Added Unbound ACL's page, users can now specify which networks are allowed to query, refused, denied and allowed to snoop Unbound.

4 files changed, 234 insertions, 7 deletions

diff --git a/config/unbound/unbound.inc b/config/unbound/unbound.inc
index cb35c81a..bce0219e 100644
--- a/config/unbound/unbound.inc
+++ b/config/unbound/unbound.inc
@@ -249,6 +249,24 @@ function unbound_get_network_interface_addresses($subnet=false, $mask=false) {
 	
 }
 
+function unbound_acls_config() {
+	global $config;
+	
+	if(array($config['installedpackages']['unboundacls']['config'])) {
+		$unbound_acls = $config['installedpackages']['unboundacls']['config'];
+		$unboundcfg = "";
+		foreach($unbound_acls as $unbound_acl){
+			$unboundcfg .= "#{$unbound_acl['aclname']}\n";
+			foreach($unbound_acl['row'] as $network) {
+				$unboundcfg .= "access-control: {$network['acl_network']}/{$network['mask']} {$unbound_acl['aclaction']}\n";
+			}			
+		}
+		return $unboundcfg;
+	} else {
+		return;
+	}
+}
+
 function unbound_resync_config() {
 	global $config, $g;
 	
@@ -256,11 +274,13 @@ function unbound_resync_config() {
 		$config['installedpackages']['unbound']['config'] = array();
 
 	$unbound_config = &$config['installedpackages']['unbound']['config'][0];
-			
+	
+	// Add networks physically attached to allowed networks and then call the acls		
 	$interfaces = unbound_get_network_interface_addresses(true, true);
 	foreach($interfaces as $allowed_network) {
 		$unbound_allowed_networks .= "access-control: $allowed_network allow\n";
 	}
+	$unbound_allowed_networks .= unbound_acls_config();
 	
 	if($unbound_config['dnssec_status'] == "on") {
 		$module_config = "validator iterator";
@@ -365,7 +385,8 @@ use-syslog: yes
 module-config: "{$module_config}"
 unwanted-reply-threshold: 10000000
 {$anchor_file}
-# Networks allowed to utilize service
+#### Access Control ####
+# Local attached networks allowed to utilize service and any user added ACLs
 access-control: 127.0.0.0/8 allow
 {$unbound_allowed_networks}
 {$pvt_addr}
@@ -502,10 +523,25 @@ function unbound_validate($post, $acl=false) {
 		$input_errors[] = "The system dns-forwarder is still active. Disable it before enabling the Unbound service.";
 		
 	if($acl) {
-		if(isset($post['row']['acl_network']))
-			print_r($post); exit;
-	}
-	
+		$acls = $post;
+		// Check to ensure values entered is an action that is in the list
+		if ($acls['aclaction'] != 'refuse' && $acls['aclaction'] != 'allow' && $acls['aclaction'] && 'allow_snoop' && $acls['aclaction'] != 'deny')
+			$input_errors[] = "{$acls['aclaction']} is not a valid ACL Action. Please select one of the four actions defined in the list.";
+		
+		// Make sure there is at least 1 network defined.
+		if (!isset($acls['acl_network0']))	
+			$input_errors[] = "You need to specify at least one network to create a valid ACL.";
+			
+		$count = 0;
+		// Get number of rows added, should be passed by the form - will look into that later
+		for($i=0; $i<99; $i++) {
+			if (isset($acls['acl_network'.$i])) {
+				// Check to ensure values entered are networks
+				if(!is_ipaddr($acls['acl_network'.$i]) && !is_subnet($acls['mask'.$i]))
+					$input_errors[] = "{$acls['acl_network'.$i]}/{$acls['mask'.$i]} is not a valid network.";
+			}				
+		}
+	}	
 }
 
