1"
+ echo " server-key-file: $UB_SRVKEY_FILE"
+ echo " server-cert-file: $UB_SRVPEM_FILE"
+ echo " control-key-file: $UB_CTLKEY_FILE"
+ echo " control-cert-file: $UB_CTLPEM_FILE"
+ echo
+ } >> $UB_CTRL_CONF
+ ;;
- [3-4])
- {
- # Network Encrypted Remote Control
- # (3) may auto setup and (4) must have static key/pem files
- # TODO: add UCI list for interfaces to bind
- echo "remote-control:"
- echo " control-enable: yes"
- echo " control-use-cert: yes"
- echo " control-interface: 0.0.0.0"
- echo " control-interface: ::0"
- echo " server-key-file: $UNBOUND_SRVKEY_FILE"
- echo " server-cert-file: $UNBOUND_SRVPEM_FILE"
- echo " control-key-file: $UNBOUND_CTLKEY_FILE"
- echo " control-cert-file: $UNBOUND_CTLPEM_FILE"
- echo
- } >> $UNBOUND_CONFFILE
- ;;
+ [3-4])
+ {
+ # Network Encrypted Remote Control
+ # (3) may auto setup and (4) must have static key/pem files
+ # TODO: add UCI list for interfaces to bind
+ echo "remote-control:"
+ echo " control-enable: yes"
+ echo " control-use-cert: yes"
+ echo " control-interface: 0.0.0.0"
+ echo " control-interface: ::0"
+ echo " server-key-file: $UB_SRVKEY_FILE"
+ echo " server-cert-file: $UB_SRVPEM_FILE"
+ echo " control-key-file: $UB_CTLKEY_FILE"
+ echo " control-cert-file: $UB_CTLPEM_FILE"
+ echo
+ } >> $UB_CTRL_CONF
+ ;;
esac
-
-
- {
- # Amend your own extended clauses here like forward zones or disable
- # above (local, no encryption) and amend your own remote encrypted control
- echo
- echo "include: $UNBOUND_EXT_CONF" >> $UNBOUND_CONFFILE
- echo
- } >> $UNBOUND_CONFFILE
}
##############################################################################
-unbound_forward() {
- local fdomain fresolver resolvers
- # Forward selected domains to the upstream (WAN) stub resolver. This may be
- # faster or local pool addresses to ISP service login page. This may keep
- # internal organization lookups, well, internal to the organization.
+unbound_zone() {
+ local cfg=$1
+ local zone_sym zone_name zone_type zone_enabled zone_file
+ local tls_upstream fallback proivder
+ local server port tls_port tls_index tls_suffix url_dir
+ if [ ! -f "$UB_ZONE_CONF" ] ; then
+ echo "# $UB_ZONE_CONF generated by UCI $( date -Is )" > $UB_ZONE_CONF
+ fi
- if [ -n "$UNBOUND_LIST_FORWARD" ] ; then
- resolvers=$( grep nameserver /tmp/resolv.conf.auto | sed "s/nameserver//g" )
+ config_get_bool zone_enabled "$cfg" enabled 0
- if [ -n "$resolvers" ] ; then
- for fdomain in $UNBOUND_LIST_FORWARD ; do
- {
- echo "forward-zone:"
- echo " name: $fdomain"
- for fresolver in $resolvers ; do
- echo " forward-addr: $fresolver"
- done
- echo
- } >> $UNBOUND_CONFFILE
- done
+
+ if [ "$zone_enabled" -eq 1 ] ; then
+ # these lists are built for each zone; empty to start
+ UB_LIST_ZONE_NAMES=""
+ UB_LIST_ZONE_SERVERS=""
+
+ config_get zone_type "$cfg" zone_type ""
+ config_get port "$cfg" port ""
+ config_get tls_index "$cfg" tls_index ""
+ config_get tls_port "$cfg" tls_port 853
+ config_get url_dir "$cfg" url_dir ""
+
+ config_get_bool resolv_conf "$cfg" resolv_conf 0
+ config_get_bool fallback "$cfg" fallback 1
+ config_get_bool tls_upstream "$cfg" tls_upstream 0
+
+ config_list_foreach "$cfg" zone_name bundle_zone_names
+ config_list_foreach "$cfg" server bundle_zone_servers
+
+ # string formating for Unbound syntax
+ tls_suffix="${tls_port:+@${tls_port}${tls_index:+#${tls_index}}}"
+ [ "$fallback" -eq 0 ] && fallback=no || fallback=yes
+ [ "$tls_upstream" -eq 0 ] && tls_upstream=no || tls_upstream=yes
+
+
+ if [ $resolv_conf -eq 1 ] ; then
+ bundle_resolv_conf_servers
fi
+
+ else
+ zone_type=skip
fi
-}
-##############################################################################
-unbound_auth_root() {
- local axfrservers="lax.xfr.dns.icann.org iad.xfr.dns.icann.org"
- local httpserver="http://www.internic.net/domain/"
- local authzones="root arpa in-addr.arpa ip6.arpa"
- local server zone realzone
- # Download or AXFR the root and arpa zones to reduce the work needed at
- # top level of recursion. If your users will hit many ccTLD or you have
- # tracking logs resolving many PTR, then this can speed things up.
- # Total size of text in TMPFS could be about 5MB.
-
-
- if [ "$UNBOUND_B_AUTH_ROOT" -gt 0 ] ; then
- for zone in $authzones ; do
- if [ "$zone" = "root" ] ; then
- realzone="."
- else
- realzone=$zone
+ case $zone_type in
+ auth_zone)
+ if [ -n "$UB_LIST_ZONE_NAMES" ] \
+ && [ -n "$url_dir" -o -n "$UB_LIST_ZONE_SERVERS" ] ; then
+ for zone_name in $UB_LIST_ZONE_NAMES ; do
+ if [ "$zone_name" = "." ] ; then
+ zone_sym=.
