src/initscripts/system/unbound

   1 #!/bin/sh
   2 # Begin $rc_base/init.d/unbound
   3
   4 # Description : Unbound DNS resolver boot script for IPfire
   5 # Author      : Marcel Lorenz <marcel.lorenz@ipfire.org>
   6
   7 . /etc/sysconfig/rc
   8 . ${rc_functions}
   9
  10 # Cache any local zones for 60 seconds
  11 LOCAL_TTL=60
  12
  13 # Load configuration
  14 eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
  15 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  16
  17 ip_address_revptr() {
  18         local addr=${1}
  19
  20         local a1 a2 a3 a4
  21         IFS=. read -r a1 a2 a3 a4 <<< ${addr}
  22
  23         echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
  24 }
  25
  26 read_name_servers() {
  27         # Read name servers from ISP
  28         if [ "${USE_ISP_NAMESERVERS}" = "on" -a "${PROTO}" != "TLS" ]; then
  29                 local i
  30                 for i in 1 2; do
  31                         echo "$(</var/run/dns${i})"
  32                 done 2>/dev/null
  33         fi
  34
  35         # Read configured name servers
  36         local id address tls_hostname enabled remark
  37         while IFS="," read -r id address tls_hostname enabled remark; do
  38                 [ "${enabled}" != "enabled" ] && continue
  39
  40                 if [ "${PROTO}" = "TLS" ]; then
  41                         if [ -n "${tls_hostname}" ]; then
  42                                 echo "${address}@853#${tls_hostname}"
  43                         fi
  44                 else
  45                         echo "${address}"
  46                 fi
  47         done < /var/ipfire/dns/servers
  48 }
  49
  50 config_header() {
  51         echo "# This file is automatically generated and any changes"
  52         echo "# will be overwritten. DO NOT EDIT!"
  53         echo
  54 }
  55
  56 write_hosts_conf() {
  57         (
  58                 config_header
  59
  60                 # Make own hostname resolveable
  61                 # 1.1.1.1 is reserved for unused green, skip this
  62                 if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
  63                         echo "local-data: \"${HOSTNAME} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}\""
  64                 fi
  65
  66                 local address
  67                 for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
  68                         [ -n "${address}" ] || continue
  69                         [ "${address}" = "1.1.1.1" ] && continue
  70
  71                         address=$(ip_address_revptr ${address})
  72                         echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${HOSTNAME}\""
  73                 done
  74
  75                 # Add all hosts
  76                 local enabled address hostname domainname generateptr
  77                 while IFS="," read -r enabled address hostname domainname generateptr; do
  78                         [ "${enabled}" = "on" ] || continue
  79
  80                         # Build FQDN
  81                         local fqdn="${hostname}.${domainname}"
  82                         echo "local-data: \"${fqdn} ${LOCAL_TTL} IN A ${address}\""
  83
  84                         # Skip reverse resolution if the address equals the GREEN address
  85                         [ "${address}" = "${GREEN_ADDRESS}" ] && continue
  86
  87                         # Skip reverse resolution if user requested not to do so
  88                         [ "${generateptr}" = "off" ] && continue
  89
  90                         # Add RDNS
  91                         address=$(ip_address_revptr ${address})
  92                         echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${fqdn}\""
  93                 done < /var/ipfire/main/hosts
  94         ) > /etc/unbound/hosts.conf
  95 }
  96
  97 write_forward_conf() {
  98         (
  99                 config_header
 100
 101                 # Enable strict QNAME minimisation
 102                 if [ "${QNAME_MIN}" = "strict" ]; then
 103                         echo "server:"
 104                         echo "  qname-minimisation-strict: yes"
 105                         echo
 106                 fi
 107
 108                 # Force using TCP for upstream servers only
 109                 if [ "${PROTO}" = "TCP" ]; then
 110                         echo "# Force using TCP for upstream servers only"
 111                         echo "server:"
 112                         echo "  tcp-upstream: yes"
 113                         echo
 114                 fi
 115
 116                 local insecure_zones=""
 117
 118                 local enabled zone server servers remark disable_dnssec rest
 119                 while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
 120                         # Line must be enabled.
