[ipfire-2.x.git] / src / initscripts / system / unbound

#!/bin/sh
# Begin $rc_base/init.d/unbound

# Description : Unbound DNS resolver boot script for IPfire
# Author      : Marcel Lorenz <marcel.lorenz@ipfire.org>

. /etc/sysconfig/rc
. ${rc_functions}

# Cache any local zones for 60 seconds
LOCAL_TTL=60

# Load configuration
eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)

ip_address_revptr() {
	local addr=${1}

	local a1 a2 a3 a4
	IFS=. read -r a1 a2 a3 a4 <<< ${addr}

	echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
}

read_name_servers() {
	# Read name servers from ISP
	if [ "${USE_ISP_NAMESERVERS}" = "on" -a "${PROTO}" != "TLS" ]; then
		local i
		for i in 1 2; do
			echo "$(</var/run/dns${i})"
		done 2>/dev/null
	fi

	# Read configured name servers
	local id address tls_hostname enabled remark
	while IFS="," read -r id address tls_hostname enabled remark; do
		[ "${enabled}" != "enabled" ] && continue

		if [ "${PROTO}" = "TLS" ]; then
			if [ -n "${tls_hostname}" ]; then
				echo "${address}@853#${tls_hostname}"
			fi
		else
			echo "${address}"
		fi
	done < /var/ipfire/dns/servers
}

config_header() {
	echo "# This file is automatically generated and any changes"
	echo "# will be overwritten. DO NOT EDIT!"
	echo
}

write_hosts_conf() {
	(
		config_header

		# Make own hostname resolveable
		# 1.1.1.1 is reserved for unused green, skip this
		if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
			echo "local-data: \"${HOSTNAME} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}\""
		fi

		local address
		for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
			[ -n "${address}" ] || continue
			[ "${address}" = "1.1.1.1" ] && continue

			address=$(ip_address_revptr ${address})
			echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${HOSTNAME}\""
		done

		# Add all hosts
		local enabled address hostname domainname generateptr
		while IFS="," read -r enabled address hostname domainname generateptr; do
			[ "${enabled}" = "on" ] || continue

			# Build FQDN
			local fqdn="${hostname}.${domainname}"
			echo "local-data: \"${fqdn} ${LOCAL_TTL} IN A ${address}\""

			# Skip reverse resolution if the address equals the GREEN address
			[ "${address}" = "${GREEN_ADDRESS}" ] && continue

			# Skip reverse resolution if user requested not to do so
			[ "${generateptr}" = "off" ] && continue

			# Add RDNS
			address=$(ip_address_revptr ${address})
			echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${fqdn}\""
		done < /var/ipfire/main/hosts
	) > /etc/unbound/hosts.conf
}

write_forward_conf() {
	(
		config_header

		# Enable strict QNAME minimisation
		if [ "${QNAME_MIN}" = "strict" ]; then
			echo "server:"
			echo "	qname-minimisation-strict: yes"
			echo
		fi

		# Force using TCP for upstream servers only
		if [ "${PROTO}" = "TCP" ]; then
			echo "# Force using TCP for upstream servers only"
			echo "server:"
			echo "	tcp-upstream: yes"
			echo
		fi

		local insecure_zones=""

		local enabled zone server servers remark disable_dnssec rest
		while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
			# Line must be enabled.
			[ "${enabled}" = "on" ] || continue

			# Zones that end with .local are commonly used for internal
			# zones and therefore not signed
			case "${zone}" in
				*.local)
					insecure_zones="${insecure_zones} ${zone}"
					;;
				*)
					if [ "${disable_dnssec}" = "on" ]; then
						insecure_zones="${insecure_zones} ${zone}"
					fi
					;;
			esac

			echo "stub-zone:"
			echo "	name: ${zone}"
			for server in ${servers//|/ }; do
				if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
					echo "	stub-addr: ${server}"
				else
					echo "	stub-host: ${server}"
				fi
			done
			echo

			# Make all reverse lookup zones transparent
			case "${zone}" in
				*.in-addr.arpa)
					echo "server:"
					echo "	local-zone: \"${zone}\" transparent"
					echo
					;;
			esac
		done < /var/ipfire/dnsforward/config

		if [ -n "${insecure_zones}" ]; then
			echo "server:"

			for zone in ${insecure_zones}; do
				echo "	domain-insecure: ${zone}"
			done
		fi

