[ipfire-2.x.git] / src / initscripts / system / unbound

#!/bin/sh
# Begin $rc_base/init.d/unbound

# Description : Unbound DNS resolver boot script for IPfire
# Author      : Marcel Lorenz <marcel.lorenz@ipfire.org>

. /etc/sysconfig/rc
. ${rc_functions}

TEST_DOMAIN="ipfire.org"

# This domain will never validate
TEST_DOMAIN_FAIL="dnssec-failed.org"

# Cache any local zones for 60 seconds
LOCAL_TTL=60

# Load configuration
eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)

ip_address_revptr() {
	local addr=${1}

	local a1 a2 a3 a4
	IFS=. read -r a1 a2 a3 a4 <<< ${addr}

	echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
}

read_name_servers() {
	# Read name servers from ISP
	if [ "${USE_ISP_NAMESERVERS}" = "on" -a "${PROTO}" != "TLS" ]; then
		local i
		for i in 1 2; do
			echo "$(</var/run/dns${i})"
		done 2>/dev/null
	fi

	# Read configured name servers
	local id address tls_hostname enabled remark
	while IFS="," read -r id address tls_hostname enabled remark; do
		[ "${enabled}" != "enabled" ] && continue

		if [ "${PROTO}" = "TLS" ]; then
			if [ -n "${tls_hostname}" ]; then
				echo "${address}@853#${tls_hostname}"
			fi
		else
			echo "${address}"
		fi
	done < /var/ipfire/dns/servers
}

config_header() {
	echo "# This file is automatically generated and any changes"
	echo "# will be overwritten. DO NOT EDIT!"
	echo
}

own_hostname() {
	local hostname=$(hostname -f)
	# 1.1.1.1 is reserved for unused green, skip this
	if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
		unbound-control -q local_data "${hostname} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}"
	fi

	local address
	for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
		[ -n "${address}" ] || continue
		[ "${address}" = "1.1.1.1" ] && continue

		address=$(ip_address_revptr ${address})
		unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${hostname}"
	done
}

update_hosts() {
	local enabled address hostname domainname generateptr

	while IFS="," read -r enabled address hostname domainname generateptr; do
		[ "${enabled}" = "on" ] || continue

		# Build FQDN
		local fqdn="${hostname}.${domainname}"

		unbound-control -q local_data "${fqdn} ${LOCAL_TTL} IN A ${address}"

		# Skip reverse resolution if the address equals the GREEN address
		[ "${address}" = "${GREEN_ADDRESS}" ] && continue

		# Skip reverse resolution if user requested not to do so
		[ "${generateptr}" = "off" ] && continue

		# Add RDNS
		address=$(ip_address_revptr ${address})
		unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${fqdn}"
	done < /var/ipfire/main/hosts
}

write_forward_conf() {
	(
		config_header

		# Enable strict QNAME minimisation
		if [ "${QNAME_MIN}" = "strict" ]; then
			echo "server:"
			echo "	qname-minimisation-strict: yes"
			echo
		fi

		# Force using TCP for upstream servers only
		if [ "${PROTO}" = "TCP" ]; then
			echo "# Force using TCP for upstream servers only"
			echo "server:"
			echo "	tcp-upstream: yes"
			echo
		fi

		local insecure_zones=""

		local enabled zone server servers remark disable_dnssec rest
		while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
			# Line must be enabled.
			[ "${enabled}" = "on" ] || continue

			# Zones that end with .local are commonly used for internal
			# zones and therefore not signed
			case "${zone}" in
				*.local)
					insecure_zones="${insecure_zones} ${zone}"
					;;
				*)
					if [ "${disable_dnssec}" = "on" ]; then
						insecure_zones="${insecure_zones} ${zone}"
					fi
					;;
			esac

			echo "stub-zone:"
			echo "	name: ${zone}"
			for server in ${servers//|/ }; do
				if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
					echo "	stub-addr: ${server}"
				else
					echo "	stub-host: ${server}"
				fi
			done
			echo

