Difuse/packages
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
packages/net/unbound/files/unbound.ntpd

30 lines
1 KiB
Text
Raw Normal View History

Unbound: Add hotplug/ntp script to request restart -DNSSEC needs time, time needs ntp, or power off RTC -Many consumer routers are cost thrifted without RTC -Conf "val-override-date: -1" disables time inside DNSSEC -Need restart as option is not dynamically switchable -hotplug/ntp is used to set file /var/lib/unbound/unbound.time -UCI will add or remove option depending on flag-like-file Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2016-10-28 02:01:00 +00:00
#!/bin/sh
##############################################################################
#
# Copyright (C) 2016 Eric Luehrsen
#
##############################################################################
#
# "Restart" Unbound on hotplug NTP ready:
# - Only do this the first time when no file exists
# - Some of Unbound conf options to not reload run time
# - Change the enable flag for DNSSEC date-time checking
#
##############################################################################
unbound: clean up interface interpretation in UCI DNS flag day 2020, software should reflect the minimum EDNS 1232 bytes. Added iface_wan and iface_lan to control internal DNS assignemnts and to control what is local service ACL. Interface wild cards are not explicitly set so that they can be customized in extended conf. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-10-27 03:09:18 +00:00
# while useful (sh)ellcheck is pedantic and noisy
# shellcheck disable=1091,2002,2004,2034,2039,2086,2094,2140,2154,2155
unbound: add UCI for forward stub and auth zone clauses With growing interest, DNS over TLS can be setup in Unbounds foward-zone: clause. A broader UCI solution is added to support forward-, stub-, and auth- zone clauses in a new 'zone' section. This implentation required reworking scripts, because they did not scale. 'forward_domain' and 'prefetch_root' options are removed, and superceded by 'zone' section. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-06-29 00:41:37 +00:00
. /usr/lib/unbound/defaults.sh
Unbound: Add hotplug/ntp script to request restart -DNSSEC needs time, time needs ntp, or power off RTC -Many consumer routers are cost thrifted without RTC -Conf "val-override-date: -1" disables time inside DNSSEC -Need restart as option is not dynamically switchable -hotplug/ntp is used to set file /var/lib/unbound/unbound.time -UCI will add or remove option depending on flag-like-file Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2016-10-28 02:01:00 +00:00
##############################################################################
unbound: clean up interface interpretation in UCI DNS flag day 2020, software should reflect the minimum EDNS 1232 bytes. Added iface_wan and iface_lan to control internal DNS assignemnts and to control what is local service ACL. Interface wild cards are not explicitly set so that they can be customized in extended conf. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-10-27 03:09:18 +00:00
if [ ! -f "$UB_TIME_FILE" ] && [ "$ACTION" = stratum ] ; then
unbound: add UCI for forward stub and auth zone clauses With growing interest, DNS over TLS can be setup in Unbounds foward-zone: clause. A broader UCI solution is added to support forward-, stub-, and auth- zone clauses in a new 'zone' section. This implentation required reworking scripts, because they did not scale. 'forward_domain' and 'prefetch_root' options are removed, and superceded by 'zone' section. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-06-29 00:41:37 +00:00
date -Is > $UB_TIME_FILE
unbound: improve NTP hotplug behavior when Unbound is disabled If Unbound was disabled and at later time enabled, then it would operate in DNSSEC less-secure mode. When NTP hotplug was called, the timestamp file was not updated. This was found testing Unbound vs other tools (bind, dnsmasq). Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2016-12-23 07:37:21 +00:00
/etc/init.d/unbound enabled && /etc/init.d/unbound restart
unbound: improve interface trigger behavior procd interface triggers may be busy. Unbound hard restarts will flush the cache. This might happen frequently depending on how interface triggers occur. Change the procd trigger to reduce occurences. Load this trigger prior to netifd (START=20), but only truly start Unbound from the trigger rather than immediately in init. Clean up log entries in scripts after Unbound, NTP, and DNSSEC are established. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2017-03-25 05:53:28 +00:00
# Yes, hard RESTART. We need to be absolutely sure to enable DNSSEC.
Unbound: Add hotplug/ntp script to request restart -DNSSEC needs time, time needs ntp, or power off RTC -Many consumer routers are cost thrifted without RTC -Conf "val-override-date: -1" disables time inside DNSSEC -Need restart as option is not dynamically switchable -hotplug/ntp is used to set file /var/lib/unbound/unbound.time -UCI will add or remove option depending on flag-like-file Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2016-10-28 02:01:00 +00:00
fi
##############################################################################
Reference in a new issue Copy permalink