		# Read name servers.
		nameservers=$(read_name_servers)

		# Only write forward zones if any nameservers are configured.
		#
		# Otherwise fall-back into recursor mode.
		if [ -n "${nameservers}" ]; then

			echo "forward-zone:"
			echo "	name: \".\""

			# Force using TLS only
			if [ "${PROTO}" = "TLS" ]; then
				echo "	forward-tls-upstream: yes"
			fi

			# Add upstream name servers
			local ns
			for ns in ${nameservers}; do
				echo "	forward-addr: ${ns}"
			done
		fi

	) > /etc/unbound/forward.conf
}

write_tuning_conf() {
	# https://www.unbound.net/documentation/howto_optimise.html

	# Determine number of online processors
	local processors=$(getconf _NPROCESSORS_ONLN)

	# Determine number of slabs
	local slabs=1
	while [ ${slabs} -lt ${processors} ]; do
		slabs=$(( ${slabs} * 2 ))
	done

	# Determine amount of system memory
	local mem=$(get_memory_amount)

	# In the worst case scenario, unbound can use double the
	# amount of memory allocated to a cache due to malloc overhead

	# Even larger systems with more than 8GB of RAM
	if [ ${mem} -ge 8192 ]; then
		mem=1024

	# Extra large systems with more than 4GB of RAM
	elif [ ${mem} -ge 4096 ]; then
		mem=512

	# Large systems with more than 2GB of RAM
	elif [ ${mem} -ge 2048 ]; then
		mem=256

	# Medium systems with more than 1GB of RAM
	elif [ ${mem} -ge 1024 ]; then
		mem=128

	# Small systems with less than 256MB of RAM
	elif [ ${mem} -le 256 ]; then
		mem=16

	# Everything else
	else
		mem=64
	fi

	(
		config_header

		# We run one thread per processor
		echo "num-threads: ${processors}"
		echo "so-reuseport: yes"

		# Adjust number of slabs
		echo "infra-cache-slabs: ${slabs}"
		echo "key-cache-slabs: ${slabs}"
		echo "msg-cache-slabs: ${slabs}"
		echo "rrset-cache-slabs: ${slabs}"

		# Slice up the cache
		echo "rrset-cache-size: $(( ${mem} / 2 ))m"
		echo "msg-cache-size: $(( ${mem} / 4 ))m"
		echo "key-cache-size: $(( ${mem} / 4 ))m"

		# Increase parallel queries
		echo "outgoing-range: 8192"
		echo "num-queries-per-thread: 4096"

		# Use larger send/receive buffers
		echo "so-sndbuf: 4m"
		echo "so-rcvbuf: 4m"
	) > /etc/unbound/tuning.conf
}

get_memory_amount() {
	local key val unit

	while read -r key val unit; do
		case "${key}" in
			MemTotal:*)
				# Convert to MB
				echo "$(( ${val} / 1024 ))"
				break
				;;
		esac
	done < /proc/meminfo
}

fix_time_if_dns_fails() {
	# Sometimes the first try fails so do it twice
	resolve "ping.ipfire.org" &>/dev/null
	# If DNS is working, everything is fine
	if resolve "ping.ipfire.org" &>/dev/null; then
		return 0
	fi

	# Try to sync time with a known time server
	boot_mesg "DNS not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
	loadproc /usr/local/bin/settime 81.3.27.46
}

resolve() {
	local hostname="${1}"
	local found=1

	local answer
	for answer in $(dig +short A "${hostname}"); do
		# Filter out non-IP addresses
		if [[ ! "${answer}" =~ \.$ ]]; then
			found=0
			echo "${answer}"
		fi
	done

