1 -- Copyright 2008 Steven Barth <steven@midlink.org>
2 -- Copyright 2016 Eric Luehrsen <ericluehrsen@hotmail.com>
3 -- Copyright 2016 Dan Luedtke <mail@danrl.com>
4 -- Licensed to the public under the Apache License 2.0.
7 local ena, mcf, lci, lsv, rlh, rpv, vld, nvd, eds, prt, tlm
8 local ctl, dlk, dom, dty, lfq, wfq, exa, dp6, d64, pfx, qry, qrs
9 local pro, tgr, rsc, rsn, ag2, stt
10 local ucl = luci.model.uci.cursor()
11 local valman = ucl:get_first("unbound", "unbound", "manual_conf")
15 s1 = m1:section(TypedSection, "unbound")
19 --LuCI, Unbound, or Not
20 s1:tab("basic", translate("Basic"),
21 translatef("<h3>Unbound Basic Settings</h3>\n"
22 .. "<a href=\"%s\" target=\"_blank\">Unbound</a>"
23 .. " is a validating, recursive, and caching DNS resolver. "
24 .. "UCI help can be found on "
25 .. "<a href=\"%s\" target=\"_blank\">github</a>.",
26 "https://www.unbound.net/",
27 "https://github.com/openwrt/packages/blob/master/net/unbound/files/README.md"))
29 ena = s1:taboption("basic", Flag, "enabled", translate("Enable Unbound:"),
30 translate("Enable the initialization scripts for Unbound"))
33 mcf = s1:taboption("basic", Flag, "manual_conf", translate("Manual Conf:"),
34 translate("Skip UCI and use /etc/unbound/unbound.conf"))
37 lci = s1:taboption("basic", Flag, "extended_luci", translate("Advanced LuCI:"),
38 translate("See detailed tabs for debug and advanced manual configuration"))
42 function ena.cfgvalue(self, section)
43 return luci.sys.init.enabled("unbound") and self.enabled or self.disabled
47 function ena.write(self, section, value)
49 luci.sys.init.enable("unbound")
50 luci.sys.call("/etc/init.d/unbound start >/dev/null")
52 luci.sys.call("/etc/init.d/unbound stop >/dev/null")
53 luci.sys.init.disable("unbound")
56 return Flag.write(self, section, value)
61 -- Not in manual configuration mode; show UCI
62 s1:tab("advanced", translate("Advanced"),
63 translatef("<h3>Unbound Advanced Settings</h3>\n"
64 .. "Advanced setttings and plugin modules for "
65 .. "<a href=\"%s\" target=\"_blank\">Unbound</a>"
66 .. " DNS resolver.", "https://www.unbound.net/"))
68 s1:tab("resource", translate("Resource"),
69 translatef("<h3>Unbound Resource Settings</h3>\n"
70 .. "Memory and protocol setttings for "
71 .. "<a href=\"%s\" target=\"_blank\">Unbound</a>"
72 .. " DNS resolver.", "https://www.unbound.net/"))
75 lsv = s1:taboption("basic", Flag, "localservice", translate("Local Service:"),
76 translate("Accept queries only from local subnets"))
79 rlh = s1:taboption("basic", Flag, "rebind_localhost", translate("Block Localhost Rebind:"),
80 translate("Prevent upstream response of 127.0.0.0/8"))
83 rpv = s1:taboption("basic", Flag, "rebind_protection", translate("Block Private Rebind:"),
84 translate("Prevent upstream response of RFC1918 ranges"))
87 vld = s1:taboption("basic", Flag, "validator", translate("Enable DNSSEC:"),
88 translate("Enable the DNSSEC validator module"))
91 nvd = s1:taboption("basic", Flag, "validator_ntp", translate("DNSSEC NTP Fix:"),
92 translate("Break the loop where DNSSEC needs NTP and NTP needs DNS"))
94 nvd:depends({ validator = true })
96 eds = s1:taboption("basic", Value, "edns_size", translate("EDNS Size:"),
97 translate("Limit extended DNS packet size"))
98 eds.datatype = "and(uinteger,min(512),max(4096))"
101 prt = s1:taboption("basic", Value, "listen_port", translate("Listening Port:"),
102 translate("Choose Unbounds listening port"))
103 prt.datatype = "port"
106 tlm = s1:taboption("basic", Value, "ttl_min", translate("TTL Minimum:"),
107 translate("Prevent excessively short cache periods"))
108 tlm.datatype = "and(uinteger,min(0),max(600))"
112 ctl = s1:taboption("advanced", ListValue, "unbound_control", translate("Unbound Control App:"),
