aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--config/unbound/unbound.inc48
-rw-r--r--config/unbound/unbound.xml11
-rw-r--r--config/unbound/unbound_acls.xml181
-rw-r--r--config/unbound/unbound_status.php1
4 files changed, 234 insertions, 7 deletions
diff --git a/config/unbound/unbound.inc b/config/unbound/unbound.inc
index cb35c81a..bce0219e 100644
--- a/config/unbound/unbound.inc
+++ b/config/unbound/unbound.inc
@@ -249,6 +249,24 @@ function unbound_get_network_interface_addresses($subnet=false, $mask=false) {
}
+function unbound_acls_config() {
+ global $config;
+
+ if(array($config['installedpackages']['unboundacls']['config'])) {
+ $unbound_acls = $config['installedpackages']['unboundacls']['config'];
+ $unboundcfg = "";
+ foreach($unbound_acls as $unbound_acl){
+ $unboundcfg .= "#{$unbound_acl['aclname']}\n";
+ foreach($unbound_acl['row'] as $network) {
+ $unboundcfg .= "access-control: {$network['acl_network']}/{$network['mask']} {$unbound_acl['aclaction']}\n";
+ }
+ }
+ return $unboundcfg;
+ } else {
+ return;
+ }
+}
+
function unbound_resync_config() {
global $config, $g;
@@ -256,11 +274,13 @@ function unbound_resync_config() {
$config['installedpackages']['unbound']['config'] = array();
$unbound_config = &$config['installedpackages']['unbound']['config'][0];
-
+
+ // Add networks physically attached to allowed networks and then call the acls
$interfaces = unbound_get_network_interface_addresses(true, true);
foreach($interfaces as $allowed_network) {
$unbound_allowed_networks .= "access-control: $allowed_network allow\n";
}
+ $unbound_allowed_networks .= unbound_acls_config();
if($unbound_config['dnssec_status'] == "on") {
$module_config = "validator iterator";
@@ -365,7 +385,8 @@ use-syslog: yes
module-config: "{$module_config}"
unwanted-reply-threshold: 10000000
{$anchor_file}
-# Networks allowed to utilize service
+#### Access Control ####
+# Local attached networks allowed to utilize service and any user added ACLs
access-control: 127.0.0.0/8 allow
{$unbound_allowed_networks}
{$pvt_addr}
@@ -502,10 +523,25 @@ function unbound_validate($post, $acl=false) {
$input_errors[] = "The system dns-forwarder is still active. Disable it before enabling the Unbound service.";
if($acl) {
- if(isset($post['row']['acl_network']))
- print_r($post); exit;
- }
-
+ $acls = $post;
+ // Check to ensure values entered is an action that is in the list
+ if ($acls['aclaction'] != 'refuse' && $acls['aclaction'] != 'allow' && $acls['aclaction'] && 'allow_snoop' && $acls['aclaction'] != 'deny')
+ $input_errors[] = "{$acls['aclaction']} is not a valid ACL Action. Please select one of the four actions defined in the list.";
+
+ // Make sure there is at least 1 network defined.
