mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-25 10:22:59 +02:00
unbound: Rewrite configuration and initscript
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
@@ -10,18 +10,10 @@
|
||||
. /etc/sysconfig/rc
|
||||
. ${rc_functions}
|
||||
|
||||
if [[ ! -d /run/var ]]; then mkdir /run/var; fi;
|
||||
USE_FORWARDERS=1
|
||||
|
||||
CONTROL_INTERFACE_FILE=1
|
||||
CONTROL_ACCESS_FILE=1
|
||||
USE_CUSTOM_FORWARDS=0
|
||||
ENABLE_DNSSEC=1
|
||||
|
||||
# Unbound daemon pid file
|
||||
PIDFILE=/var/run/unbound.pid
|
||||
|
||||
# Watcher deamon pid file must be the same in unbound main init script
|
||||
WAPIDFILE=/var/run/unbound_dhcpd.pid
|
||||
# Load optional configuration
|
||||
[ -e "/etc/sysconfig/unbound" ] && . /etc/sysconfig/unbound
|
||||
|
||||
function cidr() {
|
||||
local cidr nbits IFS;
|
||||
@@ -47,132 +39,124 @@ function cidr() {
|
||||
echo "${cidr}/${nbits}"
|
||||
}
|
||||
|
||||
read_name_servers() {
|
||||
local i
|
||||
for i in 1 2; do
|
||||
echo "$(</var/ipfire/red/dns${i})"
|
||||
done | xargs echo
|
||||
}
|
||||
|
||||
config_header() {
|
||||
echo "# This file is automatically generated and any changes"
|
||||
echo "# will be overwritten. DO NOT EDIT!"
|
||||
echo
|
||||
}
|
||||
|
||||
update_forwarders() {
|
||||
local forwarders="$(read_name_servers)"
|
||||
|
||||
if [ "${USE_FORWARDERS}" = "1" ] && [ -n "${forwarders}" ]; then
|
||||
boot_mesg "Using Name Server(s): ${forwarders}"
|
||||
boot_mesg_flush
|
||||
|
||||
unbound-control -q forward ${forwarders}
|
||||
|
||||
# If forwarders cannot be used we run in recursor mode
|
||||
else
|
||||
unbound-control -q forward off
|
||||
fi
|
||||
}
|
||||
|
||||
write_interfaces_conf() {
|
||||
(
|
||||
config_header
|
||||
|
||||
if [ -n "${GREEN_ADDRESS}" ]; then
|
||||
echo "# GREEN"
|
||||
echo "interface: ${GREEN_ADDRESS}"
|
||||
echo "access-control: $(cidr ${GREEN_NETADDRESS} ${GREEN_NETMASK}) allow"
|
||||
fi
|
||||
|
||||
if [ -n "${BLUE_ADDRESS}" ]; then
|
||||
echo "# BLUE"
|
||||
echo "interface: ${BLUE_ADDRESS}"
|
||||
echo "access-control: $(cidr ${BLUE_NETADDRESS} ${BLUE_NETMASK}) allow"
