net/unbound/files/unbound.sh

   1 #!/bin/sh
   2 ##############################################################################
   3 #
   4 # This program is free software; you can redistribute it and/or modify
   5 # it under the terms of the GNU General Public License version 2 as
   6 # published by the Free Software Foundation.
   7 #
   8 # This program is distributed in the hope that it will be useful,
   9 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  10 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11 # GNU General Public License for more details.
  12 #
  13 # Copyright (C) 2016 Eric Luehrsen
  14 #
  15 ##############################################################################
  16 #
  17 # This builds the basic UCI components currently supported for Unbound. It is
  18 # intentionally NOT comprehensive and bundles a lot of options. The UCI is to
  19 # be a simpler presentation of the total Unbound conf set.
  20 #
  21 ##############################################################################
  22
  23 UNBOUND_B_CONTROL=0
  24 UNBOUND_B_SLAAC6_MAC=0
  25 UNBOUND_B_DNSSEC=0
  26 UNBOUND_B_DNS64=0
  27 UNBOUND_B_GATE_NAME=0
  28 UNBOUND_B_HIDE_BIND=1
  29 UNBOUND_B_LOCL_BLCK=0
  30 UNBOUND_B_LOCL_SERV=1
  31 UNBOUND_B_MAN_CONF=0
  32 UNBOUND_B_NTP_BOOT=1
  33 UNBOUND_B_PRIV_BLCK=1
  34 UNBOUND_B_QUERY_MIN=0
  35 UNBOUND_B_QRY_MINST=0
  36
  37 UNBOUND_D_DOMAIN_TYPE=static
  38 UNBOUND_D_DHCP_LINK=none
  39 UNBOUND_D_LAN_FQDN=0
  40 UNBOUND_D_PROTOCOL=mixed
  41 UNBOUND_D_RESOURCE=small
  42 UNBOUND_D_RECURSION=passive
  43 UNBOUND_D_WAN_FQDN=0
  44
  45 UNBOUND_IP_DNS64="64:ff9b::/96"
  46
  47 UNBOUND_N_EDNS_SIZE=1280
  48 UNBOUND_N_FWD_PORTS=""
  49 UNBOUND_N_RX_PORT=53
  50 UNBOUND_N_ROOT_AGE=9
  51
  52 UNBOUND_TTL_MIN=120
  53
  54 UNBOUND_TXT_DOMAIN=lan
  55 UNBOUND_TXT_FWD_ZONE=""
  56 UNBOUND_TXT_HOSTNAME=thisrouter
  57
  58 ##############################################################################
  59
  60 UNBOUND_LIBDIR=/usr/lib/unbound
  61 UNBOUND_VARDIR=/var/lib/unbound
  62
  63 UNBOUND_PIDFILE=/var/run/unbound.pid
  64
  65 UNBOUND_SRV_CONF=$UNBOUND_VARDIR/unbound_srv.conf
  66 UNBOUND_EXT_CONF=$UNBOUND_VARDIR/unbound_ext.conf
  67 UNBOUND_DHCP_CONF=$UNBOUND_VARDIR/unbound_dhcp.conf
  68 UNBOUND_CONFFILE=$UNBOUND_VARDIR/unbound.conf
  69
  70 UNBOUND_KEYFILE=$UNBOUND_VARDIR/root.key
  71 UNBOUND_HINTFILE=$UNBOUND_VARDIR/root.hints
  72 UNBOUND_TIMEFILE=$UNBOUND_VARDIR/unbound.time
  73
  74 ##############################################################################
  75
  76 UNBOUND_ANCHOR=/usr/sbin/unbound-anchor
  77 UNBOUND_CONTROL=/usr/sbin/unbound-control
  78 UNBOUND_CONTROL_CFG="$UNBOUND_CONTROL -c $UNBOUND_CONFFILE"
  79
  80 ##############################################################################
  81
  82 . /lib/functions.sh
  83 . /lib/functions/network.sh
  84
  85 . $UNBOUND_LIBDIR/dnsmasq.sh
  86 . $UNBOUND_LIBDIR/iptools.sh
  87 . $UNBOUND_LIBDIR/rootzone.sh
  88
  89 ##############################################################################
  90
  91 copy_dash_update() {
  92   # TODO: remove this function and use builtins when this issues is resovled.
  93   # Due to OpenWrt/LEDE divergence "cp -u" isn't yet universally available.
