src/initscripts/system/unbound

   1 #!/bin/sh
   2 # Begin $rc_base/init.d/unbound
   3
   4 # Description : Unbound DNS resolver boot script for IPfire
   5 # Author      : Marcel Lorenz <marcel.lorenz@ipfire.org>
   6
   7 . /etc/sysconfig/rc
   8 . ${rc_functions}
   9
  10 # Cache any local zones for 60 seconds
  11 LOCAL_TTL=60
  12
  13 # Load configuration
  14 eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
  15 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  16
  17 ip_address_revptr() {
  18         local addr=${1}
  19
  20         local a1 a2 a3 a4
  21         IFS=. read -r a1 a2 a3 a4 <<< ${addr}
  22
  23         echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
  24 }
  25
  26 read_name_servers() {
  27         # Read name servers from ISP
  28         if [ "${USE_ISP_NAMESERVERS}" = "on" -a "${PROTO}" != "TLS" ]; then
  29                 local i
  30                 for i in 1 2; do
  31                         echo "$(</var/run/dns${i})"
  32                 done 2>/dev/null
  33         fi
  34
  35         # Read configured name servers
  36         local id address tls_hostname enabled remark
  37         while IFS="," read -r id address tls_hostname enabled remark; do
  38                 [ "${enabled}" != "enabled" ] && continue
  39
  40                 if [ "${PROTO}" = "TLS" ]; then
  41                         if [ -n "${tls_hostname}" ]; then
  42                                 echo "${address}@853#${tls_hostname}"
  43                         fi
  44                 else
  45                         echo "${address}"
  46                 fi
  47         done < /var/ipfire/dns/servers
  48 }
  49
  50 config_header() {
  51         echo "# This file is automatically generated and any changes"
  52         echo "# will be overwritten. DO NOT EDIT!"
  53         echo
  54 }
  55
  56 write_hosts_conf() {
  57         (
  58                 config_header
  59
  60                 # Make own hostname resolveable
  61                 # 1.1.1.1 is reserved for unused green, skip this
  62                 if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
  63                         echo "local-data: \"${HOSTNAME} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}\""
  64                 fi
  65
  66                 local address
  67                 for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
  68                         [ -n "${address}" ] || continue
  69                         [ "${address}" = "1.1.1.1" ] && continue
  70
  71                         address=$(ip_address_revptr ${address})
  72                         echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${HOSTNAME}\""
  73                 done
  74
  75                 # Add all hosts
  76                 local enabled address hostname domainname generateptr
  77                 while IFS="," read -r enabled address hostname domainname generateptr; do
  78                         [ "${enabled}" = "on" ] || continue
  79
  80                         # Build FQDN
  81                         local fqdn="${hostname}.${domainname}"
  82                         echo "local-data: \"${fqdn} ${LOCAL_TTL} IN A ${address}\""
  83
  84                         # Skip reverse resolution if the address equals the GREEN address
  85                         [ "${address}" = "${GREEN_ADDRESS}" ] && continue
  86
  87                         # Skip reverse resolution if user requested not to do so
  88                         [ "${generateptr}" = "off" ] && continue
  89
  90                         # Add RDNS
  91                         address=$(ip_address_revptr ${address})
  92                         echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${fqdn}\""
  93                 done < /var/ipfire/main/hosts
  94         ) > /etc/unbound/hosts.conf
  95 }
  96
  97 write_forward_conf() {
  98         (
  99                 config_header
 100
 101                 # Enable strict QNAME minimisation
 102                 if [ "${QNAME_MIN}" = "strict" ]; then
 103                         echo "server:"
 104                         echo "  qname-minimisation-strict: yes"
 105                         echo
 106                 fi
 107
 108                 # Force using TCP for upstream servers only
 109                 if [ "${PROTO}" = "TCP" ]; then
 110                         echo "# Force using TCP for upstream servers only"
 111                         echo "server:"
 112                         echo "  tcp-upstream: yes"
 113                         echo
 114                 fi
 115
 116                 local insecure_zones=""
 117
 118                 local enabled zone server servers remark disable_dnssec rest
 119                 while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
 120                         # Line must be enabled.
