You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1458 lines
40 KiB

  1. #!/bin/sh
  2. ##############################################################################
  3. #
  4. # This program is free software; you can redistribute it and/or modify
  5. # it under the terms of the GNU General Public License version 2 as
  6. # published by the Free Software Foundation.
  7. #
  8. # This program is distributed in the hope that it will be useful,
  9. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  10. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11. # GNU General Public License for more details.
  12. #
  13. # Copyright (C) 2016 Eric Luehrsen
  14. #
  15. ##############################################################################
  16. #
  17. # Unbound is a full featured recursive server with many options. The UCI
  18. # provided tries to simplify and bundle options. This should make Unbound
  19. # easier to deploy. Even light duty routers may resolve recursively instead of
  20. # depending on a stub with the ISP. The UCI also attempts to replicate dnsmasq
  21. # features as used in base LEDE/OpenWrt. If there is a desire for more
  22. # detailed tuning, then manual conf file overrides are also made available.
  23. #
  24. ##############################################################################
  25. UB_B_SLAAC6_MAC=0
  26. UB_B_DNSSEC=0
  27. UB_B_DNS64=0
  28. UB_B_EXT_STATS=0
  29. UB_B_GATE_NAME=0
  30. UB_B_HIDE_BIND=1
  31. UB_B_LOCL_BLCK=0
  32. UB_B_LOCL_SERV=1
  33. UB_B_MAN_CONF=0
  34. UB_B_NTP_BOOT=1
  35. UB_B_QUERY_MIN=0
  36. UB_B_QRY_MINST=0
  37. UB_B_AUTH_ROOT=0
  38. UB_D_CONTROL=0
  39. UB_D_DOMAIN_TYPE=static
  40. UB_D_DHCP_LINK=none
  41. UB_D_EXTRA_DNS=0
  42. UB_D_LAN_FQDN=0
  43. UB_D_PRIV_BLCK=1
  44. UB_D_PROTOCOL=mixed
  45. UB_D_RESOURCE=small
  46. UB_D_RECURSION=passive
  47. UB_D_VERBOSE=1
  48. UB_D_WAN_FQDN=0
  49. UB_IP_DNS64="64:ff9b::/96"
  50. UB_N_EDNS_SIZE=1280
  51. UB_N_RX_PORT=53
  52. UB_N_ROOT_AGE=9
  53. UB_N_THREADS=1
  54. UB_TTL_MIN=120
  55. UB_TXT_DOMAIN=lan
  56. UB_TXT_HOSTNAME=thisrouter
  57. ##############################################################################
  58. # reset as a combo with UB_B_NTP_BOOT and some time stamp files
  59. UB_B_READY=1
  60. # keep track of assignments during inserted resource records
  61. UB_LIST_NETW_ALL=""
  62. UB_LIST_NETW_LAN=""
  63. UB_LIST_NETW_WAN=""
  64. UB_LIST_INSECURE=""
  65. UB_LIST_ZONE_SERVERS=""
  66. UB_LIST_ZONE_NAMES=""
  67. ##############################################################################
  68. . /lib/functions.sh
  69. . /lib/functions/network.sh
  70. . /usr/lib/unbound/defaults.sh
  71. . /usr/lib/unbound/dnsmasq.sh
  72. . /usr/lib/unbound/iptools.sh
  73. ##############################################################################
  74. bundle_all_networks() {
  75. local cfg="$1"
  76. local ifname ifdashname validip
  77. local subnet subnets subnets4 subnets6
  78. network_get_subnets subnets4 "$cfg"
  79. network_get_subnets6 subnets6 "$cfg"
  80. network_get_device ifname "$cfg"
  81. ifdashname="${ifname//./-}"
  82. subnets="$subnets4 $subnets6"
  83. if [ -n "$subnets" ] ; then
  84. for subnet in $subnets ; do
  85. validip=$( valid_subnet_any $subnet )
  86. if [ "$validip" = "ok" ] ; then
  87. UB_LIST_NETW_ALL="$UB_LIST_NETW_ALL $ifdashname@$subnet"
  88. fi
  89. done
  90. fi
  91. }
  92. ##############################################################################
  93. bundle_lan_networks() {
  94. local cfg="$1"
  95. local interface ifsubnet ifname ifdashname ignore
  96. config_get_bool ignore "$cfg" ignore 0
  97. config_get interface "$cfg" interface ""
  98. network_get_device ifname "$interface"
  99. ifdashname="${ifname//./-}"
  100. if [ "$ignore" -eq 0 ] && [ -n "$ifdashname" ] \
  101. && [ -n "$UB_LIST_NETW_ALL" ] ; then
  102. for ifsubnet in $UB_LIST_NETW_ALL ; do
  103. case $ifsubnet in
  104. "${ifdashname}"@*)
  105. # Special GLA protection for local block; ULA protected as a catagory
  106. UB_LIST_NETW_LAN="$UB_LIST_NETW_LAN $ifsubnet"
  107. ;;
  108. esac
  109. done
  110. fi
  111. }
  112. ##############################################################################
  113. bundle_wan_networks() {
  114. local ifsubnet
  115. if [ -n "$UB_LIST_NETW_ALL" ] ; then
  116. for ifsubnet in $UB_LIST_NETW_ALL ; do
  117. case $UB_LIST_NETW_LAN in
  118. *"${ifsubnet}"*)
  119. # If LAN, then not WAN ...
