aboutsummaryrefslogtreecommitdiff
path: root/net/unbound/files/unbound.init
Commit message (Collapse)AuthorAge
* unbound: add file parameter to service instanceJan Klos2024-03-17
| | | | | | | | that way, procd does not needlessly restart unbound on triggers when everything remains the same - changes in non-default included configuration files will not be registered, however Signed-off-by: Jan Klos <jan@klos.xyz>
* unbound: clean up interface interpretation in UCIEric Luehrsen2020-11-04
| | | | | | | | | DNS flag day 2020, software should reflect the minimum EDNS 1232 bytes. Added iface_wan and iface_lan to control internal DNS assignemnts and to control what is local service ACL. Interface wild cards are not explicitly set so that they can be customized in extended conf. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: improve startup and dhcp script robustnessEric Luehrsen2020-07-12
| | | | | | | | | - prevent rapid overlap in DHCP script updates - check and allow localhost forwards with specific applications - add option for rate limiting inbound queries - change UCI list to table format with Unbound conf references Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: improve a few UCI settingsEric Luehrsen2019-06-19
| | | | | | | | | - treat RFC6762 'local.' as nxdomain because avahi and other services will disable if SOA or NS records appear in central DNS. - allow two threads to be enabled with the 'heavy traffic' variant of Unbound packages. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: replace obsolete test expressionsEric Luehrsen2019-05-28
| | | | | | | | Expressions '-o', '-a', and '\( \)' within test or '[ ]' are obsolete. POSIX allows few arguments to test, so long expressions are not portable. '[ p -a q ]' can be replaced with '[ p ] && [ q ]' instead. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: log openssl-1.0.2 lacks TLS host verificationEric Luehrsen2018-08-10
| | | | | | | | | | | ssl_set1_host() is not available without openssl-1.1.0. Unbound can not do host cert verification. DNS over TLS connects, but hosts are unverified. A patch for log err is added with a noitce in README.md. (see: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=658) Also, squash some minor robustness and TLS usability fixes. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: fix boot time and default run directoryEric Luehrsen2018-08-03
| | | | | | | | | Unbound struggles with boot ifup, so procd triggers changed to push outside of this noise. Unbound has run in /var/lib/unbound/, so chroot (jail) protects /etc/, and it can save flash wear. Compiled defaults reflect this now, so Unbound tools are easier run on the command line. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add UCI for forward stub and auth zone clausesEric Luehrsen2018-07-29
| | | | | | | | | | With growing interest, DNS over TLS can be setup in Unbounds foward-zone: clause. A broader UCI solution is added to support forward-, stub-, and auth- zone clauses in a new 'zone' section. This implentation required reworking scripts, because they did not scale. 'forward_domain' and 'prefetch_root' options are removed, and superceded by 'zone' section. Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: limit outside script source to init funciton scopeEric Luehrsen2018-06-26
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
* unbound: add domain resolution control optionsEric Luehrsen2018-03-18
| | | | | | | | | | | - Add domain_forward to permit designated domains to forward instead of recurse as listed in resolve.conf.auto from DHCP WAN client - Update rebind_protection and add rebind_interface to protect IP6 GLA locally just like RFC 1918 protection - Rename trigger to trigger_interface with backwards compatability - Update odhcpd script for efficiency handling many clients Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: add option for dhcp UCI domain mx srv and cnameEric Luehrsen2017-05-23
| | | | | | | | | | | | | | | | Base LEDE/OpenWrt UCI for dnsmasq provides for DNS override in /etc/config/dhcp. It is desired to be able to use dnsmasq and Unbound as transparently as possible. Option 'add_extra_dns' will pull 'domain', 'mxhost', 'srvhost, and 'cname' from base. netifd/procd have an interaction with DHCPv6/RA on WAN (FS#713). Minor IP6 parameter updates can cause Unbound reload events every few minutes. List option 'trigger' selects which interfaces may cause reload. For example 'lan', 'wan' but not 'wan6'. Squash other cosmetics. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve interface trigger behaviorEric Luehrsen2017-03-26
| | | | | | | | | | | | | procd interface triggers may be busy. Unbound hard restarts will flush the cache. This might happen frequently depending on how interface triggers occur. Change the procd trigger to reduce occurences. Load this trigger prior to netifd (START=20), but only truly start Unbound from the trigger rather than immediately in init. Clean up log entries in scripts after Unbound, NTP, and DNSSEC are established. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: fix hotplug iface and ntp restartsEric Luehrsen2017-03-17
| | | | | | | | | | | | Unbound is configured to restart on hotplug/iface but this can result in numerous restarts at boot. Unbound also has a restart for NTP. This was observed to generate trouble and even with procd robustness too many crashes might occur (rare). Unbound would not be running. Give more care to /var/lib/unbound/root.key during restarts. Use procd for iface restarts. Check pidof() to wait one more second for Unbound. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: expand UCI to cover some popular dnsmasq featuresEric Luehrsen2017-01-22
| | | | | | | | | | | | | | | | | | | | | | | | | | Unbound+DHCP (server of your choice) should be able to replicate a lot of what dnsmasq provides. With this change set Unbound still works with dnsmasq, but also it can work with a plain DHCP server. Features have been added within the UCI itself to act like dnsmasq. - alone: name each interface relative to router hostname - alone: prevent upstream leakage of your domain and '.local' - dnsmasq: use dnsmasq UCI to configure forwarding clauses - dhcp: work with odhcpd as example of companion DHCP-DNS - dhcp: convert DHCPv4 leases into EUI64 SLAAC for DNS records - all: enable encrypted remote unbound-control using splice conf - all: allow user spliced conf-files for hybrid UCI and manual conf -- 'unbound_srv.conf' will be spliced into the 'server:' clause -- 'unbound_ext.conf' will add clauses to the end, example 'forward:' README HOW TO for dnsmasq-in-serial, dnsmasq-in-parallel, and unbound-with-odhcpd have better/added UCI starters. HOW TO for including unbound_srv.conf and unbound_ext.conf are added. Document new UCI: add_local_fqdn, add_wan_fqdn, dhcp4_slaac6, dhcp_link, domain, and domain_type Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Update scripts to build conf file from UCIEric Luehrsen2016-11-29
| | | | | | | | | -unbound.sh implements the majority of requirements in README.md -rootzone.sh reloads a small subset for alternate trigger maintenance -unbound.init sets procd triggers on Unbound and dnsmasq (dhcp) UCI -two part commit squashed with Makefile included Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Incorporate hotplug/iface and root.key in tmpfsEric Luehrsen2016-10-30
| | | | | | | | | | -Patch for /etc/unbound/unbound.conf --All work done in /var/lib/unbound/ --chroot or jail to /var/lib/unbound/ -Init script points to /usr/lib/unbound.sh -Makefile to install new scripts in the package Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: Switch to non-privileged userMichael Hanselmann2016-06-14
| | | | | | | Until now unbound was always running as root by default. A DNS resolver can easily run under a non-privileged user. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* unbound: Rewrite init script to use procdMichael Hanselmann2016-06-14
| | | | Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* Import net/unbound package from SubversionMichael Hanselmann2014-08-19
This is an import of the net/unbound package from Subversion revision 40658 (May 2, 2014). The only change is the addition of PKG_LICENSE, PKG_LICENSE_FILE and PKG_MAINTAINER to Makefile. Unbound 1.4.22 is the current upstream release. Signed-off-by: Michael Hanselmann <public@hansmi.ch>