  94   local filetime keeptime
  95
  96
  97   if [ -f $UNBOUND_KEYFILE.keep ] ; then
  98     # root.key.keep is reused if newest
  99     filetime=$( date -r $UNBOUND_KEYFILE +%s )
 100     keeptime=$( date -r $UNBOUND_KEYFILE.keep +%s )
 101
 102
 103     if [ $keeptime -gt $filetime ] ; then
 104       cp $UNBOUND_KEYFILE.keep $UNBOUND_KEYFILE
 105     fi
 106
 107
 108     rm -f $UNBOUND_KEYFILE.keep
 109   fi
 110 }
 111
 112 ##############################################################################
 113
 114 create_interface_dns() {
 115   local cfg="$1"
 116   local ipcommand logint ignore ifname ifdashname
 117   local name names address addresses
 118   local ulaprefix if_fqdn host_fqdn mode mode_ptr
 119
 120   # Create local-data: references for this hosts interfaces (router).
 121   config_get logint "$cfg" interface
 122   config_get_bool ignore "$cfg" ignore 0
 123   network_get_device ifname "$cfg"
 124
 125   ifdashname="${ifname//./-}"
 126   ipcommand="ip -o address show $ifname"
 127   addresses="$($ipcommand | awk '/inet/{sub(/\/.*/,"",$4); print $4}')"
 128   ulaprefix="$(uci_get network @globals[0] ula_prefix)"
 129   host_fqdn="$UNBOUND_TXT_HOSTNAME.$UNBOUND_TXT_DOMAIN"
 130   if_fqdn="$ifdashname.$host_fqdn"
 131
 132
 133   if [ -z "${ulaprefix%%:/*}" ] ; then
 134     # Nonsense so this option isn't globbed below
 135     ulaprefix="fdno:such:addr::/48"
 136   fi
 137
 138
 139   if [ "$ignore" -gt 0 ] ; then
 140     mode="$UNBOUND_D_WAN_FQDN"
 141   else
 142     mode="$UNBOUND_D_LAN_FQDN"
 143   fi
 144
 145
 146   case "$mode" in
 147   3)
 148     mode_ptr="$host_fqdn"
 149     names="$host_fqdn  $UNBOUND_TXT_HOSTNAME"
 150     ;;
 151
 152   4)
 153     if [ -z "$ifdashname" ] ; then
 154       # race conditions at init can rarely cause a blank device return
 155       # the record format is invalid and Unbound won't load the conf file
 156       mode_ptr="$host_fqdn"
 157       names="$host_fqdn  $UNBOUND_TXT_HOSTNAME"
 158     else
 159       mode_ptr="$if_fqdn"
 160       names="$if_fqdn  $host_fqdn  $UNBOUND_TXT_HOSTNAME"
 161     fi
 162     ;;
 163
 164   *)
 165     mode_ptr="$UNBOUND_TXT_HOSTNAME"
 166     names="$UNBOUND_TXT_HOSTNAME"
 167     ;;
 168   esac
 169
 170
 171   if [ "$mode" -gt 1 ] ; then
 172     {
 173       for address in $addresses ; do
 174         case $address in
 175         fe80:*|169.254.*)
 176           echo "  # note link address $address"
 177           ;;
 178
 179         [1-9a-f]*:*[0-9a-f])
 180           # GA and ULA IP6 for HOST IN AAA records (ip command is robust)
 181           for name in $names ; do
 182             echo "  local-data: \"$name. 120 IN AAAA $address\""
 183           done
 184           echo "  local-data-ptr: \"$address 120 $mode_ptr\""
 185           ;;
 186
 187         [1-9]*.*[0-9])
 188           # Old fashioned HOST IN A records
 189           for name in $names ; do
 190             echo "  local-data: \"$name. 120 IN A $address\""
 191           done
 192           echo "  local-data-ptr: \"$address 120 $mode_ptr\""
 193           ;;
 194         esac
 195       done
 196       echo
 197     } >> $UNBOUND_CONFFILE
 198
 199   elif [ "$mode" -gt 0 ] ; then
 200     {
 201       for address in $addresses ; do
 202         case $address in
 203         fe80:*|169.254.*)
 204           echo "  # note link address $address"
 205           ;;
 206
 207         "${ulaprefix%%:/*}"*)
 208           # Only this networks ULA and only hostname
 209           echo "  local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN AAAA $address\""
 210           echo "  local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
 211           ;;
 212
 213         [1-9]*.*[0-9])
 214           echo "  local-data: \"$UNBOUND_TXT_HOSTNAME. 120 IN A $address\""
 215           echo "  local-data-ptr: \"$address 120 $UNBOUND_TXT_HOSTNAME\""
 216           ;;
 217         esac
 218       done
 219       echo
 220     } >> $UNBOUND_CONFFILE
 221   fi
 222 }
 223