  120. ;;
  121. *)
  122. UB_LIST_NETW_WAN="$UB_LIST_NETW_WAN $ifsubnet"
  123. ;;
  124. esac
  125. done
  126. fi
  127. }
  128. ##############################################################################
  129. bundle_resolv_conf_servers() {
  130. local resolvers=$( awk '/nameserver/ { print $2 }' /tmp/resolv.conf.auto )
  131. UB_LIST_ZONE_SERVERS="$UB_LIST_ZONE_SERVERS $resolvers"
  132. }
  133. ##############################################################################
  134. bundle_zone_names() {
  135. UB_LIST_ZONE_NAMES="$UB_LIST_ZONE_NAMES $1"
  136. }
  137. ##############################################################################
  138. bundle_zone_servers() {
  139. UB_LIST_ZONE_SERVERS="$UB_LIST_ZONE_SERVERS $1"
  140. }
  141. ##############################################################################
  142. bundle_domain_insecure() {
  143. UB_LIST_INSECURE="$UB_LIST_INSECURE $1"
  144. }
  145. ##############################################################################
  146. unbound_mkdir() {
  147. local filestuff
  148. if [ "$UB_D_DHCP_LINK" = "odhcpd" ] ; then
  149. local dhcp_origin=$( uci_get dhcp.@odhcpd[0].leasefile )
  150. local dhcp_dir=$( dirname $dhcp_origin )
  151. if [ ! -d "$dhcp_dir" ] ; then
  152. # make sure odhcpd has a directory to write (not done itself, yet)
  153. mkdir -p "$dhcp_dir"
  154. fi
  155. fi
  156. if [ -f $UB_RKEY_FILE ] ; then
  157. filestuff=$( cat $UB_RKEY_FILE )
  158. case "$filestuff" in
  159. *"state=2 [ VALID ]"*)
  160. # Lets not lose RFC 5011 tracking if we don't have to
  161. cp -p $UB_RKEY_FILE $UB_RKEY_FILE.keep
  162. ;;
  163. esac
  164. fi
  165. # Blind copy /etc/unbound to /var/lib/unbound
  166. mkdir -p $UB_VARDIR
  167. rm -f $UB_VARDIR/dhcp_*
  168. touch $UB_TOTAL_CONF
  169. cp -p /etc/unbound/* $UB_VARDIR/
  170. if [ ! -f $UB_RHINT_FILE ] ; then
  171. if [ -f /usr/share/dns/root.hints ] ; then
  172. # Debian-like package dns-root-data
  173. cp -p /usr/share/dns/root.hints $UB_RHINT_FILE
  174. elif [ "$UB_B_READY" -eq 0 ] ; then
  175. logger -t unbound -s "default root hints (built in root-servers.net)"
  176. fi
  177. fi
  178. if [ ! -f $UB_RKEY_FILE ] ; then
  179. if [ -f /usr/share/dns/root.key ] ; then
  180. # Debian-like package dns-root-data
  181. cp -p /usr/share/dns/root.key $UB_RKEY_FILE
  182. elif [ -x $UB_ANCHOR ] ; then
  183. $UB_ANCHOR -a $UB_RKEY_FILE
  184. elif [ "$UB_B_READY" -eq 0 ] ; then
  185. logger -t unbound -s "default trust anchor (built in root DS record)"
  186. fi
  187. fi
  188. if [ -f $UB_RKEY_FILE.keep ] ; then
  189. # root.key.keep is reused if newest
  190. cp -u $UB_RKEY_FILE.keep $UB_RKEY_FILE
  191. rm -f $UB_RKEY_FILE.keep
  192. fi
  193. if [ -f $UB_TLS_ETC_FILE ] ; then
  194. # copy the cert bundle into jail
  195. cp -p $UB_TLS_ETC_FILE $UB_TLS_FWD_FILE
  196. fi
  197. # Ensure access and prepare to jail
  198. chown -R unbound:unbound $UB_VARDIR
  199. chmod 755 $UB_VARDIR
  200. chmod 644 $UB_VARDIR/*
  201. if [ -f $UB_CTLKEY_FILE ] || [ -f $UB_CTLPEM_FILE ] \
  202. || [ -f $UB_SRVKEY_FILE ] || [ -f $UB_SRVPEM_FILE ] ; then
  203. # Keys (some) exist already; do not create new ones
  204. chmod 640 $UB_CTLKEY_FILE $UB_CTLPEM_FILE \
  205. $UB_SRVKEY_FILE $UB_SRVPEM_FILE
  206. elif [ -x /usr/sbin/unbound-control-setup ] ; then
  207. case "$UB_D_CONTROL" in
  208. [2-3])
  209. # unbound-control-setup for encrypt opt. 2 and 3, but not 4 "static"
  210. /usr/sbin/unbound-control-setup -d $UB_VARDIR
  211. chown -R unbound:unbound $UB_CTLKEY_FILE $UB_CTLPEM_FILE \
  212. $UB_SRVKEY_FILE $UB_SRVPEM_FILE
  213. chmod 640 $UB_CTLKEY_FILE $UB_CTLPEM_FILE \
  214. $UB_SRVKEY_FILE $UB_SRVPEM_FILE
  215. cp -p $UB_CTLKEY_FILE /etc/unbound/unbound_control.key
  216. cp -p $UB_CTLPEM_FILE /etc/unbound/unbound_control.pem
  217. cp -p $UB_SRVKEY_FILE /etc/unbound/unbound_server.key
  218. cp -p $UB_SRVPEM_FILE /etc/unbound/unbound_server.pem
  219. ;;
  220. esac
  221. fi
  222. if [ -f "$UB_TIME_FILE" ] ; then
  223. # NTP is done so its like you actually had an RTC
  224. UB_B_READY=1
  225. UB_B_NTP_BOOT=0
  226. elif [ "$UB_B_NTP_BOOT" -eq 0 ] ; then
  227. # time is considered okay on this device (ignore /etc/hotplug/ntpd/unbound)
  228. date -Is > $UB_TIME_FILE
  229. UB_B_READY=0
  230. UB_B_NTP_BOOT=0
  231. else
  232. # DNSSEC-TIME will not reconcile
  233. UB_B_READY=0
  234. UB_B_NTP_BOOT=1
  235. fi
  236. }
  237. ##############################################################################
  238. unbound_control() {
  239. echo "# $UB_CTRL_CONF generated by UCI $( date -Is )" > $UB_CTRL_CONF
  240. if [ "$UB_D_CONTROL" -gt 1 ] ; then
  241. if [ ! -f $UB_CTLKEY_FILE ] || [ ! -f $UB_CTLPEM_FILE ] \
  242. || [ ! -f $UB_SRVKEY_FILE ] || [ ! -f $UB_SRVPEM_FILE ] ; then
  243. # Key files need to be present; if unbound-control-setup was found, then
  244. # they might have been made during unbound_makedir() above.
