aboutsummaryrefslogtreecommitdiff
path: root/net/unbound/Makefile
Commit message (Collapse)AuthorAge
...
* unbound: fix odhcpd link and axfr zone scriptsEric Luehrsen2018-10-24
| | | | | | | - fix AXFR zones to delay a potentially large download with ntp-hotplug - fix odhcpd link script to properly delete expired lease data from DNS Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to 1.8.1Eric Luehrsen2018-10-09
| | | | | | | bug fixes for memory leaks bug fixes for DNS over TLS Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add patches for leaks during TLS queryEric Luehrsen2018-09-27
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to 1.8.0Eric Luehrsen2018-09-15
| | | | | | | - adjust a few UCI translations to coordinate with upstream defaults - remove OpenSSL < 1.1.0 API log error patch which is included upstream Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: drop odhcpd leases with wrong field countEric Luehrsen2018-08-16
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: log openssl-1.0.2 lacks TLS host verificationEric Luehrsen2018-08-10
| | | | | | | | | | | ssl_set1_host() is not available without openssl-1.1.0. Unbound can not do host cert verification. DNS over TLS connects, but hosts are unverified. A patch for log err is added with a noitce in README.md. (see: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=658) Also, squash some minor robustness and TLS usability fixes. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: fix boot time and default run directoryEric Luehrsen2018-08-03
| | | | | | | | | Unbound struggles with boot ifup, so procd triggers changed to push outside of this noise. Unbound has run in /var/lib/unbound/, so chroot (jail) protects /etc/, and it can save flash wear. Compiled defaults reflect this now, so Unbound tools are easier run on the command line. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add UCI for forward stub and auth zone clausesEric Luehrsen2018-07-29
| | | | | | | | | | With growing interest, DNS over TLS can be setup in Unbounds foward-zone: clause. A broader UCI solution is added to support forward-, stub-, and auth- zone clauses in a new 'zone' section. This implentation required reworking scripts, because they did not scale. 'forward_domain' and 'prefetch_root' options are removed, and superceded by 'zone' section. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: limit outside script source to init funciton scopeEric Luehrsen2018-06-26
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to 1.7.3Eric Luehrsen2018-06-23
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve local zone evaluation in UCIEric Luehrsen2018-06-12
| | | | | | | | | | | | When UCI local zone is private and static, Unbound covered private addresses with defaults. Optional delegated global IP6 prefix protection lacked a static zone, but it was prevented from appearing in global DNS responses. Domain names router-as-TLD, "lan." and "local." were static, but they lacked default SOA or NS such as Unbound had assinged to private addresses. Clean up these local zones UCI evaluation and block global DNS inclusion. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.7.2Eric Luehrsen2018-06-12
| | | | | | | A few bug fixes but importantly fix a deadlock on AXFR configuration when notify occurs (auth-zone:) Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: Enable TCP fast openToke Høiland-Jørgensen2018-06-04
| | | | | | | This can reduce the lookup times for TCP lookups with a full RTT for supported servers. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* unbound: add root zone file cache optionEric Luehrsen2018-05-28
| | | | | | | | | Add the possibility to use Unbound auto-zone: clause to fetch complete root, arpa, in-addr.arpa, and ip6.arpa zone files. This can speed up recursion when users access many ccTLD or connection logging hits many PTR. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: provide transparent defaults with documentationEric Luehrsen2018-05-28
| | | | | | | | Some resource options bundled many Unbound.conf options and made customizing on top of UCI difficult. Make it easier to use Unbound built defaults (blank conf sections). Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.7.1Eric Luehrsen2018-05-05
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: don't use unitialised vars when UNBOUND_D_DHCP_LINK != odhcpdPeter Wagner2018-05-01
| | | | Signed-off-by: Peter Wagner <tripolar@gmx.at>
* unbound: add domain resolution control optionsEric Luehrsen2018-03-18
| | | | | | | | | | | - Add domain_forward to permit designated domains to forward instead of recurse as listed in resolve.conf.auto from DHCP WAN client - Update rebind_protection and add rebind_interface to protect IP6 GLA locally just like RFC 1918 protection - Rename trigger to trigger_interface with backwards compatability - Update odhcpd script for efficiency handling many clients Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.7.0Eric Luehrsen2018-03-18
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.8 for CVE-2017-15105Eric Luehrsen2018-01-19
| | | | | | | | | | A vulnerability was discovered in the processing of wildcard synthesized NSEC records. While synthesis of NSEC records is allowed by RFC4592, these synthesized owner names should not be used in the NSEC processing. This does, however, happen in Unbound 1.6.7 and earlier versions. (see https://unbound.net/downloads/CVE-2017-15105.txt) Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: fix crash when using odhcpd w/o dnsmasqDaniel Gimpelevich2018-01-18