 224 ##############################################################################
 225
 226 create_access_control() {
 227   local cfg="$1"
 228   local subnets subnets4 subnets6
 229   local validip4 validip6
 230
 231   network_get_subnets  subnets4 "$cfg"
 232   network_get_subnets6 subnets6 "$cfg"
 233   subnets="$subnets4 $subnets6"
 234
 235
 236   if [ -n "$subnets" ] ; then
 237     for subnet in $subnets ; do
 238       validip4=$( valid_subnet4 $subnet )
 239       validip6=$( valid_subnet6 $subnet )
 240
 241
 242       if [ "$validip4" = "ok" -o "$validip6" = "ok" ] ; then
 243         # For each "network" UCI add "access-control:" white list for queries
 244         echo "  access-control: $subnet allow" >> $UNBOUND_CONFFILE
 245       fi
 246     done
 247   fi
 248 }
 249
 250 ##############################################################################
 251
 252 create_domain_insecure() {
 253   echo "  domain-insecure: \"$1\"" >> $UNBOUND_CONFFILE
 254 }
 255
 256 ##############################################################################
 257
 258 unbound_mkdir() {
 259   local resolvsym=0
 260   local dhcp_origin=$( uci get dhcp.@odhcpd[0].leasefile )
 261   local dhcp_dir=$( dirname "$dhcp_origin" )
 262   local filestuff
 263
 264
 265   if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
 266     resolvsym=1
 267   else
 268     /etc/init.d/dnsmasq enabled || resolvsym=1
 269   fi
 270
 271
 272   if [ "$resolvsym" -gt 0 ] ; then
 273     rm -f /tmp/resolv.conf
 274
 275
 276     {
 277       # Set resolver file to local but not if /etc/init.d/dnsmasq will do it.
 278       echo "nameserver 127.0.0.1"
 279       echo "nameserver ::1"
 280       echo "search $UNBOUND_TXT_DOMAIN"
 281     } > /tmp/resolv.conf
 282   fi
 283
 284
 285   if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" -a ! -d "$dhcp_dir" ] ; then
 286     # make sure odhcpd has a directory to write (not done itself, yet)
 287     mkdir -p "$dhcp_dir"
 288   fi
 289
 290
 291   if [ -f $UNBOUND_KEYFILE ] ; then
 292     filestuff=$( cat $UNBOUND_KEYFILE )
 293
 294
 295     case "$filestuff" in
 296       *"state=2 [  VALID  ]"*)
 297         # Lets not lose RFC 5011 tracking if we don't have to
 298         cp -p $UNBOUND_KEYFILE $UNBOUND_KEYFILE.keep
 299         ;;
 300     esac
 301   fi
 302
 303
 304   # Blind copy /etc/ to /var/lib/
 305   mkdir -p $UNBOUND_VARDIR
 306   rm -f $UNBOUND_VARDIR/dhcp_*
 307   touch $UNBOUND_CONFFILE
 308   touch $UNBOUND_SRV_CONF
 309   touch $UNBOUND_EXT_CONF
 310   cp -p /etc/unbound/* $UNBOUND_VARDIR/
 311
 312
 313   if [ ! -f $UNBOUND_HINTFILE ] ; then
 314     if [ -f /usr/share/dns/root.hints ] ; then
 315       # Debian-like package dns-root-data
 316       cp -p /usr/share/dns/root.hints $UNBOUND_HINTFILE
 317
 318     elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 319       logger -t unbound -s "iterator will use built-in root hints"
 320     fi
 321   fi
 322
 323
 324   if [ ! -f $UNBOUND_KEYFILE ] ; then
 325     if [ -f /usr/share/dns/root.key ] ; then
 326       # Debian-like package dns-root-data
 327       cp -p /usr/share/dns/root.key $UNBOUND_KEYFILE
 328
 329     elif [ -x $UNBOUND_ANCHOR ] ; then
 330       $UNBOUND_ANCHOR -a $UNBOUND_KEYFILE
 331
 332     elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 333       logger -t unbound -s "validator will use built-in trust anchor"
 334     fi
 335   fi
 336
 337
 338   copy_dash_update
 339
 340
 341   # Ensure access and prepare to jail
 342   chown -R unbound:unbound $UNBOUND_VARDIR
 343   chmod 775 $UNBOUND_VARDIR
 344   chmod 664 $UNBOUND_VARDIR/*
 345 }
 346
 347 ##############################################################################
 348
 349 unbound_control() {
 350   if [ "$UNBOUND_B_CONTROL" -gt 0 ] ; then
 351     {
 352       # Enable remote control tool, but only at local host for security
 353       # You can hand write fancier encrypted access with /etc/..._ext.conf
 354       echo "remote-control:"
 355       echo "  control-enable: yes"