+ zone_name=root
+ zone_file=root.zone
+ else
+ zone_sym=$zone_name
+ zone_file=$zone_name.zone
+ zone_file=${zone_file//../.}
+ fi
+
+
+ {
+ # generate an auth-zone: with switches for prefetch cache
+ echo "auth-zone:"
+ echo " name: $zone_sym"
+ for server in $UB_LIST_ZONE_SERVERS ; do
+ echo " master: $server${port:+@${port}}"
+ done
+ if [ -n "$url_dir" ] ; then
+ echo " url: $url_dir$zone_file"
+ fi
+ echo " fallback-enabled: $fallback"
+ echo " for-downstream: no"
+ echo " for-upstream: yes"
+ echo " zonefile: $zone_file"
+ echo
+ } >> $UB_ZONE_CONF
+ done
+ fi
+ ;;
+
+ forward_zone)
+ if [ ! -f $UB_TLS_FWD_FILE -a "$tls_upstream" = "yes" ] ; then
+ logger -p 4 -t unbound -s \
+ "Forward-zone TLS benefits from authentication in package 'ca-bundle'"
fi
- {
- echo "auth-zone:"
- echo " name: $realzone"
- for server in $axfrservers ; do
- echo " master: $server"
+ if [ -n "$UB_LIST_ZONE_NAMES" -a -n "$UB_LIST_ZONE_SERVERS" ] ; then
+ for zonename in $UB_LIST_ZONE_NAMES ; do
+ {
+ # generate a forward-zone with or without tls
+ echo "forward-zone:"
+ echo " name: $zonename"
+ for server in $UB_LIST_ZONE_SERVERS ; do
+ if [ "$tls_upstream" = "yes" ] ; then
+ echo " forward-addr: $server${tls_suffix}"
+ else
+ echo " forward-addr: $server${port:+@${port}}"
+ fi
+ done
+ echo " forward-first: $fallback"
+ echo " forward-tls-upstream: $tls_upstream"
+ echo
+ } >> $UB_ZONE_CONF
done
- echo " url: $httpserver$zone.zone"
- echo " fallback-enabled: yes"
- echo " for-downstream: no"
- echo " for-upstream: yes"
- echo " zonefile: $zone.zone"
- echo
- } >> $UNBOUND_CONFFILE
- done
- fi
+ fi
+ ;;
+
+ stub_zone)
+ if [ -n "$UB_LIST_ZONE_NAMES" -a -n "$UB_LIST_ZONE_SERVERS" ] ; then
+ for zonename in $UB_LIST_ZONE_NAMES ; do
+ {
+ # generate a stub-zone: or ensure short cut to authority NS
+ echo "stub-zone:"
+ echo " name: $zonename"
+ for server in $UB_LIST_ZONE_SERVERS ; do
+ echo " stub-addr: $server${port:+@${port}}"
+ done
+ echo " stub-first: $fallback"
+ echo
+ } >> $UB_ZONE_CONF
+ done
+ fi
+ ;;
+ esac
}
##############################################################################
unbound_conf() {
- local rt_mem rt_conn modulestring domain ifsubnet
-
- # Make fresh conf file
- echo > $UNBOUND_CONFFILE
-
+ local rt_mem rt_conn rt_buff modulestring domain ifsubnet nsubnet
{
- # Make fresh conf file
- echo "# $UNBOUND_CONFFILE generated by UCI $( date )"
- echo
+ # server: for this whole function
+ echo "# $UB_CORE_CONF generated by UCI $( date -Is )"
echo "server:"
echo " username: unbound"
- echo " chroot: $UNBOUND_VARDIR"
- echo " directory: $UNBOUND_VARDIR"
- echo " pidfile: $UNBOUND_PIDFILE"
- echo
+ echo " chroot: $UB_VARDIR"
+ echo " directory: $UB_VARDIR"
+ echo " pidfile: $UB_PIDFILE"
+ } > $UB_CORE_CONF
+
+
+ if [ -f "$UB_TLS_FWD_FILE" ] ; then
+ # TLS cert bundle for upstream forwarder and https zone files
+ # This is loaded before drop to root, so pull from /etc/ssl
+ echo " tls-cert-bundle: $UB_TLS_FWD_FILE" >> $UB_CORE_CONF
+ fi
+
+
+ if [ -f "$UB_RHINT_FILE" ] ; then
+ # Optional hints if found
+ echo " root-hints: $UB_RHINT_FILE" >> $UB_CORE_CONF
+ fi
+
+
+ if [ "$UB_B_DNSSEC" -gt 0 -a -f "$UB_RKEY_FILE" ] ; then
+ {
+ echo " auto-trust-anchor-file: $UB_RKEY_FILE"
+ echo
+ } >> $UB_CORE_CONF
+
+ else
+ echo >> $UB_CORE_CONF
+ fi
+
+
+ {
# No threading
echo " num-threads: 1"
echo " msg-cache-slabs: 1"
echo " infra-cache-slabs: 1"
echo " key-cache-slabs: 1"
echo
- # Interface Wildcard (access contol handled by "option local_service")
- echo " interface: 0.0.0.0"
- echo " interface: ::0"
- echo " outgoing-interface: 0.0.0.0"
- echo " outgoing-interface: ::0"
- echo
# Logging
echo " use-syslog: yes"
- echo " verbosity: 1"
echo " statistics-interval: 0"
echo " statistics-cumulative: no"
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
+
+ if [ "$UB_D_VERBOSE" -ge 0 -a "$UB_D_VERBOSE" -le 5 ] ; then
+ echo " verbosity: $UB_D_VERBOSE" >> $UB_CORE_CONF
+ fi
- if [ "$UNBOUND_B_EXT_STATS" -gt 0 ] ; then
+
+ if [ "$UB_B_EXT_STATS" -gt 0 ] ; then
{
# Log More
echo " extended-statistics: yes"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
else
{
# Log Less
echo " extended-statistics: no"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
fi
- case "$UNBOUND_D_PROTOCOL" in
+ case "$UB_D_PROTOCOL" in
ip4_only)
{
+ echo " edns-buffer-size: $UB_N_EDNS_SIZE"
+ echo " port: $UB_N_RX_PORT"
+ echo " outgoing-port-permit: 10240-65535"
+ echo " interface: 0.0.0.0"
+ echo " interface: ::0"
+ echo " outgoing-interface: 0.0.0.0"
echo " do-ip4: yes"
echo " do-ip6: no"
- } >> $UNBOUND_CONFFILE
+ echo
+ } >> $UB_CORE_CONF
;;
ip6_only)
{
+ echo " edns-buffer-size: $UB_N_EDNS_SIZE"
+ echo " port: $UB_N_RX_PORT"
+ echo " outgoing-port-permit: 10240-65535"
+ echo " interface: 0.0.0.0"
+ echo " interface: ::0"
+ echo " outgoing-interface: ::0"
echo " do-ip4: no"
echo " do-ip6: yes"
- } >> $UNBOUND_CONFFILE
+ echo
+ } >> $UB_CORE_CONF
;;
ip6_prefer)
{
+ echo " edns-buffer-size: $UB_N_EDNS_SIZE"
+ echo " port: $UB_N_RX_PORT"
+ echo " outgoing-port-permit: 10240-65535"
+ echo " interface: 0.0.0.0"
+ echo " interface: ::0"
+ echo " outgoing-interface: 0.0.0.0"
+ echo " outgoing-interface: ::0"
echo " do-ip4: yes"
echo " do-ip6: yes"
echo " prefer-ip6: yes"
- } >> $UNBOUND_CONFFILE
+ echo
+ } >> $UB_CORE_CONF
;;
mixed)
{
+ # Interface Wildcard (access contol handled by "option local_service")
+ echo " edns-buffer-size: $UB_N_EDNS_SIZE"
+ echo " port: $UB_N_RX_PORT"
+ echo " outgoing-port-permit: 10240-65535"
+ echo " interface: 0.0.0.0"
+ echo " interface: ::0"
+ echo " outgoing-interface: 0.0.0.0"
+ echo " outgoing-interface: ::0"
echo " do-ip4: yes"
echo " do-ip6: yes"
- } >> $UNBOUND_CONFFILE
+ echo
+ } >> $UB_CORE_CONF
