src/initscripts/system/unbound

   1 #!/bin/sh
   2 # Begin $rc_base/init.d/unbound
   3
   4 # Description : Unbound DNS resolver boot script for IPfire
   5 # Author      : Marcel Lorenz <marcel.lorenz@ipfire.org>
   6
   7 . /etc/sysconfig/rc
   8 . ${rc_functions}
   9
  10 # Cache any local zones for 60 seconds
  11 LOCAL_TTL=60
  12
  13 # Load configuration
  14 eval $(/usr/local/bin/readhash /var/ipfire/dns/settings)
  15 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
  16
  17 ip_address_revptr() {
  18         local addr=${1}
  19
  20         local a1 a2 a3 a4
  21         IFS=. read -r a1 a2 a3 a4 <<< ${addr}
  22
  23         echo "${a4}.${a3}.${a2}.${a1}.in-addr.arpa"
  24 }
  25
  26 read_name_servers() {
  27         # Read name servers from ISP
  28         if [ "${USE_ISP_NAMESERVERS}" = "on" -a "${PROTO}" != "TLS" ]; then
  29                 local i
  30                 for i in 1 2; do
  31                         echo "$(</var/run/dns${i})"
  32                 done 2>/dev/null
  33         fi
  34
  35         # Read configured name servers
  36         local id address tls_hostname enabled remark
  37         while IFS="," read -r id address tls_hostname enabled remark; do
  38                 [ "${enabled}" != "enabled" ] && continue
  39
  40                 if [ "${PROTO}" = "TLS" ]; then
  41                         if [ -n "${tls_hostname}" ]; then
  42                                 echo "${address}@853#${tls_hostname}"
  43                         fi
  44                 else
  45                         echo "${address}"
  46                 fi
  47         done < /var/ipfire/dns/servers
  48 }
  49
  50 config_header() {
  51         echo "# This file is automatically generated and any changes"
  52         echo "# will be overwritten. DO NOT EDIT!"
  53         echo
  54 }
  55
  56 write_hosts_conf() {
  57         (
  58                 config_header
  59
  60                 # Make own hostname resolveable
  61                 # 1.1.1.1 is reserved for unused green, skip this
  62                 if [ -n "${GREEN_ADDRESS}" -a "${GREEN_ADDRESS}" != "1.1.1.1" ]; then
  63                         echo "local-data: \"${HOSTNAME} ${LOCAL_TTL} IN A ${GREEN_ADDRESS}\""
  64                 fi
  65
  66                 local address
  67                 for address in ${GREEN_ADDRESS} ${BLUE_ADDRESS} ${ORANGE_ADDRESS}; do
  68                         [ -n "${address}" ] || continue
  69                         [ "${address}" = "1.1.1.1" ] && continue
  70
  71                         address=$(ip_address_revptr ${address})
  72                         echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${HOSTNAME}\""
  73                 done
  74
  75                 # Add all hosts
  76                 local enabled address hostname domainname generateptr
  77                 while IFS="," read -r enabled address hostname domainname generateptr; do
  78                         [ "${enabled}" = "on" ] || continue
  79
  80                         # Build FQDN
  81                         local fqdn="${hostname}.${domainname}"
  82                         echo "local-data: \"${fqdn} ${LOCAL_TTL} IN A ${address}\""
  83
  84                         # Skip reverse resolution if the address equals the GREEN address
  85                         [ "${address}" = "${GREEN_ADDRESS}" ] && continue
  86
  87                         # Skip reverse resolution if user requested not to do so
  88                         [ "${generateptr}" = "off" ] && continue
  89
  90                         # Add RDNS
  91                         address=$(ip_address_revptr ${address})
  92                         echo "local-data: \"${address} ${LOCAL_TTL} IN PTR ${fqdn}\""
  93                 done < /var/ipfire/main/hosts
  94         ) > /etc/unbound/hosts.conf
  95 }
  96
  97 write_forward_conf() {
  98         (
  99                 config_header
 100
 101                 # Enable strict QNAME minimisation
 102                 if [ "${QNAME_MIN}" = "strict" ]; then
 103                         echo "server:"
 104                         echo "  qname-minimisation-strict: yes"
 105                         echo
 106                 fi
 107
 108                 # Force using TCP for upstream servers only
 109                 if [ "${PROTO}" = "TCP" ]; then
 110                         echo "# Force using TCP for upstream servers only"
 111                         echo "server:"
 112                         echo "  tcp-upstream: yes"
 113                         echo
 114                 fi
 115
 116                 local insecure_zones=""
 117
 118                 local enabled zone server servers remark disable_dnssec rest
 119                 while IFS="," read -r enabled zone servers remark disable_dnssec rest; do
 120                         # Line must be enabled.