  245. UB_D_CONTROL=0
  246. fi
  247. fi
  248. case "$UB_D_CONTROL" in
  249. 1)
  250. {
  251. # Local Host Only Unencrypted Remote Control
  252. echo "remote-control:"
  253. echo " control-enable: yes"
  254. echo " control-use-cert: no"
  255. echo " control-interface: 127.0.0.1"
  256. echo " control-interface: ::1"
  257. echo
  258. } >> $UB_CTRL_CONF
  259. ;;
  260. 2)
  261. {
  262. # Local Host Only Encrypted Remote Control
  263. echo "remote-control:"
  264. echo " control-enable: yes"
  265. echo " control-use-cert: yes"
  266. echo " control-interface: 127.0.0.1"
  267. echo " control-interface: ::1"
  268. echo " server-key-file: $UB_SRVKEY_FILE"
  269. echo " server-cert-file: $UB_SRVPEM_FILE"
  270. echo " control-key-file: $UB_CTLKEY_FILE"
  271. echo " control-cert-file: $UB_CTLPEM_FILE"
  272. echo
  273. } >> $UB_CTRL_CONF
  274. ;;
  275. [3-4])
  276. {
  277. # Network Encrypted Remote Control
  278. # (3) may auto setup and (4) must have static key/pem files
  279. # TODO: add UCI list for interfaces to bind
  280. echo "remote-control:"
  281. echo " control-enable: yes"
  282. echo " control-use-cert: yes"
  283. echo " control-interface: 0.0.0.0"
  284. echo " control-interface: ::0"
  285. echo " server-key-file: $UB_SRVKEY_FILE"
  286. echo " server-cert-file: $UB_SRVPEM_FILE"
  287. echo " control-key-file: $UB_CTLKEY_FILE"
  288. echo " control-cert-file: $UB_CTLPEM_FILE"
  289. echo
  290. } >> $UB_CTRL_CONF
  291. ;;
  292. esac
  293. }
  294. ##############################################################################
  295. unbound_zone() {
  296. local cfg=$1
  297. local servers_ip=""
  298. local servers_host=""
  299. local zone_sym zone_name zone_type zone_enabled zone_file
  300. local tls_upstream fallback
  301. local server port tls_port tls_index tls_suffix url_dir
  302. if [ ! -f "$UB_ZONE_CONF" ] ; then
  303. echo "# $UB_ZONE_CONF generated by UCI $( date -Is )" > $UB_ZONE_CONF
  304. fi
  305. config_get_bool zone_enabled "$cfg" enabled 0
  306. if [ "$zone_enabled" -eq 1 ] ; then
  307. # these lists are built for each zone; empty to start
  308. UB_LIST_ZONE_NAMES=""
  309. UB_LIST_ZONE_SERVERS=""
  310. config_get zone_type "$cfg" zone_type ""
  311. config_get port "$cfg" port ""
  312. config_get tls_index "$cfg" tls_index ""
  313. config_get tls_port "$cfg" tls_port 853
  314. config_get url_dir "$cfg" url_dir ""
  315. config_get_bool resolv_conf "$cfg" resolv_conf 0
  316. config_get_bool fallback "$cfg" fallback 1
  317. config_get_bool tls_upstream "$cfg" tls_upstream 0
  318. config_list_foreach "$cfg" zone_name bundle_zone_names
  319. config_list_foreach "$cfg" server bundle_zone_servers
  320. # string formating for Unbound syntax
  321. tls_suffix="${tls_port:+@${tls_port}${tls_index:+#${tls_index}}}"
  322. [ "$fallback" -eq 0 ] && fallback=no || fallback=yes
  323. [ "$tls_upstream" -eq 0 ] && tls_upstream=no || tls_upstream=yes
  324. if [ $resolv_conf -eq 1 ] ; then
  325. bundle_resolv_conf_servers
  326. fi
  327. else
  328. zone_type=skip
  329. fi
  330. case $zone_type in
  331. auth_zone)
  332. if [ "$UB_B_NTP_BOOT" -eq 0 ] && [ -n "$UB_LIST_ZONE_NAMES" ] \
  333. && { [ -n "$url_dir" ] || [ -n "$UB_LIST_ZONE_SERVERS" ] ; } ; then
  334. # Note AXFR may have large downloads. If NTP restart is configured,
  335. # then this can cause procd to force a process kill.
  336. for zone_name in $UB_LIST_ZONE_NAMES ; do
  337. if [ "$zone_name" = "." ] ; then
  338. zone_sym=.
  339. zone_name=root
  340. zone_file=root.zone
  341. else
  342. zone_sym=$zone_name
  343. zone_file=$zone_name.zone
  344. zone_file=${zone_file//../.}
  345. fi
  346. {
  347. # generate an auth-zone: with switches for prefetch cache
  348. echo "auth-zone:"
  349. echo " name: $zone_sym"
  350. for server in $UB_LIST_ZONE_SERVERS ; do
  351. echo " master: $server${port:+@${port}}"
  352. done
  353. if [ -n "$url_dir" ] ; then
  354. echo " url: $url_dir$zone_file"
  355. fi
  356. echo " fallback-enabled: $fallback"
  357. echo " for-downstream: no"
  358. echo " for-upstream: yes"
  359. echo " zonefile: $zone_file"
  360. echo
  361. } >> $UB_ZONE_CONF
  362. done
  363. fi
  364. ;;
  365. forward_zone)
  366. if [ ! -f $UB_TLS_FWD_FILE ] && [ "$tls_upstream" = "yes" ] ; then
  367. logger -p 4 -t unbound -s \
  368. "Forward-zone TLS benefits from authentication in package 'ca-bundle'"
  369. fi
  370. if [ -n "$UB_LIST_ZONE_NAMES" ] && [ -n "$UB_LIST_ZONE_SERVERS" ] ; then
  371. for server in $UB_LIST_ZONE_SERVERS ; do
  372. if [ "$( valid_subnet_any $server )" = "not" ] ; then
  373. case $server in
  374. *@[0-9]*)
  375. # unique Unbound option for server host name
  376. servers_host="$servers_host $server"
  377. ;;
  378. *)
  379. if [ "$tls_upstream" = "yes" ] ; then
  380. servers_host="$servers_host $server${tls_port:+@${tls_port}}"
  381. else
  382. servers_host="$servers_host $server${port:+@${port}}"
  383. fi
  384. esac
  385. else
  386. case $server in
  387. *[0-9]@[0-9]*)
  388. # unique Unbound option for server address
  389. servers_ip="$servers_ip $server"
  390. ;;
  391. *)
  392. if [ "$tls_upstream" = "yes" ] ; then
  393. servers_ip="$servers_ip $server$tls_suffix"
  394. else
  395. servers_ip="$servers_ip $server${port:+@${port}}"
  396. fi
  397. esac
  398. fi
  399. done
  400. for zonename in $UB_LIST_ZONE_NAMES ; do
  401. {
  402. # generate a forward-zone with or without tls
  403. echo "forward-zone:"
  404. echo " name: $zonename"
  405. for server in $servers_host ; do
  406. echo " forward-host: $server"
  407. done
  408. for server in $servers_ip ; do
  409. echo " forward-addr: $server"
  410. done
  411. echo " forward-first: $fallback"
  412. echo " forward-tls-upstream: $tls_upstream"
  413. echo
  414. } >> $UB_ZONE_CONF