;;
*)
- if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
+ if [ ! -f "$UB_TIME_FILE" ] ; then
logger -t unbound -s "default protocol configuration"
fi
- ;;
- esac
- {
- # protocol level tuning
- echo " edns-buffer-size: $UNBOUND_N_EDNS_SIZE"
- echo " msg-buffer-size: 8192"
- echo " port: $UNBOUND_N_RX_PORT"
- echo " outgoing-port-permit: 10240-65535"
- echo
- } >> $UNBOUND_CONFFILE
+ {
+ # outgoing-interface has useful defaults; incoming is localhost though
+ echo " edns-buffer-size: $UB_N_EDNS_SIZE"
+ echo " port: $UB_N_RX_PORT"
+ echo " outgoing-port-permit: 10240-65535"
+ echo " interface: 0.0.0.0"
+ echo " interface: ::0"
+ echo
+ } >> $UB_CORE_CONF
+ ;;
+ esac
{
echo " harden-referral-path: no"
echo " use-caps-for-id: no"
echo
- } >> $UNBOUND_CONFFILE
-
-
- if [ -f "$UNBOUND_HINTFILE" ] ; then
- # Optional hints if found
- echo " root-hints: $UNBOUND_HINTFILE" >> $UNBOUND_CONFFILE
- fi
-
+ } >> $UB_CORE_CONF
- if [ "$UNBOUND_B_DNSSEC" -gt 0 -a -f "$UNBOUND_KEYFILE" ] ; then
- {
- echo " auto-trust-anchor-file: $UNBOUND_KEYFILE"
- echo
- } >> $UNBOUND_CONFFILE
- else
- echo >> $UNBOUND_CONFFILE
- fi
-
-
- case "$UNBOUND_D_RESOURCE" in
+ case "$UB_D_RESOURCE" in
# Tiny - Unbound's recommended cheap hardware config
- tiny) rt_mem=1 ; rt_conn=1 ;;
+ tiny) rt_mem=1 ; rt_conn=2 ; rt_buff=1 ;;
# Small - Half RRCACHE and open ports
- small) rt_mem=8 ; rt_conn=5 ;;
+ small) rt_mem=8 ; rt_conn=10 ; rt_buff=2 ;;
# Medium - Nearly default but with some added balancintg
- medium) rt_mem=16 ; rt_conn=10 ;;
+ medium) rt_mem=16 ; rt_conn=20 ; rt_buff=4 ;;
# Large - Double medium
- large) rt_mem=32 ; rt_conn=10 ;;
+ large) rt_mem=32 ; rt_conn=40 ; rt_buff=4 ;;
# Whatever unbound does
*) rt_mem=0 ; rt_conn=0 ;;
esac
if [ "$rt_mem" -gt 0 ] ; then
{
# Set memory sizing parameters
+ echo " msg-buffer-size: $(($rt_buff*8192))"
echo " outgoing-range: $(($rt_conn*64))"
echo " num-queries-per-thread: $(($rt_conn*32))"
echo " outgoing-num-tcp: $(($rt_conn))"
echo " neg-cache-size: $(($rt_mem*64))k"
echo " infra-cache-numhosts: $(($rt_mem*256))"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
- elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
+ elif [ ! -f "$UB_TIME_FILE" ] ; then
logger -t unbound -s "default memory configuration"
fi
modulestring="iterator"
- if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
- if [ ! -f "$UNBOUND_TIMEFILE" -a "$UNBOUND_B_NTP_BOOT" -gt 0 ] ; then
+ if [ "$UB_B_DNSSEC" -gt 0 ] ; then
+ if [ ! -f "$UB_TIME_FILE" -a "$UB_B_NTP_BOOT" -gt 0 ] ; then
# DNSSEC chicken and egg with getting NTP time
- echo " val-override-date: -1" >> $UNBOUND_CONFFILE
+ echo " val-override-date: -1" >> $UB_CORE_CONF
fi
echo " harden-dnssec-stripped: yes"
echo " val-clean-additional: yes"
echo " ignore-cd-flag: yes"
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
modulestring="validator $modulestring"
fi
- if [ "$UNBOUND_B_DNS64" -gt 0 ] ; then
- echo " dns64-prefix: $UNBOUND_IP_DNS64" >> $UNBOUND_CONFFILE
+ if [ "$UB_B_DNS64" -gt 0 ] ; then
+ echo " dns64-prefix: $UB_IP_DNS64" >> $UB_CORE_CONF
modulestring="dns64 $modulestring"
fi
# Print final module string
echo " module-config: \"$modulestring\""
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
- case "$UNBOUND_D_RECURSION" in
+ case "$UB_D_RECURSION" in
passive)
{
# Some query privacy but "strict" will break some servers
- if [ "$UNBOUND_B_QRY_MINST" -gt 0 \
- -a "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
+ if [ "$UB_B_QRY_MINST" -gt 0 \
+ -a "$UB_B_QUERY_MIN" -gt 0 ] ; then
echo " qname-minimisation: yes"
echo " qname-minimisation-strict: yes"
- elif [ "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
+ elif [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
echo " qname-minimisation: yes"
else
echo " qname-minimisation: no"
fi
# Use DNSSEC to quickly understand NXDOMAIN ranges
- if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
+ if [ "$UB_B_DNSSEC" -gt 0 ] ; then
echo " aggressive-nsec: yes"
echo " prefetch-key: no"
fi
echo " prefetch: no"
echo " target-fetch-policy: \"0 0 0 0 0\""
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
;;
aggressive)
{
# Some query privacy but "strict" will break some servers
- if [ "$UNBOUND_B_QRY_MINST" -gt 0 \
- -a "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
+ if [ "$UB_B_QRY_MINST" -gt 0 \
+ -a "$UB_B_QUERY_MIN" -gt 0 ] ; then
echo " qname-minimisation: yes"
echo " qname-minimisation-strict: yes"
- elif [ "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
+ elif [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
echo " qname-minimisation: yes"
else
echo " qname-minimisation: no"
fi
# Use DNSSEC to quickly understand NXDOMAIN ranges
- if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
+ if [ "$UB_B_DNSSEC" -gt 0 ] ; then
echo " aggressive-nsec: yes"
echo " prefetch-key: yes"
fi
echo " prefetch: yes"
echo " target-fetch-policy: \"3 2 1 0 0\""
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
;;
*)
- if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
+ if [ ! -f "$UB_TIME_FILE" ] ; then
logger -t unbound -s "default recursion configuration"
fi
;;
{
- # Reload records more than 10 hours old
+ # Reload records more than 20 hours old
# DNSSEC 5 minute bogus cool down before retry
# Adaptive infrastructure info kept for 15 minutes
- echo " cache-min-ttl: $UNBOUND_TTL_MIN"
- echo " cache-max-ttl: 36000"
+ echo " cache-min-ttl: $UB_TTL_MIN"
+ echo " cache-max-ttl: 72000"
echo " val-bogus-ttl: 300"
echo " infra-host-ttl: 900"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
- if [ "$UNBOUND_B_HIDE_BIND" -gt 0 ] ; then
+ if [ "$UB_B_HIDE_BIND" -gt 0 ] ; then
{
# Block server id and version DNS TXT records
echo " hide-identity: yes"
