unbound: bugfix init race condition invalid FQDN
options 'add_local_fqdn' and 'add_wan_fqdn' can be affected by race conditions when they are at level 4. Interface name may not be returned by network tools. The conf file has bad record formats and Unbound just will not load. Detect this and fall back to only the host FQDN (level 3). squash: improve documentation wording and format codes. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
This commit is contained in:
Eric Luehrsen
parent
8f9479f433
commit
a6e8e5384b
3 changed files with 207 additions and 186 deletions
|
|
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
|
|||
|
||||
PKG_NAME:=unbound
|
||||
PKG_VERSION:=1.6.1
|
||||
PKG_RELEASE:=2
|
||||
PKG_RELEASE:=3
|
||||
|
||||
PKG_LICENSE:=BSD-3-Clause
|
||||
PKG_LICENSE_FILES:=LICENSE
|
||||
|
|
|
|||
|
|
@ -1,15 +1,15 @@
|
|||
# Unbound Recursive DNS Server with UCI
|
||||
|
||||
## Unbound Description
|
||||
Unbound is a validating, recursive, and caching DNS resolver. The C implementation of Unbound is developed and maintained by [NLnet Labs](https://www.unbound.net/). It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modular components, so that also DNSSEC (secure DNS) validation and stub-resolvers (that do not run as a server, but are linked into an application) are easily possible.
|
||||
[Unbound](https://www.unbound.net/) is a validating, recursive, and caching DNS resolver. The C implementation of Unbound is developed and maintained by [NLnet Labs](https://www.nlnetlabs.nl/). It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modular components, so that also DNSSEC (secure DNS) validation and stub-resolvers (that do not run as a server, but are linked into an application) are easily possible.
|
||||
|
||||
## Package Overview
|
||||
Unbound may be useful on consumer grade embedded hardware. It is *intended* to be a recursive resolver only. [NLnet Labs NSD](https://www.nlnetlabs.nl/projects/nsd/) is *intended* for the authoritative task. This is different than [ISC Bind](https://www.isc.org/downloads/bind/) and its inclusive functions. Unbound configuration effort and memory consumption may be easier to control. A consumer could have their own recursive resolver, and remove potential issues from forwarding resolvers outside of their control.
|
||||
Unbound may be useful on consumer grade embedded hardware. It is _intended_ to be a recursive resolver only. [NLnet Labs NSD](https://www.nlnetlabs.nl/projects/nsd/) is _intended_ for the authoritative task. This is different than [ISC Bind](https://www.isc.org/downloads/bind/) and its inclusive functions. Unbound configuration effort and memory consumption may be easier to control. A consumer could have their own recursive resolver with 8/64 MB router, and remove potential issues from forwarding resolvers outside of their control.
|
||||
|
||||
This package builds on Unbounds capabilities with OpenWrt UCI. Not every Unbound option is in UCI, but rather, UCI simplifies the combination of related options. Unbounds native options are bundled and balanced within a smaller set of choices. Options include resources, DNSSEC, access control, and some TTL tweaking. The UCI also provides an escape option and work at the raw "unbound.conf" level.
|
||||
|
||||
## Adblocking
|
||||
The UCI scripts will work with OpenWrt/pacakages/net/adblock (2.3.0 and above) if it is installed and enabled. Its all detected and integrated automatically. In brief, the adblock scripts create distinct local-zone files that are simply included in the unbound conf file during UCI generation. If you don't want this, then disable adblock or reconfigure adblock to not send these files to Unbound.
|
||||
## HOW TO Adblocking
|
||||
The UCI scripts will work with [net/adblock 2.3+](https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md), if it is installed and enabled. Its all detected and integrated automatically. In brief, the adblock scripts create distinct local-zone files that are simply included in the unbound conf file during UCI generation. If you don't want this, then disable adblock or reconfigure adblock to not send these files to Unbound.
|
||||
|
||||
## HOW TO Integrate with DHCP
|
||||
Some UCI options and scripts help Unbound to work with DHCP servers to load the local DNS. The examples provided here are serial dnsmasq-unbound, parallel dnsmasq-unbound, and unbound scripted with odhcpd.