 356       echo "  control-use-cert: no"
 357       echo "  control-interface: 127.0.0.1"
 358       echo "  control-interface: ::1"
 359       echo
 360     } >> $UNBOUND_CONFFILE
 361   fi
 362
 363
 364   {
 365     # Amend your own extended clauses here like forward zones or disable
 366     # above (local, no encryption) and amend your own remote encrypted control
 367     echo
 368     echo "include: $UNBOUND_EXT_CONF" >> $UNBOUND_CONFFILE
 369     echo
 370   } >> $UNBOUND_CONFFILE
 371 }
 372
 373 ##############################################################################
 374
 375 unbound_conf() {
 376   local cfg="$1"
 377   local rt_mem rt_conn modulestring
 378
 379
 380   {
 381     # Make fresh conf file
 382     echo "# $UNBOUND_CONFFILE generated by UCI $( date )"
 383     echo
 384   } > $UNBOUND_CONFFILE
 385
 386
 387   {
 388     # No threading
 389     echo "server:"
 390     echo "  username: unbound"
 391     echo "  num-threads: 1"
 392     echo "  msg-cache-slabs: 1"
 393     echo "  rrset-cache-slabs: 1"
 394     echo "  infra-cache-slabs: 1"
 395     echo "  key-cache-slabs: 1"
 396     echo
 397   } >> $UNBOUND_CONFFILE
 398
 399
 400   {
 401     # Logging
 402     echo "  verbosity: 1"
 403     echo "  statistics-interval: 0"
 404     echo "  statistics-cumulative: no"
 405     echo "  extended-statistics: no"
 406     echo
 407   } >> $UNBOUND_CONFFILE
 408
 409
 410   {
 411     # Interfaces (access contol "option local_service")
 412     echo "  interface: 0.0.0.0"
 413     echo "  interface: ::0"
 414     echo "  outgoing-interface: 0.0.0.0"
 415     echo "  outgoing-interface: ::0"
 416     echo
 417   } >> $UNBOUND_CONFFILE
 418
 419
 420   case "$UNBOUND_D_PROTOCOL" in
 421     ip4_only)
 422       {
 423         echo "  do-ip4: yes"
 424         echo "  do-ip6: no"
 425       } >> $UNBOUND_CONFFILE
 426       ;;
 427
 428     ip6_only)
 429       {
 430         echo "  do-ip4: no"
 431         echo "  do-ip6: yes"
 432       } >> $UNBOUND_CONFFILE
 433       ;;
 434
 435     ip6_prefer)
 436       {
 437         echo "  do-ip4: yes"
 438         echo "  do-ip6: yes"
 439         echo "  prefer-ip6: yes"
 440       } >> $UNBOUND_CONFFILE
 441       ;;
 442
 443     *)
 444       {
 445         echo "  do-ip4: yes"
 446         echo "  do-ip6: yes"
 447       } >> $UNBOUND_CONFFILE
 448       ;;
 449   esac
 450
 451
 452   {
 453     # protocol level tuning
 454     echo "  edns-buffer-size: $UNBOUND_N_EDNS_SIZE"
 455     echo "  msg-buffer-size: 8192"
 456     echo "  port: $UNBOUND_N_RX_PORT"
 457     echo "  outgoing-port-permit: 10240-65535"
 458     echo
 459   } >> $UNBOUND_CONFFILE
 460
 461
 462   {
 463     # Other harding and options for an embedded router
 464     echo "  harden-short-bufsize: yes"
 465     echo "  harden-large-queries: yes"
 466     echo "  harden-glue: yes"
 467     echo "  harden-below-nxdomain: no"
 468     echo "  harden-referral-path: no"
 469     echo "  use-caps-for-id: no"
 470     echo
 471   } >> $UNBOUND_CONFFILE
 472
 473
 474   {
 475     # Default Files
 476     echo "  use-syslog: yes"
 477     echo "  chroot: \"$UNBOUND_VARDIR\""
 478     echo "  directory: \"$UNBOUND_VARDIR\""
 479     echo "  pidfile: \"$UNBOUND_PIDFILE\""
 480   } >> $UNBOUND_CONFFILE
 481
 482
 483   if [ -f "$UNBOUND_HINTFILE" ] ; then
 484     # Optional hints if found
 485     echo "  root-hints: \"$UNBOUND_HINTFILE\"" >> $UNBOUND_CONFFILE
 486   fi
 487
 488
 489   if [ "$UNBOUND_B_DNSSEC" -gt 0 -a -f "$UNBOUND_KEYFILE" ] ; then
 490     {
 491       echo "  auto-trust-anchor-file: \"$UNBOUND_KEYFILE\""
 492       echo
 493     } >> $UNBOUND_CONFFILE
 494
 495   else
 496     echo >> $UNBOUND_CONFFILE
 497   fi
 498
 499
 500   case "$UNBOUND_D_RESOURCE" in
 501     # Tiny - Unbound's recommended cheap hardware config
 502     tiny)   rt_mem=1  ; rt_conn=1 ;;
 503     # Small - Half RRCACHE and open ports
 504     small)  rt_mem=8  ; rt_conn=5 ;;
 505     # Medium - Nearly default but with some added balancintg