 121                         [ "${enabled}" = "on" ] || continue
 122
 123                         # Zones that end with .local are commonly used for internal
 124                         # zones and therefore not signed
 125                         case "${zone}" in
 126                                 *.local)
 127                                         insecure_zones="${insecure_zones} ${zone}"
 128                                         ;;
 129                                 *)
 130                                         if [ "${disable_dnssec}" = "on" ]; then
 131                                                 insecure_zones="${insecure_zones} ${zone}"
 132                                         fi
 133                                         ;;
 134                         esac
 135
 136                         echo "stub-zone:"
 137                         echo "  name: ${zone}"
 138                         for server in ${servers//|/ }; do
 139                                 if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
 140                                         echo "  stub-addr: ${server}"
 141                                 else
 142                                         echo "  stub-host: ${server}"
 143                                 fi
 144                         done
 145                         echo
 146
 147                         # Make all reverse lookup zones transparent
 148                         case "${zone}" in
 149                                 *.in-addr.arpa)
 150                                         echo "server:"
 151                                         echo "  local-zone: \"${zone}\" transparent"
 152                                         echo
 153                                         ;;
 154                         esac
 155                 done < /var/ipfire/dnsforward/config
 156
 157                 if [ -n "${insecure_zones}" ]; then
 158                         echo "server:"
 159
 160                         for zone in ${insecure_zones}; do
 161                                 echo "  domain-insecure: ${zone}"
 162                         done
 163                 fi
 164
 165                 # Read name servers.
 166                 nameservers=$(read_name_servers)
 167
 168                 # Only write forward zones if any nameservers are configured.
 169                 #
 170                 # Otherwise fall-back into recursor mode.
 171                 if [ -n "${nameservers}" ]; then
 172
 173                         echo "forward-zone:"
 174                         echo "  name: \".\""
 175
 176                         # Force using TLS only
 177                         if [ "${PROTO}" = "TLS" ]; then
 178                                 echo "  forward-tls-upstream: yes"
 179                         fi
 180
 181                         # Add upstream name servers
 182                         local ns
 183                         for ns in ${nameservers}; do
 184                                 echo "  forward-addr: ${ns}"
 185                         done
 186                 fi
 187
 188         ) > /etc/unbound/forward.conf
 189 }
 190
 191 write_tuning_conf() {
 192         # https://www.unbound.net/documentation/howto_optimise.html
 193
 194         # Determine number of online processors
 195         local processors=$(getconf _NPROCESSORS_ONLN)
 196
 197         # Determine number of slabs
 198         local slabs=1
 199         while [ ${slabs} -lt ${processors} ]; do
 200                 slabs=$(( ${slabs} * 2 ))
 201         done
 202
 203         # Determine amount of system memory
 204         local mem=$(get_memory_amount)
 205
 206         # In the worst case scenario, unbound can use double the
 207         # amount of memory allocated to a cache due to malloc overhead
 208
 209         # Even larger systems with more than 8GB of RAM
 210         if [ ${mem} -ge 8192 ]; then
 211                 mem=1024
 212
 213         # Extra large systems with more than 4GB of RAM
 214         elif [ ${mem} -ge 4096 ]; then
 215                 mem=512
 216
 217         # Large systems with more than 2GB of RAM
 218         elif [ ${mem} -ge 2048 ]; then
 219                 mem=256
 220
 221         # Medium systems with more than 1GB of RAM
 222         elif [ ${mem} -ge 1024 ]; then
 223                 mem=128
 224
 225         # Small systems with less than 256MB of RAM
 226         elif [ ${mem} -le 256 ]; then
 227                 mem=16
 228
 229         # Everything else
 230         else
 231                 mem=64
 232         fi
 233
 234         (
 235                 config_header
 236
 237                 # We run one thread per processor
 238                 echo "num-threads: ${processors}"
 239                 echo "so-reuseport: yes"
 240
 241                 # Adjust number of slabs
 242                 echo "infra-cache-slabs: ${slabs}"
 243                 echo "key-cache-slabs: ${slabs}"
 244                 echo "msg-cache-slabs: ${slabs}"
 245                 echo "rrset-cache-slabs: ${slabs}"
 246
 247                 # Slice up the cache
 248                 echo "rrset-cache-size: $(( ${mem} / 2 ))m"
 249                 echo "msg-cache-size: $(( ${mem} / 4 ))m"
 250                 echo "key-cache-size: $(( ${mem} / 4 ))m"
 251
 252                 # Increase parallel queries
 253                 echo "outgoing-range: 8192"
 254                 echo "num-queries-per-thread: 4096"
 255
 256                 # Use larger send/receive buffers
 257                 echo "so-sndbuf: 4m"
 258                 echo "so-rcvbuf: 4m"
 259         ) > /etc/unbound/tuning.conf
 260 }
 261
 262 get_memory_amount() {
 263         local key val unit
 264
 265         while read -r key val unit; do
 266                 case "${key}" in
 267                         MemTotal:*)
 268                                 # Convert to MB
 269                                 echo "$(( ${val} / 1024 ))"
 270                                 break
