Unbound: Add files to enable forward link to dnsmasq
-dnsmasq really provides nice local DHCP-DNS records -Unbound host records would be clumsy to update -Unbound can be configured to forward to dnsmasq -iptools provided to facilitate PTR records -flexible ipv6 colon notation is a bit complex Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
This commit is contained in:
Eric Luehrsen
parent
2202548ff0
commit
e8efcadcd5
2 changed files with 322 additions and 0 deletions
182
net/unbound/files/dnsmasq.sh
Normal file
182
net/unbound/files/dnsmasq.sh
Normal file
|
|
@ -0,0 +1,182 @@
|
||||||
|
#!/bin/sh
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License version 2 as
|
||||||
|
# published by the Free Software Foundation.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# Copyright (C) 2016 Eric Luehrsen
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# This crosses over to the dnsmasq UCI file "dhcp" and parses it for fields
|
||||||
|
# that will allow Unbound to request local host DNS of dnsmasq. We need to look
|
||||||
|
# at the interfaces in "dhcp" and get their subnets. The Unbound conf syntax
|
||||||
|
# makes this a little difficult. First in "server:" we need to create private
|
||||||
|
# zones for the domain and PTR records. Then we need to create numerous
|
||||||
|
# "forward:" clauses to forward those zones to dnsmasq.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
create_local_zone() {
|
||||||
|
local cfg="$1"
|
||||||
|
local fwd_port fwd_domain
|
||||||
|
|
||||||
|
config_get fwd_domain "$cfg" domain
|
||||||
|
config_get fwd_port "$cfg" port
|
||||||
|
|
||||||
|
|
||||||
|
if [ -n "$fwd_domain" -a -n "$fwd_port" -a ! "$fwd_port" -eq 53 ] ; then
|
||||||
|
# dnsmasq localhost listening ports (possible multiple instances)
|
||||||
|
UNBOUND_N_FWD_PORTS="$UNBOUND_N_FWD_PORTS $fwd_port"
|
||||||
|
UNBOUND_TXT_FWD_ZONE="$UNBOUND_TXT_FWD_ZONE $fwd_domain"
|
||||||
|
|
||||||
|
{
|
||||||
|
# This creates DOMAIN local privledges
|
||||||
|
echo " private-domain: \"$fwd_domain\""
|
||||||
|
echo " local-zone: \"$fwd_domain.\" transparent"
|
||||||
|
echo " domain-insecure: \"$fwd_domain\""
|
||||||
|
echo
|
||||||
|
} >> $UNBOUND_CONFFILE
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
create_local_arpa() {
|
||||||
|
local cfg="$1"
|
||||||
|
local logint dhcpv4 dhcpv6 ignore
|
||||||
|
local subnets subnets4 subnets6
|
||||||
|
local forward arpa
|
||||||
|
local validip4 validip6 privateip
|
||||||
|
|
||||||
|
config_get logint "$cfg" interface
|
||||||
|
config_get dhcpv4 "$cfg" dhcpv4
|
||||||
|
config_get dhcpv6 "$cfg" dhcpv6
|
||||||
|
config_get_bool ignore "$cfg" ignore 0
|
||||||
|
|
||||||
|
# Find the list of addresses assigned to a logical interface
|
||||||
|
# Its typical to have a logical gateway split NAME and NAME6
|
||||||
|
network_get_subnets subnets4 "$logint"
|
||||||
|
network_get_subnets6 subnets6 "$logint"
|
||||||
|
subnets="$subnets4 $subnets6"
|
||||||
|
|
||||||
|
network_get_subnets subnets4 "${logint}6"
|
||||||
|
network_get_subnets6 subnets6 "${logint}6"
|
||||||
|
subnets="$subnets $subnets4 $subnets6"
|
||||||
|
|
||||||
|
|
||||||
|
if [ -z "$subnets" ] ; then
|
||||||
|
forward=""
|
||||||
|
|
||||||
|
elif [ -z "$UNBOUND_N_FWD_PORTS" ] ; then
|
||||||
|
forward=""
|
||||||
|
|
||||||
|
elif [ "$ignore" -gt 0 ] ; then
|
||||||
|
if [ "$UNBOUND_B_GATE_NAME" -gt 0 ] ; then
|
||||||
|
# Only forward the one gateway host.
|
||||||
|
forward="host"