|
||||
|
|
@ -19,7 +19,8 @@ In this case, dnsmasq is not changed *much* with respect to the default OpenWRT/
|
|||
|
||||
**/etc/config/unbound**:
|
||||
|
||||
config unbound
|
||||
```
|
||||
config unbound
|
||||
option add_local_fqdn '0'
|
||||
option add_wan_fqdn '0'
|
||||
option dhcp_link 'none'
|
||||
|
|
@ -28,10 +29,12 @@ In this case, dnsmasq is not changed *much* with respect to the default OpenWRT/
|
|||
option domain_type 'refuse'
|
||||
option listen_port '1053'
|
||||
...
|
||||
```
|
||||
|
||||
**/etc/config/dhcp**:
|
||||
|
||||
config dnsmasq
|
||||
```
|
||||
config dnsmasq
|
||||
option domain 'yourdomain'
|
||||
option noresolv '1'
|
||||
option resolvfile '/tmp/resolv.conf.auto'
|
||||
|
|
@ -39,39 +42,45 @@ In this case, dnsmasq is not changed *much* with respect to the default OpenWRT/
|
|||
list server '127.0.0.1#1053'
|
||||
list server '::1#1053'
|
||||
...
|
||||
```
|
||||
|
||||
### Parallel dnsmasq
|
||||
In this case, Unbound serves your local network directly for all purposes. It will look over to dnsmasq for DHCP-DNS resolution. Unbound is generally accessible on port 53, and dnsmasq is only accessed at 127.0.0.1:1053 by Unbound. Although you can dig/drill/nslookup remotely with the proper directives.
|
||||
|
||||
**/etc/config/unbound**:
|
||||
|
||||
config unbound
|
||||
```
|
||||
config unbound
|
||||
option dhcp_link 'dnsmasq'
|
||||
option listen_port '53'
|
||||
...
|
||||
```
|
||||
|
||||
**/etc/config/dhcp**:
|
||||
|
||||
config dnsmasq
|
||||
```
|
||||
config dnsmasq
|
||||
option domain 'yourdomain'
|
||||
option noresolv '1'
|
||||
option resolvfile '/tmp/resolv.conf.auto'
|
||||
option port '1053'
|
||||
...
|
||||
|
||||
config dhcp 'lan'
|
||||
config dhcp 'lan'
|
||||
# dnsmasq may not issue DNS option if not std. configuration
|
||||
list dhcp_option 'option:dns-server,0.0.0.0'
|
||||
...
|
||||
```
|
||||
|
||||
### Only odhcpd
|
||||
Why use dnsmasq you might ask? Well test, try, and review. You can have Unbound and odhcpd only. When odhcpd configures each DHCP lease, it will call a script. The script provided with Unbound will read the lease file and enter DHCP-DNS records as much as dnsmasq once did. You **must install** `unbound-control`, because the lease records are added and removed without starting, stopping, flushing cache, or re-writing conf files.
|
||||
### Unbound and odhcpd
|
||||
You may ask can Unbound replace dnsmasq? You can have DHCP-DNS records with Unbound and odhcpd only. The UCI scripts will allow Unbound to act like dnsmasq. When odhcpd configures each DHCP lease, it will call a script. The script provided with Unbound will read the lease file for DHCP-DNS records. You **must install** `unbound-control`, because the lease records are added and removed without starting, stopping, flushing cache, or re-writing conf files. (_restart overhead can be excessive with even a few mobile devices._)
|
||||
|
||||
*note: if you run the default LEDE/OpenWrt setup with dnsmasq and odhcpd, then use the link to dnsmasq. Unbound will pole dnsmasq. dnsmasq merges its lease file and odhcpd lease file.*
|
||||
Don't forget to disable or uninstall dnsmasq when you don't intend to use it. Strange results may occur. If you want to use default dnsmasq+odhcpd and add Unbound on top, then use the dnsmasq-serial or dnsmasq-parallel methods above.
|
||||
|
||||
**/etc/config/unbound**:
|
||||
|
||||
config unbound
|
||||
```
|
||||
config unbound
|
||||
# name your router in DNS
|
||||
option add_local_fqdn '1'
|
||||
option add_wan_fqdn '1'
|
||||
|
|
@ -85,27 +94,30 @@ Why use dnsmasq you might ask? Well test, try, and review. You can have Unbound
|
|||
# install unbound-control and set this
|
||||
option unbound_control '1'
|
||||
...