 271                                 ;;
 272                 esac
 273         done < /proc/meminfo
 274 }
 275
 276 fix_time_if_dns_fails() {
 277         # If DNS is working, everything is fine
 278         if resolve "ping.ipfire.org" &>/dev/null; then
 279                 return 0
 280         fi
 281
 282         # Try to sync time with a known time server
 283         boot_mesg "DNS not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
 284         loadproc /usr/local/bin/settime 81.3.27.46
 285 }
 286
 287 resolve() {
 288         local hostname="${1}"
 289
 290         local answer
 291         for answer in $(dig +short A "${hostname}"); do
 292                 # Filter out non-IP addresses
 293                 if [[ ! "${answer}" =~ \.$ ]]; then
 294                         echo "${answer}"
 295                 fi
 296         done
 297 }
 298
 299 # Sets up Safe Search for various search engines
 300 update_safe_search() {
 301         local google_tlds=(
 302                 google.ad
 303                 google.ae
 304                 google.al
 305                 google.am
 306                 google.as
 307                 google.at
 308                 google.az
 309                 google.ba
 310                 google.be
 311                 google.bf
 312                 google.bg
 313                 google.bi
 314                 google.bj
 315                 google.bs
 316                 google.bt
 317                 google.by
 318                 google.ca
 319                 google.cat
 320                 google.cd
 321                 google.cf
 322                 google.cg
 323                 google.ch
 324                 google.ci
 325                 google.cl
 326                 google.cm
 327                 google.cn
 328                 google.co.ao
 329                 google.co.bw
 330                 google.co.ck
 331                 google.co.cr
 332                 google.co.id
 333                 google.co.il
 334                 google.co.in
 335                 google.co.jp
 336                 google.co.ke
 337                 google.co.kr
 338                 google.co.ls
 339                 google.com
 340                 google.co.ma
 341                 google.com.af
 342                 google.com.ag
 343                 google.com.ai
 344                 google.com.ar
 345                 google.com.au
 346                 google.com.bd
 347                 google.com.bh
 348                 google.com.bn
 349                 google.com.bo
 350                 google.com.br
 351                 google.com.bz
 352                 google.com.co
 353                 google.com.cu
 354                 google.com.cy
 355                 google.com.do
 356                 google.com.ec
 357                 google.com.eg
 358                 google.com.et
 359                 google.com.fj
 360                 google.com.gh
 361                 google.com.gi
 362                 google.com.gt
 363                 google.com.hk
 364                 google.com.jm
 365                 google.com.kh
 366                 google.com.kw
 367                 google.com.lb
 368                 google.com.ly
 369                 google.com.mm
 370                 google.com.mt
 371                 google.com.mx
 372                 google.com.my
 373                 google.com.na
 374                 google.com.nf
 375                 google.com.ng
 376                 google.com.ni
 377                 google.com.np
 378                 google.com.om
 379                 google.com.pa
 380                 google.com.pe
 381                 google.com.pg
 382                 google.com.ph
 383                 google.com.pk
 384                 google.com.pr
 385                 google.com.py
 386                 google.com.qa
 387                 google.com.sa
 388                 google.com.sb
 389                 google.com.sg
 390                 google.com.sl
 391                 google.com.sv
 392                 google.com.tj
 393                 google.com.tr
 394                 google.com.tw
 395                 google.com.ua
 396                 google.com.uy
 397                 google.com.vc
 398                 google.com.vn
 399                 google.co.mz
 400                 google.co.nz
 401                 google.co.th
 402                 google.co.tz
 403                 google.co.ug
 404                 google.co.uk
 405                 google.co.uz
 406                 google.co.ve
 407                 google.co.vi
 408                 google.co.za
 409                 google.co.zm
 410                 google.co.zw
 411                 google.cv
 412                 google.cz
 413                 google.de
 414                 google.dj
 415                 google.dk
 416                 google.dm
 417                 google.dz
 418                 google.ee
 419                 google.es
 420                 google.fi
 421                 google.fm
 422                 google.fr
 423                 google.ga
 424                 google.ge
 425                 google.gg
 426                 google.gl
 427                 google.gm
 428                 google.gp
 429                 google.gr
 430                 google.gy
 431                 google.hn
 432                 google.hr
 433                 google.ht
 434                 google.hu
 435                 google.ie
 436                 google.im
 437                 google.iq
 438                 google.is
 439                 google.it
 440                 google.je
 441                 google.jo
 442                 google.kg
 443                 google.ki
 444                 google.kz
 445                 google.la
 446                 google.li
 447                 google.lk
 448                 google.lt
 449                 google.lu
 450                 google.lv
 451                 google.md
 452                 google.me
 453                 google.mg
 454                 google.mk