echo " hide-version: yes"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
fi
- if [ "$UNBOUND_D_PRIV_BLCK" -gt 0 ] ; then
+ if [ "$UB_D_PRIV_BLCK" -gt 0 ] ; then
{
# Remove _upstream_ or global reponses with private addresses.
# Unbounds own "local zone" and "forward zone" may still use these.
echo " private-address: fc00::/7"
echo " private-address: fe80::/10"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
fi
- if [ -n "$UNBOUND_LIST_PRV_IP6GLA" -a "$UNBOUND_D_PRIV_BLCK" -gt 1 ] ; then
- for ifsubnet in $UNBOUND_LIST_PRV_IP6GLA ; do
- # Remove global DNS responses with your local network IP6 GLA
- echo " private-address: $ifsubnet" >> $UNBOUND_CONFFILE
- done
-
-
- echo >> $UNBOUND_CONFFILE
+ if [ -n "$UB_LIST_NETW_LAN" -a "$UB_D_PRIV_BLCK" -gt 1 ] ; then
+ {
+ for ifsubnet in $UB_LIST_NETW_LAN ; do
+ case $ifsubnet in
+ *@[1-9][0-9a-f][0-9a-f][0-9a-f]:*:[0-9a-f]*)
+ # Remove global DNS responses with your local network IP6 GLA
+ echo " private-address: ${ifsubnet#*@}"
+ ;;
+ esac
+ done
+ echo
+ } >> $UB_CORE_CONF
fi
- if [ "$UNBOUND_B_LOCL_BLCK" -gt 0 ] ; then
+ if [ "$UB_B_LOCL_BLCK" -gt 0 ] ; then
{
# Remove DNS reponses from upstream with loopback IP
# Black hole DNS method for ad blocking, so consider...
echo " private-address: 127.0.0.0/8"
echo " private-address: ::1/128"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
fi
- if [ -n "$UNBOUND_LIST_INSECURE" ] ; then
- for domain in $UNBOUND_LIST_INSECURE ; do
- # Except and accept domains without (DNSSEC); work around broken domains
- echo " domain-insecure: $domain" >> $UNBOUND_CONFFILE
- done
-
-
- echo >> $UNBOUND_CONFFILE
+ if [ -n "$UB_LIST_INSECURE" ] ; then
+ {
+ for domain in $UB_LIST_INSECURE ; do
+ # Except and accept domains without (DNSSEC); work around broken domains
+ echo " domain-insecure: $domain"
+ done
+ echo
+ } >> $UB_CORE_CONF
fi
-}
-
-##############################################################################
-
-unbound_access() {
- # TODO: Unbound 1.6.0 added "tags" and "views", so we can add tags to
- # each access-control IP block, and then divert access.
- # -- "guest" WIFI will not be allowed to see local zone data
- # -- "child" LAN can black whole a list of domains to http~deadpixel
-
-
- if [ "$UNBOUND_B_LOCL_SERV" -gt 0 ] ; then
- # Only respond to queries from which this device has an interface.
- # Prevent DNS amplification attacks by not responding to the universe.
- config_load network
- config_foreach create_access_control interface
+ if [ "$UB_B_LOCL_SERV" -gt 0 -a -n "$UB_LIST_NETW_ALL" ] ; then
{
+ for ifsubnet in $UB_LIST_NETW_ALL ; do
+ # Only respond to queries from subnets which have an interface.
+ # Prevent DNS amplification attacks by not responding to the universe.
+ echo " access-control: ${ifsubnet#*@} allow"
+ done
echo " access-control: 127.0.0.0/8 allow"
echo " access-control: ::1/128 allow"
echo " access-control: fe80::/10 allow"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
else
{
echo " access-control: 0.0.0.0/0 allow"
echo " access-control: ::0/0 allow"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_CORE_CONF
fi
-
-
- {
- # Amend your own "server:" stuff here
- echo " include: $UNBOUND_SRV_CONF"
- echo
- } >> $UNBOUND_CONFFILE
}
##############################################################################
-unbound_adblock() {
- # TODO: Unbound 1.6.0 added "tags" and "views"; lets work with adblock team
- local adb_enabled adb_file
-
+unbound_hostname() {
+ local ifsubnet ifarpa ifaddr ifname iffqdn
+ local ulaprefix hostfqdn name names namerec ptrrec
+ local zonetype=0
- if [ ! -x /usr/bin/adblock.sh -o ! -x /etc/init.d/adblock ] ; then
- adb_enabled=0
- else
- /etc/init.d/adblock enabled && adb_enabled=1 || adb_enabled=0
- fi
+ echo "# $UB_HOST_CONF generated by UCI $( date -Is )" > $UB_HOST_CONF
- if [ "$adb_enabled" -gt 0 ] ; then
+ if [ "$UB_D_DHCP_LINK" = "dnsmasq" ] ; then
{
- # Pull in your selected openwrt/pacakges/net/adblock generated lists
- for adb_file in $UNBOUND_VARDIR/adb_list.* ; do
- echo " include: $adb_file"
- done
+ echo "# Local zone is handled by dnsmasq"
echo
- } >> $UNBOUND_CONFFILE
- fi
-}
+ } >> $UB_HOST_CONF
-##############################################################################
+ elif [ -n "$UB_TXT_DOMAIN" ] \
+ && [ "$UB_D_WAN_FQDN" -gt 0 -o "$UB_D_LAN_FQDN" -gt 0 ] ; then
+ case "$UB_D_DOMAIN_TYPE" in
+ deny|inform_deny|refuse|static)
+ {
+ # type static means only this router has your domain
+ echo " domain-insecure: $UB_TXT_DOMAIN"
+ echo " private-domain: $UB_TXT_DOMAIN"
+ echo " local-zone: $UB_TXT_DOMAIN $UB_D_DOMAIN_TYPE"
+ echo " local-data: \"$UB_TXT_DOMAIN. $UB_XSOA\""
+ echo " local-data: \"$UB_TXT_DOMAIN. $UB_XNS\""
+ echo " local-data: '$UB_TXT_DOMAIN. $UB_XTXT'"
+ echo
+ # avoid upstream involvement in RFC6762
+ echo " domain-insecure: local"
+ echo " private-domain: local"
+ echo " local-zone: local $UB_D_DOMAIN_TYPE"
+ echo " local-data: \"local. $UB_XSOA\""
