unbound: Fix reverse lookup zones

These should be stubs and overlay the internal zones that
unbound comes with.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Fixes: #11625

diff --git a/src/initscripts/system/unbound b/src/initscripts/system/unbound
index 4e7e63e5fa72727f2d7c80079bc35ea0b15ec9d0..a46999992a2b99b91cfe3d7b8b2466614dda3d24 100644 (file)
--- a/src/initscripts/system/unbound
+++ b/src/initscripts/system/unbound
@@ -210,10 +210,24 @@ write_forward_conf() {
                                        ;;
                        esac
 
-                       echo "forward-zone:"
-                       echo "  name: ${zone}"
-                       echo "  forward-addr: ${server}"
-                       echo
+                       # Reverse-lookup zones must be stubs
+                       case "${zone}" in
+                               *.in-addr.arpa)
+                                       echo "stub-zone:"
+                                       echo "  name: ${zone}."
+                                       echo "  stub-addr: ${server}"
+                                       echo
+                                       echo "server:"
+                                       echo "  local-zone: \"${zone}.\" transparent"
+                                       echo
+                                       ;;
+                               *)
+                                       echo "forward-zone:"
+                                       echo "  name: ${zone}."
+                                       echo "  forward-addr: ${server}"
+                                       echo
+                                       ;;
+                       esac
                done < /var/ipfire/dnsforward/config
 
                if [ -n "${insecure_zones}" ]; then