 function unbound_reconfigure() {
diff --git a/config/unbound/unbound.xml b/config/unbound/unbound.xml
index a3660c1f..eeb384a9 100644
--- a/config/unbound/unbound.xml
+++ b/config/unbound/unbound.xml
@@ -40,7 +40,7 @@
 	<requirements/>
 	<faq/>
 	<name>unbound</name>
-	<version>1.4.6</version>
+	<version>1.4.7</version>
 	<title>Services: Unbound DNS Forwarder</title>
 	<include_file>/usr/local/pkg/unbound.inc</include_file>
 	<menu>
@@ -70,6 +70,11 @@
 		<chmod>0644</chmod>
 		<item>http://www.pfsense.org/packages/config/unbound/unbound_status.php</item>
 	</additional_files_needed>
+	<additional_files_needed>
+		<prefix>/usr/local/pkg/</prefix>
+		<chmod>0644</chmod>
+		<item>http://www.pfsense.org/packages/config/unbound/unbound_acls.xml</item>
+	</additional_files_needed>
 	<tabs>
 		<tab>
 			<text>Unbound DNS Settings</text>
@@ -77,6 +82,10 @@
 			<active/>
 		</tab>
 		<tab>
+			<text>Unbound ACLs</text>
+			<url>/pkg.php?xml=unbound_acls.xml</url>
+		</tab>
+		<tab>
 			<text>Unbound DNS Status</text>
 			<url>/unbound_status.php</url>
 		</tab>
diff --git a/config/unbound/unbound_acls.xml b/config/unbound/unbound_acls.xml
new file mode 100644
index 00000000..9a22d888
--- /dev/null
+++ b/config/unbound/unbound_acls.xml
@@ -0,0 +1,181 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE packagegui SYSTEM "../schema/packages.dtd">
+<?xml-stylesheet type="text/xsl" href="../xsl/package.xsl"?>
+<packagegui>
+	<copyright>
+		<![CDATA[
+		/*
+		    unbound_acls.xml
+		    part of the Unbound package for pfSense (http://www.pfSense.com)
+		    Copyright (C) 2010 Warren Baker
+		    All rights reserved.
+		                                                       						  */
+		/* ========================================================================== */
+		/*
+		    Redistribution and use in source and binary forms, with or without
+		    modification, are permitted provided that the following conditions are met:
+
+		     1. Redistributions of source code must retain the above copyright notice,
+		        this list of conditions and the following disclaimer.
+
+		     2. Redistributions in binary form must reproduce the above copyright
+		        notice, this list of conditions and the following disclaimer in the
+		        documentation and/or other materials provided with the distribution.
+
+		    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+		    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+		    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+		    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+		    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+		    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+		    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+		    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+		    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+		    POSSIBILITY OF SUCH DAMAGE.
+		                                                                              */
+		/* ========================================================================== */
+		        ]]>
+	</copyright>
+	<description>Unbound is a validating, recursive, and caching DNS resolver.</description>
+	<requirements/>
+	<faq/>
+	<name>unboundacls</name>
+	<version>1.4.7</version>
+	<title>Services: Unbound DNS Forwarder: ACLs</title>
+	<include_file>/usr/local/pkg/unbound.inc</include_file>
+	<menu>
+		<name>Unbound DNS</name>
+		<tooltiptext>Setup Unbound specific settings</tooltiptext>
+		<section>Services</section>
+		<url>pkg_edit.php?xml=unbound.xml&amp;id=0</url>
+	</menu>
+	<tabs>
+		<tab>
+			<text>Unbound DNS Settings</text>
+			<url>/pkg_edit.php?xml=unbound.xml&amp;id=0</url>
+		</tab>
+		<tab>
+			<text>Unbound ACLs</text>
+			<url>/pkg.php?xml=unbound_acls.xml</url>
+			<active/>
+		</tab>
+		<tab>
+			<text>Unbound DNS Status</text>
+			<url>/unbound_status.php</url>
+		</tab>
+	</tabs>
+	<adddeleteeditpagefields>
+		<columnitem>
+			<fielddescr>ACL Name</fielddescr>
+			<fieldname>aclname</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Action</fielddescr>
+			<fieldname>acl_action</fieldname>
+		</columnitem>
+		<columnitem>
+			<fielddescr>Description</fielddescr>
+			<fieldname>description</fieldname>
+		</columnitem>
+	</adddeleteeditpagefields>
+	<fields>
+		<field>
+			<name>Edit Unbound ACL</name>
+			<type>listtopic</type>
+		</field>
+		<field>
+			<fieldname>aclname</fieldname>
+			<fielddescr>ACL name</fielddescr>
+			<description>Provide an ACL name.</description>
+			<type>input</type>
+			<required/>
+		</field>
+		<field>
+			<fieldname>aclaction</fieldname>
