src/initscripts/system/unbound

   1 #!/bin/sh
   2 # Begin $rc_base/init.d/unbound
   3
   4 # Description : Unbound DNS resolver boot script for IPfire
   5 # Author      : Marcel Lorenz <marcel.lorenz@ipfire.org>
   6
   7 . /etc/sysconfig/rc
   8 . ${rc_functions}
   9
  10 TEST_DOMAIN="ipfire.org"
  11
  12 # This domain will never validate
  13 TEST_DOMAIN_FAIL="dnssec-failed.org"
  14
  15 INSECURE_ZONES=
  16 USE_FORWARDERS=1
  17
  18 # Cache any local zones for 60 seconds
  19 LOCAL_TTL=60
  20
  21 # EDNS buffer size
  22 EDNS_DEFAULT_BUFFER_SIZE=4096
  23
  24 # Load optional configuration
  25 [ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound
  26
  27 function cidr() {
  28     local cidr nbits IFS;
  29     IFS=. read -r i1 i2 i3 i4 <<< ${1}
  30     IFS=. read -r m1 m2 m3 m4 <<< ${2}
  31     cidr=$(printf "%d.%d.%d.%d\n" "$((i1 & m1))" "$((i2 & m2))" "$((i3 & m3))" "$((i4 & m4))")
  32     nbits=0
  33     IFS=.
  34     for dec in $2 ; do
  35         case $dec in
  36             255) let nbits+=8;;
  37             254) let nbits+=7;;
  38             252) let nbits+=6;;
  39             248) let nbits+=5;;
  40             240) let nbits+=4;;
  41             224) let nbits+=3;;
  42             192) let nbits+=2;;
  43             128) let nbits+=1;;
  44             0);;
  45             *) echo "Error: $dec is not recognised"; exit 1
  46         esac
  47     done
  48     echo "${cidr}/${nbits}"
  49 }
  50
  51 ip_address_revptr() {
  52         local addr=${1}
  53
  54         local a1 a2 a3 a4
  55         IFS=. read -r a1 a2 a3 a4 <<< ${addr}
  56
  57         echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
  58 }
  59
  60 read_name_servers() {
  61         local i
  62         for i in 1 2; do
  63                 echo "$(</var/ipfire/red/dns${i})"
  64         done 2>/dev/null | xargs echo
  65 }
  66
  67 config_header() {
  68         echo "# This file is automatically generated and any changes"
  69         echo "# will be overwritten. DO NOT EDIT!"
  70         echo
  71 }
  72
  73 update_forwarders() {
  74         if [ "${USE_FORWARDERS}" = "1" -a -e "/var/ipfire/red/active" ]; then
  75                 local forwarders
  76                 local broken_forwarders
  77
  78                 local ns
  79                 for ns in $(read_name_servers); do
  80                         test_name_server ${ns} &>/dev/null
  81                         case "$?" in
  82                                 # Only use DNSSEC-validating or DNSSEC-aware name servers
  83                                 0|2)
  84                                         forwarders="${forwarders} ${ns}"
  85                                         ;;
  86                                 *)
  87                                         broken_forwarders="${broken_forwarders} ${ns}"
  88                                         ;;
  89                         esac
  90                 done
  91
  92                 # Determine EDNS buffer size
  93                 local new_edns_buffer_size=${EDNS_DEFAULT_BUFFER_SIZE}
  94
  95                 for ns in ${forwarders}; do
  96                         local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
  97                         if [ -n "${edns_buffer_size}" ]; then
  98                                 if [ ${edns_buffer_size} -lt ${new_edns_buffer_size} ]; then
  99                                         new_edns_buffer_size=${edns_buffer_size}
 100                                 fi
 101                         fi
 102                 done
 103
 104                 if [ ${new_edns_buffer_size} -lt ${EDNS_DEFAULT_BUFFER_SIZE} ]; then
 105                         boot_mesg "EDNS buffer size reduced to ${new_edns_buffer_size}" ${WARNING}
 106                         echo_warning
 107
 108                         unbound-control -q set_option edns-buffer-size: ${new_edns_buffer_size}
 109                 fi
 110
 111                 # Show warning for any broken upstream name servers
 112                 if [ -n "${broken_forwarders}" ]; then