+ echo " local-data: \"local. $UB_XNS\""
+ echo " local-data: 'local. $UB_LTXT'"
+ echo
+ } >> $UB_HOST_CONF
+ zonetype=2
+ ;;
-unbound_hostname() {
- local ifsubnet ifarpa
+ transparent|typetransparent)
+ {
+ # transparent will permit forward-zone: or stub-zone: clauses
+ echo " private-domain: $UB_TXT_DOMAIN"
+ echo " local-zone: $UB_TXT_DOMAIN $UB_D_DOMAIN_TYPE"
+ echo
+ } >> $UB_HOST_CONF
+ zonetype=1
+ ;;
+ esac
- if [ -n "$UNBOUND_TXT_DOMAIN" ] ; then
{
- # Hostname as TLD works, but not transparent through recursion
- echo " domain-insecure: $UNBOUND_TXT_HOSTNAME"
- echo " private-domain: $UNBOUND_TXT_HOSTNAME"
- echo " local-zone: $UNBOUND_TXT_HOSTNAME static"
- echo " local-data: \"$UNBOUND_TXT_HOSTNAME. $UNBOUND_XSOA\""
- echo " local-data: \"$UNBOUND_TXT_HOSTNAME. $UNBOUND_XNS\""
+ # Hostname as TLD works, but not transparent through recursion (singular)
+ echo " domain-insecure: $UB_TXT_HOSTNAME"
+ echo " private-domain: $UB_TXT_HOSTNAME"
+ echo " local-zone: $UB_TXT_HOSTNAME static"
+ echo " local-data: \"$UB_TXT_HOSTNAME. $UB_XSOA\""
+ echo " local-data: \"$UB_TXT_HOSTNAME. $UB_XNS\""
+ echo " local-data: '$UB_TXT_HOSTNAME. $UB_XTXT'"
echo
- } >> $UNBOUND_CONFFILE
+ } >> $UB_HOST_CONF
- case "$UNBOUND_D_DOMAIN_TYPE" in
- deny|inform_deny|refuse|static)
- if [ -n "$UNBOUND_LIST_PRV_IP6GLA" \
- -a "$UNBOUND_D_PRIV_BLCK" -gt 1 ] ; then
- for ifsubnet in $UNBOUND_LIST_PRV_IP6GLA ; do
- ifarpa=$( domain_ptr_any "$ifsubnet" )
+ if [ -f "$UB_TIME_FILE" ] ; then
+ if [ -n "$UB_LIST_NETW_WAN" ] ; then
+ for ifsubnet in $UB_LIST_NETW_WAN ; do
+ ifaddr=${ifsubnet#*@}
+ ifaddr=${ifaddr%/*}
+ ifarpa=$( host_ptr_any "$ifaddr" )
if [ -n "$ifarpa" ] ; then
- {
- # Do NOT forward queries with your GLA ip6.arpa
- echo " domain-insecure: $ifarpa"
- echo " local-zone: $ifarpa $UNBOUND_D_DOMAIN_TYPE"
- echo " local-data: \"$ifarpa. $UNBOUND_XSOA\""
- echo " local-data: \"$ifarpa. $UNBOUND_XNS\""
- echo
- } >> $UNBOUND_CONFFILE
+ if [ "$UB_D_WAN_FQDN" -gt 0 ] ; then
+ {
+ # Create a static zone for WAN host record only (singular)
+ echo " domain-insecure: $ifarpa"
+ echo " private-address: $ifaddr"
+ echo " local-zone: $ifarpa static"
+ echo " local-data: \"$ifarpa. $UB_XSOA\""
+ echo " local-data: \"$ifarpa. $UB_XNS\""
+ echo " local-data: '$ifarpa. $UB_MTXT'"
+ echo
+ } >> $UB_HOST_CONF
+
+ elif [ "$zonetype" -gt 0 ] ; then
+ {
+ echo " local-zone: $ifarpa transparent"
+ echo
+ } >> $UB_HOST_CONF
+ fi
fi
done
fi
- if [ -n "$UNBOUND_LIST_LAN_NET" \
- -a "$UNBOUND_D_PRIV_BLCK" -gt 0 ] ; then
- for ifsubnet in $UNBOUND_LIST_LAN_NET ; do
- ifarpa=$( domain_ptr_any "$ifsubnet" )
+ if [ -n "$UB_LIST_NETW_LAN" ] ; then
+ for ifsubnet in $UB_LIST_NETW_LAN ; do
+ ifarpa=$( domain_ptr_any "${ifsubnet#*@}" )
if [ -n "$ifarpa" ] ; then
- {
- # Do NOT forward queries with your ULA ip6.arpa or in-addr.arpa
- echo " domain-insecure: $ifarpa"
- echo " local-zone: $ifarpa $UNBOUND_D_DOMAIN_TYPE"
- echo " local-data: \"$ifarpa. $UNBOUND_XSOA\""
- echo " local-data: \"$ifarpa. $UNBOUND_XNS\""
- echo
- } >> $UNBOUND_CONFFILE
+ if [ "$zonetype" -eq 2 ] ; then
+ {
+ # Do NOT forward queries with your ip6.arpa or in-addr.arpa
+ echo " domain-insecure: $ifarpa"
+ echo " local-zone: $ifarpa static"
+ echo " local-data: \"$ifarpa. $UB_XSOA\""
+ echo " local-data: \"$ifarpa. $UB_XNS\""
+ echo " local-data: '$ifarpa. $UB_XTXT'"
+ echo
+ } >> $UB_HOST_CONF
+
+ elif [ "$zonetype" -eq 1 -a "$UB_D_PRIV_BLCK" -eq 0 ] ; then
+ {
+ echo " local-zone: $ifarpa transparent"
+ echo
+ } >> $UB_HOST_CONF
+ fi
fi
done
fi
- {
- # avoid upstream involvement in RFC6762
- echo " domain-insecure: local"
- echo " private-domain: local"
- echo " local-zone: local $UNBOUND_D_DOMAIN_TYPE"
- echo " local-data: \"local. $UNBOUND_XSOA\""
- echo " local-data: \"local. $UNBOUND_XNS\""
- echo " local-data: \"local. 3600 IN TXT RFC6762\""
- echo
- # type static means only this router has your domain
- # type transparent will permit forward-zone: or stub-zone: clauses
- echo " domain-insecure: $UNBOUND_TXT_DOMAIN"
- echo " private-domain: $UNBOUND_TXT_DOMAIN"
- echo " local-zone: $UNBOUND_TXT_DOMAIN $UNBOUND_D_DOMAIN_TYPE"
- echo " local-data: \"$UNBOUND_TXT_DOMAIN. $UNBOUND_XSOA\""
- echo " local-data: \"$UNBOUND_TXT_DOMAIN. $UNBOUND_XNS\""
- echo
- } >> $UNBOUND_CONFFILE
- ;;
+ ulaprefix=$( uci_get network.@globals[0].ula_prefix )
+ ulaprefix=${ulaprefix%%:/*}
+ hostfqdn="$UB_TXT_HOSTNAME.$UB_TXT_DOMAIN"
- *)
- # likely transparent domain with fordward-zone: clause to next router
- echo " domain-insecure: $UNBOUND_TXT_DOMAIN"
- echo " private-domain: $UNBOUND_TXT_DOMAIN"
- echo " local-zone: $UNBOUND_TXT_DOMAIN $UNBOUND_D_DOMAIN_TYPE"
- echo
- ;;
- esac
+ if [ -z "$ulaprefix" ] ; then
+ # Nonsense so this option isn't globbed below
+ ulaprefix="fdno:such:addr::"
+ fi
- if [ "$UNBOUND_D_LAN_FQDN" -gt 0 -o "$UNBOUND_D_WAN_FQDN" -gt 0 ] ; then
- config_load dhcp
- config_foreach create_interface_dns dhcp
- fi