 121                         [ "${enabled}" = "on" ] || continue
 122
 123                         # Zones that end with .local are commonly used for internal
 124                         # zones and therefore not signed
 125                         case "${zone}" in
 126                                 *.local)
 127                                         insecure_zones="${insecure_zones} ${zone}"
 128                                         ;;
 129                                 *)
 130                                         if [ "${disable_dnssec}" = "on" ]; then
 131                                                 insecure_zones="${insecure_zones} ${zone}"
 132                                         fi
 133                                         ;;
 134                         esac
 135
 136                         echo "stub-zone:"
 137                         echo "  name: ${zone}"
 138                         for server in ${servers//|/ }; do
 139                                 if [[ ${server} =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
 140                                         echo "  stub-addr: ${server}"
 141                                 else
 142                                         echo "  stub-host: ${server}"
 143                                 fi
 144                         done
 145                         echo
 146
 147                         # Make all reverse lookup zones transparent
 148                         case "${zone}" in
 149                                 *.in-addr.arpa)
 150                                         echo "server:"
 151                                         echo "  local-zone: \"${zone}\" transparent"
 152                                         echo
 153                                         ;;
 154                         esac
 155                 done < /var/ipfire/dnsforward/config
 156
 157                 if [ -n "${insecure_zones}" ]; then
 158                         echo "server:"
 159
 160                         for zone in ${insecure_zones}; do
 161                                 echo "  domain-insecure: ${zone}"
 162                         done
 163                 fi
 164
 165                 # Read name servers.
 166                 nameservers=$(read_name_servers)
 167
 168                 # Only write forward zones if any nameservers are configured.
 169                 #
 170                 # Otherwise fall-back into recursor mode.
 171                 if [ -n "${nameservers}" ]; then
 172
 173                         echo "forward-zone:"
 174                         echo "  name: \".\""
 175
 176                         # Force using TLS only
 177                         if [ "${PROTO}" = "TLS" ]; then
 178                                 echo "  forward-tls-upstream: yes"
 179                         fi
 180
 181                         # Add upstream name servers
 182                         local ns
 183                         for ns in ${nameservers}; do
 184                                 echo "  forward-addr: ${ns}"
 185                         done
 186                 fi
 187
 188         ) > /etc/unbound/forward.conf
 189 }
 190
 191 write_tuning_conf() {
 192         # https://www.unbound.net/documentation/howto_optimise.html
 193
 194         # Determine number of online processors
 195         local processors=$(getconf _NPROCESSORS_ONLN)
 196
 197         # Determine number of slabs
 198         local slabs=1
 199         while [ ${slabs} -lt ${processors} ]; do
 200                 slabs=$(( ${slabs} * 2 ))
 201         done
 202
 203         # Determine amount of system memory
 204         local mem=$(get_memory_amount)
 205
 206         # In the worst case scenario, unbound can use double the
 207         # amount of memory allocated to a cache due to malloc overhead
 208
 209         # Even larger systems with more than 8GB of RAM
 210         if [ ${mem} -ge 8192 ]; then
 211                 mem=1024
 212
 213         # Extra large systems with more than 4GB of RAM
 214         elif [ ${mem} -ge 4096 ]; then
 215                 mem=512
 216
 217         # Large systems with more than 2GB of RAM
 218         elif [ ${mem} -ge 2048 ]; then
 219                 mem=256
 220
 221         # Medium systems with more than 1GB of RAM
 222         elif [ ${mem} -ge 1024 ]; then
 223                 mem=128
 224
 225         # Small systems with less than 256MB of RAM
 226         elif [ ${mem} -le 256 ]; then
 227                 mem=16
 228
 229         # Everything else
 230         else