+ if (!isset($acls['acl_network0']))
+ $input_errors[] = "You need to specify at least one network to create a valid ACL.";
+
+ $count = 0;
+ // Get number of rows added, should be passed by the form - will look into that later
+ for($i=0; $i<99; $i++) {
+ if (isset($acls['acl_network'.$i])) {
+ // Check to ensure values entered are networks
+ if(!is_ipaddr($acls['acl_network'.$i]) && !is_subnet($acls['mask'.$i]))
+ $input_errors[] = "{$acls['acl_network'.$i]}/{$acls['mask'.$i]} is not a valid network.";
+ }
+ }
+ }
}
function unbound_reconfigure() {
diff --git a/config/unbound/unbound.xml b/config/unbound/unbound.xml
index a3660c1f..eeb384a9 100644
--- a/config/unbound/unbound.xml
+++ b/config/unbound/unbound.xml
@@ -40,7 +40,7 @@
<requirements/>
<faq/>
<name>unbound</name>
- <version>1.4.6</version>
+ <version>1.4.7</version>
<title>Services: Unbound DNS Forwarder</title>
<include_file>/usr/local/pkg/unbound.inc</include_file>
<menu>
@@ -70,6 +70,11 @@
<chmod>0644</chmod>
<item>http://www.pfsense.org/packages/config/unbound/unbound_status.php</item>
</additional_files_needed>
+ <additional_files_needed>
+ <prefix>/usr/local/pkg/</prefix>
+ <chmod>0644</chmod>
+ <item>http://www.pfsense.org/packages/config/unbound/unbound_acls.xml</item>
+ </additional_files_needed>
<tabs>
<tab>
<text>Unbound DNS Settings</text>
@@ -77,6 +82,10 @@
<active/>
</tab>
<tab>
+ <text>Unbound ACLs</text>
+ <url>/pkg.php?xml=unbound_acls.xml</url>
+ </tab>
+ <tab>
<text>Unbound DNS Status</text>
<url>/unbound_status.php</url>
</tab>
diff --git a/config/unbound/unbound_acls.xml b/config/unbound/unbound_acls.xml
new file mode 100644
index 00000000..9a22d888
--- /dev/null
+++ b/config/unbound/unbound_acls.xml
@@ -0,0 +1,181 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE packagegui SYSTEM "../schema/packages.dtd">
+<?xml-stylesheet type="text/xsl" href="../xsl/package.xsl"?>
+<packagegui>
+ <copyright>
+ <![CDATA[
+ /*
+ unbound_acls.xml
+ part of the Unbound package for pfSense (http://www.pfSense.com)
+ Copyright (C) 2010 Warren Baker
+ All rights reserved.
+ */
+ /* ========================================================================== */
+ /*
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+ */
+ /* ========================================================================== */
+ ]]>
+ </copyright>
+ <description>Unbound is a validating, recursive, and caching DNS resolver.</description>
+ <requirements/>
+ <faq/>
+ <name>unboundacls</name>
+ <version>1.4.7</version>
+ <title>Services: Unbound DNS Forwarder: ACLs</title>
+ <include_file>/usr/local/pkg/unbound.inc</include_file>
+ <menu>
+ <name>Unbound DNS</name>
+ <tooltiptext>Setup Unbound specific settings</tooltiptext>
+ <section>Services</section>
+ <url>pkg_edit.php?xml=unbound.xml&amp;id=0</url>
+ </menu>
+ <tabs>
+ <tab>
+ <text>Unbound DNS Settings</text>
+ <url>/pkg_edit.php?xml=unbound.xml&amp;id=0</url>
+ </tab>
+ <tab>
+ <text>Unbound ACLs</text>
+ <url>/pkg.php?xml=unbound_acls.xml</url>
+ <active/>
+ </tab>
+ <tab>
+ <text>Unbound DNS Status</text>
+ <url>/unbound_status.php</url>
+ </tab>
+ </tabs>
+ <adddeleteeditpagefields>
+ <columnitem>
+ <fielddescr>ACL Name</fielddescr>
+ <fieldname>aclname</fieldname>
+ </columnitem>
+ <columnitem>
+ <fielddescr>Action</fielddescr>
+ <fieldname>acl_action</fieldname>
+ </columnitem>
+ <columnitem>
+ <fielddescr>Description</fielddescr>
+ <fieldname>description</fieldname>
+ </columnitem>
+ </adddeleteeditpagefields>
+ <fields>
+ <field>
+ <name>Edit Unbound ACL</name>
+ <type>listtopic</type>
+ </field>
+ <field>
+ <fieldname>aclname</fieldname>
+ <fielddescr>ACL name</fielddescr>
+ <description>Provide an ACL name.</description>
+ <type>input</type>
+ <required/>
+ </field>
+ <field>
+ <fieldname>aclaction</fieldname>
+ <fielddescr>Action</fielddescr>
+ <description>&lt;br/&gt;Choose an action:&lt;br/&gt;&lt;br/&gt;
+ &lt;b&gt;Allow:&lt;/b&gt; This actions allows queries from hosts within the netblock(s) defined below.&lt;br/&gt;