+ if [ "$UB_LIST_NETW_LAN" -a "$UB_D_LAN_FQDN" -gt 0 ] ; then
+ for ifsubnet in $UB_LIST_NETW_LAN ; do
+ ifaddr=${ifsubnet#*@}
+ ifaddr=${ifaddr%/*}
+ ifname=${ifsubnet%@*}
+ iffqdn="$ifname.$hostfqdn"
- if [ -f "$UNBOUND_DHCP_CONF" ] ; then
- {
- # Seed DHCP records because dhcp scripts trigger externally
- # Incremental Unbound restarts may drop unbound-control add records
- echo " include: $UNBOUND_DHCP_CONF"
- echo
- } >> $UNBOUND_CONFFILE
- fi
- fi
-}
-##############################################################################
+ if [ "$UB_D_LAN_FQDN" -eq 4 ] ; then
+ names="$iffqdn $hostfqdn $UB_TXT_HOSTNAME"
+ ptrrec=" local-data-ptr: \"$ifaddr 300 $iffqdn\""
+ echo "$ptrrec" >> $UB_HOST_CONF
-unbound_records() {
- if [ "$UNBOUND_D_EXTRA_DNS" -gt 0 ] ; then
- # Parasite from the uci.dhcp.domain clauses
- config_load dhcp
- config_foreach create_host_record domain
- fi
+ elif [ "$UB_D_LAN_FQDN" -eq 3 ] ; then
+ names="$hostfqdn $UB_TXT_HOSTNAME"
+ ptrrec=" local-data-ptr: \"$ifaddr 300 $hostfqdn\""
+ echo "$ptrrec" >> $UB_HOST_CONF
+ else
+ names="$UB_TXT_HOSTNAME"
+ ptrrec=" local-data-ptr: \"$ifaddr 300 $UB_TXT_HOSTNAME\""
+ echo "$ptrrec" >> $UB_HOST_CONF
+ fi
- if [ "$UNBOUND_D_EXTRA_DNS" -gt 1 ] ; then
- config_foreach create_srv_record srvhost
- config_foreach create_mx_record mxhost
- fi
+ for name in $names ; do
+ case $ifaddr in
+ "${ulaprefix}"*)
+ # IP6 ULA only is assigned for OPTION 1
+ namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
+ echo "$namerec" >> $UB_HOST_CONF
+ ;;
+
+ [1-9]*.*[0-9])
+ namerec=" local-data: \"$name. 300 IN A $ifaddr\""
+ echo "$namerec" >> $UB_HOST_CONF
+ ;;
+
+ *)
+ if [ "$UB_D_LAN_FQDN" -gt 1 ] ; then
+ # IP6 GLA is assigned for higher options
+ namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
+ echo "$namerec" >> $UB_HOST_CONF
+ fi
+ ;;
+ esac
+ done
+ echo >> $UB_HOST_CONF
+ done
+ fi
- if [ "$UNBOUND_D_EXTRA_DNS" -gt 2 ] ; then
- config_foreach create_cname_record cname
- fi
+
+ if [ -n "$UB_LIST_NETW_WAN" -a "$UB_D_WAN_FQDN" -gt 0 ] ; then
+ for ifsubnet in $UB_LIST_NETW_WAN ; do
+ ifaddr=${ifsubnet#*@}
+ ifaddr=${ifaddr%/*}
+ ifname=${ifsubnet%@*}
+ iffqdn="$ifname.$hostfqdn"
- echo >> $UNBOUND_CONFFILE
+ if [ "$UB_D_WAN_FQDN" -eq 4 ] ; then
+ names="$iffqdn $hostfqdn $UB_TXT_HOSTNAME"
+ ptrrec=" local-data-ptr: \"$ifaddr 300 $iffqdn\""
+ echo "$ptrrec" >> $UB_HOST_CONF
+
+ elif [ "$UB_D_WAN_FQDN" -eq 3 ] ; then
+ names="$hostfqdn $UB_TXT_HOSTNAME"
+ ptrrec=" local-data-ptr: \"$ifaddr 300 $hostfqdn\""
+ echo "$ptrrec" >> $UB_HOST_CONF
+
+ else
+ names="$UB_TXT_HOSTNAME"
+ ptrrec=" local-data-ptr: \"$ifaddr 300 $UB_TXT_HOSTNAME\""
+ echo "$ptrrec" >> $UB_HOST_CONF
+ fi
+
+
+ for name in $names ; do
+ case $ifaddr in
+ "${ulaprefix}"*)
+ # IP6 ULA only is assigned for OPTION 1
+ namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
+ echo "$namerec" >> $UB_HOST_CONF
+ ;;
+
+ [1-9]*.*[0-9])
+ namerec=" local-data: \"$name. 300 IN A $ifaddr\""
+ echo "$namerec" >> $UB_HOST_CONF
+ ;;
+
+ *)
+ if [ "$UB_D_WAN_FQDN" -gt 1 ] ; then
+ # IP6 GLA is assigned for higher options
+ namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
+ echo "$namerec" >> $UB_HOST_CONF
+ fi
+ ;;
+ esac
+ done
+ echo >> $UB_HOST_CONF
+ done
+ fi
+ fi # end if time file
+ fi # end if uci valid
}
##############################################################################
local dnsmasqpath hostnm
hostnm=$( uci_get system.@system[0].hostname | awk '{print tolower($0)}' )
- UNBOUND_TXT_HOSTNAME=${hostnm:-thisrouter}
+ UB_TXT_HOSTNAME=${hostnm:-thisrouter}
- config_get_bool UNBOUND_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
- config_get_bool UNBOUND_B_DNS64 "$cfg" dns64 0
- config_get_bool UNBOUND_B_EXT_STATS "$cfg" extended_stats 0
- config_get_bool UNBOUND_B_HIDE_BIND "$cfg" hide_binddata 1
- config_get_bool UNBOUND_B_LOCL_SERV "$cfg" localservice 1
- config_get_bool UNBOUND_B_MAN_CONF "$cfg" manual_conf 0
- config_get_bool UNBOUND_B_QUERY_MIN "$cfg" query_minimize 0
- config_get_bool UNBOUND_B_QRY_MINST "$cfg" query_min_strict 0
- config_get_bool UNBOUND_B_AUTH_ROOT "$cfg" prefetch_root 0
- config_get_bool UNBOUND_B_LOCL_BLCK "$cfg" rebind_localhost 0
- config_get_bool UNBOUND_B_DNSSEC "$cfg" validator 0
- config_get_bool UNBOUND_B_NTP_BOOT "$cfg" validator_ntp 1
+ config_get_bool UB_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
+ config_get_bool UB_B_DNS64 "$cfg" dns64 0
+ config_get_bool UB_B_EXT_STATS "$cfg" extended_stats 0
+ config_get_bool UB_B_HIDE_BIND "$cfg" hide_binddata 1
+ config_get_bool UB_B_LOCL_SERV "$cfg" localservice 1
+ config_get_bool UB_B_MAN_CONF "$cfg" manual_conf 0
+ config_get_bool UB_B_QUERY_MIN "$cfg" query_minimize 0
+ config_get_bool UB_B_QRY_MINST "$cfg" query_min_strict 0
+ config_get_bool UB_B_AUTH_ROOT "$cfg" prefetch_root 0
+ config_get_bool UB_B_LOCL_BLCK "$cfg" rebind_localhost 0
+ config_get_bool UB_B_DNSSEC "$cfg" validator 0
+ config_get_bool UB_B_NTP_BOOT "$cfg" validator_ntp 1
