src/initscripts/init.d/unbound

   1 #!/bin/sh
   2 # Begin $rc_base/init.d/unbound
   3
   4 # Description : Unbound DNS resolver boot script for IPfire
   5 # Author      : Marcel Lorenz <marcel.lorenz@ipfire.org>
   6
   7 . /etc/sysconfig/rc
   8 . ${rc_functions}
   9
  10 TEST_DOMAIN="ipfire.org"
  11
  12 # This domain will never validate
  13 TEST_DOMAIN_FAIL="dnssec-failed.org"
  14
  15 USE_FORWARDERS=1
  16
  17 # Cache any local zones for 60 seconds
  18 LOCAL_TTL=60
  19
  20 # Load optional configuration
  21 [ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound
  22
  23 function cidr() {
  24     local cidr nbits IFS;
  25     IFS=. read -r i1 i2 i3 i4 <<< ${1}
  26     IFS=. read -r m1 m2 m3 m4 <<< ${2}
  27     cidr=$(printf "%d.%d.%d.%d\n" "$((i1 & m1))" "$((i2 & m2))" "$((i3 & m3))" "$((i4 & m4))")
  28     nbits=0
  29     IFS=.
  30     for dec in $2 ; do
  31         case $dec in
  32             255) let nbits+=8;;
  33             254) let nbits+=7;;
  34             252) let nbits+=6;;
  35             248) let nbits+=5;;
  36             240) let nbits+=4;;
  37             224) let nbits+=3;;
  38             192) let nbits+=2;;
  39             128) let nbits+=1;;
  40             0);;
  41             *) echo "Error: $dec is not recognised"; exit 1
  42         esac
  43     done
  44     echo "${cidr}/${nbits}"
  45 }
  46
  47 ip_address_revptr() {
  48         local addr=${1}
  49
  50         local a1 a2 a3 a4
  51         IFS=. read -r a1 a2 a3 a4 <<< ${addr}
  52
  53         echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
  54 }
  55
  56 read_name_servers() {
  57         local i
  58         for i in 1 2; do
  59                 echo "$(</var/ipfire/red/dns${i})"
  60         done | xargs echo
  61 }
  62
  63 config_header() {
  64         echo "# This file is automatically generated and any changes"
  65         echo "# will be overwritten. DO NOT EDIT!"
  66         echo
  67 }
  68
  69 update_forwarders() {
  70         if [ "${USE_FORWARDERS}" = "1" -a -e "/var/ipfire/red/active" ]; then
  71                 local forwarders
  72                 local broken_forwarders
  73
  74                 local ns
  75                 for ns in $(read_name_servers); do
  76                         test_name_server ${ns} &>/dev/null
  77                         case "$?" in
  78                                 # Only use DNSSEC-validating or DNSSEC-aware name servers
  79                                 0|2)
  80                                         forwarders="${forwarders} ${ns}"
  81                                         ;;
  82                                 *)
  83                                         broken_forwarders="${broken_forwarders} ${ns}"
  84                                         ;;
  85                         esac
  86                 done
  87
  88                 # Show warning for any broken upstream name servers
  89                 if [ -n "${broken_forwarders}" ]; then
  90                         boot_mesg "Ignoring broken upstream name server(s): ${broken_forwarders:1}" ${WARNING}
  91                         echo_warning
  92                 fi
  93
  94                 if [ -n "${broken_forwarders}" -a -z "${forwarders}" ]; then
  95                         boot_mesg "Falling back to recursor mode" ${WARNING}
  96                         echo_warning
  97
  98                 elif [ -n "${forwarders}" ]; then
  99                         boot_mesg "Configuring upstream name server(s): ${forwarders:1}" ${INFO}
 100                         echo_ok
 101
 102                         echo "${forwarders}" > /var/ipfire/red/dns
 103                         unbound-control -q forward ${forwarders}
 104                         return 0
 105                 fi
 106         fi
 107
 108         # If forwarders cannot be used we run in recursor mode
 109         echo "local recursor" > /var/ipfire/red/dns
 110         unbound-control -q forward off
 111 }
 112
 113 own_hostname() {
 114         local hostname=$(hostname -f)
 115         # 1.1.1.1 is reserved for unused green, skip this
 116         if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
 117                 unbound-control -q local_data "${hostname} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}"
 118         fi
 119
 120         local address
 121         for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
 122                 [ -n "${address}" ] || continue
 123                 [ "${address}" = "1.1.1.1" ] && continue
 124
 125                 address=$(ip_address_revptr ${address})