 121                         [ "${enabled}" = "on" ] || continue
 122
 123                         # Zones that end with .local are commonly used for internal
 124                         # zones and therefore not signed
 125                         case "${zone}" in
 126                                 *.local)
 127                                         insecure_zones="${insecure_zones} ${zone}"
 128                                         ;;
 129                                 *)
 130                                         if [ "${disable_dnssec}" = "on" ]; then
 131                                                 insecure_zones="${insecure_zones} ${zone}"
 132                                         fi
 133                                         ;;
 134                         esac
 135
 136                         echo "stub-zone:"
 137                         echo "  name: ${zone}"
 138                         for server in ${servers//|/ }; do
 139                                 if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
 140                                         echo "  stub-addr: ${server}"
 141                                 else
 142                                         echo "  stub-host: ${server}"
 143                                 fi
 144                         done
 145                         echo
 146
 147                         # Make all reverse lookup zones transparent
 148                         case "${zone}" in
 149                                 *.in-addr.arpa)
 150                                         echo "server:"
 151                                         echo "  local-zone: \"${zone}\" transparent"
 152                                         echo
 153                                         ;;
 154                         esac
 155                 done < /var/ipfire/dnsforward/config
 156
 157                 if [ -n "${insecure_zones}" ]; then
 158                         echo "server:"
 159
 160                         for zone in ${insecure_zones}; do
 161                                 echo "  domain-insecure: ${zone}"
 162                         done
 163                 fi
 164
 165                 # Read name servers.
 166                 nameservers=$(read_name_servers)
 167
 168                 # Only write forward zones if any nameservers are configured.
 169                 #
 170                 # Otherwise fall-back into recursor mode.
 171                 if [ -n "${nameservers}" ]; then
 172
 173                         echo "forward-zone:"
 174                         echo "  name: \".\""
 175
 176                         # Force using TLS only
 177                         if [ "${PROTO}" = "TLS" ]; then
 178                                 echo "  forward-tls-upstream: yes"
 179                         fi
 180
 181                         # Add upstream name servers
 182                         local ns
 183                         for ns in ${nameservers}; do
 184                                 echo "  forward-addr: ${ns}"
 185                         done
 186                 fi
 187
 188         ) > /etc/unbound/forward.conf
 189 }
 190
 191 write_tuning_conf() {
 192         # https://www.unbound.net/documentation/howto_optimise.html
 193
 194         # Determine number of online processors
 195         local processors=$(getconf _NPROCESSORS_ONLN)
 196
 197         # Determine number of slabs
 198         local slabs=1
 199         while [ ${slabs} -lt ${processors} ]; do
 200                 slabs=$(( ${slabs} * 2 ))
 201         done
 202
 203         # Determine amount of system memory
 204         local mem=$(get_memory_amount)
 205
 206         # In the worst case scenario, unbound can use double the
 207         # amount of memory allocated to a cache due to malloc overhead
 208
 209         # Even larger systems with more than 8GB of RAM
 210         if [ ${mem} -ge 8192 ]; then
 211                 mem=1024
 212
 213         # Extra large systems with more than 4GB of RAM
 214         elif [ ${mem} -ge 4096 ]; then
 215                 mem=512
 216
 217         # Large systems with more than 2GB of RAM
 218         elif [ ${mem} -ge 2048 ]; then
 219                 mem=256
 220
 221         # Medium systems with more than 1GB of RAM
 222         elif [ ${mem} -ge 1024 ]; then
 223                 mem=128
 224
 225         # Small systems with less than 256MB of RAM
 226         elif [ ${mem} -le 256 ]; then
 227                 mem=16
 228
 229         # Everything else
 230         else