|
||||
fi
|
||||
) > /etc/unbound/interfaces.conf
|
||||
}
|
||||
|
||||
write_forward_conf() {
|
||||
(
|
||||
config_header
|
||||
|
||||
local enabled zone server remark
|
||||
while IFS="," read -r enabled zone server remark; do
|
||||
# Line must be enabled.
|
||||
[ "${enabled}" = "on" ] || continue
|
||||
|
||||
echo "forward-zone:"
|
||||
echo " name: ${zone}"
|
||||
echo " forward-addr: ${server}"
|
||||
echo
|
||||
done < /var/ipfire/dnsforward/config
|
||||
) > /etc/unbound/forward.conf
|
||||
}
|
||||
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
|
||||
eval $(/usr/local/bin/readhash /var/ipfire/dhcp/settings)
|
||||
|
||||
if [[ -f ${PIDFILE} ]]; then
|
||||
log_warning_msg "Unbound daemon is running with Process ID $(cat ${PIDFILE})"
|
||||
else
|
||||
eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
|
||||
#ARGS="$CUSTOM_ARGS"
|
||||
#[ "$DOMAIN_NAME_GREEN" != "" ] && ARGS="$ARGS -s $DOMAIN_NAME_GREEN"
|
||||
# Create control keys at first run
|
||||
if [ ! -r "/etc/unbound/unbound_control.key" ]; then
|
||||
unbound-control-setup -d /etc/unbound &>/dev/null
|
||||
fi
|
||||
|
||||
echo > /var/ipfire/red/resolv.conf # Clear it
|
||||
if [ -e "/var/ipfire/red/dns1" ]; then
|
||||
DNS1=$(cat /var/ipfire/red/dns1 2>/dev/null)
|
||||
if [ ! -z ${DNS1} ]; then
|
||||
echo "nameserver ${DNS1}" >> /var/ipfire/red/resolv.conf
|
||||
NAMESERVERS="${DNS1} "
|
||||
fi
|
||||
fi
|
||||
if [ -e "/var/ipfire/red/dns2" ]; then
|
||||
DNS2=$(cat /var/ipfire/red/dns2 2>/dev/null)
|
||||
if [ ! -z ${DNS2} ]; then
|
||||
echo "nameserver ${DNS2}" >> /var/ipfire/red/resolv.conf
|
||||
NAMESERVERS+="${DNS2} "
|
||||
fi
|
||||
fi
|
||||
# Update configuration files
|
||||
write_interfaces_conf
|
||||
write_forward_conf
|
||||
|
||||
# create unbound interfaces.conf
|
||||
if [ ${CONTROL_INTERFACE_FILE} = 1 ]; then
|
||||
echo -n > /etc/unbound/interfaces.conf # Clear it
|
||||
if [ ! -z ${GREEN_ADDRESS} ]; then
|
||||
echo "interface: ${GREEN_ADDRESS}" >> /etc/unbound/interfaces.conf
|
||||
fi
|
||||
if [ ! -z ${BLUE_ADDRESS} ]; then
|
||||
echo "interface: ${BLUE_ADDRESS}" >> /etc/unbound/interfaces.conf
|
||||
fi
|
||||
if [ ! -z ${ORANGE_ADDRESS} ]; then
|
||||
echo "interface: ${ORANGE_ADDRESS}" >> /etc/unbound/interfaces.conf
|
||||
fi
|
||||
fi
|
||||
boot_mesg "Starting Unbound DNS Proxy..."
|
||||
loadproc /usr/sbin/unbound || exit $?
|
||||
|
||||
# create unbound access.conf
|
||||
if [ ${CONTROL_ACCESS_FILE} = 1 ]; then
|
||||
echo -n > /etc/unbound/access.conf # Clear it
|
||||
if [ ! -z ${GREEN_ADDRESS} ]; then
|
||||
echo "access-control: $(cidr ${GREEN_ADDRESS} ${GREEN_NETMASK}) allow" >> /etc/unbound/access.conf
|
||||
fi
|
||||
if [ ! -z ${BLUE_ADDRESS} ]; then
|
||||
echo "access-control: $(cidr ${BLUE_ADDRESS} ${BLUE_NETMASK}) allow" >> /etc/unbound/access.conf
|
||||
fi
|
||||
if [ ! -z ${ORANGE_ADDRESS} ]; then
|
||||
echo "access-control: $(cidr ${ORANGE_ADDRESS} ${ORANGE_NETMASK}) allow" >> /etc/unbound/access.conf
|
||||
fi
|
||||
fi
|
||||
# Update any known forwarding name servers
|
||||
update_forwarders
|
||||
|
||||
# create unbound dnssec.conf
|
||||
echo -n > /etc/unbound/dnssec.conf # Clear it
|
||||
if [ ${ENABLE_DNSSEC} = 1 ]; then
|
||||
echo " # dessec enabled per default" >> /etc/unbound/dnssec.conf
|
||||
echo " # no necessary config options in this file" >> /etc/unbound/dnssec.conf
|
||||
else
|
||||
echo " # dnssec now disabled" >> /etc/unbound/dnssec.conf
|
||||
echo " module-config: iterator" >> /etc/unbound/dnssec.conf
|
||||
echo " val-permissive-mode: yes" >> /etc/unbound/dnssec.conf
|
||||
fi
|
||||
|
||||
# create zone file for internal ipfire domain
|
||||
unbound-zone
|
||||
|
||||
boot_mesg "Starting Unbound DNS proxy..."