			# Make all reverse lookup zones transparent
			case "${zone}" in
				*.in-addr.arpa)
					echo "server:"
					echo "	local-zone: \"${zone}\" transparent"
					echo
					;;
			esac
		done < /var/ipfire/dnsforward/config

		if [ -n "${insecure_zones}" ]; then
			echo "server:"

			for zone in ${insecure_zones}; do
				echo "	domain-insecure: ${zone}"
			done
		fi

		echo "forward-zone:"
		echo "	name: \".\""

		# Force using TLS only
		if [ "${PROTO}" = "TLS" ]; then
			echo "	forward-tls-upstream: yes"
		fi

		# Add upstream name servers
		local ns
		for ns in $(read_name_servers); do
			echo "	forward-addr: ${ns}"
		done
	) > /etc/unbound/forward.conf
}

write_tuning_conf() {
	# https://www.unbound.net/documentation/howto_optimise.html

	# Determine number of online processors
	local processors=$(getconf _NPROCESSORS_ONLN)

	# Determine number of slabs
	local slabs=1
	while [ ${slabs} -lt ${processors} ]; do
		slabs=$(( ${slabs} * 2 ))
	done

	# Determine amount of system memory
	local mem=$(get_memory_amount)

	# In the worst case scenario, unbound can use double the
	# amount of memory allocated to a cache due to malloc overhead

	# Even larger systems with more than 8GB of RAM
	if [ ${mem} -ge 8192 ]; then
		mem=1024

	# Extra large systems with more than 4GB of RAM
	elif [ ${mem} -ge 4096 ]; then
		mem=512

	# Large systems with more than 2GB of RAM
	elif [ ${mem} -ge 2048 ]; then
		mem=256

	# Medium systems with more than 1GB of RAM
	elif [ ${mem} -ge 1024 ]; then
		mem=128

	# Small systems with less than 256MB of RAM
	elif [ ${mem} -le 256 ]; then
		mem=16

	# Everything else
	else
		mem=64
	fi

	(
		config_header

		# We run one thread per processor
		echo "num-threads: ${processors}"
		echo "so-reuseport: yes"

		# Adjust number of slabs
		echo "infra-cache-slabs: ${slabs}"
		echo "key-cache-slabs: ${slabs}"
		echo "msg-cache-slabs: ${slabs}"
		echo "rrset-cache-slabs: ${slabs}"

		# Slice up the cache
		echo "rrset-cache-size: $(( ${mem} / 2 ))m"
		echo "msg-cache-size: $(( ${mem} / 4 ))m"
		echo "key-cache-size: $(( ${mem} / 4 ))m"

		# Increase parallel queries
		echo "outgoing-range: 8192"
		echo "num-queries-per-thread: 4096"

		# Use larger send/receive buffers
		echo "so-sndbuf: 4m"
		echo "so-rcvbuf: 4m"
	) > /etc/unbound/tuning.conf
}

get_memory_amount() {
	local key val unit

	while read -r key val unit; do
		case "${key}" in
			MemTotal:*)
				# Convert to MB
				echo "$(( ${val} / 1024 ))"
				break
				;;
		esac
	done < /proc/meminfo
}

fix_time_if_dns_fails() {
	# If DNS is working, everything is fine
	if resolve "ping.ipfire.org" &>/dev/null; then
		return 0
	fi

	# Try to sync time with a known time server
	boot_mesg "DNS not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
	loadproc /usr/local/bin/settime 81.3.27.46
}

resolve() {
	local hostname="${1}"

	local answer
	for answer in $(dig +short A "${hostname}"); do
		# Filter out non-IP addresses
		if [[ ! "${answer}" =~ \.$ ]]; then
			echo "${answer}"
		fi
	done
}

update_forwarders() {
	# Do nothing when we do not use the ISP name servers
	[ "${USE_ISP_NAMESERVERS}" != "on" ] && return 0

	# We cannot update anything when using TLS
	# Unbound will then try to connect to the servers using UDP on port 853
	[ "${PROTO}" = "TLS" ] && return 0

	# Update unbound about the new servers
	local nameservers=( $(read_name_servers) )
	if [ -n "${nameservers[*]}" ]; then
		unbound-control -q forward "${nameservers[@]}"
	else
		unbound-control -q forward off
	fi
}