 231                 mem=64
 232         fi
 233
 234         (
 235                 config_header
 236
 237                 # We run one thread per processor
 238                 echo "num-threads: ${processors}"
 239                 echo "so-reuseport: yes"
 240
 241                 # Adjust number of slabs
 242                 echo "infra-cache-slabs: ${slabs}"
 243                 echo "key-cache-slabs: ${slabs}"
 244                 echo "msg-cache-slabs: ${slabs}"
 245                 echo "rrset-cache-slabs: ${slabs}"
 246
 247                 # Slice up the cache
 248                 echo "rrset-cache-size: $(( ${mem} / 2 ))m"
 249                 echo "msg-cache-size: $(( ${mem} / 4 ))m"
 250                 echo "key-cache-size: $(( ${mem} / 4 ))m"
 251
 252                 # Increase parallel queries
 253                 echo "outgoing-range: 8192"
 254                 echo "num-queries-per-thread: 4096"
 255
 256                 # Use larger send/receive buffers
 257                 echo "so-sndbuf: 4m"
 258                 echo "so-rcvbuf: 4m"
 259         ) > /etc/unbound/tuning.conf
 260 }
 261
 262 get_memory_amount() {
 263         local key val unit
 264
 265         while read -r key val unit; do
 266                 case "${key}" in
 267                         MemTotal:*)
 268                                 # Convert to MB
 269                                 echo "$(( ${val} / 1024 ))"
 270                                 break
 271                                 ;;
 272                 esac
 273         done < /proc/meminfo
 274 }
 275
 276 fix_time_if_dns_fails() {
 277         # Sometimes the first try fails so do it twice
 278         resolve "ping.ipfire.org" &>/dev/null
 279         # If DNS is working, everything is fine
 280         if resolve "ping.ipfire.org" &>/dev/null; then
 281                 return 0
 282         fi
 283
 284         # Try to sync time with a known time server
 285         boot_mesg "DNS not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
 286         loadproc /usr/local/bin/settime 81.3.27.46
 287 }
 288
 289 resolve() {
 290         local hostname="${1}"
 291         local found=1
 292
 293         local answer
 294         for answer in $(dig +short A "${hostname}"); do
 295                 # Filter out non-IP addresses
 296                 if [[ ! "${answer}" =~ \.$ ]]; then
 297                         found=0
 298                         echo "${answer}"
 299                 fi
 300         done
 301
 302         return ${found}
 303 }
 304
 305 # Sets up Safe Search for various search engines
 306 update_safe_search() {
 307         local google_tlds=(
 308                 google.ad
 309                 google.ae
 310                 google.al
 311                 google.am
 312                 google.as
 313                 google.at
 314                 google.az
 315                 google.ba
 316                 google.be
 317                 google.bf
 318                 google.bg
 319                 google.bi
 320                 google.bj
 321                 google.bs
 322                 google.bt
 323                 google.by
 324                 google.ca
 325                 google.cat
 326                 google.cd
 327                 google.cf
 328                 google.cg
 329                 google.ch
 330                 google.ci
 331                 google.cl
 332                 google.cm
 333                 google.cn
 334                 google.co.ao
 335                 google.co.bw
 336                 google.co.ck
 337                 google.co.cr
 338                 google.co.id
 339                 google.co.il
 340                 google.co.in
 341                 google.co.jp
 342                 google.co.ke
 343                 google.co.kr
 344                 google.co.ls
 345                 google.com
 346                 google.co.ma
 347                 google.com.af
 348                 google.com.ag
 349                 google.com.ai
 350                 google.com.ar
 351                 google.com.au
 352                 google.com.bd
 353                 google.com.bh
 354                 google.com.bn
 355                 google.com.bo
 356                 google.com.br
 357                 google.com.bz
 358                 google.com.co
 359                 google.com.cu
 360                 google.com.cy
 361                 google.com.do
 362                 google.com.ec
 363                 google.com.eg
 364                 google.com.et
 365                 google.com.fj