|
||||
unbound-anchor
|
||||
loadproc /usr/sbin/unbound
|
||||
|
||||
# start dhcpd watcher daemon if DNS-Update (RFC2136) activated
|
||||
eval $(/usr/local/bin/readhash /var/ipfire/dhcp/settings)
|
||||
if [[ ${DNS_UPDATE_ENABLED} = on && ! -f ${WAPIDFILE} ]]; then
|
||||
/etc/rc.d/init.d/unbound-dhcpd start
|
||||
fi
|
||||
|
||||
# use setup configured DNS servers
|
||||
if [ "${USE_CUSTOM_FORWARDS}" -eq 0 ]; then
|
||||
unbound-control forward_add +i . ${NAMESERVERS} &> /dev/null
|
||||
fi;
|
||||
|
||||
FORWADRS=$(unbound-control list_forwards |sed 's|. IN forward ||g'|sed 's|+i ||g')
|
||||
if [ "${USE_CUSTOM_FORWARDS}" -eq 0 ]; then
|
||||
boot_mesg "Using DNS server(s): ${FORWADRS}"
|
||||
else
|
||||
boot_mesg "Using custom DNS server(s): ${FORWADRS}"
|
||||
fi
|
||||
if [ ${ENABLE_DNSSEC} = 1 ]; then
|
||||
boot_mesg "DNSSEC is enabled!"
|
||||
else
|
||||
boot_mesg "DNSSEC is disabled!"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
# Start Unbound DHCP Lease Bridge unless RFC2136 is used
|
||||
if [ "${DNS_UPDATE_ENABLED}" != on ]; then
|
||||
boot_mesg "Starting Unbound DHCP Leases Bridge..."
|
||||
loadproc /usr/sbin/unbound-dhcp-leases-bridge -d
|
||||
fi
|
||||
;;
|
||||
|
||||
stop)
|
||||
boot_mesg "Stopping Unbound DHCP Leases Bridge..."
|
||||
killproc /usr/sbin/unbound-dhcp-leases-bridge
|
||||
|
||||
if [[ -f ${PIDFILE} ]]; then
|
||||
# stop dhcpd watcher daemon if activted
|
||||
if [[ -f ${WAPIDFILE} ]]; then
|
||||
/etc/rc.d/init.d/unbound-dhcpd stop
|
||||
fi
|
||||
# stop Unbound daemon
|
||||
boot_mesg "Stopping Unbound DNS proxy..."
|
||||
killproc -p "/var/run/unbound.pid" /usr/sbin/unbound
|
||||
else
|
||||
log_warning_msg "Unbound daemon is not running..."
|
||||
fi
|
||||
;;
|
||||
boot_mesg "Stopping Unbound DNS Proxy..."
|
||||
killproc /usr/sbin/unbound
|
||||
;;
|
||||
|
||||
restart)
|
||||
$0 stop
|
||||
sleep 1
|
||||
$0 start
|
||||
;;
|
||||
$0 stop
|
||||
sleep 1
|
||||
$0 start
|
||||
;;
|
||||
|
||||
status)
|
||||
statusproc /usr/sbin/unbound
|
||||
;;
|
||||
statusproc /usr/sbin/unbound
|
||||
statusproc /usr/sbin/unbound-dhcp-leases-bridge
|
||||
;;
|
||||
|
||||
update-forwarders)
|
||||
update_forwarders
|
||||
;;
|
||||
|
||||
*)
|
||||
echo "Usage: $0 {start|stop|restart|status}"
|
||||
exit 1
|
||||
;;
|
||||
echo "Usage: $0 {start|stop|restart|status|update-forwarders}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# End $rc_base/init.d/unbound
|
||||
|
||||
Reference in New Issue
Block a user