+ &lt;b&gt;Allow Snoop:&lt;/b&gt; This actions allows recursive and nonrecursive access from hosts within the netblock(s) defined below. Used for cache snooping and ideally should only be configured for your administrative host.&lt;br/&gt;
+ &lt;b&gt;Deny:&lt;/b&gt; This actions stops queries from hosts within the netblock(s) defined below.&lt;br/&gt;
+ &lt;b&gt;Refuse:&lt;/b&gt; This actions also stops queries from hosts within the netblock(s) defined below, but sends back DNS rcode REFUSED error message back to the client.</description>
+ <type>select</type>
+ <options>
+ <option><name>Allow</name><value>allow</value></option>
+ <option><name>Allow Snoop</name><value>allow_snoop</value></option>
+ <option><name>Refuse</name><value>refuse</value></option>
+ <option><name>Deny</name><value>deny</value></option>
+ </options>
+ <required/>
+ </field>
+ <field>
+ <type>rowhelper</type>
+ <fielddescr>Network(s)</fielddescr>
+ <required/>
+ <rowhelper>
+ <rowhelperfield>
+ <fielddescr>Network</fielddescr>
+ <fieldname>acl_network</fieldname>
+ <description></description>
+ <type>input</type>
+ <size>20</size>
+ </rowhelperfield>
+ <rowhelperfield>
+ <fielddescr>CIDR</fielddescr>
+ <fieldname>mask</fieldname>
+ <description>/</description>
+ <type>select</type>
+ <options>
+ <option><name>32</name><value>32</value></option>
+ <option><name>31</name><value>31</value></option>
+ <option><name>30</name><value>30</value></option>
+ <option><name>29</name><value>29</value></option>
+ <option><name>28</name><value>28</value></option>
+ <option><name>27</name><value>27</value></option>
+ <option><name>26</name><value>26</value></option>
+ <option><name>25</name><value>25</value></option>
+ <option><name>24</name><value>24</value></option>
+ <option><name>23</name><value>23</value></option>
+ <option><name>22</name><value>22</value></option>
+ <option><name>21</name><value>21</value></option>
+ <option><name>20</name><value>20</value></option>
+ <option><name>19</name><value>19</value></option>
+ <option><name>18</name><value>18</value></option>
+ <option><name>17</name><value>17</value></option>
+ <option><name>16</name><value>16</value></option>
+ <option><name>15</name><value>15</value></option>
+ <option><name>14</name><value>14</value></option>
+ <option><name>13</name><value>13</value></option>
+ <option><name>12</name><value>12</value></option>
+ <option><name>11</name><value>11</value></option>
+ <option><name>10</name><value>10</value></option>
+ <option><name>9</name><value>9</value></option>
+ <option><name>8</name><value>8</value></option>
+ <option><name>7</name><value>7</value></option>
+ <option><name>6</name><value>6</value></option>
+ <option><name>5</name><value>5</value></option>
+ <option><name>4</name><value>4</value></option>
+ <option><name>3</name><value>3</value></option>
+ <option><name>2</name><value>2</value></option>
+ <option><name>1</name><value>1</value></option>
+ </options>
+ </rowhelperfield>
+ </rowhelper>
+ </field>
+ <field>
+ <fielddescr>Description</fielddescr>
+ <fieldname>description</fieldname>
+ <description>Enter a description for your reference.</description>
+ <type>input</type>
+ <size>25</size>
+ </field>
+ </fields>
+ <custom_add_php_command>
+ </custom_add_php_command>
+ <custom_php_command_before_form/>
+ <custom_php_validation_command>
+ unbound_validate($_POST, true);
+ </custom_php_validation_command>
+ <custom_php_resync_config_command>
+ unbound_reconfigure();
+ </custom_php_resync_config_command>
+</packagegui>
diff --git a/config/unbound/unbound_status.php b/config/unbound/unbound_status.php
index 8ea10b73..d5752b82 100644
--- a/config/unbound/unbound_status.php
+++ b/config/unbound/unbound_status.php
@@ -132,6 +132,7 @@ function execCmds() {
<?php
$tab_array = array();
$tab_array[] = array(gettext("Unbound DNS Settings"), false, "/pkg_edit.php?xml=unbound.xml&amp;id=0");
+ $tab_array[] = array(gettext("Unbound ACLs"), false, "/pkg.php?xml=unbound_acls.xml");
$tab_array[] = array(gettext("Unbound DNS Status"), true, "/unbound_status.php");
display_top_tabs($tab_array);
?>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-08 03:50:19 +0000