# Sets up Safe Search for various search engines
update_safe_search() {
	local google_tlds=(
		google.ad
		google.ae
		google.al
		google.am
		google.as
		google.at
		google.az
		google.ba
		google.be
		google.bf
		google.bg
		google.bi
		google.bj
		google.bs
		google.bt
		google.by
		google.ca
		google.cat
		google.cd
		google.cf
		google.cg
		google.ch
		google.ci
		google.cl
		google.cm
		google.cn
		google.co.ao
		google.co.bw
		google.co.ck
		google.co.cr
		google.co.id
		google.co.il
		google.co.in
		google.co.jp
		google.co.ke
		google.co.kr
		google.co.ls
		google.com
		google.co.ma
		google.com.af
		google.com.ag
		google.com.ai
		google.com.ar
		google.com.au
		google.com.bd
		google.com.bh
		google.com.bn
		google.com.bo
		google.com.br
		google.com.bz
		google.com.co
		google.com.cu
		google.com.cy
		google.com.do
		google.com.ec
		google.com.eg
		google.com.et
		google.com.fj
		google.com.gh
		google.com.gi
		google.com.gt
		google.com.hk
		google.com.jm
		google.com.kh
		google.com.kw
		google.com.lb
		google.com.ly
		google.com.mm
		google.com.mt
		google.com.mx
		google.com.my
		google.com.na
		google.com.nf
		google.com.ng
		google.com.ni
		google.com.np
		google.com.om
		google.com.pa
		google.com.pe
		google.com.pg
		google.com.ph
		google.com.pk
		google.com.pr
		google.com.py
		google.com.qa
		google.com.sa
		google.com.sb
		google.com.sg
		google.com.sl
		google.com.sv
		google.com.tj
		google.com.tr
		google.com.tw
		google.com.ua
		google.com.uy
		google.com.vc
		google.com.vn
		google.co.mz
		google.co.nz
		google.co.th
		google.co.tz
		google.co.ug
		google.co.uk
		google.co.uz
		google.co.ve
		google.co.vi
		google.co.za
		google.co.zm
		google.co.zw
		google.cv
		google.cz
		google.de
		google.dj
		google.dk
		google.dm
		google.dz
		google.ee
		google.es
		google.fi
		google.fm
		google.fr
		google.ga
		google.ge
		google.gg
		google.gl
		google.gm
		google.gp
		google.gr
		google.gy
		google.hn
		google.hr
		google.ht
		google.hu
		google.ie
		google.im
		google.iq
		google.is
		google.it
		google.je
		google.jo
		google.kg
		google.ki
		google.kz
		google.la
		google.li
		google.lk
		google.lt
		google.lu
		google.lv
		google.md
		google.me
		google.mg
		google.mk
		google.ml
		google.mn
		google.ms
		google.mu
		google.mv
		google.mw
		google.ne
		google.nl
		google.no
		google.nr
		google.nu
		google.pl
		google.pn
		google.ps
		google.pt
		google.ro
		google.rs
		google.ru
		google.rw
		google.sc
		google.se
		google.sh
		google.si
		google.sk
		google.sm
		google.sn
		google.so
		google.sr
		google.st
		google.td
		google.tg
		google.tk
		google.tl
		google.tm
		google.tn
		google.to
		google.tt
		google.vg
		google.vu
		google.ws
	)

	# Cleanup previous settings
	unbound-control local_zone_remove "bing.com" >/dev/null
	unbound-control local_zone_remove "duckduckgo.com" >/dev/null
	unbound-control local_zone_remove "yandex.com" >/dev/null
	unbound-control local_zone_remove "yandex.ru" >/dev/null
	unbound-control local_zone_remove "youtube.com" >/dev/null

	local domain
	for domain in ${google_tlds[@]}; do
		unbound-control local_zone_remove "${domain}"
	done >/dev/null

	# Nothing to do if safe search is not enabled
	if [ "${ENABLE_SAFE_SEARCH}" != "on" ]; then
		return 0
	fi

	# Bing
	unbound-control bing.com transparent >/dev/null
	for address in $(resolve "strict.bing.com"); do
		unbound-control local_data "www.bing.com ${LOCAL_TTL} IN A ${address}"
	done >/dev/null

	# DuckDuckGo
	unbound-control local_zone duckduckgo.com typetransparent >/dev/null
	for address in $(resolve "safe.duckduckgo.com"); do
		unbound-control local_data "duckduckgo.com ${LOCAL_TTL} IN A ${address}"
	done >/dev/null