 366                 google.com.gh
 367                 google.com.gi
 368                 google.com.gt
 369                 google.com.hk
 370                 google.com.jm
 371                 google.com.kh
 372                 google.com.kw
 373                 google.com.lb
 374                 google.com.ly
 375                 google.com.mm
 376                 google.com.mt
 377                 google.com.mx
 378                 google.com.my
 379                 google.com.na
 380                 google.com.nf
 381                 google.com.ng
 382                 google.com.ni
 383                 google.com.np
 384                 google.com.om
 385                 google.com.pa
 386                 google.com.pe
 387                 google.com.pg
 388                 google.com.ph
 389                 google.com.pk
 390                 google.com.pr
 391                 google.com.py
 392                 google.com.qa
 393                 google.com.sa
 394                 google.com.sb
 395                 google.com.sg
 396                 google.com.sl
 397                 google.com.sv
 398                 google.com.tj
 399                 google.com.tr
 400                 google.com.tw
 401                 google.com.ua
 402                 google.com.uy
 403                 google.com.vc
 404                 google.com.vn
 405                 google.co.mz
 406                 google.co.nz
 407                 google.co.th
 408                 google.co.tz
 409                 google.co.ug
 410                 google.co.uk
 411                 google.co.uz
 412                 google.co.ve
 413                 google.co.vi
 414                 google.co.za
 415                 google.co.zm
 416                 google.co.zw
 417                 google.cv
 418                 google.cz
 419                 google.de
 420                 google.dj
 421                 google.dk
 422                 google.dm
 423                 google.dz
 424                 google.ee
 425                 google.es
 426                 google.fi
 427                 google.fm
 428                 google.fr
 429                 google.ga
 430                 google.ge
 431                 google.gg
 432                 google.gl
 433                 google.gm
 434                 google.gp
 435                 google.gr
 436                 google.gy
 437                 google.hn
 438                 google.hr
 439                 google.ht
 440                 google.hu
 441                 google.ie
 442                 google.im
 443                 google.iq
 444                 google.is
 445                 google.it
 446                 google.je
 447                 google.jo
 448                 google.kg
 449                 google.ki
 450                 google.kz
 451                 google.la
 452                 google.li
 453                 google.lk
 454                 google.lt
 455                 google.lu
 456                 google.lv
 457                 google.md
 458                 google.me
 459                 google.mg
 460                 google.mk
 461                 google.ml
 462                 google.mn
 463                 google.ms
 464                 google.mu
 465                 google.mv
 466                 google.mw
 467                 google.ne
 468                 google.nl
 469                 google.no
 470                 google.nr
 471                 google.nu
 472                 google.pl
 473                 google.pn
 474                 google.ps
 475                 google.pt
 476                 google.ro
 477                 google.rs
 478                 google.ru
 479                 google.rw
 480                 google.sc
 481                 google.se
 482                 google.sh
 483                 google.si
 484                 google.sk
 485                 google.sm
 486                 google.sn
 487                 google.so
 488                 google.sr
 489                 google.st
 490                 google.td
 491                 google.tg
 492                 google.tk
 493                 google.tl
 494                 google.tm
 495                 google.tn
 496                 google.to
 497                 google.tt
 498                 google.vg
 499                 google.vu
 500                 google.ws
 501         )
 502
 503         # Cleanup previous settings
 504         unbound-control local_zone_remove "bing.com" >/dev/null
 505         unbound-control local_zone_remove "duckduckgo.com" >/dev/null