  415. done
  416. fi
  417. ;;
  418. stub_zone)
  419. if [ -n "$UB_LIST_ZONE_NAMES" ] && [ -n "$UB_LIST_ZONE_SERVERS" ] ; then
  420. for zonename in $UB_LIST_ZONE_NAMES ; do
  421. {
  422. # generate a stub-zone: or ensure short cut to authority NS
  423. echo "stub-zone:"
  424. echo " name: $zonename"
  425. for server in $UB_LIST_ZONE_SERVERS ; do
  426. echo " stub-addr: $server${port:+@${port}}"
  427. done
  428. echo " stub-first: $fallback"
  429. echo
  430. } >> $UB_ZONE_CONF
  431. done
  432. fi
  433. ;;
  434. esac
  435. }
  436. ##############################################################################
  437. unbound_conf() {
  438. local rt_mem rt_conn rt_buff modulestring domain ifsubnet
  439. {
  440. # server: for this whole function
  441. echo "# $UB_CORE_CONF generated by UCI $( date -Is )"
  442. echo "server:"
  443. echo " username: unbound"
  444. echo " chroot: $UB_VARDIR"
  445. echo " directory: $UB_VARDIR"
  446. echo " pidfile: $UB_PIDFILE"
  447. } > $UB_CORE_CONF
  448. if [ -f "$UB_TLS_FWD_FILE" ] ; then
  449. # TLS cert bundle for upstream forwarder and https zone files
  450. # This is loaded before drop to root, so pull from /etc/ssl
  451. echo " tls-cert-bundle: $UB_TLS_FWD_FILE" >> $UB_CORE_CONF
  452. fi
  453. if [ -f "$UB_RHINT_FILE" ] ; then
  454. # Optional hints if found
  455. echo " root-hints: $UB_RHINT_FILE" >> $UB_CORE_CONF
  456. fi
  457. if [ "$UB_B_DNSSEC" -gt 0 ] && [ -f "$UB_RKEY_FILE" ] ; then
  458. {
  459. echo " auto-trust-anchor-file: $UB_RKEY_FILE"
  460. echo
  461. } >> $UB_CORE_CONF
  462. else
  463. echo >> $UB_CORE_CONF
  464. fi
  465. if [ "$UB_N_THREADS" -gt 1 ] \
  466. && $PROG -h | grep -q "linked libs:.*libevent" ; then
  467. # heavy variant using "threads" may need substantial resources
  468. echo " num-threads: 2" >> $UB_CORE_CONF
  469. else
  470. # light variant with one "process" is much more efficient with light traffic
  471. echo " num-threads: 1" >> $UB_CORE_CONF
  472. fi
  473. {
  474. # Limited threading (2) with one shared slab
  475. echo " msg-cache-slabs: 1"
  476. echo " rrset-cache-slabs: 1"
  477. echo " infra-cache-slabs: 1"
  478. echo " key-cache-slabs: 1"
  479. echo
  480. # Logging
  481. echo " use-syslog: yes"
  482. echo " statistics-interval: 0"
  483. echo " statistics-cumulative: no"
  484. } >> $UB_CORE_CONF
  485. if [ "$UB_D_VERBOSE" -ge 0 ] && [ "$UB_D_VERBOSE" -le 5 ] ; then
  486. echo " verbosity: $UB_D_VERBOSE" >> $UB_CORE_CONF
  487. fi
  488. if [ "$UB_B_EXT_STATS" -gt 0 ] ; then
  489. {
  490. # Log More
  491. echo " extended-statistics: yes"
  492. echo
  493. } >> $UB_CORE_CONF
  494. else
  495. {
  496. # Log Less
  497. echo " extended-statistics: no"
  498. echo
  499. } >> $UB_CORE_CONF
  500. fi
  501. case "$UB_D_PROTOCOL" in
  502. ip4_only)
  503. {
  504. echo " edns-buffer-size: $UB_N_EDNS_SIZE"
  505. echo " port: $UB_N_RX_PORT"
  506. echo " outgoing-port-permit: 10240-65535"
  507. echo " interface: 0.0.0.0"
  508. echo " outgoing-interface: 0.0.0.0"
  509. echo " do-ip4: yes"
  510. echo " do-ip6: no"
  511. echo
  512. } >> $UB_CORE_CONF
  513. ;;
  514. ip6_only)
  515. {
  516. echo " edns-buffer-size: $UB_N_EDNS_SIZE"
  517. echo " port: $UB_N_RX_PORT"
  518. echo " outgoing-port-permit: 10240-65535"
  519. echo " interface: ::0"
  520. echo " outgoing-interface: ::0"
  521. echo " do-ip4: no"
  522. echo " do-ip6: yes"
  523. echo
  524. } >> $UB_CORE_CONF
  525. ;;
  526. ip6_local)
  527. {
  528. echo " edns-buffer-size: $UB_N_EDNS_SIZE"
  529. echo " port: $UB_N_RX_PORT"
  530. echo " outgoing-port-permit: 10240-65535"
  531. echo " interface: 0.0.0.0"
  532. echo " interface: ::0"
  533. echo " outgoing-interface: 0.0.0.0"
  534. echo " do-ip4: yes"
  535. echo " do-ip6: yes"
  536. echo
  537. } >> $UB_CORE_CONF
  538. ;;
  539. ip6_prefer)
  540. {
  541. echo " edns-buffer-size: $UB_N_EDNS_SIZE"
  542. echo " port: $UB_N_RX_PORT"
  543. echo " outgoing-port-permit: 10240-65535"
  544. echo " interface: 0.0.0.0"
  545. echo " interface: ::0"
  546. echo " outgoing-interface: 0.0.0.0"
  547. echo " outgoing-interface: ::0"
  548. echo " do-ip4: yes"
  549. echo " do-ip6: yes"
  550. echo " prefer-ip6: yes"
  551. echo
  552. } >> $UB_CORE_CONF
  553. ;;
  554. mixed)
  555. {
  556. # Interface Wildcard (access contol handled by "option local_service")
  557. echo " edns-buffer-size: $UB_N_EDNS_SIZE"
  558. echo " port: $UB_N_RX_PORT"
  559. echo " outgoing-port-permit: 10240-65535"
  560. echo " interface: 0.0.0.0"
  561. echo " interface: ::0"
  562. echo " outgoing-interface: 0.0.0.0"
  563. echo " outgoing-interface: ::0"
  564. echo " do-ip4: yes"
  565. echo " do-ip6: yes"
  566. echo
  567. } >> $UB_CORE_CONF
  568. ;;
  569. *)
  570. if [ "$UB_B_READY" -eq 0 ] ; then
  571. logger -t unbound -s "default protocol configuration"
  572. fi
  573. {
  574. # outgoing-interface has useful defaults; incoming is localhost though
  575. echo " edns-buffer-size: $UB_N_EDNS_SIZE"
  576. echo " port: $UB_N_RX_PORT"
  577. echo " outgoing-port-permit: 10240-65535"
  578. echo " interface: 0.0.0.0"
  579. echo " interface: ::0"
  580. echo
  581. } >> $UB_CORE_CONF
  582. ;;
  583. esac
  584. case "$UB_D_RESOURCE" in
  585. # Tiny - Unbound's recommended cheap hardware config
  586. tiny) rt_mem=1 ; rt_conn=2 ; rt_buff=1 ;;
  587. # Small - Half RRCACHE and open ports
  588. small) rt_mem=8 ; rt_conn=10 ; rt_buff=2 ;;
  589. # Medium - Nearly default but with some added balancintg
  590. medium) rt_mem=16 ; rt_conn=15 ; rt_buff=4 ;;
  591. # Large - Double medium
  592. large) rt_mem=32 ; rt_conn=20 ; rt_buff=4 ;;
  593. # Whatever unbound does
  594. *) rt_mem=0 ; rt_conn=0 ;;
  595. esac
  596. if [ "$rt_mem" -gt 0 ] ; then
  597. {