	# Google
	local addresses="$(resolve "forcesafesearch.google.com")"
	for domain in ${google_tlds[@]}; do
		unbound-control local_zone "${domain}" transparent >/dev/null
		for address in ${addresses}; do
			unbound-control local_data: "www.${domain} ${LOCAL_TTL} IN A ${address}"
		done >/dev/null
	done

	# Yandex
	for domain in yandex.com yandex.ru; do
		unbound-control local_zone "${domain}" typetransparent >/dev/null
		for address in $(resolve "familysearch.${domain}"); do
			unbound-control local_data "${domain} ${LOCAL_TTL} IN A ${address}"
		done >/dev/null
	done

	# YouTube
	unbound-control local_zone youtube.com transparent >/dev/null
	for address in $(resolve "restrictmoderate.youtube.com"); do
		unbound-control local_data "www.youtube.com ${LOCAL_TTL} IN A ${address}"
	done >/dev/null

	return 0
}

case "$1" in
	start)
		# Print a nicer messagen when unbound is already running
		if pidofproc -s unbound; then
			statusproc /usr/sbin/unbound
			exit 0
		fi

		# Update configuration files
		write_tuning_conf
		write_forward_conf

		boot_mesg "Starting Unbound DNS Proxy..."
		loadproc /usr/sbin/unbound || exit $?

		# Make own hostname resolveable
		own_hostname

		# Install Safe Search rules when the system is already online
		if [ -e "/var/ipfire/red/active" ]; then
			update_safe_search
		fi

		# Update hosts
		update_hosts
		;;

	stop)
		boot_mesg "Stopping Unbound DNS Proxy..."
		killproc /usr/sbin/unbound
		;;

	restart)
		$0 stop
		sleep 1
		$0 start
		;;

	status)
		statusproc /usr/sbin/unbound
		;;

	update-forwarders)
		update_forwarders

		# Make sure DNS works at this point
		fix_time_if_dns_fails

		# Update Safe Search settings
		update_safe_search
		;;

	remove-forwarders)
		update_forwarders
		;;

	resolve)
		resolve "${2}"
		;;

	update-safe-search)
		update_safe_search
		;;

	*)
		echo "Usage: $0 {start|stop|restart|status|resolve|update-forwarders|remove-forwarders|update-safe-search}"
		exit 1
		;;
esac