| | | | | | | | | When using the configuration under "Unbound and odhcpd" in the package's README.md, the scripts generated a malformed config file for unbound, due to an "ip route" command giving extra output lines with the string "anycast" where the awk script expects an address. These are now filtered. Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
* treewide: fix incorrect *_BUILD_DEPENDSMatthias Schiffer2018-01-09
| | | | | | | | | | | | | | | | Build depends refer to source package names, not binary package names. In many cases, PKG_BUILD_DEPENDS simply duplicated runtime dependencies of a source package's binary packages; as the corresponding source packages are implicitly added as bulid dependencies, PKG_BUILD_DEPENDS can simply be dropped in these cases. In the other cases, *_BUILD_DEPENDS is fixed to refer to the correct source package name. Dependency of mysql-server is adjusted from libncursesw to libncurses (as libncursesw is a virtual package provided by libncurses), so the build dependency on ncurses is emitted unconditionally. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* unbound: fix uci for option domain-insecure:Eric Luehrsen2018-01-09
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.7Eric Luehrsen2017-10-11
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update options for remote-controlEric Luehrsen2017-09-22
| | | | | | | | | | Enhance the 'control' option to allow using SSL to connect to the server. Add the 'extended_stats' option to match 'extended-statistics: yes.' Document the 'extended_luci' option; it does not control Unbound, but changes the LuCI tabs. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.6Eric Luehrsen2017-09-21
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.5Eric Luehrsen2017-08-21
| | | | | | This fixes the root.key file if created when unbound is installed between sep11 and oct11 2017 Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.6.4Eric Luehrsen2017-06-27
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: manage resolv.conf iff when listening on 127.0.0.1#53Paul Oranje2017-06-20
| | | | | | | | | | | | With this patch the unbound init routines manage resolv.conf if and only if when unbound will listen on 127.0.0.1#53 and dnsmasq is not. Also logs some cases where config values are overriden with sane defaults. Fixes (partially) LEDE FS#785 Fixes openwrt/packages#4487 Signed-off-by: Paul Oranje <por@xs4all.nl>
* unbound: add option for dhcp UCI domain mx srv and cnameEric Luehrsen2017-05-23
| | | | | | | | | | | | | | | | Base LEDE/OpenWrt UCI for dnsmasq provides for DNS override in /etc/config/dhcp. It is desired to be able to use dnsmasq and Unbound as transparently as possible. Option 'add_extra_dns' will pull 'domain', 'mxhost', 'srvhost, and 'cname' from base. netifd/procd have an interaction with DHCPv6/RA on WAN (FS#713). Minor IP6 parameter updates can cause Unbound reload events every few minutes. List option 'trigger' selects which interfaces may cause reload. For example 'lan', 'wan' but not 'wan6'. Squash other cosmetics. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to version 1.6.2Eric Luehrsen2017-04-25
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve interface trigger behaviorEric Luehrsen2017-03-26
| | | | | | | | | | | | | procd interface triggers may be busy. Unbound hard restarts will flush the cache. This might happen frequently depending on how interface triggers occur. Change the procd trigger to reduce occurences. Load this trigger prior to netifd (START=20), but only truly start Unbound from the trigger rather than immediately in init. Clean up log entries in scripts after Unbound, NTP, and DNSSEC are established. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: support copy without dash updateEric Luehrsen2017-03-21
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: fix hotplug iface and ntp restartsEric Luehrsen2017-03-17
| | | | | | | | | | | | Unbound is configured to restart on hotplug/iface but this can result in numerous restarts at boot. Unbound also has a restart for NTP. This was observed to generate trouble and even with procd robustness too many crashes might occur (rare). Unbound would not be running. Give more care to /var/lib/unbound/root.key during restarts. Use procd for iface restarts. Check pidof() to wait one more second for Unbound. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: bugfix init race condition invalid FQDNEric Luehrsen2017-03-12
| | | | | | | | | | | | options 'add_local_fqdn' and 'add_wan_fqdn' can be affected by race conditions when they are at level 4. Interface name may not be returned by network tools. The conf file has bad record formats and Unbound just will not load. Detect this and fall back to only the host FQDN (level 3). squash: improve documentation wording and format codes. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve maintenance of trust anchorEric Luehrsen2017-03-02
| | | | | | | | | | | | | | | | | | | Unbound UCI tries to protect embedded flash from excess use. Unbound RFC5011 KSK tracking can rewrite root.key every few minutes to an hour. It also writes and destroys files in the same directory during the process. Recommended UCI delays for copying busy work in /var/ back to /etc/ may be too conservative. These are all changed from 28 to 9 days. The RFC5011 KSK results were also destroyed by an init.d restart, even if /var/ is mounted on persistent storage like USB drive. /var/lib/unbound/root.key is now preserved during this process, unless a newer key is installed in /etc/ manually or package update. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: Update to 1.6.1 with 2017 trust anchorEric Luehrsen2017-02-25