 506     medium) rt_mem=16 ; rt_conn=10 ;;
 507     # Large - Double medium
 508     large)  rt_mem=32 ; rt_conn=10 ;;
 509     # Whatever unbound does
 510     *) rt_mem=0 ; rt_conn=0 ;;
 511   esac
 512
 513
 514   if [ "$rt_mem" -gt 0 ] ; then
 515     {
 516       # Set memory sizing parameters
 517       echo "  outgoing-range: $(($rt_conn*64))"
 518       echo "  num-queries-per-thread: $(($rt_conn*32))"
 519       echo "  outgoing-num-tcp: $(($rt_conn))"
 520       echo "  incoming-num-tcp: $(($rt_conn))"
 521       echo "  rrset-cache-size: $(($rt_mem*256))k"
 522       echo "  msg-cache-size: $(($rt_mem*128))k"
 523       echo "  key-cache-size: $(($rt_mem*128))k"
 524       echo "  neg-cache-size: $(($rt_mem*64))k"
 525       echo "  infra-cache-numhosts: $(($rt_mem*256))"
 526       echo
 527     } >> $UNBOUND_CONFFILE
 528
 529   elif [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 530     logger -t unbound -s "default memory resource consumption"
 531   fi
 532
 533   # Assembly of module-config: options is tricky; order matters
 534   modulestring="iterator"
 535
 536
 537   if [ "$UNBOUND_B_DNSSEC" -gt 0 ] ; then
 538     if [ ! -f "$UNBOUND_TIMEFILE" -a "$UNBOUND_B_NTP_BOOT" -gt 0 ] ; then
 539       # DNSSEC chicken and egg with getting NTP time
 540       echo "  val-override-date: -1" >> $UNBOUND_CONFFILE
 541     fi
 542
 543
 544     {
 545       echo "  harden-dnssec-stripped: yes"
 546       echo "  val-clean-additional: yes"
 547       echo "  ignore-cd-flag: yes"
 548     } >> $UNBOUND_CONFFILE
 549
 550
 551     modulestring="validator $modulestring"
 552   fi
 553
 554
 555   if [ "$UNBOUND_B_DNS64" -gt 0 ] ; then
 556     echo "  dns64-prefix: $UNBOUND_IP_DNS64" >> $UNBOUND_CONFFILE
 557
 558     modulestring="dns64 $modulestring"
 559   fi
 560
 561
 562   {
 563     # Print final module string
 564     echo "  module-config: \"$modulestring\""
 565     echo
 566   }  >> $UNBOUND_CONFFILE
 567
 568
 569   if [ "$UNBOUND_B_QRY_MINST" -gt 0 -a "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
 570     {
 571       # Some query privacy but "strict" will break some name servers
 572       echo "  qname-minimisation: yes"
 573       echo "  qname-minimisation-strict: yes"
 574     } >> $UNBOUND_CONFFILE
 575
 576   elif [ "$UNBOUND_B_QUERY_MIN" -gt 0 ] ; then
 577     # Minor improvement on query privacy
 578     echo "  qname-minimisation: yes" >> $UNBOUND_CONFFILE
 579
 580   else
 581     echo "  qname-minimisation: no" >> $UNBOUND_CONFFILE
 582   fi
 583
 584
 585   case "$UNBOUND_D_RECURSION" in
 586     passive)
 587       {
 588         echo "  prefetch: no"
 589         echo "  prefetch-key: no"
 590         echo "  target-fetch-policy: \"0 0 0 0 0\""
 591         echo
 592       } >> $UNBOUND_CONFFILE
 593       ;;
 594
 595     aggressive)
 596       {
 597         echo "  prefetch: yes"
 598         echo "  prefetch-key: yes"
 599         echo "  target-fetch-policy: \"3 2 1 0 0\""
 600         echo
 601       } >> $UNBOUND_CONFFILE
 602       ;;
 603
 604     *)
 605       if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 606         logger -t unbound -s "default recursion configuration"
 607       fi
 608       ;;
 609   esac
 610
 611
 612   {
 613     # Reload records more than 10 hours old
 614     # DNSSEC 5 minute bogus cool down before retry
 615     # Adaptive infrastructure info kept for 15 minutes
 616     echo "  cache-min-ttl: $UNBOUND_TTL_MIN"
 617     echo "  cache-max-ttl: 36000"
 618     echo "  val-bogus-ttl: 300"
 619     echo "  infra-host-ttl: 900"
 620     echo
 621   } >> $UNBOUND_CONFFILE
 622
 623
 624   if [ "$UNBOUND_B_HIDE_BIND" -gt 0 ] ; then
 625     {
 626       # Block server id and version DNS TXT records
 627       echo "  hide-identity: yes"
 628       echo "  hide-version: yes"
 629       echo
 630     } >> $UNBOUND_CONFFILE
 631   fi
 632
 633
 634   if [ "$UNBOUND_B_PRIV_BLCK" -gt 0 ] ; then
 635     {
 636       # Remove _upstream_ or global reponses with private addresses.