 113                         boot_mesg "Ignoring broken upstream name server(s): ${broken_forwarders:1}" ${WARNING}
 114                         echo_warning
 115                 fi
 116
 117                 if [ -n "${forwarders}" ]; then
 118                         boot_mesg "Configuring upstream name server(s): ${forwarders:1}" ${INFO}
 119                         echo_ok
 120
 121                         # Make sure DNSSEC is activated
 122                         enable_dnssec
 123
 124                         echo "${forwarders}" > /var/ipfire/red/dns
 125                         unbound-control -q forward ${forwarders}
 126                         return 0
 127
 128                 # In case we have found no working forwarders
 129                 else
 130                         # Test if the recursor mode is available
 131                         if can_resolve_root +bufsize=${new_edns_buffer_size}; then
 132                                 # Make sure DNSSEC is activated
 133                                 enable_dnssec
 134
 135                                 boot_mesg "Falling back to recursor mode" ${WARNING}
 136                                 echo_warning
 137
 138                         # If not, we set DNSSEC in permissive mode and allow using all recursors
 139                         elif [ -n "${broken_forwarders}" ]; then
 140                                 disable_dnssec
 141
 142                                 boot_mesg "DNSSEC has been set to permissive mode" ${FAILURE}
 143                                 echo_failure
 144
 145                                 echo "${broken_forwarders}" > /var/ipfire/red/dns
 146                                 unbound-control -q forward ${broken_forwarders}
 147                                 return 0
 148                         fi
 149                 fi
 150         fi
 151
 152         # If forwarders cannot be used we run in recursor mode
 153         echo "local recursor" > /var/ipfire/red/dns
 154         unbound-control -q forward off
 155 }
 156
 157 own_hostname() {
 158         local hostname=$(hostname -f)
 159         # 1.1.1.1 is reserved for unused green, skip this
 160         if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
 161                 unbound-control -q local_data "${hostname} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}"
 162         fi
 163
 164         local address
 165         for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
 166                 [ -n "${address}" ] || continue
 167                 [ "${address}" = "1.1.1.1" ] && continue
 168
 169                 address=$(ip_address_revptr ${address})
 170                 unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${hostname}"
 171         done
 172 }
 173
 174 update_hosts() {
 175         local enabled address hostname domainname generateptr
 176
 177         while IFS="," read -r enabled address hostname domainname generateptr; do
 178                 [ "${enabled}" = "on" ] || continue
 179
 180                 # Build FQDN
 181                 local fqdn="${hostname}.${domainname}"
 182
 183                 unbound-control -q local_data "${fqdn} ${LOCAL_TTL} IN A ${address}"
 184
 185                 # Skip reverse resolution if the address equals the GREEN address
 186                 [ "${address}" = "${GREEN_ADDRESS}" ] && continue
 187
 188                 # Skip reverse resolution if user requested not to do so
 189                 [ "${generateptr}" = "off" ] && continue
 190
 191                 # Add RDNS
 192                 address=$(ip_address_revptr ${address})
 193                 unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${fqdn}"
 194         done < /var/ipfire/main/hosts
 195 }
 196
 197 write_forward_conf() {
 198         (
 199                 config_header
 200
 201                 local insecure_zones="${INSECURE_ZONES}"
 202
 203                 local enabled zone server servers remark disable_dnssec rest
 204                 while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
 205                         # Line must be enabled.