|
||||||
|
|
||||||
|
else
|
||||||
|
forward=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
else
|
||||||
|
# Forward the entire private subnet.
|
||||||
|
forward="domain"
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if [ -n "$forward" ] ; then
|
||||||
|
for subnet in $subnets ; do
|
||||||
|
validip4=$( valid_subnet4 $subnet )
|
||||||
|
validip6=$( valid_subnet6 $subnet )
|
||||||
|
privateip=$( private_subnet $subnet )
|
||||||
|
|
||||||
|
|
||||||
|
if [ "$validip4" = "ok" -a "$dhcpv4" != "disable" ] ; then
|
||||||
|
if [ "$forward" = "domain" ] ; then
|
||||||
|
arpa=$( domain_ptr_ip4 "$subnet" )
|
||||||
|
else
|
||||||
|
arpa=$( host_ptr_ip4 "$subnet" )
|
||||||
|
fi
|
||||||
|
|
||||||
|
elif [ "$validip6" = "ok" -a "$dhcpv6" != "disable" ] ; then
|
||||||
|
if [ "$forward" = "domain" ] ; then
|
||||||
|
arpa=$( domain_ptr_ip6 "$subnet" )
|
||||||
|
else
|
||||||
|
arpa=$( host_ptr_ip6 "$subnet" )
|
||||||
|
fi
|
||||||
|
|
||||||
|
else
|
||||||
|
arpa=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
if [ -n "$arpa" ] ; then
|
||||||
|
if [ "$privateip" = "ok" ] ; then
|
||||||
|
{
|
||||||
|
# This creates ARPA local zone privledges
|
||||||
|
echo " local-zone: \"$arpa.\" transparent"
|
||||||
|
echo " domain-insecure: \"$arpa\""
|
||||||
|
echo
|
||||||
|
} >> $UNBOUND_CONFFILE
|
||||||
|
fi
|
||||||
|
|
||||||
|
|
||||||
|
UNBOUND_TXT_FWD_ZONE="$UNBOUND_TXT_FWD_ZONE $arpa"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
forward_local_zone() {
|
||||||
|
if [ -n "$UNBOUND_N_FWD_PORTS" -a -n "$UNBOUND_TXT_FWD_ZONE" ] ; then
|
||||||
|
for fwd_domain in $UNBOUND_TXT_FWD_ZONE ; do
|
||||||
|
{
|
||||||
|
# This is derived of create_local_zone/arpa
|
||||||
|
# but forward: clauses need to be seperate
|
||||||
|
echo "forward-zone:"
|
||||||
|
echo " name: \"$fwd_domain.\""
|
||||||
|
|
||||||
|
for port in $UNBOUND_N_FWD_PORTS ; do
|
||||||
|
echo " forward-addr: 127.0.0.1@$port"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo
|
||||||
|
} >> $UNBOUND_CONFFILE
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
dnsmasq_link() {
|
||||||
|
####################
|
||||||
|
# UCI @ dhcp #
|
||||||
|
####################
|
||||||
|
|
||||||
|
|
||||||
|
if [ "$UNBOUND_B_DNSMASQ" -gt 0 ] ; then
|
||||||
|
# Forward to dnsmasq on same host for DHCP lease hosts
|
||||||
|
echo " do-not-query-localhost: no" >> $UNBOUND_CONFFILE
|
||||||
|
# Look at dnsmasq settings
|
||||||
|
config_load dhcp
|
||||||
|
# Zone for DHCP / SLAAC-PING DOMAIN
|
||||||
|
config_foreach create_local_zone dnsmasq
|
||||||
|
# Zone for DHCP / SLAAC-PING ARPA
|
||||||
|
config_foreach create_local_arpa dhcp
|
||||||
|
# Now create ALL seperate forward: clauses
|
||||||
|
forward_local_zone
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
140
net/unbound/files/iptools.sh
Normal file
140
net/unbound/files/iptools.sh
Normal file
|
|
@ -0,0 +1,140 @@
|
||||||
|
#!/bin/sh
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License version 2 as
|
||||||
|
# published by the Free Software Foundation.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# Copyright (C) 2016 Eric Luehrsen
