0
0
mirror of https://github.com/openwrt/packages.git synced 2025-02-25 16:53:43 +00:00

18 Commits

Author SHA1 Message Date
9296409e88 unbound: add cache-max-negative-ttl config option
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
2021-04-20 12:22:42 +02:00
658c27ea97 unbound: clean up interface interpretation in UCI
DNS flag day 2020, software should reflect the minimum EDNS 1232 bytes.
Added iface_wan and iface_lan to control internal DNS assignemnts and
to control what is local service ACL. Interface wild cards are not
explicitly set so that they can be customized in extended conf.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-11-04 19:25:08 -05:00
e81529596d unbound: improve startup and dhcp script robustness
- prevent rapid overlap in DHCP script updates
- check and allow localhost forwards with specific applications
- add option for rate limiting inbound queries
- change UCI list to table format with Unbound conf references

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-07-12 14:56:46 -04:00
af73a9b9a4 unbound: make option interface_auto default on
Unbound has a quirk and may reply on a different device address.
When Unbound answers with from-address different than it
received queries on, it may cause trouble for select VPN and
firewall configurations. Ensure Unbound replies with the same
address by changing this default.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-06-13 15:13:45 -04:00
da76aeb24c unbound: expose interface-auto to UCI
This exposes the interface-auto option to UCI.

By default, interface-auto is disabled.
This leads to the DNS reply possibly originating from
a different address then the request was sent to.

Devices with a packet filter might not receive the reply in this case.

Enabling interface-auto ensures the reply is sent with the
source-address the request was sent to.

Signed-off-by: David Bauer <mail@david-bauer.net>
2020-06-03 16:05:52 +02:00
68b094d411 unbound: improve a few UCI settings
- treat RFC6762 'local.' as nxdomain because avahi and other services
will disable if SOA or NS records appear in central DNS.
- allow two threads to be enabled with the 'heavy traffic' variant of
Unbound packages.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-06-19 00:50:28 -04:00
408047628e unbound: add UCI for forward stub and auth zone clauses
With growing interest, DNS over TLS can be setup in Unbounds foward-zone:
clause. A broader UCI solution is added to support forward-, stub-, and
auth- zone clauses in a new 'zone' section. This implentation required
reworking scripts, because they did not scale. 'forward_domain' and
'prefetch_root' options are removed, and superceded by 'zone' section.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-07-29 23:24:09 -04:00
36e1aa0892 unbound: add root zone file cache option
Add the possibility to use Unbound auto-zone: clause to
fetch complete root, arpa, in-addr.arpa, and ip6.arpa
zone files. This can speed up recursion when users
access many ccTLD or connection logging hits many PTR.

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2018-05-28 23:32:12 -04:00
cdeefec73e unbound: provide transparent defaults with documentation
Some resource options bundled many Unbound.conf options and
made customizing on top of UCI difficult. Make it easier to
use Unbound built defaults (blank conf sections).

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2018-05-28 23:32:12 -04:00
8b616efb10 unbound: add domain resolution control options
- Add domain_forward to permit designated domains to forward instead
  of recurse as listed in resolve.conf.auto from DHCP WAN client
- Update rebind_protection and add rebind_interface to protect IP6
  GLA locally just like RFC 1918 protection
- Rename trigger to trigger_interface with backwards compatability
- Update odhcpd script for efficiency handling many clients

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2018-03-18 14:48:50 -04:00
e7f5bbc65e unbound: update options for remote-control
Enhance the 'control' option to allow using SSL
to connect to the server. Add the 'extended_stats'
option to match 'extended-statistics: yes.'
Document the 'extended_luci' option; it does not
control Unbound, but changes the LuCI tabs.

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2017-09-22 22:54:32 -04:00
9d96dfd468 unbound: add option for dhcp UCI domain mx srv and cname
Base LEDE/OpenWrt UCI for dnsmasq provides for DNS override in
/etc/config/dhcp. It is desired to be able to use dnsmasq and
Unbound as transparently as possible. Option 'add_extra_dns'
will pull 'domain', 'mxhost', 'srvhost, and 'cname' from base.

netifd/procd have an interaction with DHCPv6/RA on WAN (FS#713).
Minor IP6 parameter updates can cause Unbound reload events every
few minutes. List option 'trigger' selects which interfaces may
cause reload. For example 'lan', 'wan' but not 'wan6'.

Squash other cosmetics.

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2017-05-23 00:14:33 -04:00
a4f23e52bf unbound: improve maintenance of trust anchor
Unbound UCI tries to protect embedded flash from excess
use. Unbound RFC5011 KSK tracking can rewrite root.key
every few minutes to an hour. It also writes and destroys
files in the same directory during the process.

Recommended UCI delays for copying busy work in /var/
back to /etc/ may be too conservative. These are all
changed from 28 to 9 days.

The RFC5011 KSK results were also destroyed by an
init.d restart, even if /var/ is mounted on persistent
storage like USB drive. /var/lib/unbound/root.key is
now preserved during this process, unless a newer key
is installed in /etc/ manually or package update.

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2017-03-02 00:55:16 -05:00
de1198d54d unbound: expand UCI to cover some popular dnsmasq features
Unbound+DHCP (server of your choice) should be able to replicate
a lot of what dnsmasq provides. With this change set Unbound
still works with dnsmasq, but also it can work with a plain
DHCP server. Features have been added within the UCI itself
to act like dnsmasq.

- alone: name each interface relative to router hostname
- alone: prevent upstream leakage of your domain and '.local'
- dnsmasq: use dnsmasq UCI to configure forwarding clauses
- dhcp: work with odhcpd as example of companion DHCP-DNS
- dhcp: convert DHCPv4 leases into EUI64 SLAAC for DNS records
- all: enable encrypted remote unbound-control using splice conf
- all: allow user spliced conf-files for hybrid UCI and manual conf
-- 'unbound_srv.conf' will be spliced into the 'server:' clause
-- 'unbound_ext.conf' will add clauses to the end, example 'forward:'

README HOW TO for dnsmasq-in-serial, dnsmasq-in-parallel, and
unbound-with-odhcpd have better/added UCI starters. HOW TO for
including unbound_srv.conf and unbound_ext.conf are added.
Document new UCI: add_local_fqdn, add_wan_fqdn, dhcp4_slaac6,
dhcp_link, domain, and domain_type

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2017-01-22 20:53:04 -05:00
82c2368177 unbound: UCI updates to take advantage of 1.6.0
- UCI to take advantage of "qname-minimisation-strict:"
- UCI to block chaos reponses bind, server, and version
- UCI to limit or prefer recrusion over IP4 or IP6

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2016-12-18 22:38:19 -05:00
c0a630001b unbound: bugfix for UCI script typos
- UCI option dnsmasq_gate_name typo in few locations
- NTP hotplug to check /etc/init.d/unbound not ..dnsmasq

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2016-12-18 22:38:19 -05:00
c189596a4a Unbound: added UCI support for DNS64
Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
Signed-off-by: Dan Luedte <mail@danrl.com>
2016-12-12 08:12:26 +01:00
2202548ff0 Unbound: Add UCI primer files
-README.md to describe the UCI in detail
-unbound.uci to get you started

Signed-off-by: Eric Luehrsen <ericluehrsen@hotmail.com>
2016-11-29 20:49:46 -05:00