	return ${found}
}

# Sets up Safe Search for various search engines
update_safe_search() {
	local google_tlds=(
		google.ad
		google.ae
		google.al
		google.am
		google.as
		google.at
		google.az
		google.ba
		google.be
		google.bf
		google.bg
		google.bi
		google.bj
		google.bs
		google.bt
		google.by
		google.ca
		google.cat
		google.cd
		google.cf
		google.cg
		google.ch
		google.ci
		google.cl
		google.cm
		google.cn
		google.co.ao
		google.co.bw
		google.co.ck
		google.co.cr
		google.co.id
		google.co.il
		google.co.in
		google.co.jp
		google.co.ke
		google.co.kr
		google.co.ls
		google.com
		google.co.ma
		google.com.af
		google.com.ag
		google.com.ai
		google.com.ar
		google.com.au
		google.com.bd
		google.com.bh
		google.com.bn
		google.com.bo
		google.com.br
		google.com.bz
		google.com.co
		google.com.cu
		google.com.cy
		google.com.do
		google.com.ec
		google.com.eg
		google.com.et
		google.com.fj
		google.com.gh
		google.com.gi
		google.com.gt
		google.com.hk
		google.com.jm
		google.com.kh
		google.com.kw
		google.com.lb
		google.com.ly
		google.com.mm
		google.com.mt
		google.com.mx
		google.com.my
		google.com.na
		google.com.nf
		google.com.ng
		google.com.ni
		google.com.np
		google.com.om
		google.com.pa
		google.com.pe
		google.com.pg
		google.com.ph
		google.com.pk
		google.com.pr
		google.com.py
		google.com.qa
		google.com.sa
		google.com.sb
		google.com.sg
		google.com.sl
		google.com.sv
		google.com.tj
		google.com.tr
		google.com.tw
		google.com.ua
		google.com.uy
		google.com.vc
		google.com.vn
		google.co.mz
		google.co.nz
		google.co.th
		google.co.tz
		google.co.ug
		google.co.uk
		google.co.uz
		google.co.ve
		google.co.vi
		google.co.za
		google.co.zm
		google.co.zw
		google.cv
		google.cz
		google.de
		google.dj
		google.dk
		google.dm
		google.dz
		google.ee
		google.es
		google.fi
		google.fm
		google.fr
		google.ga
		google.ge
		google.gg
		google.gl
		google.gm
		google.gp
		google.gr
		google.gy
		google.hn
		google.hr
		google.ht
		google.hu
		google.ie
		google.im
		google.iq
		google.is
		google.it
		google.je
		google.jo
		google.kg
		google.ki
		google.kz
		google.la
		google.li
		google.lk
		google.lt
		google.lu
		google.lv
		google.md
		google.me
		google.mg
		google.mk
		google.ml
		google.mn
		google.ms
		google.mu
		google.mv
		google.mw
		google.ne
		google.nl
		google.no
		google.nr
		google.nu
		google.pl
		google.pn
		google.ps
		google.pt
		google.ro
		google.rs
		google.ru
		google.rw
		google.sc
		google.se
		google.sh
		google.si
		google.sk
		google.sm
		google.sn
		google.so
		google.sr
		google.st
		google.td
		google.tg
		google.tk
		google.tl
		google.tm
		google.tn
		google.to
		google.tt
		google.vg
		google.vu
		google.ws
	)

	# Cleanup previous settings
	unbound-control local_zone_remove "bing.com" >/dev/null
	unbound-control local_zone_remove "duckduckgo.com" >/dev/null
	unbound-control local_zone_remove "yandex.com" >/dev/null
	unbound-control local_zone_remove "yandex.ru" >/dev/null
	unbound-control local_zone_remove "youtube.com" >/dev/null

	local domain
	for domain in ${google_tlds[@]}; do
		unbound-control local_zone_remove "${domain}"
	done >/dev/null

	# Nothing to do if safe search is not enabled
	if [ "${ENABLE_SAFE_SEARCH}" != "on" ]; then
		return 0
	fi

	# Bing
	unbound-control bing.com transparent >/dev/null
	for address in $(resolve "strict.bing.com"); do
		unbound-control local_data "www.bing.com ${LOCAL_TTL} IN A ${address}"
	done >/dev/null

	# DuckDuckGo
	unbound-control local_zone duckduckgo.com typetransparent >/dev/null
	for address in $(resolve "safe.duckduckgo.com"); do
		unbound-control local_data "duckduckgo.com ${LOCAL_TTL} IN A ${address}"
	done >/dev/null

	# Google
	local addresses="$(resolve "forcesafesearch.google.com")"
	for domain in ${google_tlds[@]}; do
		unbound-control local_zone "${domain}" transparent >/dev/null
		for address in ${addresses}; do
			unbound-control local_data: "www.${domain} ${LOCAL_TTL} IN A ${address}"
		done >/dev/null
	done

	# Yandex
	for domain in yandex.com yandex.ru; do
		unbound-control local_zone "${domain}" typetransparent >/dev/null
		for address in $(resolve "familysearch.${domain}"); do
			unbound-control local_data "${domain} ${LOCAL_TTL} IN A ${address}"
		done >/dev/null
	done

	# YouTube
	unbound-control local_zone youtube.com transparent >/dev/null
	for address in $(resolve "restrictmoderate.youtube.com"); do
		unbound-control local_data "www.youtube.com ${LOCAL_TTL} IN A ${address}"
	done >/dev/null

	return 0
}

case "$1" in
	start)
		# Print a nicer messagen when unbound is already running
		if pidofproc -s unbound; then
			statusproc /usr/sbin/unbound
			exit 0
		fi

		# Update configuration files
		write_tuning_conf
		write_hosts_conf
		write_forward_conf

		boot_mesg "Starting Unbound DNS Proxy..."
		loadproc /usr/sbin/unbound || exit $?