 231                 mem=64
 232         fi
 233
 234         (
 235                 config_header
 236
 237                 # We run one thread per processor
 238                 echo "num-threads: ${processors}"
 239                 echo "so-reuseport: yes"
 240
 241                 # Adjust number of slabs
 242                 echo "infra-cache-slabs: ${slabs}"
 243                 echo "key-cache-slabs: ${slabs}"
 244                 echo "msg-cache-slabs: ${slabs}"
 245                 echo "rrset-cache-slabs: ${slabs}"
 246
 247                 # Slice up the cache
 248                 echo "rrset-cache-size: $(( ${mem} / 2 ))m"
 249                 echo "msg-cache-size: $(( ${mem} / 4 ))m"
 250                 echo "key-cache-size: $(( ${mem} / 4 ))m"
 251
 252                 # Increase parallel queries
 253                 echo "outgoing-range: 8192"
 254                 echo "num-queries-per-thread: 4096"
 255
 256                 # Use larger send/receive buffers
 257                 echo "so-sndbuf: 4m"
 258                 echo "so-rcvbuf: 4m"
 259         ) > /etc/unbound/tuning.conf
 260 }
 261
 262 get_memory_amount() {
 263         local key val unit
 264
 265         while read -r key val unit; do
 266                 case "${key}" in
 267                         MemTotal:*)
 268                                 # Convert to MB
 269                                 echo "$(( ${val} / 1024 ))"
 270                                 break
 271                                 ;;
 272                 esac
 273         done < /proc/meminfo
 274 }
 275
 276 fix_time_if_dns_fails() {
 277         # If DNS is working, everything is fine
 278         if resolve "ping.ipfire.org" &>/dev/null; then
 279                 return 0
 280         fi
 281
 282         # Try to sync time with a known time server
 283         boot_mesg "DNS not functioning... Trying to sync time with ntp.ipfire.org (81.3.27.46)..."
 284         loadproc /usr/local/bin/settime 81.3.27.46
 285 }
 286
 287 resolve() {
 288         local hostname="${1}"
 289         local found=1
 290
 291         local answer
 292         for answer in $(dig +short A "${hostname}"); do
 293                 # Filter out non-IP addresses
 294                 if [[ ! "${answer}" =~ \.$ ]]; then
 295                         found=0
 296                         echo "${answer}"
 297                 fi
 298         done
 299
 300         return ${found}
 301 }
 302
 303 # Sets up Safe Search for various search engines
 304 update_safe_search() {
 305         local google_tlds=(
 306                 google.ad
 307                 google.ae
 308                 google.al
 309                 google.am
 310                 google.as
 311                 google.at
 312                 google.az
 313                 google.ba
 314                 google.be
 315                 google.bf
 316                 google.bg
 317                 google.bi
 318                 google.bj
 319                 google.bs
 320                 google.bt
 321                 google.by
 322                 google.ca
 323                 google.cat
 324                 google.cd
 325                 google.cf
 326                 google.cg
 327                 google.ch
 328                 google.ci
 329                 google.cl
 330                 google.cm
 331                 google.cn
 332                 google.co.ao
 333                 google.co.bw
 334                 google.co.ck
 335                 google.co.cr
 336                 google.co.id
 337                 google.co.il
 338                 google.co.in
 339                 google.co.jp
 340                 google.co.ke
 341                 google.co.kr
 342                 google.co.ls
 343                 google.com
 344                 google.co.ma
 345                 google.com.af
 346                 google.com.ag
 347                 google.com.ai
 348                 google.com.ar
 349                 google.com.au
 350                 google.com.bd
 351                 google.com.bh
 352                 google.com.bn
 353                 google.com.bo
 354                 google.com.br
 355                 google.com.bz
 356                 google.com.co
 357                 google.com.cu
 358                 google.com.cy
 359                 google.com.do
 360                 google.com.ec
 361                 google.com.eg
 362                 google.com.et
 363                 google.com.fj
 364                 google.com.gh
 365                 google.com.gi
 366                 google.com.gt