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
#
|
||||||
|
# These are iptools that might be useful in a larger package, if provided
|
||||||
|
# elsewhere for common use. One example that many may find useful is turning
|
||||||
|
# flexible IPV6 colon dividers into PTR. Otherwise these are incomplete and
|
||||||
|
# would need robustness improvements for more generic applications.
|
||||||
|
#
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
domain_ptr_ip6() {
|
||||||
|
# Get the nibble rounded /CIDR ...ip6.arpa.
|
||||||
|
echo "$1" | awk -F: \
|
||||||
|
'BEGIN { OFS = "" ; }
|
||||||
|
{ CIDR = $0 ;
|
||||||
|
sub(/.*\//,"",CIDR) ;
|
||||||
|
CIDR = (CIDR / 4) ;
|
||||||
|
sub(/\/[0-9]+/,"",$0) ;
|
||||||
|
ct_stop = 9 - NF ;
|
||||||
|
for(i=1; i<=NF; i++) {
|
||||||
|
if(length($i) == 0) {
|
||||||
|
for(j=1; j<=ct_stop; j++) { $i = ($i "0000") ; } }
|
||||||
|
else { $i = substr(("0000" $i), length($i)+5-4) ; } } ;
|
||||||
|
y = $0 ;
|
||||||
|
ct_start = length(y) - 32 + CIDR ;
|
||||||
|
for(i=ct_start; i>0; i--) { x = (x substr(y,i,1)) ; } ;
|
||||||
|
gsub(/./,"&\.",x) ;
|
||||||
|
x = (x "ip6.arpa") ;
|
||||||
|
print x }'
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
host_ptr_ip6() {
|
||||||
|
# Get complete host ...ip6.arpa.
|
||||||
|
echo "$1" | awk -F: \
|
||||||
|
'BEGIN { OFS = "" ; }
|
||||||
|
{ sub(/\/[0-9]+/,"",$0) ;
|
||||||
|
ct_stop = 9 - NF ;
|
||||||
|
for(i=1; i<=NF; i++) {
|
||||||
|
if(length($i) == 0) {
|
||||||
|
for(j=1; j<=ct_stop; j++) { $i = ($i "0000") ; } }
|
||||||
|
else { $i = substr(("0000" $i), length($i)+5-4) ; } } ;
|
||||||
|
y = $0 ;
|
||||||
|
ct_start = length(y);
|
||||||
|
for(i=ct_start; i>0; i--) { x = (x substr(y,i,1)) ; } ;
|
||||||
|
sub(/[0-9]+\//,"",x) ;
|
||||||
|
gsub(/./,"&\.",x) ;
|
||||||
|
x = (x "ip6.arpa") ;
|
||||||
|
print x }'
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
domain_ptr_ip4() {
|
||||||
|
# Get the byte rounded /CIDR ...in-addr.arpa.
|
||||||
|
echo "$1" | awk \
|
||||||
|
'{ CIDR = $0 ;
|
||||||
|
sub(/.*\//,"",CIDR) ;
|
||||||
|
CIDR = (CIDR / 8) ;
|
||||||
|
dtxt = $0 ;
|
||||||
|
sub(/\/.*/,"",dtxt) ;
|
||||||
|
split(dtxt, dtxt, ".") ;
|
||||||
|
for(i=1; i<=CIDR; i++) { x = (dtxt[i] "." x) ; }
|
||||||
|
x = (x "in-addr.arpa") ;
|
||||||
|
print x }'
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
host_ptr_ip4() {
|
||||||
|
# Get omplete host ...in-addr.arpa.
|
||||||
|
echo "$1" | awk -F. \
|
||||||
|
'{ x = ( $4"."$3"."$2"."$1".in-addr.arpa" ) ;
|
||||||
|
sub(/\/[0-9]+/,"",x) ;
|
||||||
|
print x }'
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
valid_subnet6() {
|
||||||
|
case "$1" in
|
||||||
|
# GA
|
||||||
|
[1-9][0-9a-f][0-9a-f][0-9a-f]":"*) echo "ok" ;;
|
||||||
|
# ULA
|
||||||
|
f[cd][0-9a-f][0-9a-f]":"*) echo "ok" ;;
|
||||||
|
# fe80::, ::1, and such
|
||||||
|
*) echo "not" ;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
valid_subnet4() {
|
||||||
|
case "$1" in
|
||||||
|
# Link, Local, and Such
|
||||||
|
169"."254"."*) echo "not" ;;
|
||||||
|
127"."*) echo "not" ;;
|
||||||
|
0"."*) echo "not" ;;
|
||||||
|
255"."*) echo "not" ;;
|
||||||
|
# Other Normal
|
||||||
|
25[0-4]"."[0-9]*) echo "ok" ;;
|
||||||
|
2[0-4][0-9]"."[0-9]*) echo "ok" ;;
|
||||||
|
1[0-9][0-9]"."[0-9]*) echo "ok" ;;
|
||||||
|
[0-9][0-9]"."[0-9]*) echo "ok" ;;
|
||||||
|
[0-9]"."[0-9]*) echo "ok" ;;
|
||||||
|
# Not Right
|
||||||
|
*) echo "not";;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
|
private_subnet() {
|
||||||
|
case "$1" in
|
||||||
|
10"."*) echo "ok" ;;
|
||||||
|
172"."1[6-9]"."*) echo "ok" ;;
|
||||||
|
172"."2[0-9]"."*) echo "ok" ;;
|
||||||
|
172"."3[0-1]"."*) echo "ok" ;;
|
||||||
|
192"."168"."*) echo "ok" ;;
|
||||||
|
f[cd][0-9a-f][0-9a-f]":"*) echo "ok" ;;
|
||||||
|
*) echo "not" ;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
##############################################################################
|
||||||
|
|
||||||
Loading…
Reference in a new issue