 206                         [ "${enabled}" = "on" ] || continue
 207
 208                         # Zones that end with .local are commonly used for internal
 209                         # zones and therefore not signed
 210                         case "${zone}" in
 211                                 *.local)
 212                                         insecure_zones="${insecure_zones} ${zone}"
 213                                         ;;
 214                                 *)
 215                                         if [ "${disable_dnssec}" = "on" ]; then
 216                                                 insecure_zones="${insecure_zones} ${zone}"
 217                                         fi
 218                                         ;;
 219                         esac
 220
 221                         # Reverse-lookup zones must be stubs
 222                         case "${zone}" in
 223                                 *.in-addr.arpa)
 224                                         echo "stub-zone:"
 225                                         echo "  name: ${zone}"
 226                                         for server in ${servers//|/ }; do
 227                                                 if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
 228                                                         echo "  stub-addr: ${server}"
 229                                                 else
 230                                                         echo "  stub-host: ${server}"
 231                                                 fi
 232                                         done
 233                                         echo
 234                                         echo "server:"
 235                                         echo "  local-zone: \"${zone}\" transparent"
 236                                         echo
 237                                         ;;
 238                                 *)
 239                                         echo "forward-zone:"
 240                                         echo "  name: ${zone}"
 241                                         for server in ${servers//|/ }; do
 242                                                 if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
 243                                                         echo "  forward-addr: ${server}"
 244                                                 else
 245                                                         echo "  forward-host: ${server}"
 246                                                 fi
 247                                         done
 248                                         echo
 249                                         ;;
 250                         esac
 251                 done < /var/ipfire/dnsforward/config
 252
 253                 if [ -n "${insecure_zones}" ]; then
 254                         echo "server:"
 255
 256                         for zone in ${insecure_zones}; do
 257                                 echo "  domain-insecure: ${zone}"
 258                         done
 259                 fi
 260         ) > /etc/unbound/forward.conf
 261 }
 262
 263 write_tuning_conf() {
 264         # https://www.unbound.net/documentation/howto_optimise.html
 265
 266         # Determine number of online processors
 267         local processors=$(getconf _NPROCESSORS_ONLN)
 268
 269         # Determine number of slabs
 270         local slabs=1
 271         while [ ${slabs} -lt ${processors} ]; do
 272                 slabs=$(( ${slabs} * 2 ))
 273         done
 274
 275         # Determine amount of system memory
 276         local mem=$(get_memory_amount)
 277
 278         # In the worst case scenario, unbound can use double the
 279         # amount of memory allocated to a cache due to malloc overhead
 280
 281         # Even larger systems with more than 8GB of RAM
 282         if [ ${mem} -ge 8192 ]; then
 283                 mem=1024
 284
 285         # Extra large systems with more than 4GB of RAM
 286         elif [ ${mem} -ge 4096 ]; then
 287                 mem=512
 288
 289         # Large systems with more than 2GB of RAM
 290         elif [ ${mem} -ge 2048 ]; then
 291                 mem=256
 292
 293         # Medium systems with more than 1GB of RAM
 294         elif [ ${mem} -ge 1024 ]; then
 295                 mem=128
 296
 297         # Small systems with less than 256MB of RAM
 298         elif [ ${mem} -le 256 ]; then
 299                 mem=16
 300
 301         # Everything else
 302         else
 303                 mem=64
 304         fi
 305
 306         (
 307                 config_header
 308
 309                 # We run one thread per processor
 310                 echo "num-threads: ${processors}"
 311                 echo "so-reuseport: yes"
 312
 313                 # Adjust number of slabs
 314                 echo "infra-cache-slabs: ${slabs}"
 315                 echo "key-cache-slabs: ${slabs}"
 316                 echo "msg-cache-slabs: ${slabs}"
 317                 echo "rrset-cache-slabs: ${slabs}"
 318
 319                 # Slice up the cache
 320                 echo "rrset-cache-size: $(( ${mem} / 2 ))m"
 321                 echo "msg-cache-size: $(( ${mem} / 4 ))m"
 322                 echo "key-cache-size: $(( ${mem} / 4 ))m"
 323
 324                 # Increase parallel queries
 325                 echo "outgoing-range: 8192"
 326                 echo "num-queries-per-thread: 4096"
 327
 328                 # Use larger send/receive buffers
 329                 echo "so-sndbuf: 4m"
 330                 echo "so-rcvbuf: 4m"
 331         ) > /etc/unbound/tuning.conf
 332 }
 333
 334 get_memory_amount() {
 335         local key val unit
 336
 337         while read -r key val unit; do
 338                 case "${key}" in
 339                         MemTotal:*)
 340                                 # Convert to MB
 341                                 echo "$(( ${val} / 1024 ))"
 342                                 break
 343                                 ;;
 344                 esac
 345         done < /proc/meminfo
 346 }
 347
 348 test_name_server() {
 349         local ns=${1}
 350         local args
 351
 352         # Return codes:
 353         # 0     DNSSEC validating
 354         # 1     Error: unreachable, etc.