  598. # Other harding and options for an embedded router
  599. echo " harden-short-bufsize: yes"
  600. echo " harden-large-queries: yes"
  601. echo " harden-glue: yes"
  602. echo " use-caps-for-id: no"
  603. echo
  604. # Set memory sizing parameters
  605. echo " msg-buffer-size: $(($rt_buff*8192))"
  606. echo " outgoing-range: $(($rt_conn*32))"
  607. echo " num-queries-per-thread: $(($rt_conn*16))"
  608. echo " outgoing-num-tcp: $(($rt_conn))"
  609. echo " incoming-num-tcp: $(($rt_conn))"
  610. echo " rrset-cache-size: $(($rt_mem*256))k"
  611. echo " msg-cache-size: $(($rt_mem*128))k"
  612. echo " key-cache-size: $(($rt_mem*128))k"
  613. echo " neg-cache-size: $(($rt_mem*64))k"
  614. echo " infra-cache-numhosts: $(($rt_mem*256))"
  615. echo
  616. } >> $UB_CORE_CONF
  617. elif [ "$UB_B_READY" -eq 0 ] ; then
  618. logger -t unbound -s "default memory configuration"
  619. fi
  620. # Assembly of module-config: options is tricky; order matters
  621. modulestring="iterator"
  622. if [ "$UB_B_DNSSEC" -gt 0 ] ; then
  623. if [ "$UB_B_NTP_BOOT" -gt 0 ] ; then
  624. # DNSSEC chicken and egg with getting NTP time
  625. echo " val-override-date: -1" >> $UB_CORE_CONF
  626. fi
  627. {
  628. echo " harden-dnssec-stripped: yes"
  629. echo " val-clean-additional: yes"
  630. echo " ignore-cd-flag: yes"
  631. } >> $UB_CORE_CONF
  632. modulestring="validator $modulestring"
  633. fi
  634. if [ "$UB_B_DNS64" -gt 0 ] ; then
  635. echo " dns64-prefix: $UB_IP_DNS64" >> $UB_CORE_CONF
  636. modulestring="dns64 $modulestring"
  637. fi
  638. {
  639. # Print final module string
  640. echo " module-config: \"$modulestring\""
  641. echo
  642. } >> $UB_CORE_CONF
  643. case "$UB_D_RECURSION" in
  644. passive)
  645. {
  646. # Some query privacy but "strict" will break some servers
  647. if [ "$UB_B_QRY_MINST" -gt 0 ] && [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
  648. echo " qname-minimisation: yes"
  649. echo " qname-minimisation-strict: yes"
  650. elif [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
  651. echo " qname-minimisation: yes"
  652. else
  653. echo " qname-minimisation: no"
  654. fi
  655. # Use DNSSEC to quickly understand NXDOMAIN ranges
  656. if [ "$UB_B_DNSSEC" -gt 0 ] ; then
  657. echo " aggressive-nsec: yes"
  658. echo " prefetch-key: no"
  659. fi
  660. # On demand fetching
  661. echo " prefetch: no"
  662. echo " target-fetch-policy: \"0 0 0 0 0\""
  663. echo
  664. } >> $UB_CORE_CONF
  665. ;;
  666. aggressive)
  667. {
  668. # Some query privacy but "strict" will break some servers
  669. if [ "$UB_B_QRY_MINST" -gt 0 ] && [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
  670. echo " qname-minimisation: yes"
  671. echo " qname-minimisation-strict: yes"
  672. elif [ "$UB_B_QUERY_MIN" -gt 0 ] ; then
  673. echo " qname-minimisation: yes"
  674. else
  675. echo " qname-minimisation: no"
  676. fi
  677. # Use DNSSEC to quickly understand NXDOMAIN ranges
  678. if [ "$UB_B_DNSSEC" -gt 0 ] ; then
  679. echo " aggressive-nsec: yes"
  680. echo " prefetch-key: yes"
  681. fi
  682. # Prefetch what can be
  683. echo " prefetch: yes"
  684. echo " target-fetch-policy: \"3 2 1 0 0\""
  685. echo
  686. } >> $UB_CORE_CONF
  687. ;;
  688. *)
  689. if [ "$UB_B_READY" -eq 0 ] ; then
  690. logger -t unbound -s "default recursion configuration"
  691. fi
  692. ;;
  693. esac
  694. {
  695. # Reload records more than 20 hours old
  696. # DNSSEC 5 minute bogus cool down before retry
  697. # Adaptive infrastructure info kept for 15 minutes
  698. echo " cache-min-ttl: $UB_TTL_MIN"
  699. echo " cache-max-ttl: 72000"
  700. echo " val-bogus-ttl: 300"
  701. echo " infra-host-ttl: 900"
  702. echo
  703. } >> $UB_CORE_CONF
  704. if [ "$UB_B_HIDE_BIND" -gt 0 ] ; then
  705. {
  706. # Block server id and version DNS TXT records
  707. echo " hide-identity: yes"
  708. echo " hide-version: yes"
  709. echo
  710. } >> $UB_CORE_CONF
  711. fi
  712. if [ "$UB_D_PRIV_BLCK" -gt 0 ] ; then
  713. {
  714. # Remove _upstream_ or global reponses with private addresses.
  715. # Unbounds own "local zone" and "forward zone" may still use these.
  716. # RFC1918, RFC3927, RFC4291, RFC6598, RFC6890
  717. echo " private-address: 10.0.0.0/8"
  718. echo " private-address: 100.64.0.0/10"
  719. echo " private-address: 169.254.0.0/16"
  720. echo " private-address: 172.16.0.0/12"
  721. echo " private-address: 192.168.0.0/16"
  722. echo " private-address: fc00::/7"
  723. echo " private-address: fe80::/10"
  724. echo
  725. } >> $UB_CORE_CONF
  726. fi
  727. if [ -n "$UB_LIST_NETW_LAN" ] && [ "$UB_D_PRIV_BLCK" -gt 1 ] ; then
  728. {
  729. for ifsubnet in $UB_LIST_NETW_LAN ; do
  730. case $ifsubnet in
  731. *@[1-9][0-9a-f][0-9a-f][0-9a-f]:*:[0-9a-f]*)
  732. # Remove global DNS responses with your local network IP6 GLA
  733. echo " private-address: ${ifsubnet#*@}"
  734. ;;
  735. esac
  736. done
  737. echo
  738. } >> $UB_CORE_CONF
  739. fi
  740. if [ "$UB_B_LOCL_BLCK" -gt 0 ] ; then
  741. {
  742. # Remove DNS reponses from upstream with loopback IP
  743. # Black hole DNS method for ad blocking, so consider...
  744. echo " private-address: 127.0.0.0/8"
  745. echo " private-address: ::1/128"
  746. echo
  747. } >> $UB_CORE_CONF
  748. fi
  749. if [ -n "$UB_LIST_INSECURE" ] ; then
  750. {
  751. for domain in $UB_LIST_INSECURE ; do
  752. # Except and accept domains without (DNSSEC); work around broken domains
  753. echo " domain-insecure: $domain"
  754. done
  755. echo
  756. } >> $UB_CORE_CONF
  757. fi
  758. if [ "$UB_B_LOCL_SERV" -gt 0 ] && [ -n "$UB_LIST_NETW_ALL" ] ; then
  759. {
  760. for ifsubnet in $UB_LIST_NETW_ALL ; do
  761. # Only respond to queries from subnets which have an interface.
  762. # Prevent DNS amplification attacks by not responding to the universe.
