src/initscripts/init.d/unbound

   1 #!/bin/sh
   2 # Begin $rc_base/init.d/unbound
   3
   4 # Description : Unbound DNS resolver boot script for IPfire
   5 # Author      : Marcel Lorenz <marcel.lorenz@ipfire.org>
   6
   7 . /etc/sysconfig/rc
   8 . ${rc_functions}
   9
  10 TEST_DOMAIN="ipfire.org"
  11
  12 # This domain will never validate
  13 TEST_DOMAIN_FAIL="dnssec-failed.org"
  14
  15 USE_FORWARDERS=1
  16
  17 # Cache any local zones for 60 seconds
  18 LOCAL_TTL=60
  19
  20 # Load optional configuration
  21 [ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound
  22
  23 function cidr() {
  24     local cidr nbits IFS;
  25     IFS=. read -r i1 i2 i3 i4 <<< ${1}
  26     IFS=. read -r m1 m2 m3 m4 <<< ${2}
  27     cidr=$(printf "%d.%d.%d.%d\n" "$((i1 & m1))" "$((i2 & m2))" "$((i3 & m3))" "$((i4 & m4))")
  28     nbits=0
  29     IFS=.
  30     for dec in $2 ; do
  31         case $dec in
  32             255) let nbits+=8;;
  33             254) let nbits+=7;;
  34             252) let nbits+=6;;
  35             248) let nbits+=5;;
  36             240) let nbits+=4;;
  37             224) let nbits+=3;;
  38             192) let nbits+=2;;
  39             128) let nbits+=1;;
  40             0);;
  41             *) echo "Error: $dec is not recognised"; exit 1
  42         esac
  43     done
  44     echo "${cidr}/${nbits}"
  45 }
  46
  47 read_name_servers() {
  48         local i
  49         for i in 1 2; do
  50                 echo "$(</var/ipfire/red/dns${i})"
  51         done | xargs echo
  52 }
  53
  54 config_header() {
  55         echo "# This file is automatically generated and any changes"
  56         echo "# will be overwritten. DO NOT EDIT!"
  57         echo
  58 }
  59
  60 update_forwarders() {
  61         if [ "${USE_FORWARDERS}" = "1" -a -e "/var/ipfire/red/active" ]; then
  62                 local forwarders
  63                 local broken_forwarders
  64
  65                 local ns
  66                 for ns in $(read_name_servers); do
  67                         test_name_server ${ns} &>/dev/null
  68                         case "$?" in
  69                                 # Only use DNSSEC-validating or DNSSEC-aware name servers
  70                                 0|2)
  71                                         forwarders="${forwarders} ${ns}"
  72                                         ;;
  73                                 *)
  74                                         broken_forwarders="${broken_forwarders} ${ns}"
  75                                         ;;
  76                         esac
  77                 done
  78
  79                 # Show warning for any broken upstream name servers
  80                 if [ -n "${broken_forwarders}" ]; then
  81                         boot_mesg "Ignoring broken upstream name server(s): ${broken_forwarders:1}" ${WARNING}
  82                         echo_warning
  83                 fi
  84
  85                 if [ -n "${broken_forwarders}" -a -z "${forwarders}" ]; then
  86                         boot_mesg "Falling back to recursor mode" ${WARNING}
  87                         echo_warning
  88
  89                 elif [ -n "${forwarders}" ]; then
  90                         boot_mesg "Configuring upstream name server(s): ${forwarders:1}" ${INFO}
  91                         echo_ok
  92
  93                         unbound-control -q forward ${forwarders}
  94                         return 0
  95                 fi
  96         fi
  97
  98         # If forwarders cannot be used we run in recursor mode
  99         unbound-control -q forward off
 100 }
 101
 102 update_hosts() {
 103         local enabled address hostname domainname
 104
 105         while IFS="," read -r enabled address hostname domainname; do
 106                 [ "${enabled}" = "on" ] || continue
 107
 108                 # Build FQDN
 109                 local fqdn="${hostname}.${domainname}"
 110
 111                 unbound-control -q local_data "${fqdn} ${LOCAL_TTL} IN A ${address}"
 112         done < /var/ipfire/main/hosts
 113 }
 114
 115 write_interfaces_conf() {
 116         (
 117                 config_header
 118
 119                 if [ -n "${GREEN_ADDRESS}" ]; then
 120                         echo "# GREEN"
 121                         echo "interface: ${GREEN_ADDRESS}"
 122                         echo "access-control: $(cidr ${GREEN_NETADDRESS} ${GREEN_NETMASK}) allow"
 123                 fi
 124
 125                 if [ -n "${BLUE_ADDRESS}" ]; then
 126                         echo "# BLUE"
 127                         echo "interface: ${BLUE_ADDRESS}"
 128                         echo "access-control: $(cidr ${BLUE_NETADDRESS} ${BLUE_NETMASK}) allow"
 129                 fi
 130         ) > /etc/unbound/interfaces.conf
 131 }
 132
 133 write_forward_conf() {
 134         (
 135                 config_header
 136
 137                 local enabled zone server remark
 138                 while IFS="," read -r enabled zone server remark; do
 139                         # Line must be enabled.
