aboutsummaryrefslogtreecommitdiff
path: root/net/unbound
Commit message (Collapse)AuthorAge
...
* unbound: manage resolv.conf iff when listening on 127.0.0.1#53Paul Oranje2017-06-20
| | | | | | | | | | | | With this patch the unbound init routines manage resolv.conf if and only if when unbound will listen on 127.0.0.1#53 and dnsmasq is not. Also logs some cases where config values are overriden with sane defaults. Fixes (partially) LEDE FS#785 Fixes openwrt/packages#4487 Signed-off-by: Paul Oranje <por@xs4all.nl>
* unbound: add option for dhcp UCI domain mx srv and cnameEric Luehrsen2017-05-23
| | | | | | | | | | | | | | | | Base LEDE/OpenWrt UCI for dnsmasq provides for DNS override in /etc/config/dhcp. It is desired to be able to use dnsmasq and Unbound as transparently as possible. Option 'add_extra_dns' will pull 'domain', 'mxhost', 'srvhost, and 'cname' from base. netifd/procd have an interaction with DHCPv6/RA on WAN (FS#713). Minor IP6 parameter updates can cause Unbound reload events every few minutes. List option 'trigger' selects which interfaces may cause reload. For example 'lan', 'wan' but not 'wan6'. Squash other cosmetics. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update to version 1.6.2Eric Luehrsen2017-04-25
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve interface trigger behaviorEric Luehrsen2017-03-26
| | | | | | | | | | | | | procd interface triggers may be busy. Unbound hard restarts will flush the cache. This might happen frequently depending on how interface triggers occur. Change the procd trigger to reduce occurences. Load this trigger prior to netifd (START=20), but only truly start Unbound from the trigger rather than immediately in init. Clean up log entries in scripts after Unbound, NTP, and DNSSEC are established. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: support copy without dash updateEric Luehrsen2017-03-21
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: fix hotplug iface and ntp restartsEric Luehrsen2017-03-17
| | | | | | | | | | | | Unbound is configured to restart on hotplug/iface but this can result in numerous restarts at boot. Unbound also has a restart for NTP. This was observed to generate trouble and even with procd robustness too many crashes might occur (rare). Unbound would not be running. Give more care to /var/lib/unbound/root.key during restarts. Use procd for iface restarts. Check pidof() to wait one more second for Unbound. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: bugfix init race condition invalid FQDNEric Luehrsen2017-03-12
| | | | | | | | | | | | options 'add_local_fqdn' and 'add_wan_fqdn' can be affected by race conditions when they are at level 4. Interface name may not be returned by network tools. The conf file has bad record formats and Unbound just will not load. Detect this and fall back to only the host FQDN (level 3). squash: improve documentation wording and format codes. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: fix odhcpd trigger scriptAudric Schiltknecht2017-03-12
| | | | | | | Read UNBOUND_TXT_DOMAIN from main unbound configuration. This prevents records to be added into Unbound in the default 'lan' zone. Signed-off-by: Audric Schiltknecht <storm+github@chemicalstorm.org>
* unbound: improve maintenance of trust anchorEric Luehrsen2017-03-02
| | | | | | | | | | | | | | | | | | | Unbound UCI tries to protect embedded flash from excess use. Unbound RFC5011 KSK tracking can rewrite root.key every few minutes to an hour. It also writes and destroys files in the same directory during the process. Recommended UCI delays for copying busy work in /var/ back to /etc/ may be too conservative. These are all changed from 28 to 9 days. The RFC5011 KSK results were also destroyed by an init.d restart, even if /var/ is mounted on persistent storage like USB drive. /var/lib/unbound/root.key is now preserved during this process, unless a newer key is installed in /etc/ manually or package update. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: Update to 1.6.1 with 2017 trust anchorEric Luehrsen2017-02-25