		# Install Safe Search rules when the system is already online
		if [ -e "/var/ipfire/red/active" ]; then
			update_safe_search
		fi
		;;

	stop)
		boot_mesg "Stopping Unbound DNS Proxy..."
		killproc /usr/sbin/unbound
		;;

	restart)
		$0 stop
		sleep 1
		$0 start
		;;
	reload|remove-forwarders)
		# Update configuration files
		write_forward_conf
		write_hosts_conf

		# Update Safe Search rules if the system is online.
		if [ -e "/var/ipfire/red/active" ]; then
			update_safe_search
		fi

		# Call unbound-control and perform the reload
		/usr/sbin/unbound-control -q reload
		;;

	status)
		statusproc /usr/sbin/unbound
		;;

	update-forwarders)
		$0 reload

		# Make sure DNS works at this point
		fix_time_if_dns_fails
		;;

	resolve)
		resolve "${2}" || exit $?
		;;

	*)
		echo "Usage: $0 {start|stop|restart|reload|status|resolve|update-forwarders|remove-forwarders}"
		exit 1
		;;
esac

# End $rc_base/init.d/unbound
Commit	Line	Data
d0e5f71f ML	1	#!/bin/sh
	2	# Begin $rc_base/init.d/unbound
	3
	4	# Description : Unbound DNS resolver boot script for IPfire
	5	# Author : Marcel Lorenz <marcel.lorenz@ipfire.org>
d0e5f71f ML	6
	7	. /etc/sysconfig/rc
	8	. ${rc_functions}
	9
36792be6 MT	10	# Cache any local zones for 60 seconds
	11	LOCAL_TTL=60
	12
ee90aa98 MT	13	# Load configuration
ee90aa98 MT	14	eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
4b26aac6	15	eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
d0e5f71f	16
f75c279b AF	17	ip_address_revptr() {
	18	local addr=${1}
	19
	20	local a1 a2 a3 a4
	21	IFS=. read -r a1 a2 a3 a4 <<< ${addr}
	22
	23	echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
	24	}
	25
b8f5eda8	26	read_name_servers() {
2654c669 MT	27	# Read name servers from ISP
	28	if [ "${USE_ISP_NAMESERVERS}" = "on" -a "${PROTO}" != "TLS" ]; then
	29	local i
	30	for i in 1 2; do
	31	echo "$(</var/run/dns${i})"
	32	done 2>/dev/null
	33	fi
	34
	35	# Read configured name servers
	36	local id address tls_hostname enabled remark
	37	while IFS="," read -r id address tls_hostname enabled remark; do
	38	[ "${enabled}" != "enabled" ] && continue
	39
	40	if [ "${PROTO}" = "TLS" ]; then
	41	if [ -n "${tls_hostname}" ]; then
	42	echo "${address}@853#${tls_hostname}"
	43	fi
	44	else
	45	echo "${address}"
	46	fi
	47	done < /var/ipfire/dns/servers
b8f5eda8 MT	48	}
	49
	50	config_header() {
	51	echo "# This file is automatically generated and any changes"
	52	echo "# will be overwritten. DO NOT EDIT!"
	53	echo
	54	}
	55
6137797c MT	56	write_hosts_conf() {
	57	(
	58	config_header
f75c279b	59
6137797c MT	60	# Make own hostname resolveable
	61	# 1.1.1.1 is reserved for unused green, skip this
	62	if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
	63	echo "local-data: \"${HOSTNAME} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}\""
	64	fi
f59bc0c5	65
6137797c MT	66	local address
	67	for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
	68	[ -n "${address}" ] \|\| continue
	69	[ "${address}" = "1.1.1.1" ] && continue
36792be6	70
6137797c MT	71	address=$(ip_address_revptr ${address})
	72	echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${HOSTNAME}\""
	73	done
36792be6	74
6137797c MT	75	# Add all hosts
	76	local enabled address hostname domainname generateptr
	77	while IFS="," read -r enabled address hostname domainname generateptr; do
	78	[ "${enabled}" = "on" ] \|\| continue
36792be6	79
6137797c MT	80	# Build FQDN
	81	local fqdn="${hostname}.${domainname}"