 637       # Unbounds own "local zone" and "forward zone" may still use these.
 638       # RFC1918, RFC3927, RFC4291, RFC6598, RFC6890
 639       echo "  private-address: 10.0.0.0/8"
 640       echo "  private-address: 100.64.0.0/10"
 641       echo "  private-address: 169.254.0.0/16"
 642       echo "  private-address: 172.16.0.0/12"
 643       echo "  private-address: 192.168.0.0/16"
 644       echo "  private-address: fc00::/8"
 645       echo "  private-address: fd00::/8"
 646       echo "  private-address: fe80::/10"
 647     } >> $UNBOUND_CONFFILE
 648   fi
 649
 650
 651   if [ "$UNBOUND_B_LOCL_BLCK" -gt 0 ] ; then
 652     {
 653       # Remove DNS reponses from upstream with loopback IP
 654       # Black hole DNS method for ad blocking, so consider...
 655       echo "  private-address: 127.0.0.0/8"
 656       echo "  private-address: ::1/128"
 657       echo
 658     } >> $UNBOUND_CONFFILE
 659
 660   else
 661     echo >> $UNBOUND_CONFFILE
 662   fi
 663
 664
 665   # Except and accept domains as insecure (DNSSEC); work around broken domains
 666   config_list_foreach "$cfg" "domain_insecure" create_domain_insecure
 667   echo >> $UNBOUND_CONFFILE
 668 }
 669
 670 ##############################################################################
 671
 672 unbound_access() {
 673   # TODO: Unbound 1.6.0 added "tags" and "views", so we can add tags to
 674   # each access-control IP block, and then divert access.
 675   # -- "guest" WIFI will not be allowed to see local zone data
 676   # -- "child" LAN can black whole a list of domains to http~deadpixel
 677
 678
 679   if [ "$UNBOUND_B_LOCL_SERV" -gt 0 ] ; then
 680     # Only respond to queries from which this device has an interface.
 681     # Prevent DNS amplification attacks by not responding to the universe.
 682     config_load network
 683     config_foreach create_access_control interface
 684
 685
 686     {
 687       echo "  access-control: 127.0.0.0/8 allow"
 688       echo "  access-control: ::1/128 allow"
 689       echo "  access-control: fe80::/10 allow"
 690       echo
 691     } >> $UNBOUND_CONFFILE
 692
 693   else
 694     {
 695       echo "  access-control: 0.0.0.0/0 allow"
 696       echo "  access-control: ::0/0 allow"
 697       echo
 698     } >> $UNBOUND_CONFFILE
 699   fi
 700
 701
 702   {
 703     # Amend your own "server:" stuff here
 704     echo "  include: $UNBOUND_SRV_CONF"
 705     echo
 706   } >> $UNBOUND_CONFFILE
 707 }
 708
 709 ##############################################################################
 710
 711 unbound_adblock() {
 712   # TODO: Unbound 1.6.0 added "tags" and "views"; lets work with adblock team
 713   local adb_enabled adb_file
 714
 715   if [ ! -x /usr/bin/adblock.sh -o ! -x /etc/init.d/adblock ] ; then
 716     adb_enabled=0
 717   else
 718     /etc/init.d/adblock enabled && adb_enabled=1 || adb_enabled=0
 719   fi
 720
 721
 722   if [ "$adb_enabled" -gt 0 ] ; then
 723     {
 724       # Pull in your selected openwrt/pacakges/net/adblock generated lists
 725       for adb_file in $UNBOUND_VARDIR/adb_list.* ; do
 726         echo "  include: $adb_file"
 727       done
 728       echo
 729     } >> $UNBOUND_CONFFILE
 730   fi
 731 }
 732
 733 ##############################################################################