# End $rc_base/init.d/unbound
Commit	Line	Data
	1	#!/bin/sh
	2	# Begin $rc_base/init.d/unbound
	3
	4	# Description : Unbound DNS resolver boot script for IPfire
	5	# Author : Marcel Lorenz <marcel.lorenz@ipfire.org>
	6
	7	. /etc/sysconfig/rc
	8	. ${rc_functions}
	9
	10	TEST_DOMAIN="ipfire.org"
	11
	12	# This domain will never validate
	13	TEST_DOMAIN_FAIL="dnssec-failed.org"
	14
	15	# Cache any local zones for 60 seconds
	16	LOCAL_TTL=60
	17
	18	# Load configuration
	19	eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
	20	eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
	21
	22	ip_address_revptr() {
	23	local addr=${1}
	24
	25	local a1 a2 a3 a4
	26	IFS=. read -r a1 a2 a3 a4 <<< ${addr}
	27
	28	echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
	29	}
	30
	31	read_name_servers() {
	32	# Read name servers from ISP
	33	if [ "${USE_ISP_NAMESERVERS}" = "on" -a "${PROTO}" != "TLS" ]; then
	34	local i
	35	for i in 1 2; do
	36	echo "$(</var/run/dns${i})"
	37	done 2>/dev/null
	38	fi
	39
	40	# Read configured name servers
	41	local id address tls_hostname enabled remark
	42	while IFS="," read -r id address tls_hostname enabled remark; do
	43	[ "${enabled}" != "enabled" ] && continue
	44
	45	if [ "${PROTO}" = "TLS" ]; then
	46	if [ -n "${tls_hostname}" ]; then
	47	echo "${address}@853#${tls_hostname}"
	48	fi
	49	else
	50	echo "${address}"
	51	fi
	52	done < /var/ipfire/dns/servers
	53	}
	54
	55	config_header() {
	56	echo "# This file is automatically generated and any changes"
	57	echo "# will be overwritten. DO NOT EDIT!"
	58	echo
	59	}
	60
	61	own_hostname() {
	62	local hostname=$(hostname -f)
	63	# 1.1.1.1 is reserved for unused green, skip this
	64	if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
	65	unbound-control -q local_data "${hostname} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}"
	66	fi
	67
	68	local address
	69	for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
	70	[ -n "${address}" ] \|\| continue
	71	[ "${address}" = "1.1.1.1" ] && continue
	72
	73	address=$(ip_address_revptr ${address})
	74	unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${hostname}"
	75	done
	76	}
	77
	78	update_hosts() {
	79	local enabled address hostname domainname generateptr
	80
	81	while IFS="," read -r enabled address hostname domainname generateptr; do
	82	[ "${enabled}" = "on" ] \|\| continue
	83
	84	# Build FQDN
	85	local fqdn="${hostname}.${domainname}"
	86
	87	unbound-control -q local_data "${fqdn} ${LOCAL_TTL} IN A ${address}"
	88
	89	# Skip reverse resolution if the address equals the GREEN address
	90	[ "${address}" = "${GREEN_ADDRESS}" ] && continue
	91
	92	# Skip reverse resolution if user requested not to do so
	93	[ "${generateptr}" = "off" ] && continue
	94
	95	# Add RDNS
	96	address=$(ip_address_revptr ${address})
	97	unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${fqdn}"
	98	done < /var/ipfire/main/hosts
	99	}
	100
	101	write_forward_conf() {
	102	(
	103	config_header
	104
	105	# Enable strict QNAME minimisation
	106	if [ "${QNAME_MIN}" = "strict" ]; then
	107	echo "server:"
	108	echo " qname-minimisation-strict: yes"
	109	echo
	110	fi
	111
	112	# Force using TCP for upstream servers only
	113	if [ "${PROTO}" = "TCP" ]; then
	114	echo "# Force using TCP for upstream servers only"
	115	echo "server:"
	116	echo " tcp-upstream: yes"
	117	echo
	118	fi
	119
	120	local insecure_zones=""
	121
	122	local enabled zone server servers remark disable_dnssec rest
	123	while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
	124	# Line must be enabled.
	125	[ "${enabled}" = "on" ] \|\| continue
	126
	127	# Zones that end with .local are commonly used for internal
	128	# zones and therefore not signed
	129	case "${zone}" in
	130	*.local)