| | | | | | | | | | | | | Unbound 1.6.1 has a few bug fixes for resource leaks, configuration robustness, compile environment interaction, and maintaining the trust anchor. The 2017 trust anchor (DS) is built into unbound and unbound-anchor. File /etc/unbound/root.key holds 2010/2017 DS record until 2018 https://www.icann.org/resources/pages/ksk-rollover https://www.iana.org/domains/root Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve robustness with dhcp scriptsEric Luehrsen2017-02-11
| | | | | | | | | | When for example 'package/net/adblock' and DNSSEC vs NTP robustness is enabled, significant restart thrashing can occur at boot up. DHCP lease triggers may be occuring at the same time. Unbounds DNS-DHCP may be incomplete until new DHCP solicit events. Solve this by leaving a passive but complete host conf file during lease trigger. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: bug fix odhcpd and add auto adblockEric Luehrsen2017-02-06
| | | | | | | | | | | | | Bug fix dhcp4_slaac6 option was adding to all IP6 routes. Filtering was added to this process to only include addresses served from "this dhcp interface." adblock 2.3.0 file output is now detected and automatically integrated into Unbound local-zones. adblock deposites its block site zone-files into /var/lib/unbound. If this is not desired, then disable adblock or reconfigure to avoid Unbound. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: expand UCI to cover some popular dnsmasq featuresEric Luehrsen2017-01-22
| | | | | | | | | | | | | | | | | | | | | | | | | | Unbound+DHCP (server of your choice) should be able to replicate a lot of what dnsmasq provides. With this change set Unbound still works with dnsmasq, but also it can work with a plain DHCP server. Features have been added within the UCI itself to act like dnsmasq. - alone: name each interface relative to router hostname - alone: prevent upstream leakage of your domain and '.local' - dnsmasq: use dnsmasq UCI to configure forwarding clauses - dhcp: work with odhcpd as example of companion DHCP-DNS - dhcp: convert DHCPv4 leases into EUI64 SLAAC for DNS records - all: enable encrypted remote unbound-control using splice conf - all: allow user spliced conf-files for hybrid UCI and manual conf -- 'unbound_srv.conf' will be spliced into the 'server:' clause -- 'unbound_ext.conf' will add clauses to the end, example 'forward:' README HOW TO for dnsmasq-in-serial, dnsmasq-in-parallel, and unbound-with-odhcpd have better/added UCI starters. HOW TO for including unbound_srv.conf and unbound_ext.conf are added. Document new UCI: add_local_fqdn, add_wan_fqdn, dhcp4_slaac6, dhcp_link, domain, and domain_type Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: UCI updates to take advantage of 1.6.0Eric Luehrsen2016-12-18
| | | | | | | | - UCI to take advantage of "qname-minimisation-strict:" - UCI to block chaos reponses bind, server, and version - UCI to limit or prefer recrusion over IP4 or IP6 Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update 1.6.0Eric Luehrsen2016-12-18
| | | | | | | | | | | | | - future opportunity: added "views:" clause -- consider won't need UCI for security instances -- consider access lists, forwards, views, and tags -- consider query denial for DNS amplification defense - future opportunity: thrifted "local-zone:" memory bloat -- consider adblock package to feed thru unbound-control -- consider access lists, forwards, views, and tags -- consider offering LuCI parental controls or other Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: added UCI support for DNS64Eric Luehrsen2016-12-12
| | | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com> Signed-off-by: Dan Luedte <mail@danrl.com>
* Unbound: fix regression of manual conf for power userEric Luehrsen2016-12-08
| | | | | | | | | | | - History: prior to package 1.5.10-3 /var/lib/unbound was not used - History: prior to package 1.5.10-4 no UCI scripts were provided - Problem: UCI 'option manual_conf 1' only copied unbound.conf and root.key - Problem: power users that had complex file nests cannot use this - Fix: README.md includes instructions for /var/lib/unbound jail - Fix: unbound.sh copies ALL of /etc/unbound for 'option manual_conf 1' Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Update scripts to build conf file from UCIEric Luehrsen2016-11-29
| | | | | | | | | -unbound.sh implements the majority of requirements in README.md -rootzone.sh reloads a small subset for alternate trigger maintenance -unbound.init sets procd triggers on Unbound and dnsmasq (dhcp) UCI -two part commit squashed with Makefile included Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Incorporate hotplug/iface and root.key in tmpfsEric Luehrsen2016-10-30
| | | | | | | | | | -Patch for /etc/unbound/unbound.conf --All work done in /var/lib/unbound/ --chroot or jail to /var/lib/unbound/ -Init script points to /usr/lib/unbound.sh -Makefile to install new scripts in the package Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Give USERID explicit numbers for clean installEric Luehrsen2016-10-20
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to 1.5.10Stijn Segers2016-10-18
| | | | Signed-off-by: Stijn Segers <francesco.borromini@inventati.org>
* net/unbound: Change maintainer to Eric LuehrsenMichael Hanselmann2016-10-16
| | | | | | | Eric has offered to take over maintainership for the net/unbound package. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* unbound: enable pthreads, disable deprecated ciphersStijn Segers2016-09-11
| | | | Signed-off-by: Stijn Segers <francesco.borromini@inventati.org>
Powered by cgit, Themed by Ted Yin.