 140                         [ "${enabled}" = "on" ] || continue
 141
 142                         echo "forward-zone:"
 143                         echo "  name: ${zone}"
 144                         echo "  forward-addr: ${server}"
 145                         echo
 146                 done < /var/ipfire/dnsforward/config
 147         ) > /etc/unbound/forward.conf
 148 }
 149
 150 write_tuning_conf() {
 151         # https://www.unbound.net/documentation/howto_optimise.html
 152
 153         # Determine number of online processors
 154         local processors=$(getconf _NPROCESSORS_ONLN)
 155
 156         # Determine number of slabs
 157         local slabs=1
 158         while [ ${slabs} -lt ${processors} ]; do
 159                 slabs=$(( ${slabs} * 2 ))
 160         done
 161
 162         # Determine amount of system memory
 163         local mem=$(get_memory_amount)
 164
 165         # In the worst case scenario, unbound can use double the
 166         # amount of memory allocated to a cache due to malloc overhead
 167
 168         # Large systems with more than 2GB of RAM
 169         if [ ${mem} -ge 2048 ]; then
 170                 mem=128
 171
 172         # Small systems with less than 256MB of RAM
 173         elif [ ${mem} -le 256 ]; then
 174                 mem=8
 175
 176         # Everything else
 177         else
 178                 mem=32
 179         fi
 180
 181         (
 182                 config_header
 183
 184                 # We run one thread per processor
 185                 echo "num-threads: ${processors}"
 186
 187                 # Adjust number of slabs
 188                 echo "infra-cache-slabs: ${slabs}"
 189                 echo "key-cache-slabs: ${slabs}"
 190                 echo "msg-cache-slabs: ${slabs}"
 191                 echo "rrset-cache-slabs: ${slabs}"
 192
 193                 # Slice up the cache
 194                 echo "rrset-cache-size: $(( ${mem} / 2 ))m"
 195                 echo "msg-cache-size: $(( ${mem} / 4 ))m"
 196                 echo "key-cache-size: $(( ${mem} / 4 ))m"
 197         ) > /etc/unbound/tuning.conf
 198 }
 199
 200 get_memory_amount() {
 201         local key val unit
 202
 203         while read -r key val unit; do
 204                 case "${key}" in
 205                         MemTotal:*)
 206                                 # Convert to MB
 207                                 echo "$(( ${val} / 1024 ))"
 208                                 break
 209                                 ;;
 210                 esac
 211         done < /proc/meminfo
 212 }
 213
 214 test_name_server() {
 215         local ns=${1}
 216
 217         # Return codes:
 218         # 0     DNSSEC validating
 219         # 1     Error: unreachable, etc.