	82	echo "local-data: \"${fqdn} ${LOCAL_TTL} IN A ${address}\""
f75c279b	83
6137797c MT	84	# Skip reverse resolution if the address equals the GREEN address
6137797c MT	85	[ "${address}" = "${GREEN_ADDRESS}" ] && continue
868d2a1f	86
6137797c MT	87	# Skip reverse resolution if user requested not to do so
6137797c MT	88	[ "${generateptr}" = "off" ] && continue
6874a576	89
6137797c MT	90	# Add RDNS
	91	address=$(ip_address_revptr ${address})
	92	echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${fqdn}\""
	93	done < /var/ipfire/main/hosts
	94	) > /etc/unbound/hosts.conf
36792be6 MT	95	}
36792be6 MT	96
b8f5eda8 MT	97	write_forward_conf() {
	98	(
	99	config_header
	100
beebf925 MT	101	# Enable strict QNAME minimisation
	102	if [ "${QNAME_MIN}" = "strict" ]; then
	103	echo "server:"
	104	echo " qname-minimisation-strict: yes"
	105	echo
	106	fi
	107
974d8653	108	# Force using TCP for upstream servers only
ee90aa98	109	if [ "${PROTO}" = "TCP" ]; then
974d8653 MT	110	echo "# Force using TCP for upstream servers only"
	111	echo "server:"
	112	echo " tcp-upstream: yes"
	113	echo
	114	fi
	115
ee90aa98	116	local insecure_zones=""
a6dcc5bb	117
1ececb67 MT	118	local enabled zone server servers remark disable_dnssec rest
1ececb67 MT	119	while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
b8f5eda8 MT	120	# Line must be enabled.
	121	[ "${enabled}" = "on" ] \|\| continue
	122
a6dcc5bb MT	123	# Zones that end with .local are commonly used for internal
	124	# zones and therefore not signed
	125	case "${zone}" in
	126	*.local)
	127	insecure_zones="${insecure_zones} ${zone}"
	128	;;
1ececb67 MT	129	*)
	130	if [ "${disable_dnssec}" = "on" ]; then
	131	insecure_zones="${insecure_zones} ${zone}"
	132	fi
	133	;;
a6dcc5bb MT	134	esac
a6dcc5bb MT	135
15cf79e3 MT	136	echo "stub-zone:"
	137	echo " name: ${zone}"
	138	for server in ${servers//\|/ }; do
	139	if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
	140	echo " stub-addr: ${server}"
	141	else
	142	echo " stub-host: ${server}"
	143	fi
	144	done
	145	echo
	146
	147	# Make all reverse lookup zones transparent
c7e41255 MT	148	case "${zone}" in
c7e41255 MT	149	*.in-addr.arpa)
c7e41255	150	echo "server:"
9f099932	151	echo " local-zone: \"${zone}\" transparent"
c7e41255 MT	152	echo
c7e41255 MT	153	;;
c7e41255	154	esac
b8f5eda8	155	done < /var/ipfire/dnsforward/config
a6dcc5bb MT	156
	157	if [ -n "${insecure_zones}" ]; then
	158	echo "server:"
	159
	160	for zone in ${insecure_zones}; do
	161	echo " domain-insecure: ${zone}"
	162	done
	163	fi
50005ad1	164
ab4ef40f SS	165	# Read name servers.
ab4ef40f SS	166	nameservers=$(read_name_servers)
50005ad1	167
ab4ef40f SS	168	# Only write forward zones if any nameservers are configured.
	169	#
	170	# Otherwise fall-back into recursor mode.
	171	if [ -n "${nameservers}" ]; then
	172
	173	echo "forward-zone:"
	174	echo " name: \".\""
	175
	176	# Force using TLS only
	177	if [ "${PROTO}" = "TLS" ]; then
	178	echo " forward-tls-upstream: yes"
	179	fi
	180
	181	# Add upstream name servers
	182	local ns
	183	for ns in ${nameservers}; do
	184	echo " forward-addr: ${ns}"
	185	done
50005ad1 MT	186	fi
50005ad1 MT	187
b8f5eda8 MT	188	) > /etc/unbound/forward.conf
	189	}
	190
b658a451 MT	191	write_tuning_conf() {
	192	# https://www.unbound.net/documentation/howto_optimise.html
	193
	194	# Determine number of online processors
	195	local processors=$(getconf _NPROCESSORS_ONLN)
	196
	197	# Determine number of slabs