|
||||
```
|
||||
|
||||
**/etc/config/dhcp**:
|
||||
|
||||
config dhcp 'lan'
|
||||
```
|
||||
config dhcp 'lan'
|
||||
option dhcpv4 'server'
|
||||
option dhcpv6 'server'
|
||||
option interface 'lan'
|
||||
# short times help renew events to refresh dns
|
||||
option leasetime '4h'
|
||||
option leasetime '12h'
|
||||
option ra 'server'
|
||||
option ra_management '1'
|
||||
# issue your ULA and avoid default [fe80::]
|
||||
list dns 'fdxx:xxxx:xxxx::1'
|
||||
...
|
||||
|
||||
config odhcpd 'odhcpd'
|
||||
config odhcpd 'odhcpd'
|
||||
option maindhcp '1'
|
||||
option leasefile '/var/lib/odhcpd/dhcp.leases'
|
||||
# this is where the magic happens
|
||||
option leasetrigger '/usr/lib/unbound/odhcpd.sh'
|
||||
```
|
||||
|
||||
## Back to Manual Configuration
|
||||
## HOW TO Manual Override
|
||||
Yes, there is a UCI to disable the rest of Unbound UCI. However, OpenWrt or LEDE are targeted at embedded machines with flash ROM. The initialization scripts do a few things to protect flash ROM.
|
||||
|
||||
### Completely Manual (almost)
|
||||
|
|
@ -115,9 +127,12 @@ Keep the DNSKEY updated with your choice of flash activity. `root.key` maintenan
|
|||
|
||||
**/etc/config/unbound**:
|
||||
|
||||
config unbound
|
||||
```
|
||||
config unbound
|
||||
option manual_conf '1'
|
||||
option root_age '9'
|
||||
# end
|
||||
```
|
||||
|
||||
### Hybrid Manual/UCI
|
||||
You like the UCI. Yet, you need to add some difficult to standardize options, or just are not ready to make a UCI request yet. The files `/etc/unbound/unbound_srv.conf` and `/etc/unbound/unbound_ext.conf` will be copied to Unbounds chroot directory and included during auto generation.
|
||||
|
|
@ -127,7 +142,8 @@ The former will be added to the end of the `server:` clause. The later will be a
|
|||
## Complete List of UCI Options
|
||||
**/etc/config/unbound**:
|
||||
|
||||
config unbound
|
||||
```
|
||||
config unbound
|
||||
Currently only one instance is supported.
|
||||
|
||||
option add_local_fqdn '0'
|
||||
|
|
@ -258,7 +274,6 @@ The former will be added to the end of the `server:` clause. The later will be a
|
|||
list domain_insecure
|
||||
List. Domains or pointers that you wish to skip DNSSEC. Your DHCP
|
||||
domains and pointers in dnsmasq will get this automatically.
|
||||
```
|
||||
|
||||
## Deprecated UCI
|
||||
The dnsmasq specific UCI will still work as well as they did, but please use `option dhcp_link 'dnsmasq'` above. Local host name and WAN host name will be lifted and configured from DHCP UCI subpart dnsmasq. (`dnsmasq_gate_name`, `dnsmasq_link_dns`, `dnsmasq_only_local`)
|
||||
|
||||
|
|
|
|||
|
|
@ -115,7 +115,6 @@ create_interface_dns() {
|
|||
|
||||
if [ "$ignore" -gt 0 ] ; then
|
||||
mode="$UNBOUND_D_WAN_FQDN"
|
||||
|
||||
else
|
||||
mode="$UNBOUND_D_LAN_FQDN"
|
||||
fi
|
||||
|
|
@ -128,8 +127,15 @@ create_interface_dns() {
|
|||
;;
|
||||
|
||||
4)
|
||||
if [ -z "$ifdashname" ] ; then
|
||||
# race conditions at init can rarely cause a blank device return
|
||||
# the record format is invalid and Unbound won't load the conf file
|
||||
mode_ptr="$host_fqdn"
|
||||
names="$host_fqdn $UNBOUND_TXT_HOSTNAME"
|
||||
else
|
||||
mode_ptr="$if_fqdn"
|
||||
names="$if_fqdn $host_fqdn $UNBOUND_TXT_HOSTNAME"
|
||||
fi
|
||||
;;
|
||||
|
||||
*)
|
||||
|
|
|
|||
Loading…
Reference in a new issue