 506         unbound-control local_zone_remove "yandex.com" >/dev/null
 507         unbound-control local_zone_remove "yandex.ru" >/dev/null
 508         unbound-control local_zone_remove "youtube.com" >/dev/null
 509
 510         local domain
 511         for domain in ${google_tlds[@]}; do
 512                 unbound-control local_zone_remove "${domain}"
 513         done >/dev/null
 514
 515         # Nothing to do if safe search is not enabled
 516         if [ "${ENABLE_SAFE_SEARCH}" != "on" ]; then
 517                 return 0
 518         fi
 519
 520         # Bing
 521         unbound-control bing.com transparent >/dev/null
 522         for address in $(resolve "strict.bing.com"); do
 523                 unbound-control local_data "www.bing.com ${LOCAL_TTL} IN A ${address}"
 524         done >/dev/null
 525
 526         # DuckDuckGo
 527         unbound-control local_zone duckduckgo.com typetransparent >/dev/null
 528         for address in $(resolve "safe.duckduckgo.com"); do
 529                 unbound-control local_data "duckduckgo.com ${LOCAL_TTL} IN A ${address}"
 530         done >/dev/null
 531
 532         # Google
 533         local addresses="$(resolve "forcesafesearch.google.com")"
 534         for domain in ${google_tlds[@]}; do
 535                 unbound-control local_zone "${domain}" transparent >/dev/null
 536                 for address in ${addresses}; do
 537                         unbound-control local_data: "www.${domain} ${LOCAL_TTL} IN A ${address}"
 538                 done >/dev/null
 539         done
 540
 541         # Yandex
 542         for domain in yandex.com yandex.ru; do
 543                 unbound-control local_zone "${domain}" typetransparent >/dev/null
 544                 for address in $(resolve "familysearch.${domain}"); do
 545                         unbound-control local_data "${domain} ${LOCAL_TTL} IN A ${address}"
 546                 done >/dev/null
 547         done
 548
 549         # YouTube
 550         unbound-control local_zone youtube.com transparent >/dev/null
 551         for address in $(resolve "restrictmoderate.youtube.com"); do
 552                 unbound-control local_data "www.youtube.com ${LOCAL_TTL} IN A ${address}"
 553         done >/dev/null
 554
 555         return 0
 556 }
 557
 558 case "$1" in
 559         start)
 560                 # Print a nicer messagen when unbound is already running
 561                 if pidofproc -s unbound; then
 562                         statusproc /usr/sbin/unbound
 563                         exit 0
 564                 fi
 565
 566                 # Update configuration files
 567                 write_tuning_conf
 568                 write_hosts_conf
 569                 write_forward_conf
 570
 571                 boot_mesg "Starting Unbound DNS Proxy..."
 572                 loadproc /usr/sbin/unbound || exit $?
 573
 574                 # Install Safe Search rules when the system is already online
 575                 if [ -e "/var/ipfire/red/active" ]; then
 576                         update_safe_search
 577                 fi
 578                 ;;
 579
 580         stop)
 581                 boot_mesg "Stopping Unbound DNS Proxy..."
 582                 killproc /usr/sbin/unbound
 583                 ;;
 584
 585         restart)
 586                 $0 stop
 587                 sleep 1
 588                 $0 start
 589                 ;;
 590         reload|remove-forwarders)
 591                 # Update configuration files
 592                 write_forward_conf
 593                 write_hosts_conf
 594
 595                 # Update Safe Search rules if the system is online.
 596                 if [ -e "/var/ipfire/red/active" ]; then
 597                         update_safe_search
 598                 fi
 599
 600                 # Call unbound-control and perform the reload
 601                 /usr/sbin/unbound-control -q reload
 602                 ;;
 603
 604         status)
 605                 statusproc /usr/sbin/unbound
 606                 ;;
 607
 608         update-forwarders)
 609                 $0 reload
 610
 611                 # Make sure DNS works at this point
 612                 fix_time_if_dns_fails
 613                 ;;
 614
 615         resolve)
 616                 resolve "${2}" || exit $?
 617                 ;;
 618
 619         *)
 620                 echo "Usage: $0 {start|stop|restart|reload|status|resolve|update-forwarders|remove-forwarders}"
 621                 exit 1
 622                 ;;
 623 esac
 624
 625 # End $rc_base/init.d/unbound