- config_get UNBOUND_IP_DNS64 "$cfg" dns64_prefix "64:ff9b::/96"
+ config_get UB_IP_DNS64 "$cfg" dns64_prefix "64:ff9b::/96"
- config_get UNBOUND_N_EDNS_SIZE "$cfg" edns_size 1280
- config_get UNBOUND_N_RX_PORT "$cfg" listen_port 53
- config_get UNBOUND_N_ROOT_AGE "$cfg" root_age 9
+ config_get UB_N_EDNS_SIZE "$cfg" edns_size 1280
+ config_get UB_N_RX_PORT "$cfg" listen_port 53
+ config_get UB_N_ROOT_AGE "$cfg" root_age 9
- config_get UNBOUND_D_CONTROL "$cfg" unbound_control 0
- config_get UNBOUND_D_DOMAIN_TYPE "$cfg" domain_type static
- config_get UNBOUND_D_DHCP_LINK "$cfg" dhcp_link none
- config_get UNBOUND_D_EXTRA_DNS "$cfg" add_extra_dns 0
- config_get UNBOUND_D_LAN_FQDN "$cfg" add_local_fqdn 0
- config_get UNBOUND_D_PRIV_BLCK "$cfg" rebind_protection 1
- config_get UNBOUND_D_PROTOCOL "$cfg" protocol mixed
- config_get UNBOUND_D_RECURSION "$cfg" recursion passive
- config_get UNBOUND_D_RESOURCE "$cfg" resource small
- config_get UNBOUND_D_WAN_FQDN "$cfg" add_wan_fqdn 0
+ config_get UB_D_CONTROL "$cfg" unbound_control 0
+ config_get UB_D_DOMAIN_TYPE "$cfg" domain_type static
+ config_get UB_D_DHCP_LINK "$cfg" dhcp_link none
+ config_get UB_D_EXTRA_DNS "$cfg" add_extra_dns 0
+ config_get UB_D_LAN_FQDN "$cfg" add_local_fqdn 0
+ config_get UB_D_PRIV_BLCK "$cfg" rebind_protection 1
+ config_get UB_D_PROTOCOL "$cfg" protocol mixed
+ config_get UB_D_RECURSION "$cfg" recursion passive
+ config_get UB_D_RESOURCE "$cfg" resource small
+ config_get UB_D_VERBOSE "$cfg" verbosity 1
+ config_get UB_D_WAN_FQDN "$cfg" add_wan_fqdn 0
- config_get UNBOUND_TTL_MIN "$cfg" ttl_min 120
- config_get UNBOUND_TXT_DOMAIN "$cfg" domain lan
+ config_get UB_TTL_MIN "$cfg" ttl_min 120
+ config_get UB_TXT_DOMAIN "$cfg" domain lan
- config_list_foreach "$cfg" "domain_forward" bundle_domain_forward
- config_list_foreach "$cfg" "domain_insecure" bundle_domain_insecure
- config_list_foreach "$cfg" "rebind_interface" bundle_private_interface
+ config_list_foreach "$cfg" domain_insecure bundle_domain_insecure
- UNBOUND_LIST_DOMAINS="nowhere $UNBOUND_TXT_DOMAIN"
- if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
- config_get_bool UNBOUND_B_DNSMASQ "$cfg" dnsmasq_link_dns 0
+ if [ "$UB_D_DHCP_LINK" = "none" ] ; then
+ config_get_bool UB_B_DNSMASQ "$cfg" dnsmasq_link_dns 0
- if [ "$UNBOUND_B_DNSMASQ" -gt 0 ] ; then
- UNBOUND_D_DHCP_LINK=dnsmasq
+ if [ "$UB_B_DNSMASQ" -gt 0 ] ; then
+ UB_D_DHCP_LINK=dnsmasq
- if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
+ if [ ! -f "$UB_TIME_FILE" ] ; then
logger -t unbound -s "Please use 'dhcp_link' selector instead"
fi
fi
fi
- if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
+ if [ "$UB_D_DHCP_LINK" = "dnsmasq" ] ; then
if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
- UNBOUND_D_DHCP_LINK=none
+ UB_D_DHCP_LINK=none
else
- /etc/init.d/dnsmasq enabled || UNBOUND_D_DHCP_LINK=none
+ /etc/init.d/dnsmasq enabled || UB_D_DHCP_LINK=none
fi
- if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
+ if [ ! -f "$UB_TIME_FILE" -a "$UB_D_DHCP_LINK" = "none" ] ; then
logger -t unbound -s "cannot forward to dnsmasq"
fi
fi
- if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" ] ; then
+ if [ "$UB_D_DHCP_LINK" = "odhcpd" ] ; then
if [ ! -x /usr/sbin/odhcpd -o ! -x /etc/init.d/odhcpd ] ; then
- UNBOUND_D_DHCP_LINK=none
+ UB_D_DHCP_LINK=none
else
- /etc/init.d/odhcpd enabled || UNBOUND_D_DHCP_LINK=none
+ /etc/init.d/odhcpd enabled || UB_D_DHCP_LINK=none
fi
- if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
+ if [ ! -f "$UB_TIME_FILE" -a "$UB_D_DHCP_LINK" = "none" ] ; then
logger -t unbound -s "cannot receive records from odhcpd"
fi
fi
- if [ "$UNBOUND_N_EDNS_SIZE" -lt 512 \
- -o 4096 -lt "$UNBOUND_N_EDNS_SIZE" ] ; then
+ if [ "$UB_N_EDNS_SIZE" -lt 512 \
+ -o 4096 -lt "$UB_N_EDNS_SIZE" ] ; then
logger -t unbound -s "edns_size exceeds range, using default"
- UNBOUND_N_EDNS_SIZE=1280
+ UB_N_EDNS_SIZE=1280
fi
- if [ "$UNBOUND_N_RX_PORT" -ne 53 ] \
- && [ "$UNBOUND_N_RX_PORT" -lt 1024 -o 10240 -lt "$UNBOUND_N_RX_PORT" ] ; then
+ if [ "$UB_N_RX_PORT" -ne 53 ] \
+ && [ "$UB_N_RX_PORT" -lt 1024 -o 10240 -lt "$UB_N_RX_PORT" ] ; then
logger -t unbound -s "privileged port or in 5 digits, using default"
- UNBOUND_N_RX_PORT=53
+ UB_N_RX_PORT=53
fi
- if [ "$UNBOUND_TTL_MIN" -gt 1800 ] ; then
+ if [ "$UB_TTL_MIN" -gt 1800 ] ; then
logger -t unbound -s "ttl_min could have had awful side effects, using 300"
- UNBOUND_TTL_MIN=300
+ UB_TTL_MIN=300
fi
}
##############################################################################
-unbound_resolv_setup() {
- if [ "$UNBOUND_N_RX_PORT" != "53" ] ; then
- return
+unbound_include() {
+ local adb_enabled
+ local adb_files=$( ls $UB_VARDIR/adb_list.* 2>/dev/null )
+
+ echo "# $UB_TOTAL_CONF generated by UCI $( date -Is )" > $UB_TOTAL_CONF
+
+
+ if [ -f "$UB_CORE_CONF" ] ; then
+ # Yes this all looks busy, but it is in TMPFS. Working on separate files
+ # and piecing together is easier. UCI order is less constrained.
