aboutsummaryrefslogtreecommitdiff
path: root/net/unbound/files/README.md
Commit message (Collapse)AuthorAge
* unbound: clean up interface interpretation in UCIEric Luehrsen2020-11-04
| | | | | | | | | DNS flag day 2020, software should reflect the minimum EDNS 1232 bytes. Added iface_wan and iface_lan to control internal DNS assignemnts and to control what is local service ACL. Interface wild cards are not explicitly set so that they can be customized in extended conf. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: improve startup and dhcp script robustnessEric Luehrsen2020-07-12
| | | | | | | | | - prevent rapid overlap in DHCP script updates - check and allow localhost forwards with specific applications - add option for rate limiting inbound queries - change UCI list to table format with Unbound conf references Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add dns assistants on local hostEric Luehrsen2020-06-27
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: refactor build options to select switchesEric Luehrsen2020-06-27
| | | | | | | | | | The two unique packages "Unbound light" and "Unbound heavy" were not working well due to the fact that Unbound is mostly its library. Tools and helpers would crash. Instead a reasonable default Unbound is built. Also up select options like python are added. libevent and libpthreads are options to down select. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: make option interface_auto default onEric Luehrsen2020-06-13
| | | | | | | | | | Unbound has a quirk and may reply on a different device address. When Unbound answers with from-address different than it received queries on, it may cause trouble for select VPN and firewall configurations. Ensure Unbound replies with the same address by changing this default. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: suggest matched domain option for dnsmasq linkEric Luehrsen2020-06-04
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: expose interface-auto to UCIDavid Bauer2020-06-03
| | | | | | | | | | | | | | | This exposes the interface-auto option to UCI. By default, interface-auto is disabled. This leads to the DNS reply possibly originating from a different address then the request was sent to. Devices with a packet filter might not receive the reply in this case. Enabling interface-auto ensures the reply is sent with the source-address the request was sent to. Signed-off-by: David Bauer <mail@david-bauer.net>
* unbound: improve a few UCI settingsEric Luehrsen2019-06-19
| | | | | | | | | - treat RFC6762 'local.' as nxdomain because avahi and other services will disable if SOA or NS records appear in central DNS. - allow two threads to be enabled with the 'heavy traffic' variant of Unbound packages. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update readme.mdEric Luehrsen2019-04-17
| | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: update to 1.8.0Eric Luehrsen2018-09-15
| | | | | | | - adjust a few UCI translations to coordinate with upstream defaults - remove OpenSSL < 1.1.0 API log error patch which is included upstream Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: log openssl-1.0.2 lacks TLS host verificationEric Luehrsen2018-08-10
| | | | | | | | | | | ssl_set1_host() is not available without openssl-1.1.0. Unbound can not do host cert verification. DNS over TLS connects, but hosts are unverified. A patch for log err is added with a noitce in README.md. (see: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=658) Also, squash some minor robustness and TLS usability fixes. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add UCI for forward stub and auth zone clausesEric Luehrsen2018-07-29
| | | | | | | | | | With growing interest, DNS over TLS can be setup in Unbounds foward-zone: clause. A broader UCI solution is added to support forward-, stub-, and auth- zone clauses in a new 'zone' section. This implentation required reworking scripts, because they did not scale. 'forward_domain' and 'prefetch_root' options are removed, and superceded by 'zone' section. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add README recipe for DNS/TLS outside of UCIEric Luehrsen2018-07-09
| | | | | | | | Unbound UCI so far has limited forward configuration lacking DNS over TLS connection setup tools. User override files 'unbound_srv.conf' and 'unbound_ext.conf' can implement this. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: improve local zone evaluation in UCIEric Luehrsen2018-06-12
| | | | | | | | | | | | When UCI local zone is private and static, Unbound covered private addresses with defaults. Optional delegated global IP6 prefix protection lacked a static zone, but it was prevented from appearing in global DNS responses. Domain names router-as-TLD, "lan." and "local." were static, but they lacked default SOA or NS such as Unbound had assinged to private addresses. Clean up these local zones UCI evaluation and block global DNS inclusion. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: add root zone file cache optionEric Luehrsen2018-05-28
| | | | | | | | | Add the possibility to use Unbound auto-zone: clause to fetch complete root, arpa, in-addr.arpa, and ip6.arpa zone files. This can speed up recursion when users access many ccTLD or connection logging hits many PTR. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: provide transparent defaults with documentationEric Luehrsen2018-05-28
| | | | | | | | Some resource options bundled many Unbound.conf options and made customizing on top of UCI difficult. Make it easier to use Unbound built defaults (blank conf sections). Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: fix SLAAC DNS inferenceEric Luehrsen2018-03-19
| | | | | | | Bug: If DHCPv4 MAC are used to infer SLAAC and the forth position of the subnet /64 is 0 (X:X:X:0::/64), then DNS records where malformed. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: add domain resolution control optionsEric Luehrsen2018-03-18