	198	local slabs=1
	199	while [ ${slabs} -lt ${processors} ]; do
	200	slabs=$(( ${slabs} * 2 ))
	201	done
	202
	203	# Determine amount of system memory
	204	local mem=$(get_memory_amount)
	205
	206	# In the worst case scenario, unbound can use double the
	207	# amount of memory allocated to a cache due to malloc overhead
	208
4a0d69ca MT	209	# Even larger systems with more than 8GB of RAM
	210	if [ ${mem} -ge 8192 ]; then
	211	mem=1024
	212
	213	# Extra large systems with more than 4GB of RAM
	214	elif [ ${mem} -ge 4096 ]; then
	215	mem=512
	216
b658a451	217	# Large systems with more than 2GB of RAM
4a0d69ca	218	elif [ ${mem} -ge 2048 ]; then
128db1a3	219	mem=256
b658a451	220
4a0d69ca MT	221	# Medium systems with more than 1GB of RAM
	222	elif [ ${mem} -ge 1024 ]; then
	223	mem=128
	224
b658a451 MT	225	# Small systems with less than 256MB of RAM
b658a451 MT	226	elif [ ${mem} -le 256 ]; then
128db1a3	227	mem=16
b658a451 MT	228
	229	# Everything else
	230	else
128db1a3	231	mem=64
b658a451 MT	232	fi
	233
	234	(
	235	config_header
	236
	237	# We run one thread per processor
	238	echo "num-threads: ${processors}"
5012e53c	239	echo "so-reuseport: yes"
b658a451 MT	240
	241	# Adjust number of slabs
	242	echo "infra-cache-slabs: ${slabs}"
	243	echo "key-cache-slabs: ${slabs}"
	244	echo "msg-cache-slabs: ${slabs}"
	245	echo "rrset-cache-slabs: ${slabs}"
	246
	247	# Slice up the cache
	248	echo "rrset-cache-size: $(( ${mem} / 2 ))m"
	249	echo "msg-cache-size: $(( ${mem} / 4 ))m"
	250	echo "key-cache-size: $(( ${mem} / 4 ))m"
0a7dca2c MT	251
	252	# Increase parallel queries
	253	echo "outgoing-range: 8192"
	254	echo "num-queries-per-thread: 4096"
c20b2009 MT	255
	256	# Use larger send/receive buffers
	257	echo "so-sndbuf: 4m"
	258	echo "so-rcvbuf: 4m"
b658a451 MT	259	) > /etc/unbound/tuning.conf
	260	}
	261
	262	get_memory_amount() {
	263	local key val unit
	264
	265	while read -r key val unit; do
	266	case "${key}" in
	267	MemTotal:*)
	268	# Convert to MB
	269	echo "$(( ${val} / 1024 ))"
	270	break
	271	;;
	272	esac
	273	done < /proc/meminfo
	274	}
b8f5eda8	275
a33489a7	276	fix_time_if_dns_fails() {
f23b0463 AF	277	# Sometimes the first try fails so do it twice
f23b0463 AF	278	resolve "ping.ipfire.org" &>/dev/null
a33489a7 MT	279	# If DNS is working, everything is fine
	280	if resolve "ping.ipfire.org" &>/dev/null; then
	281	return 0
68fac98a	282	fi
a33489a7 MT	283
	284	# Try to sync time with a known time server
	285	boot_mesg "DNS not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
	286	loadproc /usr/local/bin/settime 81.3.27.46
68fac98a AF	287	}
68fac98a AF	288
043e7aa5 MT	289	resolve() {
043e7aa5 MT	290	local hostname="${1}"
f5fe5f47	291	local found=1
043e7aa5	292
54898bc6 MT	293	local answer
	294	for answer in $(dig +short A "${hostname}"); do
	295	# Filter out non-IP addresses
	296	if [[ ! "${answer}" =~ \.$ ]]; then
f5fe5f47	297	found=0
54898bc6 MT	298	echo "${answer}"
54898bc6 MT	299	fi
043e7aa5	300	done
f5fe5f47 AF	301
f5fe5f47 AF	302	return ${found}
043e7aa5 MT	303	}
043e7aa5 MT	304
661ab153	305	# Sets up Safe Search for various search engines
d7190078	306	update_safe_search() {
661ab153 MT	307	local google_tlds=(
	308	google.ad
	309	google.ae
	310	google.al
	311	google.am
	312	google.as
	313	google.at
	314	google.az
	315	google.ba
	316	google.be
	317	google.bf
	318	google.bg
	319	google.bi
	320	google.bj
	321	google.bs
	322	google.bt
	323	google.by
	324	google.ca