  763. echo " access-control: ${ifsubnet#*@} allow"
  764. done
  765. echo " access-control: 127.0.0.0/8 allow"
  766. echo " access-control: ::1/128 allow"
  767. echo " access-control: fe80::/10 allow"
  768. echo
  769. } >> $UB_CORE_CONF
  770. else
  771. {
  772. echo " access-control: 0.0.0.0/0 allow"
  773. echo " access-control: ::0/0 allow"
  774. echo
  775. } >> $UB_CORE_CONF
  776. fi
  777. }
  778. ##############################################################################
  779. unbound_hostname() {
  780. local ifsubnet ifarpa ifaddr ifname iffqdn
  781. local ulaprefix hostfqdn name names namerec ptrrec
  782. local zonetype=0
  783. echo "# $UB_HOST_CONF generated by UCI $( date -Is )" > $UB_HOST_CONF
  784. if [ "$UB_D_DHCP_LINK" = "dnsmasq" ] ; then
  785. {
  786. echo "# Local zone is handled by dnsmasq"
  787. echo
  788. } >> $UB_HOST_CONF
  789. elif [ -n "$UB_TXT_DOMAIN" ] \
  790. && { [ "$UB_D_WAN_FQDN" -gt 0 ] || [ "$UB_D_LAN_FQDN" -gt 0 ] ; } ; then
  791. case "$UB_D_DOMAIN_TYPE" in
  792. deny|inform_deny|refuse|static)
  793. {
  794. # type static means only this router has your domain
  795. echo " domain-insecure: $UB_TXT_DOMAIN"
  796. echo " private-domain: $UB_TXT_DOMAIN"
  797. echo " local-zone: $UB_TXT_DOMAIN $UB_D_DOMAIN_TYPE"
  798. echo " local-data: \"$UB_TXT_DOMAIN. $UB_XSOA\""
  799. echo " local-data: \"$UB_TXT_DOMAIN. $UB_XNS\""
  800. echo " local-data: '$UB_TXT_DOMAIN. $UB_XTXT'"
  801. echo
  802. if [ "$UB_TXT_DOMAIN" != "local" ] ; then
  803. # avoid involvement in RFC6762, unless it is the local zone name
  804. echo " local-zone: local always_nxdomain"
  805. echo
  806. fi
  807. } >> $UB_HOST_CONF
  808. zonetype=2
  809. ;;
  810. inform|transparent|typetransparent)
  811. {
  812. # transparent will permit forward-zone: or stub-zone: clauses
  813. echo " private-domain: $UB_TXT_DOMAIN"
  814. echo " local-zone: $UB_TXT_DOMAIN $UB_D_DOMAIN_TYPE"
  815. echo
  816. } >> $UB_HOST_CONF
  817. zonetype=1
  818. ;;
  819. esac
  820. {
  821. # Hostname as TLD works, but not transparent through recursion (singular)
  822. echo " domain-insecure: $UB_TXT_HOSTNAME"
  823. echo " private-domain: $UB_TXT_HOSTNAME"
  824. echo " local-zone: $UB_TXT_HOSTNAME static"
  825. echo " local-data: \"$UB_TXT_HOSTNAME. $UB_XSOA\""
  826. echo " local-data: \"$UB_TXT_HOSTNAME. $UB_XNS\""
  827. echo " local-data: '$UB_TXT_HOSTNAME. $UB_XTXT'"
  828. echo
  829. } >> $UB_HOST_CONF
  830. if [ -n "$UB_LIST_NETW_WAN" ] ; then
  831. for ifsubnet in $UB_LIST_NETW_WAN ; do
  832. ifaddr=${ifsubnet#*@}
  833. ifaddr=${ifaddr%/*}
  834. ifarpa=$( host_ptr_any "$ifaddr" )
  835. if [ -n "$ifarpa" ] ; then
  836. if [ "$UB_D_WAN_FQDN" -gt 0 ] ; then
  837. {
  838. # Create a static zone for WAN host record only (singular)
  839. echo " domain-insecure: $ifarpa"
  840. echo " private-address: $ifaddr"
  841. echo " local-zone: $ifarpa static"
  842. echo " local-data: \"$ifarpa. $UB_XSOA\""
  843. echo " local-data: \"$ifarpa. $UB_XNS\""
  844. echo " local-data: '$ifarpa. $UB_MTXT'"
  845. echo
  846. } >> $UB_HOST_CONF
  847. elif [ "$zonetype" -gt 0 ] ; then
  848. {
  849. echo " local-zone: $ifarpa transparent"
  850. echo
  851. } >> $UB_HOST_CONF
  852. fi
  853. fi
  854. done
  855. fi
  856. if [ -n "$UB_LIST_NETW_LAN" ] ; then
  857. for ifsubnet in $UB_LIST_NETW_LAN ; do
  858. ifarpa=$( domain_ptr_any "${ifsubnet#*@}" )
  859. if [ -n "$ifarpa" ] ; then
  860. if [ "$zonetype" -eq 2 ] ; then
  861. {
  862. # Do NOT forward queries with your ip6.arpa or in-addr.arpa
  863. echo " domain-insecure: $ifarpa"
  864. echo " local-zone: $ifarpa static"
  865. echo " local-data: \"$ifarpa. $UB_XSOA\""
  866. echo " local-data: \"$ifarpa. $UB_XNS\""
  867. echo " local-data: '$ifarpa. $UB_XTXT'"
  868. echo
  869. } >> $UB_HOST_CONF
  870. elif [ "$zonetype" -eq 1 ] && [ "$UB_D_PRIV_BLCK" -eq 0 ] ; then
  871. {
  872. echo " local-zone: $ifarpa transparent"
  873. echo
  874. } >> $UB_HOST_CONF
  875. fi
  876. fi
  877. done
  878. fi
  879. ulaprefix=$( uci_get network.@globals[0].ula_prefix )
  880. ulaprefix=${ulaprefix%%:/*}
  881. hostfqdn="$UB_TXT_HOSTNAME.$UB_TXT_DOMAIN"
  882. if [ -z "$ulaprefix" ] ; then
  883. # Nonsense so this option isn't globbed below
  884. ulaprefix="fdno:such:addr::"
  885. fi
  886. if [ "$UB_LIST_NETW_LAN" ] && [ "$UB_D_LAN_FQDN" -gt 0 ] ; then
  887. for ifsubnet in $UB_LIST_NETW_LAN ; do
  888. ifaddr=${ifsubnet#*@}
  889. ifaddr=${ifaddr%/*}
  890. ifname=${ifsubnet%@*}
  891. iffqdn="$ifname.$hostfqdn"
  892. if [ "$UB_D_LAN_FQDN" -eq 4 ] ; then
  893. names="$iffqdn $hostfqdn $UB_TXT_HOSTNAME"
  894. ptrrec=" local-data-ptr: \"$ifaddr 300 $iffqdn\""
  895. echo "$ptrrec" >> $UB_HOST_CONF
  896. elif [ "$UB_D_LAN_FQDN" -eq 3 ] ; then
  897. names="$hostfqdn $UB_TXT_HOSTNAME"
  898. ptrrec=" local-data-ptr: \"$ifaddr 300 $hostfqdn\""
  899. echo "$ptrrec" >> $UB_HOST_CONF
  900. else
  901. names="$UB_TXT_HOSTNAME"
  902. ptrrec=" local-data-ptr: \"$ifaddr 300 $UB_TXT_HOSTNAME\""
  903. echo "$ptrrec" >> $UB_HOST_CONF
  904. fi
  905. for name in $names ; do
  906. case $ifaddr in
  907. "${ulaprefix}"*)
  908. # IP6 ULA only is assigned for OPTION 1
  909. namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
  910. echo "$namerec" >> $UB_HOST_CONF
  911. ;;
  912. [1-9]*.*[0-9])
  913. namerec=" local-data: \"$name. 300 IN A $ifaddr\""
  914. echo "$namerec" >> $UB_HOST_CONF
  915. ;;
  916. *)
  917. if [ "$UB_D_LAN_FQDN" -gt 1 ] ; then
  918. # IP6 GLA is assigned for higher options
  919. namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
  920. echo "$namerec" >> $UB_HOST_CONF
  921. fi
  922. ;;
  923. esac
  924. done
  925. echo >> $UB_HOST_CONF
  926. done
  927. fi