	131	insecure_zones="${insecure_zones} ${zone}"
	132	;;
	133	*)
	134	if [ "${disable_dnssec}" = "on" ]; then
	135	insecure_zones="${insecure_zones} ${zone}"
	136	fi
	137	;;
	138	esac
	139
	140	echo "stub-zone:"
	141	echo " name: ${zone}"
	142	for server in ${servers//\|/ }; do
	143	if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
	144	echo " stub-addr: ${server}"
	145	else
	146	echo " stub-host: ${server}"
	147	fi
	148	done
	149	echo
	150
	151	# Make all reverse lookup zones transparent
	152	case "${zone}" in
	153	*.in-addr.arpa)
	154	echo "server:"
	155	echo " local-zone: \"${zone}\" transparent"
	156	echo
	157	;;
	158	esac
	159	done < /var/ipfire/dnsforward/config
	160
	161	if [ -n "${insecure_zones}" ]; then
	162	echo "server:"
	163
	164	for zone in ${insecure_zones}; do
	165	echo " domain-insecure: ${zone}"
	166	done
	167	fi
	168
	169	echo "forward-zone:"
	170	echo " name: \".\""
	171
	172	# Force using TLS only
	173	if [ "${PROTO}" = "TLS" ]; then
	174	echo " forward-tls-upstream: yes"
	175	fi
	176
	177	# Add upstream name servers
	178	local ns
	179	for ns in $(read_name_servers); do
	180	echo " forward-addr: ${ns}"
	181	done
	182	) > /etc/unbound/forward.conf
	183	}
	184
	185	write_tuning_conf() {
	186	# https://www.unbound.net/documentation/howto_optimise.html
	187
	188	# Determine number of online processors
	189	local processors=$(getconf _NPROCESSORS_ONLN)
	190
	191	# Determine number of slabs
	192	local slabs=1
	193	while [ ${slabs} -lt ${processors} ]; do
	194	slabs=$(( ${slabs} * 2 ))
	195	done
	196
	197	# Determine amount of system memory
	198	local mem=$(get_memory_amount)
	199
	200	# In the worst case scenario, unbound can use double the
	201	# amount of memory allocated to a cache due to malloc overhead
	202
	203	# Even larger systems with more than 8GB of RAM
	204	if [ ${mem} -ge 8192 ]; then
	205	mem=1024
	206
	207	# Extra large systems with more than 4GB of RAM
	208	elif [ ${mem} -ge 4096 ]; then
	209	mem=512
	210
	211	# Large systems with more than 2GB of RAM
	212	elif [ ${mem} -ge 2048 ]; then
	213	mem=256
	214
	215	# Medium systems with more than 1GB of RAM
	216	elif [ ${mem} -ge 1024 ]; then
	217	mem=128
	218
	219	# Small systems with less than 256MB of RAM
	220	elif [ ${mem} -le 256 ]; then
	221	mem=16
	222
	223	# Everything else
	224	else
	225	mem=64
	226	fi
	227
	228	(
	229	config_header
	230
	231	# We run one thread per processor
	232	echo "num-threads: ${processors}"
	233	echo "so-reuseport: yes"
	234
	235	# Adjust number of slabs
	236	echo "infra-cache-slabs: ${slabs}"
	237	echo "key-cache-slabs: ${slabs}"
	238	echo "msg-cache-slabs: ${slabs}"
	239	echo "rrset-cache-slabs: ${slabs}"
	240
	241	# Slice up the cache
	242	echo "rrset-cache-size: $(( ${mem} / 2 ))m"
	243	echo "msg-cache-size: $(( ${mem} / 4 ))m"
	244	echo "key-cache-size: $(( ${mem} / 4 ))m"
	245
	246	# Increase parallel queries
	247	echo "outgoing-range: 8192"
	248	echo "num-queries-per-thread: 4096"
	249
	250	# Use larger send/receive buffers
	251	echo "so-sndbuf: 4m"
	252	echo "so-rcvbuf: 4m"
	253	) > /etc/unbound/tuning.conf
	254	}
	255
	256	get_memory_amount() {
	257	local key val unit
	258
	259	while read -r key val unit; do
	260	case "${key}" in
	261	MemTotal:*)
	262	# Convert to MB
	263	echo "$(( ${val} / 1024 ))"
	264	break
	265	;;
	266	esac
	267	done < /proc/meminfo
	268	}
	269
	270	fix_time_if_dns_fails() {
	271	# If DNS is working, everything is fine
	272	if resolve "ping.ipfire.org" &>/dev/null; then
	273	return 0
	274	fi
	275
	276	# Try to sync time with a known time server
	277	boot_mesg "DNS not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
	278	loadproc /usr/local/bin/settime 81.3.27.46
	279	}
	280
	281	resolve() {
	282	local hostname="${1}"
	283
	284	local answer