 126                 unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${hostname}"
 127         done
 128 }
 129
 130 update_hosts() {
 131         local enabled address hostname domainname
 132
 133         while IFS="," read -r enabled address hostname domainname; do
 134                 [ "${enabled}" = "on" ] || continue
 135
 136                 # Build FQDN
 137                 local fqdn="${hostname}.${domainname}"
 138
 139                 unbound-control -q local_data "${fqdn} ${LOCAL_TTL} IN A ${address}"
 140
 141                 # Add RDNS
 142                 address=$(ip_address_revptr ${address})
 143                 unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${fqdn}"
 144         done < /var/ipfire/main/hosts
 145 }
 146
 147 write_interfaces_conf() {
 148         (
 149                 config_header
 150
 151                 # 1.1.1.1 is reserved for unused green
 152                 if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
 153                         echo "# GREEN"
 154                         echo "interface: ${GREEN_ADDRESS}"
 155                         echo "access-control: $(cidr ${GREEN_NETADDRESS} ${GREEN_NETMASK}) allow"
 156                 fi
 157
 158                 if [ -n "${BLUE_ADDRESS}" ]; then
 159                         echo "# BLUE"
 160                         echo "interface: ${BLUE_ADDRESS}"
 161                         echo "access-control: $(cidr ${BLUE_NETADDRESS} ${BLUE_NETMASK}) allow"
 162                 fi
 163         ) > /etc/unbound/interfaces.conf
 164 }
 165
 166 write_forward_conf() {
 167         (
 168                 config_header
 169
 170                 local enabled zone server remark
 171                 while IFS="," read -r enabled zone server remark; do
 172                         # Line must be enabled.
 173                         [ "${enabled}" = "on" ] || continue
 174
 175                         echo "forward-zone:"
 176                         echo "  name: ${zone}"
 177                         echo "  forward-addr: ${server}"
 178                         echo
 179                 done < /var/ipfire/dnsforward/config
 180         ) > /etc/unbound/forward.conf
 181 }
 182
 183 write_tuning_conf() {
 184         # https://www.unbound.net/documentation/howto_optimise.html
 185
 186         # Determine number of online processors
 187         local processors=$(getconf _NPROCESSORS_ONLN)
 188
 189         # Determine number of slabs
 190         local slabs=1
 191         while [ ${slabs} -lt ${processors} ]; do
 192                 slabs=$(( ${slabs} * 2 ))
 193         done
 194
 195         # Determine amount of system memory
 196         local mem=$(get_memory_amount)
 197
 198         # In the worst case scenario, unbound can use double the
 199         # amount of memory allocated to a cache due to malloc overhead
 200
 201         # Large systems with more than 2GB of RAM
 202         if [ ${mem} -ge 2048 ]; then
 203                 mem=128
 204
 205         # Small systems with less than 256MB of RAM
 206         elif [ ${mem} -le 256 ]; then
 207                 mem=8
 208
 209         # Everything else
 210         else
 211                 mem=32
 212         fi
 213
 214         (
 215                 config_header
 216
 217                 # We run one thread per processor
 218                 echo "num-threads: ${processors}"
 219
 220                 # Adjust number of slabs
 221                 echo "infra-cache-slabs: ${slabs}"
 222                 echo "key-cache-slabs: ${slabs}"
 223                 echo "msg-cache-slabs: ${slabs}"
 224                 echo "rrset-cache-slabs: ${slabs}"
 225
 226                 # Slice up the cache
 227                 echo "rrset-cache-size: $(( ${mem} / 2 ))m"
 228                 echo "msg-cache-size: $(( ${mem} / 4 ))m"
 229                 echo "key-cache-size: $(( ${mem} / 4 ))m"
 230         ) > /etc/unbound/tuning.conf
 231 }
 232
 233 get_memory_amount() {
 234         local key val unit
 235
 236         while read -r key val unit; do
 237                 case "${key}" in
 238                         MemTotal:*)
 239                                 # Convert to MB
 240                                 echo "$(( ${val} / 1024 ))"
 241                                 break
 242                                 ;;
 243                 esac
 244         done < /proc/meminfo
 245 }
 246
 247 test_name_server() {
 248         local ns=${1}
 249
 250         # Return codes:
 251         # 0     DNSSEC validating
 252         # 1     Error: unreachable, etc.