	325	google.cat
	326	google.cd
	327	google.cf
	328	google.cg
	329	google.ch
	330	google.ci
	331	google.cl
	332	google.cm
	333	google.cn
	334	google.co.ao
	335	google.co.bw
	336	google.co.ck
	337	google.co.cr
	338	google.co.id
	339	google.co.il
	340	google.co.in
	341	google.co.jp
	342	google.co.ke
	343	google.co.kr
	344	google.co.ls
	345	google.com
	346	google.co.ma
	347	google.com.af
	348	google.com.ag
	349	google.com.ai
	350	google.com.ar
	351	google.com.au
	352	google.com.bd
	353	google.com.bh
	354	google.com.bn
	355	google.com.bo
	356	google.com.br
	357	google.com.bz
	358	google.com.co
	359	google.com.cu
	360	google.com.cy
	361	google.com.do
	362	google.com.ec
	363	google.com.eg
	364	google.com.et
	365	google.com.fj
	366	google.com.gh
	367	google.com.gi
	368	google.com.gt
	369	google.com.hk
	370	google.com.jm
371	google.com.kh
372	google.com.kw
373	google.com.lb
374	google.com.ly
375	google.com.mm
376	google.com.mt
377	google.com.mx
378	google.com.my
379	google.com.na
380	google.com.nf
381	google.com.ng
382	google.com.ni
383	google.com.np
384	google.com.om
385	google.com.pa
386	google.com.pe
387	google.com.pg
388	google.com.ph
389	google.com.pk
390	google.com.pr
391	google.com.py
392	google.com.qa
393	google.com.sa
394	google.com.sb
395	google.com.sg
396	google.com.sl
397	google.com.sv
398	google.com.tj
399	google.com.tr
400	google.com.tw
401	google.com.ua
402	google.com.uy
403	google.com.vc
404	google.com.vn
405	google.co.mz
406	google.co.nz
407	google.co.th
408	google.co.tz
409	google.co.ug
410	google.co.uk
411	google.co.uz
412	google.co.ve
413	google.co.vi
414	google.co.za
415	google.co.zm
416	google.co.zw
417	google.cv
418	google.cz
419	google.de
420	google.dj
421	google.dk
422	google.dm
423	google.dz
424	google.ee
425	google.es
426	google.fi
427	google.fm
428	google.fr
429	google.ga
430	google.ge
431	google.gg
432	google.gl
433	google.gm
434	google.gp
435	google.gr
436	google.gy
437	google.hn
438	google.hr
439	google.ht
440	google.hu
441	google.ie
442	google.im
443	google.iq
444	google.is
445	google.it
446	google.je
447	google.jo
448	google.kg
449	google.ki
450	google.kz
451	google.la
452	google.li
453	google.lk
454	google.lt
455	google.lu
456	google.lv
457	google.md
458	google.me
459	google.mg
460	google.mk
461	google.ml
462	google.mn
463	google.ms
464	google.mu
465	google.mv
466	google.mw
467	google.ne
468	google.nl
469	google.no
470	google.nr
471	google.nu
472	google.pl
473	google.pn
474	google.ps
475	google.pt
476	google.ro
477	google.rs
478	google.ru
479	google.rw
480	google.sc
481	google.se
482	google.sh
483	google.si
484	google.sk
485	google.sm
486	google.sn
487	google.so
488	google.sr
489	google.st
490	google.td
491	google.tg
492	google.tk
493	google.tl
494	google.tm
495	google.tn
496	google.to
497	google.tt
498	google.vg
499	google.vu
500	google.ws
501	)
502
d7190078 MT	503	# Cleanup previous settings
	504	unbound-control local_zone_remove "bing.com" >/dev/null
	505	unbound-control local_zone_remove "duckduckgo.com" >/dev/null
	506	unbound-control local_zone_remove "yandex.com" >/dev/null
	507	unbound-control local_zone_remove "yandex.ru" >/dev/null
	508	unbound-control local_zone_remove "youtube.com" >/dev/null
661ab153	509
d7190078 MT	510	local domain
	511	for domain in ${google_tlds[@]}; do
	512	unbound-control local_zone_remove "${domain}"
	513	done >/dev/null
661ab153	514
d7190078 MT	515	# Nothing to do if safe search is not enabled