	285	for answer in $(dig +short A "${hostname}"); do
	286	# Filter out non-IP addresses
	287	if [[ ! "${answer}" =~ \.$ ]]; then
	288	echo "${answer}"
	289	fi
	290	done
	291	}
	292
	293	update_forwarders() {
	294	# Do nothing when we do not use the ISP name servers
	295	[ "${USE_ISP_NAMESERVERS}" != "on" ] && return 0
	296
	297	# We cannot update anything when using TLS
	298	# Unbound will then try to connect to the servers using UDP on port 853
	299	[ "${PROTO}" = "TLS" ] && return 0
	300
	301	# Update unbound about the new servers
	302	local nameservers=( $(read_name_servers) )
	303	if [ -n "${nameservers[*]}" ]; then
	304	unbound-control -q forward "${nameservers[@]}"
	305	else
	306	unbound-control -q forward off
	307	fi
	308	}
	309
	310	# Sets up Safe Search for various search engines
	311	update_safe_search() {
	312	local google_tlds=(
	313	google.ad
	314	google.ae
	315	google.al
	316	google.am
	317	google.as
	318	google.at
	319	google.az
	320	google.ba
	321	google.be
	322	google.bf
	323	google.bg
	324	google.bi
	325	google.bj
	326	google.bs
	327	google.bt
	328	google.by
	329	google.ca
	330	google.cat
	331	google.cd
	332	google.cf
	333	google.cg
	334	google.ch
	335	google.ci
	336	google.cl
	337	google.cm
	338	google.cn
	339	google.co.ao
	340	google.co.bw
	341	google.co.ck
	342	google.co.cr
	343	google.co.id
	344	google.co.il
	345	google.co.in
	346	google.co.jp
	347	google.co.ke
	348	google.co.kr
	349	google.co.ls
	350	google.com
	351	google.co.ma
	352	google.com.af
	353	google.com.ag
	354	google.com.ai
	355	google.com.ar
	356	google.com.au
	357	google.com.bd
	358	google.com.bh
	359	google.com.bn
	360	google.com.bo
	361	google.com.br
	362	google.com.bz
	363	google.com.co
	364	google.com.cu
	365	google.com.cy
	366	google.com.do
	367	google.com.ec
	368	google.com.eg
	369	google.com.et
	370	google.com.fj
	371	google.com.gh
	372	google.com.gi
	373	google.com.gt
	374	google.com.hk
	375	google.com.jm
	376	google.com.kh
	377	google.com.kw
	378	google.com.lb
	379	google.com.ly
	380	google.com.mm
	381	google.com.mt
	382	google.com.mx
	383	google.com.my
	384	google.com.na
	385	google.com.nf
	386	google.com.ng
	387	google.com.ni
	388	google.com.np
	389	google.com.om
	390	google.com.pa
	391	google.com.pe
	392	google.com.pg
	393	google.com.ph
	394	google.com.pk
	395	google.com.pr
	396	google.com.py
	397	google.com.qa
	398	google.com.sa
	399	google.com.sb
	400	google.com.sg
	401	google.com.sl
	402	google.com.sv
	403	google.com.tj
	404	google.com.tr
	405	google.com.tw
	406	google.com.ua
	407	google.com.uy
	408	google.com.vc
	409	google.com.vn
	410	google.co.mz
	411	google.co.nz
	412	google.co.th
	413	google.co.tz
	414	google.co.ug
	415	google.co.uk
	416	google.co.uz
	417	google.co.ve
	418	google.co.vi
	419	google.co.za
	420	google.co.zm
	421	google.co.zw
	422	google.cv
	423	google.cz
	424	google.de
	425	google.dj
	426	google.dk
	427	google.dm
	428	google.dz
	429	google.ee
	430	google.es
	431	google.fi
	432	google.fm
	433	google.fr
	434	google.ga
	435	google.ge
	436	google.gg
	437	google.gl
	438	google.gm
	439	google.gp
	440	google.gr
	441	google.gy
	442	google.hn
	443	google.hr
	444	google.ht
	445	google.hu
	446	google.ie
	447	google.im
	448	google.iq
	449	google.is
	450	google.it
	451	google.je
	452	google.jo
	453	google.kg
	454	google.ki
	455	google.kz
	456	google.la
	457	google.li
	458	google.lk
	459	google.lt
	460	google.lu
	461	google.lv
	462	google.md
	463	google.me
	464	google.mg
	465	google.mk
	466	google.ml
	467	google.mn
	468	google.ms
	469	google.mu
	470	google.mv
	471	google.mw
	472	google.ne
	473	google.nl
	474	google.no
	475	google.nr
	476	google.nu
	477	google.pl
	478	google.pn
	479	google.ps
	480	google.pt
	481	google.ro
	482	google.rs
	483	google.ru
	484	google.rw