 355         # 2     DNSSEC aware
 356         # 3     NOT DNSSEC-aware
 357
 358         # Exit when the server is not reachable
 359         ns_is_online ${ns} || return 1
 360
 361         # Determine the maximum edns buffer size that works
 362         local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
 363         if [ -n "${edns_buffer_size}" ]; then
 364                 args="${args} +bufsize=${edns_buffer_size}"
 365         fi
 366
 367         local errors
 368         for rr in DNSKEY DS RRSIG; do
 369                 if ! ns_forwards_${rr} ${ns} ${args}; then
 370                         errors="${errors} ${rr}"
 371                 fi
 372         done
 373
 374         if [ -n "${errors}" ]; then
 375                 echo >&2 "Unable to retrieve the following resource records from ${ns}: ${errors:1}"
 376                 return 3
 377         fi
 378
 379         if ns_is_validating ${ns} ${args}; then
 380                 # Return 0 if validating
 381                 return 0
 382         else
 383                 # Is DNSSEC-aware
 384                 return 2
 385         fi
 386 }
 387
 388 # Sends an A query to the nameserver w/o DNSSEC
 389 ns_is_online() {
 390         local ns=${1}
 391         shift
 392
 393         dig @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null
 394 }
 395
 396 # Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating
 397 ns_is_validating() {
 398         local ns=${1}
 399         shift
 400
 401         if ! dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL; then
 402                 return 1
 403         else
 404                 # Determine if NS replies with "ad" data flag if DNSSEC enabled
 405                 dig @${ns} +dnssec SOA ${TEST_DOMAIN} $@ | awk -F: '/\;\;\ flags\:/ { s=1; if (/\ ad/) s=0; exit s }'
 406         fi
 407 }
 408
 409 # Checks if we can retrieve the DNSKEY for this domain.
 410 # dig will print the SOA if nothing was found
 411 ns_forwards_DNSKEY() {
 412         local ns=${1}
 413         shift
 414
 415         dig @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA
 416 }
 417
 418 ns_forwards_DS() {
 419         local ns=${1}
 420         shift
 421
 422         dig @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA
 423 }
 424
 425 ns_forwards_RRSIG() {
 426         local ns=${1}
 427         shift
 428
 429         dig @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG
 430 }
 431
 432 ns_supports_tcp() {
 433         local ns=${1}
 434         shift
 435
 436         dig @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1
 437 }
 438
 439 ns_determine_edns_buffer_size() {
 440         local ns=${1}
 441         shift
 442
 443         local b
 444         for b in 4096 2048 1500 1480 1464 1400 1280 512; do
 445                 if dig @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then
 446                         echo "${b}"
 447                         return 0
 448                 fi
 449         done
 450
 451         return 1
 452 }
 453
 454 get_root_nameservers() {
 455         while read -r hostname ttl record address; do
 456                 # Searching for A records
 457                 [ "${record}" = "A" ] || continue
 458
 459                 echo "${address}"
 460         done < /etc/unbound/root.hints
 461 }
 462
 463 can_resolve_root() {
 464         local ns
 465         for ns in $(get_root_nameservers); do
 466                 if dig @${ns} +dnssec SOA . $@ >/dev/null; then
 467                         return 0
 468                 fi
 469         done
 470
 471         # none of the servers was reachable
 472         return 1
 473 }
 474
 475 enable_dnssec() {
 476         local status=$(unbound-control get_option val-permissive-mode)
 477
 478         # Log DNSSEC status
 479         echo "on" > /var/ipfire/red/dnssec-status
 480
 481         # Don't do anything if DNSSEC is already activated
 482         [ "${status}" = "no" ] && return 0
 483
 484         # Activate DNSSEC and flush cache with any stale and unvalidated data
 485         unbound-control -q set_option val-permissive-mode: no
 486         unbound-control -q flush_zone .
