You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

119 lines
3.5 KiB

  1. #!/bin/sh
  2. ##############################################################################
  3. #
  4. # This program is free software; you can redistribute it and/or modify
  5. # it under the terms of the GNU General Public License version 2 as
  6. # published by the Free Software Foundation.
  7. #
  8. # This program is distributed in the hope that it will be useful,
  9. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  10. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11. # GNU General Public License for more details.
  12. #
  13. # Copyright (C) 2016 Eric Luehrsen
  14. #
  15. ##############################################################################
  16. #
  17. # This component needs to be used within the unbound.sh as an include. It uses
  18. # defaults and UCI scope variables defined there. It will copy root.key back
  19. # to /etc/unbound/ periodically, but avoid ROM flash abuse (UCI option).
  20. #
  21. ##############################################################################
  22. rootzone_uci() {
  23. local cfg=$1
  24. # This will likely be called outside of "start_service()" context
  25. config_get_bool UNBOUND_B_DNSSEC "$cfg" validator 0
  26. config_get_bool UNBOUND_B_NTP_BOOT "$cfg" validator_ntp 1
  27. config_get UNBOUND_N_ROOT_AGE "$cfg" root_age 9
  28. }
  29. ##############################################################################
  30. roothints_update() {
  31. # TODO: Might not be implemented. Unbound doesn't natively update hints.
  32. # Unbound philosophy is built in root hints are good for machine life.
  33. return 0
  34. }
  35. ##############################################################################
  36. rootkey_update() {
  37. local basekey_date rootkey_date rootkey_age filestuff
  38. if [ "$UNBOUND_N_ROOT_AGE" -gt 90 -o "$UNBOUND_B_DNSSEC" -lt 1 ] ; then
  39. # Feature disabled
  40. return 0
  41. elif [ "$UNBOUND_B_NTP_BOOT" -gt 0 -a ! -f "$UNBOUND_TIMEFILE" ] ; then
  42. # We don't have time yet
  43. return 0
  44. fi
  45. if [ -f /etc/unbound/root.key ] ; then
  46. basekey_date=$( date -r /etc/unbound/root.key +%s )
  47. else
  48. # No persistent storage key
  49. basekey_date=$( date -d 2000-01-01 +%s )
  50. fi
  51. if [ -f "$UNBOUND_KEYFILE" ] ; then
  52. # Unbound maintains it itself
  53. rootkey_date=$( date -r $UNBOUND_KEYFILE +%s )
  54. rootkey_age=$(( (rootkey_date - basekey_date) / 86440 ))
  55. elif [ -x "$UNBOUND_ANCHOR" ] ; then
  56. # No tmpfs key - use unbound-anchor
  57. rootkey_date=$( date -I +%s )
  58. rootkey_age=$(( (rootkey_date - basekey_date) / 86440 ))
  59. $UNBOUND_ANCHOR -a $UNBOUND_KEYFILE
  60. else
  61. # give up
  62. rootkey_age=0
  63. fi
  64. if [ "$rootkey_age" -gt "$UNBOUND_N_ROOT_AGE" ] ; then
  65. filestuff=$( cat $UNBOUND_KEYFILE )
  66. case "$filestuff" in
  67. *NOERROR*)
  68. # Header comment for drill and dig
  69. logger -t unbound -s "root.key updated after $rootkey_age days"
  70. cp -p $UNBOUND_KEYFILE /etc/unbound/root.key
  71. ;;
  72. *"state=2 [ VALID ]"*)
  73. # Comment inline to key for unbound-anchor
  74. logger -t unbound -s "root.key updated after $rootkey_age days"
  75. cp -p $UNBOUND_KEYFILE /etc/unbound/root.key
  76. ;;
  77. *)
  78. logger -t unbound -s "root.key still $rootkey_age days old"
  79. ;;
  80. esac
  81. fi
  82. }
  83. ##############################################################################
  84. rootzone_update() {
  85. # Partial UCI fetch for this functional group
  86. config_load unbound
  87. config_foreach rootzone_uci unbound
  88. # You need root.hints and root.key to boot strap recursion
  89. roothints_update
  90. rootkey_update
  91. }
  92. ##############################################################################