	485	google.sc
	486	google.se
	487	google.sh
	488	google.si
	489	google.sk
	490	google.sm
	491	google.sn
	492	google.so
	493	google.sr
	494	google.st
	495	google.td
	496	google.tg
	497	google.tk
	498	google.tl
	499	google.tm
	500	google.tn
	501	google.to
	502	google.tt
	503	google.vg
	504	google.vu
	505	google.ws
	506	)
	507
	508	# Cleanup previous settings
	509	unbound-control local_zone_remove "bing.com" >/dev/null
	510	unbound-control local_zone_remove "duckduckgo.com" >/dev/null
	511	unbound-control local_zone_remove "yandex.com" >/dev/null
	512	unbound-control local_zone_remove "yandex.ru" >/dev/null
	513	unbound-control local_zone_remove "youtube.com" >/dev/null
	514
	515	local domain
	516	for domain in ${google_tlds[@]}; do
	517	unbound-control local_zone_remove "${domain}"
	518	done >/dev/null
	519
	520	# Nothing to do if safe search is not enabled
	521	if [ "${ENABLE_SAFE_SEARCH}" != "on" ]; then
	522	return 0
	523	fi
	524
	525	# Bing
	526	unbound-control bing.com transparent >/dev/null
	527	for address in $(resolve "strict.bing.com"); do
	528	unbound-control local_data "www.bing.com ${LOCAL_TTL} IN A ${address}"
	529	done >/dev/null
	530
	531	# DuckDuckGo
	532	unbound-control local_zone duckduckgo.com typetransparent >/dev/null
	533	for address in $(resolve "safe.duckduckgo.com"); do
	534	unbound-control local_data "duckduckgo.com ${LOCAL_TTL} IN A ${address}"
	535	done >/dev/null
	536
	537	# Google
	538	local addresses="$(resolve "forcesafesearch.google.com")"
	539	for domain in ${google_tlds[@]}; do
	540	unbound-control local_zone "${domain}" transparent >/dev/null
	541	for address in ${addresses}; do
	542	unbound-control local_data: "www.${domain} ${LOCAL_TTL} IN A ${address}"
	543	done >/dev/null
	544	done
	545
	546	# Yandex
	547	for domain in yandex.com yandex.ru; do
	548	unbound-control local_zone "${domain}" typetransparent >/dev/null
	549	for address in $(resolve "familysearch.${domain}"); do
	550	unbound-control local_data "${domain} ${LOCAL_TTL} IN A ${address}"
	551	done >/dev/null
	552	done
	553
	554	# YouTube
	555	unbound-control local_zone youtube.com transparent >/dev/null
	556	for address in $(resolve "restrictmoderate.youtube.com"); do
	557	unbound-control local_data "www.youtube.com ${LOCAL_TTL} IN A ${address}"
	558	done >/dev/null
	559
	560	return 0
	561	}
	562
	563	case "$1" in
	564	start)
	565	# Print a nicer messagen when unbound is already running
	566	if pidofproc -s unbound; then
	567	statusproc /usr/sbin/unbound
	568	exit 0
	569	fi
	570
	571	# Update configuration files
	572	write_tuning_conf
	573	write_forward_conf
	574
	575	boot_mesg "Starting Unbound DNS Proxy..."
	576	loadproc /usr/sbin/unbound \|\| exit $?
	577
	578	# Make own hostname resolveable
	579	own_hostname
	580
	581	# Install Safe Search rules when the system is already online
	582	if [ -e "/var/ipfire/red/active" ]; then
	583	update_safe_search
	584	fi
	585
	586	# Update hosts
	587	update_hosts
	588	;;
	589
	590	stop)
	591	boot_mesg "Stopping Unbound DNS Proxy..."
	592	killproc /usr/sbin/unbound
	593	;;
	594
	595	restart)
	596	$0 stop
	597	sleep 1
	598	$0 start
	599	;;
	600
	601	status)
	602	statusproc /usr/sbin/unbound
	603	;;
	604
	605	update-forwarders)
	606	update_forwarders
	607
	608	# Make sure DNS works at this point
	609	fix_time_if_dns_fails
	610
	611	# Update Safe Search settings
	612	update_safe_search
	613	;;
	614
	615	remove-forwarders)
	616	update_forwarders
	617	;;
	618
	619	resolve)
	620	resolve "${2}"
	621	;;
	622
	623	update-safe-search)
	624	update_safe_search
	625	;;
	626
	627	*)
	628	echo "Usage: $0 {start\|stop\|restart\|status\|resolve\|update-forwarders\|remove-forwarders\|update-safe-search}"
	629	exit 1
	630	;;
	631	esac
	632
	633	# End $rc_base/init.d/unbound