 253         # 2     DNSSEC aware
 254         # 3     NOT DNSSEC-aware
 255
 256         # Exit when the server is not reachable
 257         ns_is_online ${ns} || return 1
 258
 259         # Return 0 if validating
 260         ns_is_validating ${ns} && return 0
 261
 262         local errors
 263         for rr in DNSKEY DS RRSIG; do
 264                 if ! ns_forwards_${rr} ${ns}; then
 265                         errors="${errors} ${rr}"
 266                 fi
 267         done
 268
 269         if [ -n "${errors}" ]; then
 270                 echo >&2 "Unable to retrieve the following resource records from ${ns}: ${errors:1}"
 271                 return 3
 272         fi
 273
 274         # Is DNSSEC-aware
 275         return 2
 276 }
 277
 278 # Sends an A query to the nameserver w/o DNSSEC
 279 ns_is_online() {
 280         local ns=${1}
 281
 282         dig @${ns} +nodnssec A ${TEST_DOMAIN} >/dev/null
 283 }
 284
 285 # Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating
 286 ns_is_validating() {
 287         local ns=${1}
 288
 289         dig @${ns} A ${TEST_DOMAIN_FAIL} | grep -q SERVFAIL
 290 }
 291
 292 # Checks if we can retrieve the DNSKEY for this domain.
 293 # dig will print the SOA if nothing was found
 294 ns_forwards_DNSKEY() {
 295         local ns=${1}
 296
 297         dig @${ns} DNSKEY ${TEST_DOMAIN} | grep -qv SOA
 298 }
 299
 300 ns_forwards_DS() {
 301         local ns=${1}
 302
 303         dig @${ns} DS ${TEST_DOMAIN} | grep -qv SOA
 304 }
 305
 306 ns_forwards_RRSIG() {
 307         local ns=${1}
 308
 309         dig @${ns} +dnssec A ${TEST_DOMAIN} | grep -q RRSIG
 310 }
 311
 312 ns_supports_tcp() {
 313         local ns=${1}
 314
 315         dig @${ns} +tcp A ${TEST_DOMAIN} >/dev/null || return 1
 316 }
 317
 318 case "$1" in
 319         start)
 320                 # Print a nicer messagen when unbound is already running
 321                 if pidofproc -s unbound; then
 322                         statusproc /usr/sbin/unbound
 323                         exit 0
 324                 fi
 325
 326                 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 327
 328                 # Create control keys at first run
 329                 if [ ! -r "/etc/unbound/unbound_control.key" ]; then
 330                         unbound-control-setup -d /etc/unbound &>/dev/null
 331                 fi
 332
 333                 # Update configuration files
 334                 write_tuning_conf
 335                 write_interfaces_conf
 336                 write_forward_conf
 337
 338                 boot_mesg "Starting Unbound DNS Proxy..."
 339                 loadproc /usr/sbin/unbound || exit $?
 340
 341                 # Make own hostname resolveable
 342                 own_hostname
 343
 344                 # Update any known forwarding name servers
 345                 update_forwarders
 346
 347                 # Update hosts
 348                 update_hosts
 349                 ;;
 350
 351         stop)
 352                 boot_mesg "Stopping Unbound DNS Proxy..."
 353                 killproc /usr/sbin/unbound
 354                 ;;
 355
 356         restart)
 357                 $0 stop
 358                 sleep 1
 359                 $0 start
 360                 ;;
 361
 362         status)
 363                 statusproc /usr/sbin/unbound
 364                 ;;
 365
 366         update-forwarders)
 367                 update_forwarders
 368                 ;;
 369
 370         test-name-server)
 371                 ns=${2}
 372
 373                 test_name_server ${ns}
 374                 ret=${?}
 375
 376                 case "${ret}" in
 377                         0)
 378                                 echo "${ns} is validating"
 379                                 ;;
 380                         2)
 381                                 echo "${ns} is DNSSEC-aware"
 382                                 ;;
 383                         3)
 384                                 echo "${ns} is NOT DNSSEC-aware"
 385                                 ;;
 386                         *)
 387                                 echo "Test failed for an unknown reason"
 388                                 ;;
 389                 esac
 390
 391                 if ns_supports_tcp ${ns}; then
 392                         echo "${ns} supports TCP fallback"
 393                 else
 394                         echo "${ns} does not support TCP fallback"
 395                 fi
 396
 397                 exit ${ret}
 398                 ;;
 399
 400         *)
 401                 echo "Usage: $0 {start|stop|restart|status|update-forwarders|test-name-server}"
 402                 exit 1
 403                 ;;
 404 esac
 405
 406 # End $rc_base/init.d/unbound