 487 }
 488
 489 disable_dnssec() {
 490         # Log DNSSEC status
 491         echo "off" > /var/ipfire/red/dnssec-status
 492
 493         unbound-control -q set_option val-permissive-mode: yes
 494 }
 495
 496 fix_time_if_dns_fail() {
 497         # If DNS still not work try to init ntp with
 498         # hardcoded ntp.ipfire.org (81.3.27.46)
 499         if [ -e /var/ipfire/red/active ]; then
 500                 host 0.ipfire.pool.ntp.org > /dev/null 2>&1
 501                 if [ "${?}" != "0" ]; then
 502                         boot_mesg "DNS still not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
 503                         loadproc /usr/local/bin/settime 81.3.27.46
 504                 fi
 505         fi
 506 }
 507
 508 case "$1" in
 509         start)
 510                 # Print a nicer messagen when unbound is already running
 511                 if pidofproc -s unbound; then
 512                         statusproc /usr/sbin/unbound
 513                         exit 0
 514                 fi
 515
 516                 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 517
 518                 # Update configuration files
 519                 write_tuning_conf
 520                 write_forward_conf
 521
 522                 boot_mesg "Starting Unbound DNS Proxy..."
 523                 loadproc /usr/sbin/unbound || exit $?
 524
 525                 # Make own hostname resolveable
 526                 own_hostname
 527
 528                 # Update any known forwarding name servers
 529                 update_forwarders
 530
 531                 # Update hosts
 532                 update_hosts
 533
 534                 fix_time_if_dns_fail
 535                 ;;
 536
 537         stop)
 538                 boot_mesg "Stopping Unbound DNS Proxy..."
 539                 killproc /usr/sbin/unbound
 540                 ;;
 541
 542         restart)
 543                 $0 stop
 544                 sleep 1
 545                 $0 start
 546                 ;;
 547
 548         status)
 549                 statusproc /usr/sbin/unbound
 550                 ;;
 551
 552         update-forwarders)
 553                 # Do not try updating forwarders when unbound is not running
 554                 if ! pgrep unbound &>/dev/null; then
 555                         exit 0
 556                 fi
 557
 558                 update_forwarders
 559
 560                 unbound-control flush_negative > /dev/null
 561                 unbound-control flush_bogus > /dev/null
 562
 563                 fix_time_if_dns_fail
 564                 ;;
 565
 566         test-name-server)
 567                 ns=${2}
 568
 569                 test_name_server ${ns}
 570                 ret=${?}
 571
 572                 case "${ret}" in
 573                         0)
 574                                 echo "${ns} is validating"
 575                                 ;;
 576                         2)
 577                                 echo "${ns} is DNSSEC-aware"
 578                                 ;;
 579                         3)
 580                                 echo "${ns} is NOT DNSSEC-aware"
 581                                 ;;
 582                         *)
 583                                 echo "Test failed for an unknown reason"
 584                                 exit ${ret}
 585                                 ;;
 586                 esac
 587
 588                 if ns_supports_tcp ${ns}; then
 589                         echo "${ns} supports TCP fallback"
 590                 else
 591                         echo "${ns} does not support TCP fallback"
 592                 fi
 593
 594                 edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
 595                 if [ -n "${edns_buffer_size}" ]; then
 596                         echo "EDNS buffer size for ${ns}: ${edns_buffer_size}"
 597                 fi
 598
 599                 exit ${ret}
 600                 ;;
 601
 602         *)
 603                 echo "Usage: $0 {start|stop|restart|status|update-forwarders|test-name-server}"
 604                 exit 1
 605                 ;;
 606 esac
 607
 608 # End $rc_base/init.d/unbound