 734
 735 unbound_hostname() {
 736   if [ -n "$UNBOUND_TXT_DOMAIN" ] ; then
 737     {
 738       # TODO: Unbound 1.6.0 added "tags" and "views" and we could make
 739       # domains by interface to prevent DNS from "guest" to "home"
 740       echo "  local-zone: $UNBOUND_TXT_DOMAIN. $UNBOUND_D_DOMAIN_TYPE"
 741       echo "  domain-insecure: $UNBOUND_TXT_DOMAIN"
 742       echo "  private-domain: $UNBOUND_TXT_DOMAIN"
 743       echo
 744       echo "  local-zone: $UNBOUND_TXT_HOSTNAME. $UNBOUND_D_DOMAIN_TYPE"
 745       echo "  domain-insecure: $UNBOUND_TXT_HOSTNAME"
 746       echo "  private-domain: $UNBOUND_TXT_HOSTNAME"
 747       echo
 748     } >> $UNBOUND_CONFFILE
 749
 750
 751     case "$UNBOUND_D_DOMAIN_TYPE" in
 752     deny|inform_deny|refuse|static)
 753       {
 754         # avoid upstream involvement in RFC6762 like responses (link only)
 755         echo "  local-zone: local. $UNBOUND_D_DOMAIN_TYPE"
 756         echo "  domain-insecure: local"
 757         echo "  private-domain: local"
 758         echo
 759       } >> $UNBOUND_CONFFILE
 760       ;;
 761     esac
 762
 763
 764     if [ "$UNBOUND_D_LAN_FQDN" -gt 0 -o "$UNBOUND_D_WAN_FQDN" -gt 0 ] ; then
 765       config_load dhcp
 766       config_foreach create_interface_dns dhcp
 767     fi
 768
 769
 770     if [ -f "$UNBOUND_DHCP_CONF" ] ; then
 771       {
 772         # Seed DHCP records because dhcp scripts trigger externally
 773         # Incremental Unbound restarts may drop unbound-control add records
 774         echo "  include: $UNBOUND_DHCP_CONF"
 775         echo
 776       } >> $UNBOUND_CONFFILE
 777     fi
 778   fi
 779 }
 780
 781 ##############################################################################
 782
 783 unbound_uci() {
 784   local cfg="$1"
 785   local dnsmasqpath hostnm
 786
 787   hostnm="$(uci_get system.@system[0].hostname | awk '{print tolower($0)}')"
 788   UNBOUND_TXT_HOSTNAME=${hostnm:-thisrouter}
 789
 790   config_get_bool UNBOUND_B_SLAAC6_MAC "$cfg" dhcp4_slaac6 0
 791   config_get_bool UNBOUND_B_DNS64      "$cfg" dns64 0
 792   config_get_bool UNBOUND_B_HIDE_BIND  "$cfg" hide_binddata 1
 793   config_get_bool UNBOUND_B_LOCL_SERV  "$cfg" localservice 1
 794   config_get_bool UNBOUND_B_MAN_CONF   "$cfg" manual_conf 0
 795   config_get_bool UNBOUND_B_QUERY_MIN  "$cfg" query_minimize 0
 796   config_get_bool UNBOUND_B_QRY_MINST  "$cfg" query_min_strict 0
 797   config_get_bool UNBOUND_B_PRIV_BLCK  "$cfg" rebind_protection 1
 798   config_get_bool UNBOUND_B_LOCL_BLCK  "$cfg" rebind_localhost 0
 799   config_get_bool UNBOUND_B_CONTROL    "$cfg" unbound_control 0
 800   config_get_bool UNBOUND_B_DNSSEC     "$cfg" validator 0
 801   config_get_bool UNBOUND_B_NTP_BOOT   "$cfg" validator_ntp 1
 802
 803   config_get UNBOUND_IP_DNS64    "$cfg" dns64_prefix "64:ff9b::/96"
 804
 805   config_get UNBOUND_N_EDNS_SIZE "$cfg" edns_size 1280
 806   config_get UNBOUND_N_RX_PORT   "$cfg" listen_port 53
 807   config_get UNBOUND_N_ROOT_AGE  "$cfg" root_age 9
 808
 809   config_get UNBOUND_D_DOMAIN_TYPE "$cfg" domain_type static
 810   config_get UNBOUND_D_DHCP_LINK   "$cfg" dhcp_link none
 811   config_get UNBOUND_D_LAN_FQDN    "$cfg" add_local_fqdn 0
 812   config_get UNBOUND_D_PROTOCOL    "$cfg" protocol mixed
