src/initscripts/system/unbound

   1 #!/bin/sh
   2 # Begin $rc_base/init.d/unbound
   3
   4 # Description : Unbound DNS resolver boot script for IPfire
   5 # Author      : Marcel Lorenz <marcel.lorenz@ipfire.org>
   6
   7 . /etc/sysconfig/rc
   8 . ${rc_functions}
   9
  10 TEST_DOMAIN="ipfire.org"
  11
  12 # This domain will never validate
  13 TEST_DOMAIN_FAIL="dnssec-failed.org"
  14
  15 INSECURE_ZONES=
  16 USE_FORWARDERS=1
  17
  18 # Cache any local zones for 60 seconds
  19 LOCAL_TTL=60
  20
  21 # EDNS buffer size
  22 EDNS_DEFAULT_BUFFER_SIZE=4096
  23
  24 # Load optional configuration
  25 [ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound
  26
  27 function cidr() {
  28     local cidr nbits IFS;
  29     IFS=. read -r i1 i2 i3 i4 <<< ${1}
  30     IFS=. read -r m1 m2 m3 m4 <<< ${2}
  31     cidr=$(printf "%d.%d.%d.%d\n" "$((i1 & m1))" "$((i2 & m2))" "$((i3 & m3))" "$((i4 & m4))")
  32     nbits=0
  33     IFS=.
  34     for dec in $2 ; do
  35         case $dec in
  36             255) let nbits+=8;;
  37             254) let nbits+=7;;
  38             252) let nbits+=6;;
  39             248) let nbits+=5;;
  40             240) let nbits+=4;;
  41             224) let nbits+=3;;
  42             192) let nbits+=2;;
  43             128) let nbits+=1;;
  44             0);;
  45             *) echo "Error: $dec is not recognised"; exit 1
  46         esac
  47     done
  48     echo "${cidr}/${nbits}"
  49 }
  50
  51 ip_address_revptr() {
  52         local addr=${1}
  53
  54         local a1 a2 a3 a4
  55         IFS=. read -r a1 a2 a3 a4 <<< ${addr}
  56
  57         echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
  58 }
  59
  60 read_name_servers() {
  61         local i
  62         for i in 1 2; do
  63                 echo "$(</var/ipfire/red/dns${i})"
  64         done | xargs echo
  65 }
  66
  67 config_header() {
  68         echo "# This file is automatically generated and any changes"
  69         echo "# will be overwritten. DO NOT EDIT!"
  70         echo
  71 }
  72
  73 update_forwarders() {
  74         if [ "${USE_FORWARDERS}" = "1" -a -e "/var/ipfire/red/active" ]; then
  75                 local forwarders
  76                 local broken_forwarders
  77
  78                 local ns
  79                 for ns in $(read_name_servers); do
  80                         test_name_server ${ns} &>/dev/null
  81                         case "$?" in
  82                                 # Only use DNSSEC-validating or DNSSEC-aware name servers
  83                                 0|2)
  84                                         forwarders="${forwarders} ${ns}"
  85                                         ;;
  86                                 *)
  87                                         broken_forwarders="${broken_forwarders} ${ns}"
  88                                         ;;
  89                         esac
  90                 done
  91
  92                 # Determine EDNS buffer size
  93                 local new_edns_buffer_size=${EDNS_DEFAULT_BUFFER_SIZE}
  94
  95                 for ns in ${forwarders}; do
  96                         local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
  97                         if [ -n "${edns_buffer_size}" ]; then
  98                                 if [ ${edns_buffer_size} -lt ${new_edns_buffer_size} ]; then
  99                                         new_edns_buffer_size=${edns_buffer_size}
 100                                 fi
 101                         fi
 102                 done
 103
 104                 if [ ${new_edns_buffer_size} -lt ${EDNS_DEFAULT_BUFFER_SIZE} ]; then
 105                         boot_mesg "EDNS buffer size reduced to ${new_edns_buffer_size}" ${WARNING}
 106                         echo_warning
 107
 108                         unbound-control -q set_option edns-buffer-size: ${new_edns_buffer_size}
 109                 fi
 110
 111                 # Show warning for any broken upstream name servers