 455                 google.ml
 456                 google.mn
 457                 google.ms
 458                 google.mu
 459                 google.mv
 460                 google.mw
 461                 google.ne
 462                 google.nl
 463                 google.no
 464                 google.nr
 465                 google.nu
 466                 google.pl
 467                 google.pn
 468                 google.ps
 469                 google.pt
 470                 google.ro
 471                 google.rs
 472                 google.ru
 473                 google.rw
 474                 google.sc
 475                 google.se
 476                 google.sh
 477                 google.si
 478                 google.sk
 479                 google.sm
 480                 google.sn
 481                 google.so
 482                 google.sr
 483                 google.st
 484                 google.td
 485                 google.tg
 486                 google.tk
 487                 google.tl
 488                 google.tm
 489                 google.tn
 490                 google.to
 491                 google.tt
 492                 google.vg
 493                 google.vu
 494                 google.ws
 495         )
 496
 497         # Cleanup previous settings
 498         unbound-control local_zone_remove "bing.com" >/dev/null
 499         unbound-control local_zone_remove "duckduckgo.com" >/dev/null
 500         unbound-control local_zone_remove "yandex.com" >/dev/null
 501         unbound-control local_zone_remove "yandex.ru" >/dev/null
 502         unbound-control local_zone_remove "youtube.com" >/dev/null
 503
 504         local domain
 505         for domain in ${google_tlds[@]}; do
 506                 unbound-control local_zone_remove "${domain}"
 507         done >/dev/null
 508
 509         # Nothing to do if safe search is not enabled
 510         if [ "${ENABLE_SAFE_SEARCH}" != "on" ]; then
 511                 return 0
 512         fi
 513
 514         # Bing
 515         unbound-control bing.com transparent >/dev/null
 516         for address in $(resolve "strict.bing.com"); do
 517                 unbound-control local_data "www.bing.com ${LOCAL_TTL} IN A ${address}"
 518         done >/dev/null
 519
 520         # DuckDuckGo
 521         unbound-control local_zone duckduckgo.com typetransparent >/dev/null
 522         for address in $(resolve "safe.duckduckgo.com"); do
 523                 unbound-control local_data "duckduckgo.com ${LOCAL_TTL} IN A ${address}"
 524         done >/dev/null
 525
 526         # Google
 527         local addresses="$(resolve "forcesafesearch.google.com")"
 528         for domain in ${google_tlds[@]}; do
 529                 unbound-control local_zone "${domain}" transparent >/dev/null
 530                 for address in ${addresses}; do
 531                         unbound-control local_data: "www.${domain} ${LOCAL_TTL} IN A ${address}"
 532                 done >/dev/null
 533         done
 534
 535         # Yandex
 536         for domain in yandex.com yandex.ru; do
 537                 unbound-control local_zone "${domain}" typetransparent >/dev/null
 538                 for address in $(resolve "familysearch.${domain}"); do
 539                         unbound-control local_data "${domain} ${LOCAL_TTL} IN A ${address}"
 540                 done >/dev/null
 541         done
 542
 543         # YouTube
 544         unbound-control local_zone youtube.com transparent >/dev/null
 545         for address in $(resolve "restrictmoderate.youtube.com"); do
 546                 unbound-control local_data "www.youtube.com ${LOCAL_TTL} IN A ${address}"
 547         done >/dev/null
 548
 549         return 0
 550 }
 551
 552 case "$1" in
 553         start)
 554                 # Print a nicer messagen when unbound is already running
 555                 if pidofproc -s unbound; then
 556                         statusproc /usr/sbin/unbound
 557                         exit 0
 558                 fi
 559
 560                 # Update configuration files
 561                 write_tuning_conf
 562                 write_hosts_conf
 563                 write_forward_conf
 564
 565                 boot_mesg "Starting Unbound DNS Proxy..."
 566                 loadproc /usr/sbin/unbound || exit $?
 567
 568                 # Install Safe Search rules when the system is already online
 569                 if [ -e "/var/ipfire/red/active" ]; then
 570                         update_safe_search
 571                 fi
 572                 ;;
 573
 574         stop)
 575                 boot_mesg "Stopping Unbound DNS Proxy..."
 576                 killproc /usr/sbin/unbound
 577                 ;;
 578
 579         restart)
 580                 $0 stop
 581                 sleep 1
 582                 $0 start
 583                 ;;
 584         reload|remove-forwarders)
 585                 # Update configuration files
 586                 write_forward_conf
 587                 write_hosts_conf
 588
 589                 # Update Safe Search rules if the system is online.
 590                 if [ -e "/var/ipfire/red/active" ]; then
 591                         update_safe_search
 592                 fi
 593
 594                 # Call unbound-control and perform the reload
 595                 /usr/sbin/unbound-control -q reload
 596                 ;;
 597
 598         status)
 599                 statusproc /usr/sbin/unbound
 600                 ;;
 601
 602         update-forwarders)
 603                 $0 reload
 604
 605                 # Make sure DNS works at this point
 606                 fix_time_if_dns_fails
 607                 ;;
 608
 609         resolve)
 610                 resolve "${2}"
 611                 ;;
 612
 613         *)
 614                 echo "Usage: $0 {start|stop|restart|reload|status|resolve|update-forwarders|remove-forwarders}"
 615                 exit 1
 616                 ;;
 617 esac
 618
 619 # End $rc_base/init.d/unbound