 220         # 2     DNSSEC aware
 221         # 3     NOT DNSSEC-aware
 222
 223         # Exit when the server is not reachable
 224         ns_is_online ${ns} || return 1
 225
 226         # Return 0 if validating
 227         ns_is_validating ${ns} && return 0
 228
 229         local errors
 230         for rr in DNSKEY DS RRSIG; do
 231                 if ! ns_forwards_${rr} ${ns}; then
 232                         errors="${errors} ${rr}"
 233                 fi
 234         done
 235
 236         if [ -n "${errors}" ]; then
 237                 echo >&2 "Unable to retrieve the following resource records from ${ns}: ${errors:1}"
 238                 return 3
 239         fi
 240
 241         # Is DNSSEC-aware
 242         return 2
 243 }
 244
 245 # Sends an A query to the nameserver w/o DNSSEC
 246 ns_is_online() {
 247         local ns=${1}
 248
 249         dig @${ns} +nodnssec A ${TEST_DOMAIN} >/dev/null
 250 }
 251
 252 # Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating
 253 ns_is_validating() {
 254         local ns=${1}
 255
 256         dig @${ns} A ${TEST_DOMAIN_FAIL} | grep -q SERVFAIL
 257 }
 258
 259 # Checks if we can retrieve the DNSKEY for this domain.
 260 # dig will print the SOA if nothing was found
 261 ns_forwards_DNSKEY() {
 262         local ns=${1}
 263
 264         dig @${ns} DNSKEY ${TEST_DOMAIN} | grep -qv SOA
 265 }
 266
 267 ns_forwards_DS() {
 268         local ns=${1}
 269
 270         dig @${ns} DS ${TEST_DOMAIN} | grep -qv SOA
 271 }
 272
 273 ns_forwards_RRSIG() {
 274         local ns=${1}
 275
 276         dig @${ns} +dnssec A ${TEST_DOMAIN} | grep -q RRSIG
 277 }
 278
 279 ns_supports_tcp() {
 280         local ns=${1}
 281
 282         dig @${ns} +tcp A ${TEST_DOMAIN} >/dev/null || return 1
 283 }
 284
 285 case "$1" in
 286         start)
 287                 # Print a nicer messagen when unbound is already running
 288                 if pidofproc -s unbound; then
 289                         statusproc /usr/sbin/unbound
 290                         exit 0
 291                 fi
 292
 293                 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 294
 295                 # Create control keys at first run
 296                 if [ ! -r "/etc/unbound/unbound_control.key" ]; then
 297                         unbound-control-setup -d /etc/unbound &>/dev/null
 298                 fi
 299
 300                 # Update configuration files
 301                 write_tuning_conf
 302                 write_interfaces_conf
 303                 write_forward_conf
 304
 305                 boot_mesg "Starting Unbound DNS Proxy..."
 306                 loadproc /usr/sbin/unbound || exit $?
 307
 308                 # Update any known forwarding name servers
 309                 update_forwarders
 310
 311                 # Update hosts
 312                 update_hosts
 313                 ;;
 314
 315         stop)
 316                 boot_mesg "Stopping Unbound DNS Proxy..."
 317                 killproc /usr/sbin/unbound
 318                 ;;
 319
 320         restart)
 321                 $0 stop
 322                 sleep 1
 323                 $0 start
 324                 ;;
 325
 326         status)
 327                 statusproc /usr/sbin/unbound
 328                 ;;
 329
 330         update-forwarders)
 331                 update_forwarders
 332                 ;;
 333
 334         test-name-server)
 335                 ns=${2}
 336
 337                 test_name_server ${ns}
 338                 ret=${?}
 339
 340                 case "${ret}" in
 341                         0)
 342                                 echo "${ns} is validating"
 343                                 ;;
 344                         2)
 345                                 echo "${ns} is DNSSEC-aware"
 346                                 ;;
 347                         3)
 348                                 echo "${ns} is NOT DNSSEC-aware"
 349                                 ;;
 350                         *)
 351                                 echo "Test failed for an unknown reason"
 352                                 ;;
 353                 esac
 354
 355                 if ns_supports_tcp ${ns}; then
 356                         echo "${ns} supports TCP fallback"
 357                 else
 358                         echo "${ns} does not support TCP fallback"
 359                 fi
 360
 361                 exit ${ret}
 362                 ;;
 363
 364         *)
 365                 echo "Usage: $0 {start|stop|restart|status|update-forwarders|test-name-server}"
 366                 exit 1
 367                 ;;
 368 esac
 369
 370 # End $rc_base/init.d/unbound