113 translate("Enable access for unbound-control"))
115 ctl:value("0", translate("No Remote Control"))
116 ctl:value("1", translate("Local Host, No Encryption"))
117 ctl:value("2", translate("Local Host, Encrypted"))
118 ctl:value("3", translate("Local Subnet, Encrypted"))
119 ctl:value("4", translate("Local Subnet, Static Encryption"))
121 dlk = s1:taboption("advanced", ListValue, "dhcp_link", translate("DHCP Link:"),
122 translate("Link to supported programs to load DHCP into DNS"))
123 dlk:value("none", translate("No Link"))
124 dlk:value("dnsmasq", "dnsmasq")
125 dlk:value("odhcpd", "odhcpd")
128 dom = s1:taboption("advanced", Value, "domain", translate("Local Domain:"),
129 translate("Domain suffix for this router and DHCP clients"))
130 dom.placeholder = "lan"
131 dom:depends({ dhcp_link = "none" })
132 dom:depends({ dhcp_link = "odhcpd" })
134 dty = s1:taboption("advanced", ListValue, "domain_type", translate("Local Domain Type:"),
135 translate("How to treat queries of this local domain"))
136 dty:value("deny", translate("Ignored"))
137 dty:value("refuse", translate("Refused"))
138 dty:value("static", translate("Only Local"))
139 dty:value("transparent", translate("Also Forwarded"))
140 dty:depends({ dhcp_link = "none" })
141 dty:depends({ dhcp_link = "odhcpd" })
143 lfq = s1:taboption("advanced", ListValue, "add_local_fqdn", translate("LAN DNS:"),
144 translate("How to enter the LAN or local network router in DNS"))
145 lfq:value("0", translate("No DNS"))
146 lfq:value("1", translate("Hostname, Primary Address"))
147 lfq:value("2", translate("Hostname, All Addresses"))
148 lfq:value("3", translate("Host FQDN, All Addresses"))
149 lfq:value("4", translate("Interface FQDN, All Addresses"))
150 lfq:depends({ dhcp_link = "none" })
151 lfq:depends({ dhcp_link = "odhcpd" })
153 wfq = s1:taboption("advanced", ListValue, "add_wan_fqdn", translate("WAN DNS:"),
154 translate("Override the WAN side router entry in DNS"))
155 wfq:value("0", translate("Upstream"))
156 wfq:value("1", translate("Hostname, Primary Address"))
157 wfq:value("2", translate("Hostname, All Addresses"))
158 wfq:value("3", translate("Host FQDN, All Addresses"))
159 wfq:value("4", translate("Interface FQDN, All Addresses"))
160 wfq:depends({ dhcp_link = "none" })
161 wfq:depends({ dhcp_link = "odhcpd" })
163 exa = s1:taboption("advanced", ListValue, "add_extra_dns", translate("Extra DNS:"),
164 translate("Use extra DNS entries found in /etc/config/dhcp"))
165 exa:value("0", translate("Ignore"))
166 exa:value("1", translate("Include Network/Hostnames"))
167 exa:value("2", translate("Advanced MX/SRV RR"))
168 exa:value("3", translate("Advanced CNAME RR"))
169 exa:depends({ dhcp_link = "none" })
170 exa:depends({ dhcp_link = "odhcpd" })
172 dp6 = s1:taboption("advanced", Flag, "dhcp4_slaac6", translate("DHCPv4 to SLAAC:"),
173 translate("Use DHCPv4 MAC to discover IP6 hosts SLAAC (EUI64)"))
176 d64 = s1:taboption("advanced", Flag, "dns64", translate("Enable DNS64:"),
177 translate("Enable the DNS64 module"))
180 pfx = s1:taboption("advanced", Value, "dns64_prefix", translate("DNS64 Prefix:"),
181 translate("Prefix for generated DNS64 addresses"))
182 pfx.datatype = "ip6addr"
183 pfx.placeholder = "64:ff9b::/96"
185 pfx:depends({ dns64 = true })
187 qry = s1:taboption("advanced", Flag, "query_minimize", translate("Query Minimize:"),
188 translate("Break down query components for limited added privacy"))
191 qrs = s1:taboption("advanced", Flag, "query_min_strict", translate("Strict Minimize:"),
192 translate("Strict version of 'query minimize' but it can break DNS"))
194 qrs:depends({ query_minimize = true })
196 --TODO: dnsmasq needs to not reference resolve-file and get off port 53.