 112                 if [ -n "${broken_forwarders}" ]; then
 113                         boot_mesg "Ignoring broken upstream name server(s): ${broken_forwarders:1}" ${WARNING}
 114                         echo_warning
 115                 fi
 116
 117                 if [ -n "${broken_forwarders}" -a -z "${forwarders}" ]; then
 118                         boot_mesg "Falling back to recursor mode" ${WARNING}
 119                         echo_warning
 120
 121                 elif [ -n "${forwarders}" ]; then
 122                         boot_mesg "Configuring upstream name server(s): ${forwarders:1}" ${INFO}
 123                         echo_ok
 124
 125                         echo "${forwarders}" > /var/ipfire/red/dns
 126                         unbound-control -q forward ${forwarders}
 127                         return 0
 128                 fi
 129         fi
 130
 131         # If forwarders cannot be used we run in recursor mode
 132         echo "local recursor" > /var/ipfire/red/dns
 133         unbound-control -q forward off
 134 }
 135
 136 own_hostname() {
 137         local hostname=$(hostname -f)
 138         # 1.1.1.1 is reserved for unused green, skip this
 139         if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
 140                 unbound-control -q local_data "${hostname} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}"
 141         fi
 142
 143         local address
 144         for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
 145                 [ -n "${address}" ] || continue
 146                 [ "${address}" = "1.1.1.1" ] && continue
 147
 148                 address=$(ip_address_revptr ${address})
 149                 unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${hostname}"
 150         done
 151 }
 152
 153 update_hosts() {
 154         local enabled address hostname domainname
 155
 156         while IFS="," read -r enabled address hostname domainname; do
 157                 [ "${enabled}" = "on" ] || continue
 158
 159                 # Build FQDN
 160                 local fqdn="${hostname}.${domainname}"
 161
 162                 unbound-control -q local_data "${fqdn} ${LOCAL_TTL} IN A ${address}"
 163
 164                 # Skip reverse resolution if the address equals the GREEN address
 165                 [ "${address}" = "${GREEN_ADDRESS}" ] && continue
 166
 167                 # Add RDNS
 168                 address=$(ip_address_revptr ${address})
 169                 unbound-control -q local_data "${address} ${LOCAL_TTL} IN PTR ${fqdn}"
 170         done < /var/ipfire/main/hosts
 171 }
 172
 173 write_forward_conf() {
 174         (
 175                 config_header
 176
 177                 local insecure_zones="${INSECURE_ZONES}"
 178
 179                 local enabled zone server remark
 180                 while IFS="," read -r enabled zone server remark; do
 181                         # Line must be enabled.
 182                         [ "${enabled}" = "on" ] || continue
 183
 184                         # Zones that end with .local are commonly used for internal
 185                         # zones and therefore not signed
 186                         case "${zone}" in
 187                                 *.local)
 188                                         insecure_zones="${insecure_zones} ${zone}"
 189                                         ;;
 190                         esac
 191
 192                         echo "forward-zone:"
 193                         echo "  name: ${zone}"
 194                         echo "  forward-addr: ${server}"
 195                         echo
 196                 done < /var/ipfire/dnsforward/config
 197
 198                 if [ -n "${insecure_zones}" ]; then
 199                         echo "server:"
 200
 201                         for zone in ${insecure_zones}; do
 202                                 echo "  domain-insecure: ${zone}"
 203                         done
 204                 fi
 205         ) > /etc/unbound/forward.conf
 206 }
 207