| | | | | | | | | | | - Add domain_forward to permit designated domains to forward instead of recurse as listed in resolve.conf.auto from DHCP WAN client - Update rebind_protection and add rebind_interface to protect IP6 GLA locally just like RFC 1918 protection - Rename trigger to trigger_interface with backwards compatability - Update odhcpd script for efficiency handling many clients Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update options for remote-controlEric Luehrsen2017-09-22
| | | | | | | | | | Enhance the 'control' option to allow using SSL to connect to the server. Add the 'extended_stats' option to match 'extended-statistics: yes.' Document the 'extended_luci' option; it does not control Unbound, but changes the LuCI tabs. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: add option for dhcp UCI domain mx srv and cnameEric Luehrsen2017-05-23
| | | | | | | | | | | | | | | | Base LEDE/OpenWrt UCI for dnsmasq provides for DNS override in /etc/config/dhcp. It is desired to be able to use dnsmasq and Unbound as transparently as possible. Option 'add_extra_dns' will pull 'domain', 'mxhost', 'srvhost, and 'cname' from base. netifd/procd have an interaction with DHCPv6/RA on WAN (FS#713). Minor IP6 parameter updates can cause Unbound reload events every few minutes. List option 'trigger' selects which interfaces may cause reload. For example 'lan', 'wan' but not 'wan6'. Squash other cosmetics. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: bugfix init race condition invalid FQDNEric Luehrsen2017-03-12
| | | | | | | | | | | | options 'add_local_fqdn' and 'add_wan_fqdn' can be affected by race conditions when they are at level 4. Interface name may not be returned by network tools. The conf file has bad record formats and Unbound just will not load. Detect this and fall back to only the host FQDN (level 3). squash: improve documentation wording and format codes. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve maintenance of trust anchorEric Luehrsen2017-03-02
| | | | | | | | | | | | | | | | | | | Unbound UCI tries to protect embedded flash from excess use. Unbound RFC5011 KSK tracking can rewrite root.key every few minutes to an hour. It also writes and destroys files in the same directory during the process. Recommended UCI delays for copying busy work in /var/ back to /etc/ may be too conservative. These are all changed from 28 to 9 days. The RFC5011 KSK results were also destroyed by an init.d restart, even if /var/ is mounted on persistent storage like USB drive. /var/lib/unbound/root.key is now preserved during this process, unless a newer key is installed in /etc/ manually or package update. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: bug fix odhcpd and add auto adblockEric Luehrsen2017-02-06
| | | | | | | | | | | | | Bug fix dhcp4_slaac6 option was adding to all IP6 routes. Filtering was added to this process to only include addresses served from "this dhcp interface." adblock 2.3.0 file output is now detected and automatically integrated into Unbound local-zones. adblock deposites its block site zone-files into /var/lib/unbound. If this is not desired, then disable adblock or reconfigure to avoid Unbound. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: error in README.md for unbound+dnsmasqEric Luehrsen2017-01-24
|
* unbound: expand UCI to cover some popular dnsmasq featuresEric Luehrsen2017-01-22
| | | | | | | | | | | | | | | | | | | | | | | | | | Unbound+DHCP (server of your choice) should be able to replicate a lot of what dnsmasq provides. With this change set Unbound still works with dnsmasq, but also it can work with a plain DHCP server. Features have been added within the UCI itself to act like dnsmasq. - alone: name each interface relative to router hostname - alone: prevent upstream leakage of your domain and '.local' - dnsmasq: use dnsmasq UCI to configure forwarding clauses - dhcp: work with odhcpd as example of companion DHCP-DNS - dhcp: convert DHCPv4 leases into EUI64 SLAAC for DNS records - all: enable encrypted remote unbound-control using splice conf - all: allow user spliced conf-files for hybrid UCI and manual conf -- 'unbound_srv.conf' will be spliced into the 'server:' clause -- 'unbound_ext.conf' will add clauses to the end, example 'forward:' README HOW TO for dnsmasq-in-serial, dnsmasq-in-parallel, and unbound-with-odhcpd have better/added UCI starters. HOW TO for including unbound_srv.conf and unbound_ext.conf are added. Document new UCI: add_local_fqdn, add_wan_fqdn, dhcp4_slaac6, dhcp_link, domain, and domain_type Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: UCI updates to take advantage of 1.6.0Eric Luehrsen2016-12-18
| | | | | | | | - UCI to take advantage of "qname-minimisation-strict:" - UCI to block chaos reponses bind, server, and version - UCI to limit or prefer recrusion over IP4 or IP6 Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: added UCI support for DNS64Eric Luehrsen2016-12-12
| | | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com> Signed-off-by: Dan Luedte <mail@danrl.com>
* Unbound: fix regression of manual conf for power userEric Luehrsen2016-12-08
| | | | | | | | | | | - History: prior to package 1.5.10-3 /var/lib/unbound was not used - History: prior to package 1.5.10-4 no UCI scripts were provided - Problem: UCI 'option manual_conf 1' only copied unbound.conf and root.key - Problem: power users that had complex file nests cannot use this - Fix: README.md includes instructions for /var/lib/unbound jail - Fix: unbound.sh copies ALL of /etc/unbound for 'option manual_conf 1' Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Add UCI primer filesEric Luehrsen2016-11-29
-README.md to describe the UCI in detail -unbound.uci to get you started Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
Powered by cgit, Themed by Ted Yin.