 367                 google.com.hk
 368                 google.com.jm
 369                 google.com.kh
 370                 google.com.kw
 371                 google.com.lb
 372                 google.com.ly
 373                 google.com.mm
 374                 google.com.mt
 375                 google.com.mx
 376                 google.com.my
 377                 google.com.na
 378                 google.com.nf
 379                 google.com.ng
 380                 google.com.ni
 381                 google.com.np
 382                 google.com.om
 383                 google.com.pa
 384                 google.com.pe
 385                 google.com.pg
 386                 google.com.ph
 387                 google.com.pk
 388                 google.com.pr
 389                 google.com.py
 390                 google.com.qa
 391                 google.com.sa
 392                 google.com.sb
 393                 google.com.sg
 394                 google.com.sl
 395                 google.com.sv
 396                 google.com.tj
 397                 google.com.tr
 398                 google.com.tw
 399                 google.com.ua
 400                 google.com.uy
 401                 google.com.vc
 402                 google.com.vn
 403                 google.co.mz
 404                 google.co.nz
 405                 google.co.th
 406                 google.co.tz
 407                 google.co.ug
 408                 google.co.uk
 409                 google.co.uz
 410                 google.co.ve
 411                 google.co.vi
 412                 google.co.za
 413                 google.co.zm
 414                 google.co.zw
 415                 google.cv
 416                 google.cz
 417                 google.de
 418                 google.dj
 419                 google.dk
 420                 google.dm
 421                 google.dz
 422                 google.ee
 423                 google.es
 424                 google.fi
 425                 google.fm
 426                 google.fr
 427                 google.ga
 428                 google.ge
 429                 google.gg
 430                 google.gl
 431                 google.gm
 432                 google.gp
 433                 google.gr
 434                 google.gy
 435                 google.hn
 436                 google.hr
 437                 google.ht
 438                 google.hu
 439                 google.ie
 440                 google.im
 441                 google.iq
 442                 google.is
 443                 google.it
 444                 google.je
 445                 google.jo
 446                 google.kg
 447                 google.ki
 448                 google.kz
 449                 google.la
 450                 google.li
 451                 google.lk
 452                 google.lt
 453                 google.lu
 454                 google.lv
 455                 google.md
 456                 google.me
 457                 google.mg
 458                 google.mk
 459                 google.ml
 460                 google.mn
 461                 google.ms
 462                 google.mu
 463                 google.mv
 464                 google.mw
 465                 google.ne
 466                 google.nl
 467                 google.no
 468                 google.nr
 469                 google.nu
 470                 google.pl
 471                 google.pn
 472                 google.ps
 473                 google.pt
 474                 google.ro
 475                 google.rs
 476                 google.ru
 477                 google.rw
 478                 google.sc
 479                 google.se
 480                 google.sh
 481                 google.si
 482                 google.sk
 483                 google.sm
 484                 google.sn
 485                 google.so
 486                 google.sr
 487                 google.st
 488                 google.td
 489                 google.tg
 490                 google.tk
 491                 google.tl
 492                 google.tm
 493                 google.tn
 494                 google.to
 495                 google.tt
 496                 google.vg
 497                 google.vu
 498                 google.ws
 499         )
 500
 501         # Cleanup previous settings
 502         unbound-control local_zone_remove "bing.com" >/dev/null
 503         unbound-control local_zone_remove "duckduckgo.com" >/dev/null
 504         unbound-control local_zone_remove "yandex.com" >/dev/null
 505         unbound-control local_zone_remove "yandex.ru" >/dev/null