+ cat $UB_CORE_CONF >> $UB_TOTAL_CONF
+ rm $UB_CORE_CONF
fi
- if [ -x /etc/init.d/dnsmasq ] && /etc/init.d/dnsmasq enabled \
- && nslookup localhost 127.0.0.1#53 >/dev/null 2>&1 ; then
+ if [ -f "$UB_HOST_CONF" ] ; then
+ # UCI definitions of local host or local subnet
+ cat $UB_HOST_CONF >> $UB_TOTAL_CONF
+ rm $UB_HOST_CONF
+ fi
+
+
+ if [ -f $UB_SRVMASQ_CONF ] ; then
+ # UCI found link to dnsmasq
+ cat $UB_SRVMASQ_CONF >> $UB_TOTAL_CONF
+ rm $UB_SRVMASQ_CONF
+ fi
+
+
+ if [ -f "$UB_TIME_FILE" -a -f "$UB_DHCP_CONF" ] ; then
+ {
+ # Seed DHCP records because dhcp scripts trigger externally
+ # Incremental Unbound restarts may drop unbound-control records
+ echo "include: $UB_DHCP_CONF"
+ echo
+ }>> $UB_TOTAL_CONF
+ fi
+
+
+ if [ ! -f "$UB_TIME_FILE" -o -z "$adb_files" \
+ -o ! -x /usr/bin/adblock.sh -o ! -x /etc/init.d/adblock ] ; then
+ adb_enabled=0
+
+ elif /etc/init.d/adblock enabled ; then
+ adb_enabled=1
+ {
+ # Pull in your selected openwrt/pacakges/net/adblock generated lists
+ echo "include: $UB_VARDIR/adb_list.*"
+ echo
+ } >> $UB_TOTAL_CONF
+
+ else
+ adb_enabled=0
+ fi
+
+
+ if [ -f $UB_SRV_CONF ] ; then
+ {
+ # Pull your own "server:" options here
+ echo "include: $UB_SRV_CONF"
+ echo
+ }>> $UB_TOTAL_CONF
+ fi
+
+
+ if [ -f "$UB_ZONE_CONF" ] ; then
+ # UCI defined forward, stub, and auth zones
+ cat $UB_ZONE_CONF >> $UB_TOTAL_CONF
+ rm $UB_ZONE_CONF
+ fi
+
+
+ if [ -f "$UB_CTRL_CONF" ] ; then
+ # UCI defined control application connection
+ cat $UB_CTRL_CONF >> $UB_TOTAL_CONF
+ rm $UB_CTRL_CONF
+ fi
+
+
+ if [ -f "$UB_EXTMASQ_CONF" ] ; then
+ # UCI found link to dnsmasq
+ cat $UB_EXTMASQ_CONF >> $UB_TOTAL_CONF
+ rm $UB_EXTMASQ_CONF
+ fi
+
+
+ if [ -f "$UB_EXT_CONF" ] ; then
+ {
+ # Pull your own extend feature clauses here
+ echo "include: $UB_EXT_CONF"
+ echo
+ } >> $UB_TOTAL_CONF
+ fi
+}
+
+##############################################################################
+
+resolv_setup() {
+ if [ "$UB_N_RX_PORT" != "53" ] ; then
+ return
+
+ elif [ -x /etc/init.d/dnsmasq ] \
+ && /etc/init.d/dnsmasq enabled \
+ && nslookup localhost 127.0.0.1#53 >/dev/null 2>&1 ; then
# unbound is configured for port 53, but dnsmasq is enabled and a resolver
# listens on localhost:53, lets assume dnsmasq manages the resolver file.
# TODO:
rm -f /tmp/resolv.conf
{
- echo "# /tmp/resolv.conf generated by Unbound UCI $( date )"
+ echo "# /tmp/resolv.conf generated by Unbound UCI $( date -Is )"
echo "nameserver 127.0.0.1"
echo "nameserver ::1"
- echo "search $UNBOUND_TXT_DOMAIN."
+ echo "search $UB_TXT_DOMAIN."
} > /tmp/resolv.conf
}
##############################################################################
-unbound_resolv_teardown() {
- case $( cat /tmp/resolv.conf ) in
- *"generated by Unbound UCI"*)
- # our resolver file, reset to auto resolver file.
- rm -f /tmp/resolv.conf
- ln -s /tmp/resolv.conf.auto /tmp/resolv.conf
- ;;
- esac
-}
-
-##############################################################################
-
unbound_start() {
config_load unbound
config_foreach unbound_uci unbound
unbound_mkdir
- if [ "$UNBOUND_B_MAN_CONF" -eq 0 ] ; then
+ if [ "$UB_B_MAN_CONF" -eq 0 ] ; then
+ # iterate zones before we load other UCI
+ # forward-zone: auth-zone: and stub-zone:
+ config_foreach unbound_zone zone
+ # associate potential DNS RR with interfaces
+ config_load network
+ config_foreach bundle_all_networks interface
+ config_load dhcp
+ config_foreach bundle_lan_networks dhcp
+ bundle_wan_networks
+ # server:
unbound_conf
- unbound_access
- unbound_adblock
-
-
- if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
- dnsmasq_link
- else
- unbound_hostname
- unbound_records
- fi
-
-
- unbound_forward
- unbound_auth_root
+ unbound_hostname
+ # control:
unbound_control
+ # dnsmasq
+ dnsmasq_link
+ # merge
+ unbound_include
fi
- unbound_resolv_setup
-}
-
-##############################################################################
-
-unbound_stop() {
- unbound_resolv_teardown
- rootzone_update
+ resolv_setup
}
##############################################################################
git.99rst.org / openwrt-packages.git / commitdiff