 208 write_tuning_conf() {
 209         # https://www.unbound.net/documentation/howto_optimise.html
 210
 211         # Determine number of online processors
 212         local processors=$(getconf _NPROCESSORS_ONLN)
 213
 214         # Determine number of slabs
 215         local slabs=1
 216         while [ ${slabs} -lt ${processors} ]; do
 217                 slabs=$(( ${slabs} * 2 ))
 218         done
 219
 220         # Determine amount of system memory
 221         local mem=$(get_memory_amount)
 222
 223         # In the worst case scenario, unbound can use double the
 224         # amount of memory allocated to a cache due to malloc overhead
 225
 226         # Large systems with more than 2GB of RAM
 227         if [ ${mem} -ge 2048 ]; then
 228                 mem=128
 229
 230         # Small systems with less than 256MB of RAM
 231         elif [ ${mem} -le 256 ]; then
 232                 mem=8
 233
 234         # Everything else
 235         else
 236                 mem=32
 237         fi
 238
 239         (
 240                 config_header
 241
 242                 # We run one thread per processor
 243                 echo "num-threads: ${processors}"
 244
 245                 # Adjust number of slabs
 246                 echo "infra-cache-slabs: ${slabs}"
 247                 echo "key-cache-slabs: ${slabs}"
 248                 echo "msg-cache-slabs: ${slabs}"
 249                 echo "rrset-cache-slabs: ${slabs}"
 250
 251                 # Slice up the cache
 252                 echo "rrset-cache-size: $(( ${mem} / 2 ))m"
 253                 echo "msg-cache-size: $(( ${mem} / 4 ))m"
 254                 echo "key-cache-size: $(( ${mem} / 4 ))m"
 255         ) > /etc/unbound/tuning.conf
 256 }
 257
 258 get_memory_amount() {
 259         local key val unit
 260
 261         while read -r key val unit; do
 262                 case "${key}" in
 263                         MemTotal:*)
 264                                 # Convert to MB
 265                                 echo "$(( ${val} / 1024 ))"
 266                                 break
 267                                 ;;
 268                 esac
 269         done < /proc/meminfo
 270 }
 271
 272 test_name_server() {
 273         local ns=${1}
 274         local args
 275
 276         # Return codes:
 277         # 0     DNSSEC validating
 278         # 1     Error: unreachable, etc.
 279         # 2     DNSSEC aware
 280         # 3     NOT DNSSEC-aware
 281
 282         # Exit when the server is not reachable
 283         ns_is_online ${ns} || return 1
 284
 285         # Determine the maximum edns buffer size that works
 286         local edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
 287         if [ -n "${edns_buffer_size}" ]; then
 288                 args="${args} +bufsize=${edns_buffer_size}"
 289         fi
 290
 291         local errors
 292         for rr in DNSKEY DS RRSIG; do
 293                 if ! ns_forwards_${rr} ${ns} ${args}; then
 294                         errors="${errors} ${rr}"
 295                 fi
 296         done
 297
 298         if [ -n "${errors}" ]; then
 299                 echo >&2 "Unable to retrieve the following resource records from ${ns}: ${errors:1}"
 300                 return 3
 301         fi
 302
 303         if ns_is_validating ${ns} ${args}; then
 304                 # Return 0 if validating
 305                 return 0
 306         else
 307                 # Is DNSSEC-aware
 308                 return 2
 309         fi
 310 }
 311
 312 # Sends an A query to the nameserver w/o DNSSEC
 313 ns_is_online() {
 314         local ns=${1}
 315         shift
 316
 317         dig @${ns} +nodnssec A ${TEST_DOMAIN} $@ >/dev/null
 318 }
 319
 320 # Resolving ${TEST_DOMAIN_FAIL} will fail if the nameserver is validating
 321 ns_is_validating() {
 322         local ns=${1}
 323         shift
 324
 325         dig @${ns} A ${TEST_DOMAIN_FAIL} $@ | grep -q SERVFAIL
 326 }
 327
 328 # Checks if we can retrieve the DNSKEY for this domain.