 506         unbound-control local_zone_remove "youtube.com" >/dev/null
 507
 508         local domain
 509         for domain in ${google_tlds[@]}; do
 510                 unbound-control local_zone_remove "${domain}"
 511         done >/dev/null
 512
 513         # Nothing to do if safe search is not enabled
 514         if [ "${ENABLE_SAFE_SEARCH}" != "on" ]; then
 515                 return 0
 516         fi
 517
 518         # Bing
 519         unbound-control bing.com transparent >/dev/null
 520         for address in $(resolve "strict.bing.com"); do
 521                 unbound-control local_data "www.bing.com ${LOCAL_TTL} IN A ${address}"
 522         done >/dev/null
 523
 524         # DuckDuckGo
 525         unbound-control local_zone duckduckgo.com typetransparent >/dev/null
 526         for address in $(resolve "safe.duckduckgo.com"); do
 527                 unbound-control local_data "duckduckgo.com ${LOCAL_TTL} IN A ${address}"
 528         done >/dev/null
 529
 530         # Google
 531         local addresses="$(resolve "forcesafesearch.google.com")"
 532         for domain in ${google_tlds[@]}; do
 533                 unbound-control local_zone "${domain}" transparent >/dev/null
 534                 for address in ${addresses}; do
 535                         unbound-control local_data "www.${domain} ${LOCAL_TTL} IN A ${address}"
 536                 done >/dev/null
 537         done
 538
 539         # Yandex
 540         for domain in yandex.com yandex.ru; do
 541                 unbound-control local_zone "${domain}" typetransparent >/dev/null
 542                 for address in $(resolve "familysearch.${domain}"); do
 543                         unbound-control local_data "${domain} ${LOCAL_TTL} IN A ${address}"
 544                 done >/dev/null
 545         done
 546
 547         # YouTube
 548         unbound-control local_zone youtube.com transparent >/dev/null
 549         for address in $(resolve "restrictmoderate.youtube.com"); do
 550                 unbound-control local_data "www.youtube.com ${LOCAL_TTL} IN A ${address}"
 551         done >/dev/null
 552
 553         return 0
 554 }
 555
 556 case "$1" in
 557         start)
 558                 # Print a nicer messagen when unbound is already running
 559                 if pidofproc -s unbound; then
 560                         statusproc /usr/sbin/unbound
 561                         exit 0
 562                 fi
 563
 564                 # Update configuration files
 565                 write_tuning_conf
 566                 write_hosts_conf
 567                 write_forward_conf
 568
 569                 boot_mesg "Starting Unbound DNS Proxy..."
 570                 loadproc /usr/sbin/unbound || exit $?
 571
 572                 # Install Safe Search rules when the system is already online
 573                 if [ -e "/var/ipfire/red/active" ]; then
 574                         update_safe_search
 575                 fi
 576                 ;;
 577
 578         stop)
 579                 boot_mesg "Stopping Unbound DNS Proxy..."
 580                 killproc /usr/sbin/unbound
 581                 ;;
 582
 583         restart)
 584                 $0 stop
 585                 sleep 1
 586                 $0 start
 587                 ;;
 588         reload|update-forwarders)
 589                 # Update configuration files
 590                 write_forward_conf
 591                 write_hosts_conf
 592
 593                 # Call unbound-control and perform the reload
 594                 /usr/sbin/unbound-control -q reload
 595
 596                 # Dummy Resolve to wait for unbound
 597                 resolve "ping.ipfire.org" &>/dev/null
 598
 599                 if [ "$1" = "update-forwarders" ]; then
 600                         # Make sure DNS works at this point
 601                         fix_time_if_dns_fails
 602                 fi
 603
 604                 # Update Safe Search rules if the system is online.
 605                 if [ -e "/var/ipfire/red/active" ]; then
 606                         update_safe_search
 607                 fi
 608                 ;;
 609
 610         status)
 611                 statusproc /usr/sbin/unbound
 612                 ;;
 613
 614         resolve)
 615                 resolve "${2}" || exit $?
 616                 ;;
 617
 618         *)
 619                 echo "Usage: $0 {start|stop|restart|reload|status|resolve|update-forwarders}"
 620                 exit 1
 621                 ;;
 622 esac
 623
 624 # End $rc_base/init.d/unbound