+			<fielddescr>Action</fielddescr>
+			<description>&lt;br/&gt;Choose an action:&lt;br/&gt;&lt;br/&gt;
+						&lt;b&gt;Allow:&lt;/b&gt; This actions allows queries from hosts within the netblock(s) defined below.&lt;br/&gt;
+						&lt;b&gt;Allow Snoop:&lt;/b&gt; This actions allows recursive and nonrecursive access from hosts within the netblock(s) defined below. Used for cache snooping and ideally should only be configured for your administrative host.&lt;br/&gt;
+						&lt;b&gt;Deny:&lt;/b&gt; This actions stops queries from hosts within the netblock(s) defined below.&lt;br/&gt;
+						&lt;b&gt;Refuse:&lt;/b&gt; This actions also stops queries from hosts within the netblock(s) defined below, but sends back DNS rcode REFUSED error message back to the client.</description>
+			<type>select</type>
+			<options>
+				<option><name>Allow</name><value>allow</value></option>
+				<option><name>Allow Snoop</name><value>allow_snoop</value></option>
+				<option><name>Refuse</name><value>refuse</value></option>
+				<option><name>Deny</name><value>deny</value></option>
+			</options>
+			<required/>
+		</field>
+        <field>
+			<type>rowhelper</type>
+			<fielddescr>Network(s)</fielddescr>
+			<required/>
+			<rowhelper>
+				<rowhelperfield>
+					<fielddescr>Network</fielddescr>
+					<fieldname>acl_network</fieldname>
+					<description></description>
+					<type>input</type>
+					<size>20</size>
+				</rowhelperfield>
+				<rowhelperfield>
+					<fielddescr>CIDR</fielddescr>
+					<fieldname>mask</fieldname>
+					<description>/</description>
+					<type>select</type>
+					<options>
+						<option><name>32</name><value>32</value></option>
+						<option><name>31</name><value>31</value></option>
+						<option><name>30</name><value>30</value></option>
+						<option><name>29</name><value>29</value></option>
+						<option><name>28</name><value>28</value></option>
+						<option><name>27</name><value>27</value></option>
+						<option><name>26</name><value>26</value></option>
+						<option><name>25</name><value>25</value></option>
+						<option><name>24</name><value>24</value></option>
+						<option><name>23</name><value>23</value></option>
+						<option><name>22</name><value>22</value></option>
+						<option><name>21</name><value>21</value></option>
+						<option><name>20</name><value>20</value></option>
+						<option><name>19</name><value>19</value></option>
+						<option><name>18</name><value>18</value></option>
+						<option><name>17</name><value>17</value></option>
+						<option><name>16</name><value>16</value></option>
+						<option><name>15</name><value>15</value></option>
+						<option><name>14</name><value>14</value></option>
+						<option><name>13</name><value>13</value></option>
+						<option><name>12</name><value>12</value></option>
+						<option><name>11</name><value>11</value></option>
+						<option><name>10</name><value>10</value></option>
+						<option><name>9</name><value>9</value></option>
+						<option><name>8</name><value>8</value></option>
+						<option><name>7</name><value>7</value></option>
+						<option><name>6</name><value>6</value></option>
+						<option><name>5</name><value>5</value></option>
+						<option><name>4</name><value>4</value></option>
+						<option><name>3</name><value>3</value></option>
+						<option><name>2</name><value>2</value></option>
+						<option><name>1</name><value>1</value></option>																		
+					</options>
+				</rowhelperfield>
+			</rowhelper>
+		</field>
+		<field>
+			<fielddescr>Description</fielddescr>
+			<fieldname>description</fieldname>
+			<description>Enter a description for your reference.</description>
+			<type>input</type>
+			<size>25</size>
+		</field>
+	</fields>
+	<custom_add_php_command>
+	</custom_add_php_command>
+	<custom_php_command_before_form/>
+	<custom_php_validation_command>
+		unbound_validate($_POST, true);
+	</custom_php_validation_command>
+	<custom_php_resync_config_command>
+		unbound_reconfigure();
+	</custom_php_resync_config_command>
+</packagegui>
diff --git a/config/unbound/unbound_status.php b/config/unbound/unbound_status.php
index 8ea10b73..d5752b82 100644
--- a/config/unbound/unbound_status.php
+++ b/config/unbound/unbound_status.php
@@ -132,6 +132,7 @@ function execCmds() {
 	<?php
 		$tab_array = array();
 		$tab_array[] = array(gettext("Unbound DNS Settings"), false, "/pkg_edit.php?xml=unbound.xml&amp;id=0");
+		$tab_array[] = array(gettext("Unbound ACLs"), false, "/pkg.php?xml=unbound_acls.xml");
 		$tab_array[] = array(gettext("Unbound DNS Status"), true, "/unbound_status.php");
 		display_top_tabs($tab_array);
 	?>