 813   config_get UNBOUND_D_RECURSION   "$cfg" recursion passive
 814   config_get UNBOUND_D_RESOURCE    "$cfg" resource small
 815   config_get UNBOUND_D_WAN_FQDN    "$cfg" add_wan_fqdn 0
 816
 817   config_get UNBOUND_TTL_MIN     "$cfg" ttl_min 120
 818   config_get UNBOUND_TXT_DOMAIN  "$cfg" domain lan
 819
 820
 821   if [ "$UNBOUND_D_DHCP_LINK" = "none" ] ; then
 822     config_get_bool UNBOUND_B_DNSMASQ   "$cfg" dnsmasq_link_dns 0
 823
 824
 825     if [ "$UNBOUND_B_DNSMASQ" -gt 0 ] ; then
 826       UNBOUND_D_DHCP_LINK=dnsmasq
 827
 828
 829       if [ ! -f "$UNBOUND_TIMEFILE" ] ; then
 830         logger -t unbound -s "Please use 'dhcp_link' selector instead"
 831       fi
 832     fi
 833   fi
 834
 835
 836   if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
 837     if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
 838       UNBOUND_D_DHCP_LINK=none
 839     else
 840       /etc/init.d/dnsmasq enabled || UNBOUND_D_DHCP_LINK=none
 841     fi
 842
 843
 844     if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
 845       logger -t unbound -s "cannot forward to dnsmasq"
 846     fi
 847   fi
 848
 849
 850   if [ "$UNBOUND_D_DHCP_LINK" = "odhcpd" ] ; then
 851     if [ ! -x /usr/sbin/odhcpd -o ! -x /etc/init.d/odhcpd ] ; then
 852       UNBOUND_D_DHCP_LINK=none
 853     else
 854       /etc/init.d/odhcpd enabled || UNBOUND_D_DHCP_LINK=none
 855     fi
 856
 857
 858     if [ "$UNBOUND_D_DHCP_LINK" = "none" -a ! -f "$UNBOUND_TIMEFILE" ] ; then
 859       logger -t unbound -s "cannot receive records from odhcpd"
 860     fi
 861   fi
 862
 863
 864   if [ "$UNBOUND_N_EDNS_SIZE" -lt 512 \
 865     -o 4096 -lt "$UNBOUND_N_EDNS_SIZE" ] ; then
 866     # exceeds range, back to default
 867     UNBOUND_N_EDNS_SIZE=1280
 868   fi
 869
 870
 871   if [ "$UNBOUND_N_RX_PORT" -lt 1024 \
 872     -o 10240 -lt "$UNBOUND_N_RX_PORT" ] ; then
 873     # special port or in 5 digits, back to default
 874     UNBOUND_N_RX_PORT=53
 875   fi
 876
 877
 878   if [ "$UNBOUND_TTL_MIN" -gt 1800 ] ; then
 879     # that could have had awful side effects
 880     UNBOUND_TTL_MIN=300
 881   fi
 882 }
 883
 884 ##############################################################################
 885
 886 unbound_start() {
 887   config_load unbound
 888   config_foreach unbound_uci unbound
 889   unbound_mkdir
 890
 891
 892   if [ "$UNBOUND_B_MAN_CONF" -eq 0 ] ; then
 893     unbound_conf
 894     unbound_access
 895     unbound_adblock
 896
 897     if [ "$UNBOUND_D_DHCP_LINK" = "dnsmasq" ] ; then
 898       dnsmasq_link
 899     else
 900       unbound_hostname
 901     fi
 902
 903     unbound_control
 904   fi
 905 }
 906
 907 ##############################################################################
 908
 909 unbound_stop() {
 910   local resolvsym=0
 911
 912   rootzone_update
 913
 914
 915   if [ ! -x /usr/sbin/dnsmasq -o ! -x /etc/init.d/dnsmasq ] ; then
 916     resolvsym=1
 917   else
 918     /etc/init.d/dnsmasq enabled || resolvsym=1
 919   fi
 920
 921
 922   if [ "$resolvsym" -gt 0 ] ; then
 923     # set resolver file to normal, but don't stomp on dnsmasq
 924     rm -f /tmp/resolv.conf
 925     ln -s /tmp/resolv.conf.auto /tmp/resolv.conf
 926   fi
 927 }
 928
 929 ##############################################################################
 930