 329 # dig will print the SOA if nothing was found
 330 ns_forwards_DNSKEY() {
 331         local ns=${1}
 332         shift
 333
 334         dig @${ns} DNSKEY ${TEST_DOMAIN} $@ | grep -qv SOA
 335 }
 336
 337 ns_forwards_DS() {
 338         local ns=${1}
 339         shift
 340
 341         dig @${ns} DS ${TEST_DOMAIN} $@ | grep -qv SOA
 342 }
 343
 344 ns_forwards_RRSIG() {
 345         local ns=${1}
 346         shift
 347
 348         dig @${ns} +dnssec A ${TEST_DOMAIN} $@ | grep -q RRSIG
 349 }
 350
 351 ns_supports_tcp() {
 352         local ns=${1}
 353         shift
 354
 355         dig @${ns} +tcp A ${TEST_DOMAIN} $@ >/dev/null || return 1
 356 }
 357
 358 ns_determine_edns_buffer_size() {
 359         local ns=${1}
 360         shift
 361
 362         local b
 363         for b in 4096 2048 1500 1480 1464 1400 1280 512; do
 364                 if dig @${ns} +dnssec +bufsize=${b} A ${TEST_DOMAIN} $@ >/dev/null; then
 365                         echo "${b}"
 366                         return 0
 367                 fi
 368         done
 369
 370         return 1
 371 }
 372
 373 case "$1" in
 374         start)
 375                 # Print a nicer messagen when unbound is already running
 376                 if pidofproc -s unbound; then
 377                         statusproc /usr/sbin/unbound
 378                         exit 0
 379                 fi
 380
 381                 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 382
 383                 # Create control keys at first run
 384                 if [ ! -r "/etc/unbound/unbound_control.key" ]; then
 385                         unbound-control-setup -d /etc/unbound &>/dev/null
 386                 fi
 387
 388                 # Update configuration files
 389                 write_tuning_conf
 390                 write_forward_conf
 391
 392                 boot_mesg "Starting Unbound DNS Proxy..."
 393                 loadproc /usr/sbin/unbound || exit $?
 394
 395                 # Make own hostname resolveable
 396                 own_hostname
 397
 398                 # Update any known forwarding name servers
 399                 update_forwarders
 400
 401                 # Update hosts
 402                 update_hosts
 403                 ;;
 404
 405         stop)
 406                 boot_mesg "Stopping Unbound DNS Proxy..."
 407                 killproc /usr/sbin/unbound
 408                 ;;
 409
 410         restart)
 411                 $0 stop
 412                 sleep 1
 413                 $0 start
 414                 ;;
 415
 416         status)
 417                 statusproc /usr/sbin/unbound
 418                 ;;
 419
 420         update-forwarders)
 421                 # Do not try updating forwarders when unbound is not running
 422                 if ! pgrep unbound &>/dev/null; then
 423                         exit 0
 424                 fi
 425
 426                 update_forwarders
 427                 ;;
 428
 429         test-name-server)
 430                 ns=${2}
 431
 432                 test_name_server ${ns}
 433                 ret=${?}
 434
 435                 case "${ret}" in
 436                         0)
 437                                 echo "${ns} is validating"
 438                                 ;;
 439                         2)
 440                                 echo "${ns} is DNSSEC-aware"
 441                                 ;;
 442                         3)
 443                                 echo "${ns} is NOT DNSSEC-aware"
 444                                 ;;
 445                         *)
 446                                 echo "Test failed for an unknown reason"
 447                                 exit ${ret}
 448                                 ;;
 449                 esac
 450
 451                 if ns_supports_tcp ${ns}; then
 452                         echo "${ns} supports TCP fallback"
 453                 else
 454                         echo "${ns} does not support TCP fallback"
 455                 fi
 456
 457                 edns_buffer_size=$(ns_determine_edns_buffer_size ${ns})
 458                 if [ -n "${edns_buffer_size}" ]; then
 459                         echo "EDNS buffer size for ${ns}: ${edns_buffer_size}"
 460                 fi
 461
 462                 exit ${ret}
 463                 ;;
 464
 465         *)
 466                 echo "Usage: $0 {start|stop|restart|status|update-forwarders|test-name-server}"
 467                 exit 1
 468                 ;;
 469 esac
 470
 471 # End $rc_base/init.d/unbound