| | | | | | | | | | | | | Unbound 1.6.1 has a few bug fixes for resource leaks, configuration robustness, compile environment interaction, and maintaining the trust anchor. The 2017 trust anchor (DS) is built into unbound and unbound-anchor. File /etc/unbound/root.key holds 2010/2017 DS record until 2018 https://www.icann.org/resources/pages/ksk-rollover https://www.iana.org/domains/root Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: bugfix add_local_fqdn with empty ULAEric Luehrsen2017-02-25
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve robustness with dhcp scriptsEric Luehrsen2017-02-11
| | | | | | | | | | When for example 'package/net/adblock' and DNSSEC vs NTP robustness is enabled, significant restart thrashing can occur at boot up. DHCP lease triggers may be occuring at the same time. Unbounds DNS-DHCP may be incomplete until new DHCP solicit events. Solve this by leaving a passive but complete host conf file during lease trigger. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: bug fix odhcpd and add auto adblockEric Luehrsen2017-02-06
| | | | | | | | | | | | | Bug fix dhcp4_slaac6 option was adding to all IP6 routes. Filtering was added to this process to only include addresses served from "this dhcp interface." adblock 2.3.0 file output is now detected and automatically integrated into Unbound local-zones. adblock deposites its block site zone-files into /var/lib/unbound. If this is not desired, then disable adblock or reconfigure to avoid Unbound. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: error in README.md for unbound+dnsmasqEric Luehrsen2017-01-24
|
* unbound: expand UCI to cover some popular dnsmasq featuresEric Luehrsen2017-01-22
| | | | | | | | | | | | | | | | | | | | | | | | | | Unbound+DHCP (server of your choice) should be able to replicate a lot of what dnsmasq provides. With this change set Unbound still works with dnsmasq, but also it can work with a plain DHCP server. Features have been added within the UCI itself to act like dnsmasq. - alone: name each interface relative to router hostname - alone: prevent upstream leakage of your domain and '.local' - dnsmasq: use dnsmasq UCI to configure forwarding clauses - dhcp: work with odhcpd as example of companion DHCP-DNS - dhcp: convert DHCPv4 leases into EUI64 SLAAC for DNS records - all: enable encrypted remote unbound-control using splice conf - all: allow user spliced conf-files for hybrid UCI and manual conf -- 'unbound_srv.conf' will be spliced into the 'server:' clause -- 'unbound_ext.conf' will add clauses to the end, example 'forward:' README HOW TO for dnsmasq-in-serial, dnsmasq-in-parallel, and unbound-with-odhcpd have better/added UCI starters. HOW TO for including unbound_srv.conf and unbound_ext.conf are added. Document new UCI: add_local_fqdn, add_wan_fqdn, dhcp4_slaac6, dhcp_link, domain, and domain_type Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: expand UCI support for odhcpd DHCP-DNSEric Luehrsen2017-01-22
| | | | | | | | | | | This is bare minimum change in 'unbound.sh' and 'dnsmasq.sh' to migrate the UCI option set for more flexibility. The boolean(s) to link to dnsmasq are being changed to a state to include odhcpd. It is executable but a small step for clear change management. Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: add odhcpd specific scripts to link DHCP-DNSEric Luehrsen2017-01-22
| | | | | | | | | | | | | | | | | | | | | The UCI for Unbound already links to dnsmasq, but what if with Unbound, we want to configure a plain dhcp server. Most servers can call a script for lease events. That script can then formulate DNS records and load them with unbound-control (dependency). The files added here work with OpenWRT/LEDE odhcpd, such that it can be run alone. They can be used as examples for any dhcp server. 'odhcpd.sh' is to be called by odhcpd when a lease event occurs. 'odhcpd.awk' is called internal to the shell script. The awk script handles any tricky reformating that may be required. /etc/config/dhcp config odhcpd 'odhcpd' option leasetrigger '/usr/lib/unbound/odhcpd.sh' Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: improve NTP hotplug behavior when Unbound is disabledEric Luehrsen2017-01-22
| | | | | | | | | If Unbound was disabled and at later time enabled, then it would operate in DNSSEC less-secure mode. When NTP hotplug was called, the timestamp file was not updated. This was found testing Unbound vs other tools (bind, dnsmasq). Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: UCI updates to take advantage of 1.6.0Eric Luehrsen2016-12-18