  928. if [ -n "$UB_LIST_NETW_WAN" ] && [ "$UB_D_WAN_FQDN" -gt 0 ] ; then
  929. for ifsubnet in $UB_LIST_NETW_WAN ; do
  930. ifaddr=${ifsubnet#*@}
  931. ifaddr=${ifaddr%/*}
  932. ifname=${ifsubnet%@*}
  933. iffqdn="$ifname.$hostfqdn"
  934. if [ "$UB_D_WAN_FQDN" -eq 4 ] ; then
  935. names="$iffqdn $hostfqdn $UB_TXT_HOSTNAME"
  936. ptrrec=" local-data-ptr: \"$ifaddr 300 $iffqdn\""
  937. echo "$ptrrec" >> $UB_HOST_CONF
  938. elif [ "$UB_D_WAN_FQDN" -eq 3 ] ; then
  939. names="$hostfqdn $UB_TXT_HOSTNAME"
  940. ptrrec=" local-data-ptr: \"$ifaddr 300 $hostfqdn\""
  941. echo "$ptrrec" >> $UB_HOST_CONF
  942. else
  943. names="$UB_TXT_HOSTNAME"
  944. ptrrec=" local-data-ptr: \"$ifaddr 300 $UB_TXT_HOSTNAME\""
  945. echo "$ptrrec" >> $UB_HOST_CONF
  946. fi
  947. for name in $names ; do
  948. case $ifaddr in
  949. "${ulaprefix}"*)
  950. # IP6 ULA only is assigned for OPTION 1
  951. namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
  952. echo "$namerec" >> $UB_HOST_CONF
  953. ;;
  954. [1-9]*.*[0-9])
  955. namerec=" local-data: \"$name. 300 IN A $ifaddr\""
  956. echo "$namerec" >> $UB_HOST_CONF
  957. ;;
  958. *)
  959. if [ "$UB_D_WAN_FQDN" -gt 1 ] ; then
  960. # IP6 GLA is assigned for higher options
  961. namerec=" local-data: \"$name. 300 IN AAAA $ifaddr\""
  962. echo "$namerec" >> $UB_HOST_CONF
  963. fi
  964. ;;
  965. esac
  966. done
  967. echo >> $UB_HOST_CONF
  968. done
  969. fi
  970. fi # end if uci valid
  971. }
  972. ##############################################################################
  973. unbound_uci() {
  974. local cfg="$1"
  975. local hostnm
  976. hostnm=$( uci_get system.@system[0].hostname | awk '{print tolower($0)}' )
  977. UB_TXT_HOSTNAME=${hostnm:-thisrouter}
  978. config_get_bool UB_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
  979. config_get_bool UB_B_DNS64 "$cfg" dns64 0
  980. config_get_bool UB_B_EXT_STATS "$cfg" extended_stats 0
  981. config_get_bool UB_B_HIDE_BIND "$cfg" hide_binddata 1
  982. config_get_bool UB_B_LOCL_SERV "$cfg" localservice 1
  983. config_get_bool UB_B_MAN_CONF "$cfg" manual_conf 0
  984. config_get_bool UB_B_QUERY_MIN "$cfg" query_minimize 0
  985. config_get_bool UB_B_QRY_MINST "$cfg" query_min_strict 0
  986. config_get_bool UB_B_AUTH_ROOT "$cfg" prefetch_root 0
  987. config_get_bool UB_B_LOCL_BLCK "$cfg" rebind_localhost 0
  988. config_get_bool UB_B_DNSSEC "$cfg" validator 0
  989. config_get_bool UB_B_NTP_BOOT "$cfg" validator_ntp 1
  990. config_get UB_IP_DNS64 "$cfg" dns64_prefix "64:ff9b::/96"
  991. config_get UB_N_EDNS_SIZE "$cfg" edns_size 1280
  992. config_get UB_N_RX_PORT "$cfg" listen_port 53
  993. config_get UB_N_ROOT_AGE "$cfg" root_age 9
  994. config_get UB_N_THREADS "$cfg" num_threads 1
  995. config_get UB_D_CONTROL "$cfg" unbound_control 0
  996. config_get UB_D_DOMAIN_TYPE "$cfg" domain_type static
  997. config_get UB_D_DHCP_LINK "$cfg" dhcp_link none
  998. config_get UB_D_EXTRA_DNS "$cfg" add_extra_dns 0
  999. config_get UB_D_LAN_FQDN "$cfg" add_local_fqdn 0
  1000. config_get UB_D_PRIV_BLCK "$cfg" rebind_protection 1
  1001. config_get UB_D_PROTOCOL "$cfg" protocol mixed
  1002. config_get UB_D_RECURSION "$cfg" recursion passive
  1003. config_get UB_D_RESOURCE "$cfg" resource small
  1004. config_get UB_D_VERBOSE "$cfg" verbosity 1
  1005. config_get UB_D_WAN_FQDN "$cfg" add_wan_fqdn 0
  1006. config_get UB_TTL_MIN "$cfg" ttl_min 120
  1007. config_get UB_TXT_DOMAIN "$cfg" domain lan
  1008. config_list_foreach "$cfg" domain_insecure bundle_domain_insecure
  1009. if [ "$UB_D_DHCP_LINK" = "none" ] ; then
  1010. config_get_bool UB_B_DNSMASQ "$cfg" dnsmasq_link_dns 0
  1011. if [ "$UB_B_DNSMASQ" -gt 0 ] ; then
  1012. UB_D_DHCP_LINK=dnsmasq
  1013. if [ "$UB_B_READY" -eq 0 ] ; then
  1014. logger -t unbound -s "Please use 'dhcp_link' selector instead"
  1015. fi
  1016. fi
  1017. fi
  1018. if [ "$UB_D_DHCP_LINK" = "dnsmasq" ] ; then
  1019. if [ ! -x /usr/sbin/dnsmasq ] || [ ! -x /etc/init.d/dnsmasq ] ; then
  1020. UB_D_DHCP_LINK=none
  1021. else
  1022. /etc/init.d/dnsmasq enabled || UB_D_DHCP_LINK=none
  1023. fi
  1024. if [ "$UB_B_READY" -eq 0 ] && [ "$UB_D_DHCP_LINK" = "none" ] ; then
  1025. logger -t unbound -s "cannot forward to dnsmasq"
  1026. fi
  1027. fi
  1028. if [ "$UB_D_DHCP_LINK" = "odhcpd" ] ; then
  1029. if [ ! -x /usr/sbin/odhcpd ] || [ ! -x /etc/init.d/odhcpd ] ; then
  1030. UB_D_DHCP_LINK=none
  1031. else
  1032. /etc/init.d/odhcpd enabled || UB_D_DHCP_LINK=none
  1033. fi
  1034. if [ "$UB_B_READY" -eq 0 ] && [ "$UB_D_DHCP_LINK" = "none" ] ; then
  1035. logger -t unbound -s "cannot receive records from odhcpd"
  1036. fi
  1037. fi
  1038. if [ "$UB_N_EDNS_SIZE" -lt 512 ] || [ 4096 -lt "$UB_N_EDNS_SIZE" ] ; then
  1039. logger -t unbound -s "edns_size exceeds range, using default"
  1040. UB_N_EDNS_SIZE=1280
  1041. fi
  1042. if [ "$UB_N_RX_PORT" -ne 53 ] \
  1043. && { [ "$UB_N_RX_PORT" -lt 1024 ] || [ 10240 -lt "$UB_N_RX_PORT" ] ; } ; then
  1044. logger -t unbound -s "privileged port or in 5 digits, using default"
  1045. UB_N_RX_PORT=53
  1046. fi
  1047. if [ "$UB_TTL_MIN" -gt 1800 ] ; then
  1048. logger -t unbound -s "ttl_min could have had awful side effects, using 300"
  1049. UB_TTL_MIN=300
  1050. fi
  1051. }
  1052. ##############################################################################
  1053. unbound_include() {
  1054. local adb_enabled
  1055. local adb_files=$( ls $UB_VARDIR/adb_list.* 2>/dev/null )
  1056. echo "# $UB_TOTAL_CONF generated by UCI $( date -Is )" > $UB_TOTAL_CONF
  1057. if [ -f "$UB_CORE_CONF" ] ; then
  1058. # Yes this all looks busy, but it is in TMPFS. Working on separate files
  1059. # and piecing together is easier. UCI order is less constrained.