198 --Resource Tuning Tab
199 pro = s1:taboption("resource", ListValue, "protocol", translate("Recursion Protocol:"),
200 translate("Chose the protocol recursion queries leave on"))
201 pro:value("mixed", translate("IP4 and IP6"))
202 pro:value("ip6_prefer", translate("IP6 Preferred"))
203 pro:value("ip4_only", translate("IP4 Only"))
204 pro:value("ip6_only", translate("IP6 Only"))
207 rsn = s1:taboption("resource", ListValue, "recursion", translate("Recursion Strength:"),
208 translate("Recursion activity affects memory growth and CPU load"))
209 rsn:value("aggressive", translate("Aggressive"))
210 rsn:value("default", translate("Default"))
211 rsn:value("passive", translate("Passive"))
214 rsc = s1:taboption("resource", ListValue, "resource", translate("Memory Resource:"),
215 translate("Use menu System/Processes to observe any memory growth"))
216 rsc:value("large", translate("Large"))
217 rsc:value("medium", translate("Medium"))
218 rsc:value("small", translate("Small"))
219 rsc:value("tiny", translate("Tiny"))
222 ag2 = s1:taboption("resource", Value, "root_age", translate("Root DSKEY Age:"),
223 translate("Limit days between RFC5011 to reduce flash writes"))
224 ag2.datatype = "and(uinteger,min(1),max(99))"
226 ag2:value("9", "9 ("..translate("default")..")")
227 ag2:value("12", "12")
228 ag2:value("24", "24")
229 ag2:value("99", "99 ("..translate("never")..")")
231 stt = s1:taboption("resource", Flag, "extended_stats", translate("Extended Statistics:"),
232 translate("Extended statistics are printed from unbound-control"))
235 tgr = s1:taboption("resource", Value, "trigger", translate("Trigger Networks:"),
236 translate("Networks that may trigger Unbound to reload (avoid wan6)"))
237 tgr.template = "cbi/network_netlist"
238 tgr.widget = "checkbox"
242 s1:tab("rfc5011", translate("RFC5011"),
243 translatef("<h3>Unbound RFC5011 Settings</h3>\n"
244 .. "RFC5011 copy scripts protect flash ROM even with UCI disabled."))
246 ag2 = s1:taboption("rfc5011", Value, "root_age", translate("Root DSKEY Age:"),
247 translate("Limit days to copy /var/->/etc/ to reduce flash writes"))
248 ag2.datatype = "and(uinteger,min(1),max(99))"
250 ag2:value("9", "9 ("..translate("default")..")")
251 ag2:value("12", "12")
252 ag2:value("24", "24")
253 ag2:value("99", "99 ("..translate("never")..")")
257 function m1.on_after_commit(self)
258 function ena.validate(self, value)
260 luci.sys.call("/etc/init.d/unbound restart >/dev/null 2>&1")
262 luci.sys.call("/etc/init.d/unbound stop >/dev/null 2>&1")
267 -- Restart Unbound with configuration and reload the page (some options hide)
268 luci.http.redirect(luci.dispatcher.build_url("admin", "services", "unbound"))