| | | | | | | | - UCI to take advantage of "qname-minimisation-strict:" - UCI to block chaos reponses bind, server, and version - UCI to limit or prefer recrusion over IP4 or IP6 Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: bugfix for UCI script typosEric Luehrsen2016-12-18
| | | | | | | - UCI option dnsmasq_gate_name typo in few locations - NTP hotplug to check /etc/init.d/unbound not ..dnsmasq Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: update 1.6.0Eric Luehrsen2016-12-18
| | | | | | | | | | | | | - future opportunity: added "views:" clause -- consider won't need UCI for security instances -- consider access lists, forwards, views, and tags -- consider query denial for DNS amplification defense - future opportunity: thrifted "local-zone:" memory bloat -- consider adblock package to feed thru unbound-control -- consider access lists, forwards, views, and tags -- consider offering LuCI parental controls or other Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: added UCI support for DNS64Eric Luehrsen2016-12-12
| | | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com> Signed-off-by: Dan Luedte <mail@danrl.com>
* Unbound: fix regression of manual conf for power userEric Luehrsen2016-12-08
| | | | | | | | | | | - History: prior to package 1.5.10-3 /var/lib/unbound was not used - History: prior to package 1.5.10-4 no UCI scripts were provided - Problem: UCI 'option manual_conf 1' only copied unbound.conf and root.key - Problem: power users that had complex file nests cannot use this - Fix: README.md includes instructions for /var/lib/unbound jail - Fix: unbound.sh copies ALL of /etc/unbound for 'option manual_conf 1' Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Update scripts to build conf file from UCIEric Luehrsen2016-11-29
| | | | | | | | | -unbound.sh implements the majority of requirements in README.md -rootzone.sh reloads a small subset for alternate trigger maintenance -unbound.init sets procd triggers on Unbound and dnsmasq (dhcp) UCI -two part commit squashed with Makefile included Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Add files to enable forward link to dnsmasqEric Luehrsen2016-11-29
| | | | | | | | | | -dnsmasq really provides nice local DHCP-DNS records -Unbound host records would be clumsy to update -Unbound can be configured to forward to dnsmasq -iptools provided to facilitate PTR records -flexible ipv6 colon notation is a bit complex Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Add UCI primer filesEric Luehrsen2016-11-29
| | | | | | | -README.md to describe the UCI in detail -unbound.uci to get you started Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Add hotplug/ntp script to request restartEric Luehrsen2016-11-29
| | | | | | | | | | | -DNSSEC needs time, time needs ntp, or power off RTC -Many consumer routers are cost thrifted without RTC -Conf "val-override-date: -1" disables time inside DNSSEC -Need restart as option is not dynamically switchable -hotplug/ntp is used to set file /var/lib/unbound/unbound.time -UCI will add or remove option depending on flag-like-file Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Incorporate hotplug/iface and root.key in tmpfsEric Luehrsen2016-10-30
| | | | | | | | | | -Patch for /etc/unbound/unbound.conf --All work done in /var/lib/unbound/ --chroot or jail to /var/lib/unbound/ -Init script points to /usr/lib/unbound.sh -Makefile to install new scripts in the package Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Add scripts to manage root.key in tmpfsEric Luehrsen2016-10-30
| | | | | | | | | | -Unbound RFC 5011 is busy and writes frequently -RFC 5011 creates working files in same directory -DNSSEC root.key managed in /var/lib/unbound -Protect against flash ROM wear out in /etc/unbound -Scripts will copy back every 7 days instead Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Add hotplug/iface script to request restartEric Luehrsen2016-10-30
| | | | | | | | | -Rebind to new interfaces cleanly -Detach from old interfaces cleanly -Some conf options do not reload dynamically -Unbound grows some and this will shrink it Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Give USERID explicit numbers for clean installEric Luehrsen2016-10-20
| | | | Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* Unbound: Group patch work for example.conf.inEric Luehrsen2016-10-20
| | | | | | | | | | | | | | | | -Remove interlaced configuration changes --Less sensitive to upstream example.conf changes --Easier to read patch-of-patch work for maintenance -Use MEMORY CONTROL EXAMPLE from http://unbound.net/ --Review and rework with respect to previous pacakge --Effectively the same configuration as previous package -Disable DNSSEC by default due to real-time chicken-n-egg --Many OpenWrt target devices have no power-off clock (reboot) --User choice of work around should be conscious --Initial install should not fail reboot with DNSSEC default -Add some defaults explicitly to prevent surprises Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
* unbound: fix whitespaceHannu Nyman2016-10-18
| | | | | | | * Fix upstream whitespace change in the patch. * Minor cleanup to the header. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* unbound: update to 1.5.10Stijn Segers2016-10-18
| | | | Signed-off-by: Stijn Segers <francesco.borromini@inventati.org>
* net/unbound: Change maintainer to Eric LuehrsenMichael Hanselmann2016-10-16
| | | | | | | Eric has offered to take over maintainership for the net/unbound package. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* unbound: enable pthreads, disable deprecated ciphersStijn Segers2016-09-11
| | | | Signed-off-by: Stijn Segers <francesco.borromini@inventati.org>
* unbound: Switch to non-privileged userMichael Hanselmann2016-06-14
| | | | | | | Until now unbound was always running as root by default. A DNS resolver can easily run under a non-privileged user. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* unbound: Rewrite init script to use procdMichael Hanselmann2016-06-14
| | | | Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* unbound: Update to 1.5.9Michael Hanselmann2016-06-14
| | | | | | Bump unbound to version 1.5.9 released on June 9, 2016. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* unbound: Use INSTALL_BIN/DATA for installationMichael Hanselmann2016-06-14
| | | | | | | The commands aliased by $(INSTALL_BIN) and $(INSTALL_DATA) set good permissions, unlike a raw file copy. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* unbound: Remove named.cacheMichael Hanselmann2016-06-14
| | | | | | | The custom list of DNS root servers provided with the package is not necessary. Unbound ships with a built-in list. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* [Unbound] Update to 1.5.8Michael Hanselmann2016-03-17
| | | | | | Bump unbound to version 1.5.8 released on March 2, 2016. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* [Unbound] Update to 1.5.7Michael Hanselmann2015-12-14
| | | | | | Bump unbound to version 1.5.7 released on December 10, 2015. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* [Unbound] Update to 1.5.6Michael Hanselmann2015-10-30
| | | | | | Bump unbound to version 1.5.6 released on October 20, 2015. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* [Unbound] Update to 1.5.5Michael Hanselmann2015-10-14
| | | | | | Bump unbound to version 1.5.5 released on October 6, 2015. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* [Unbound] Update to 1.5.4Borromini2015-08-31
| | | | | Bumped to latest upstream release - 1.5.4 Signed-off by Stijn Segers <francesco.borromini@inventati.org>
* unbound: Support for validating ECDSA DNSSEC signaturesOndřej Caletka2015-06-28
| | | | | | | | | | | This patch enables support for validating ECDSA signatures, which are being deployed more and more in DNSSEC. Proper validating can be tested by observing the AD flag in following query (courtesy of Olafur Gudmundsson, CloudFlare): $ dig ds-4.alg-14-nsec.dnssec-test.org Signed-off-by: Ondřej Caletka <ondrej@caletka.cz>
* Update net/unbound to version 1.5.3Michael Hanselmann2015-04-19
| | | | | | unbound 1.5.3 was released on March 10, 2015. Signed-off-by: Michael Hanselmann <public@hansmi.ch>
* unbound: bump to version 1.5.1Heiner Kallweit2015-02-12
| | | | Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
* unbound: bump named.cache to latest version from Nov 2014Heiner Kallweit2015-02-12
| | | | Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Powered by cgit, Themed by Ted Yin.