  1060. cat $UB_CORE_CONF >> $UB_TOTAL_CONF
  1061. rm $UB_CORE_CONF
  1062. fi
  1063. if [ -f "$UB_HOST_CONF" ] ; then
  1064. # UCI definitions of local host or local subnet
  1065. cat $UB_HOST_CONF >> $UB_TOTAL_CONF
  1066. rm $UB_HOST_CONF
  1067. fi
  1068. if [ -f $UB_SRVMASQ_CONF ] ; then
  1069. # UCI found link to dnsmasq
  1070. cat $UB_SRVMASQ_CONF >> $UB_TOTAL_CONF
  1071. rm $UB_SRVMASQ_CONF
  1072. fi
  1073. if [ -f "$UB_DHCP_CONF" ] ; then
  1074. {
  1075. # Seed DHCP records because dhcp scripts trigger externally
  1076. # Incremental Unbound restarts may drop unbound-control records
  1077. echo "include: $UB_DHCP_CONF"
  1078. echo
  1079. }>> $UB_TOTAL_CONF
  1080. fi
  1081. if [ -z "$adb_files" ] || [ ! -x /usr/bin/adblock.sh ] \
  1082. || [ ! -x /etc/init.d/adblock ] ; then
  1083. adb_enabled=0
  1084. elif /etc/init.d/adblock enabled ; then
  1085. adb_enabled=1
  1086. {
  1087. # Pull in your selected openwrt/pacakges/net/adblock generated lists
  1088. echo "include: $UB_VARDIR/adb_list.*"
  1089. echo
  1090. } >> $UB_TOTAL_CONF
  1091. else
  1092. adb_enabled=0
  1093. fi
  1094. if [ -f $UB_SRV_CONF ] ; then
  1095. {
  1096. # Pull your own "server:" options here
  1097. echo "include: $UB_SRV_CONF"
  1098. echo
  1099. }>> $UB_TOTAL_CONF
  1100. fi
  1101. if [ -f "$UB_ZONE_CONF" ] ; then
  1102. # UCI defined forward, stub, and auth zones
  1103. cat $UB_ZONE_CONF >> $UB_TOTAL_CONF
  1104. rm $UB_ZONE_CONF
  1105. fi
  1106. if [ -f "$UB_CTRL_CONF" ] ; then
  1107. # UCI defined control application connection
  1108. cat $UB_CTRL_CONF >> $UB_TOTAL_CONF
  1109. rm $UB_CTRL_CONF
  1110. fi
  1111. if [ -f "$UB_EXTMASQ_CONF" ] ; then
  1112. # UCI found link to dnsmasq
  1113. cat $UB_EXTMASQ_CONF >> $UB_TOTAL_CONF
  1114. rm $UB_EXTMASQ_CONF
  1115. fi
  1116. if [ -f "$UB_EXT_CONF" ] ; then
  1117. {
  1118. # Pull your own extend feature clauses here
  1119. echo "include: $UB_EXT_CONF"
  1120. echo
  1121. } >> $UB_TOTAL_CONF
  1122. fi
  1123. }
  1124. ##############################################################################
  1125. resolv_setup() {
  1126. if [ "$UB_N_RX_PORT" != "53" ] ; then
  1127. return
  1128. elif [ -x /etc/init.d/dnsmasq ] \
  1129. && /etc/init.d/dnsmasq enabled \
  1130. && nslookup localhost 127.0.0.1#53 >/dev/null 2>&1 ; then
  1131. # unbound is configured for port 53, but dnsmasq is enabled and a resolver
  1132. # listens on localhost:53, lets assume dnsmasq manages the resolver file.
  1133. # TODO:
  1134. # really check if dnsmasq runs a local (main) resolver in stead of using
  1135. # nslookup that times out when no resolver listens on localhost:53.
  1136. return
  1137. fi
  1138. # unbound is designated to listen on 127.0.0.1#53,
  1139. # set resolver file to local.
  1140. rm -f /tmp/resolv.conf
  1141. {
  1142. echo "# /tmp/resolv.conf generated by Unbound UCI $( date -Is )"
  1143. echo "nameserver 127.0.0.1"
  1144. echo "nameserver ::1"
  1145. echo "search $UB_TXT_DOMAIN."
  1146. } > /tmp/resolv.conf
  1147. }
  1148. ##############################################################################
  1149. unbound_start() {
  1150. config_load unbound
  1151. config_foreach unbound_uci unbound
  1152. unbound_mkdir
  1153. if [ "$UB_B_MAN_CONF" -eq 0 ] ; then
  1154. # iterate zones before we load other UCI
  1155. # forward-zone: auth-zone: and stub-zone:
  1156. config_foreach unbound_zone zone
  1157. # associate potential DNS RR with interfaces
  1158. config_load network
  1159. config_foreach bundle_all_networks interface
  1160. config_load dhcp
  1161. config_foreach bundle_lan_networks dhcp
  1162. bundle_wan_networks
  1163. # server:
  1164. unbound_conf
  1165. unbound_hostname
  1166. # control:
  1167. unbound_control
  1168. # dnsmasq
  1169. dnsmasq_link
  1170. # merge
  1171. unbound_include
  1172. fi
  1173. resolv_setup
  1174. }
  1175. ##############################################################################