	516	if [ "${ENABLE_SAFE_SEARCH}" != "on" ]; then
	517	return 0
	518	fi
661ab153	519
d7190078 MT	520	# Bing
	521	unbound-control bing.com transparent >/dev/null
	522	for address in $(resolve "strict.bing.com"); do
	523	unbound-control local_data "www.bing.com ${LOCAL_TTL} IN A ${address}"
	524	done >/dev/null
	525
	526	# DuckDuckGo
	527	unbound-control local_zone duckduckgo.com typetransparent >/dev/null
	528	for address in $(resolve "safe.duckduckgo.com"); do
	529	unbound-control local_data "duckduckgo.com ${LOCAL_TTL} IN A ${address}"
	530	done >/dev/null
	531
	532	# Google
	533	local addresses="$(resolve "forcesafesearch.google.com")"
	534	for domain in ${google_tlds[@]}; do
	535	unbound-control local_zone "${domain}" transparent >/dev/null
	536	for address in ${addresses}; do
	537	unbound-control local_data: "www.${domain} ${LOCAL_TTL} IN A ${address}"
	538	done >/dev/null
	539	done
661ab153	540
d7190078 MT	541	# Yandex
	542	for domain in yandex.com yandex.ru; do
	543	unbound-control local_zone "${domain}" typetransparent >/dev/null
	544	for address in $(resolve "familysearch.${domain}"); do
	545	unbound-control local_data "${domain} ${LOCAL_TTL} IN A ${address}"
	546	done >/dev/null
	547	done
661ab153	548
d7190078 MT	549	# YouTube
	550	unbound-control local_zone youtube.com transparent >/dev/null
	551	for address in $(resolve "restrictmoderate.youtube.com"); do
	552	unbound-control local_data "www.youtube.com ${LOCAL_TTL} IN A ${address}"
	553	done >/dev/null
f617fd91	554
d7190078	555	return 0
661ab153 MT	556	}
661ab153 MT	557
d0e5f71f ML	558	case "$1" in
d0e5f71f ML	559	start)
80bc6022 MT	560	# Print a nicer messagen when unbound is already running
	561	if pidofproc -s unbound; then
	562	statusproc /usr/sbin/unbound
	563	exit 0
	564	fi
	565
b8f5eda8	566	# Update configuration files
b658a451	567	write_tuning_conf
6137797c	568	write_hosts_conf
b8f5eda8 MT	569	write_forward_conf
	570
	571	boot_mesg "Starting Unbound DNS Proxy..."
	572	loadproc /usr/sbin/unbound \|\| exit $?
	573
d7190078 MT	574	# Install Safe Search rules when the system is already online
	575	if [ -e "/var/ipfire/red/active" ]; then
	576	update_safe_search
	577	fi
b8f5eda8	578	;;
d0e5f71f ML	579
d0e5f71f ML	580	stop)
b8f5eda8 MT	581	boot_mesg "Stopping Unbound DNS Proxy..."
	582	killproc /usr/sbin/unbound
	583	;;
d0e5f71f ML	584
d0e5f71f ML	585	restart)
b8f5eda8 MT	586	$0 stop
	587	sleep 1
	588	$0 start
	589	;;
24a694d4	590	reload\|remove-forwarders)
0c109477	591	# Update configuration files
0c109477	592	write_forward_conf
6137797c	593	write_hosts_conf
0c109477 SS	594
	595	# Update Safe Search rules if the system is online.
	596	if [ -e "/var/ipfire/red/active" ]; then
	597	update_safe_search
	598	fi
	599
0c109477 SS	600	# Call unbound-control and perform the reload
	601	/usr/sbin/unbound-control -q reload
	602	;;
d0e5f71f ML	603
d0e5f71f ML	604	status)
b8f5eda8	605	statusproc /usr/sbin/unbound
b8f5eda8 MT	606	;;
	607
	608	update-forwarders)
24a694d4	609	$0 reload
54898bc6	610
a33489a7 MT	611	# Make sure DNS works at this point
a33489a7 MT	612	fix_time_if_dns_fails
3ec3329d AF	613	;;
3ec3329d AF	614
043e7aa5	615	resolve)
f5fe5f47	616	resolve "${2}" \|\| exit $?
043e7aa5 MT	617	;;
043e7aa5 MT	618
d0e5f71f	619	*)
04b7a781	620	echo "Usage: $0 {start\|stop\|restart\|reload\|status\|resolve\|update-forwarders\|remove-forwarders}"
b8f5eda8 MT	621	exit 1
b8f5eda8 MT	622	;;
d0e5f71f ML	623	esac
	624
	625	# End $rc_base/init.d/unbound