From 44281487dee73f86437e6f362f1872a23921019b Mon Sep 17 00:00:00 2001 From: Warren Baker Date: Wed, 12 Jan 2011 11:47:13 +0200 Subject: Added Unbound ACL's page, users can now specify which networks are allowed to query, refused, denied and allowed to snoop Unbound. --- config/unbound/unbound.inc | 48 ++++++++-- config/unbound/unbound.xml | 11 ++- config/unbound/unbound_acls.xml | 181 ++++++++++++++++++++++++++++++++++++++ config/unbound/unbound_status.php | 1 + 4 files changed, 234 insertions(+), 7 deletions(-) create mode 100644 config/unbound/unbound_acls.xml (limited to 'config/unbound') diff --git a/config/unbound/unbound.inc b/config/unbound/unbound.inc index cb35c81a..bce0219e 100644 --- a/config/unbound/unbound.inc +++ b/config/unbound/unbound.inc @@ -249,6 +249,24 @@ function unbound_get_network_interface_addresses($subnet=false, $mask=false) { } +function unbound_acls_config() { + global $config; + + if(array($config['installedpackages']['unboundacls']['config'])) { + $unbound_acls = $config['installedpackages']['unboundacls']['config']; + $unboundcfg = ""; + foreach($unbound_acls as $unbound_acl){ + $unboundcfg .= "#{$unbound_acl['aclname']}\n"; + foreach($unbound_acl['row'] as $network) { + $unboundcfg .= "access-control: {$network['acl_network']}/{$network['mask']} {$unbound_acl['aclaction']}\n"; + } + } + return $unboundcfg; + } else { + return; + } +} + function unbound_resync_config() { global $config, $g; @@ -256,11 +274,13 @@ function unbound_resync_config() { $config['installedpackages']['unbound']['config'] = array(); $unbound_config = &$config['installedpackages']['unbound']['config'][0]; - + + // Add networks physically attached to allowed networks and then call the acls $interfaces = unbound_get_network_interface_addresses(true, true); foreach($interfaces as $allowed_network) { $unbound_allowed_networks .= "access-control: $allowed_network allow\n"; } + $unbound_allowed_networks .= unbound_acls_config(); if($unbound_config['dnssec_status'] == "on") { $module_config = "validator iterator"; @@ -365,7 +385,8 @@ use-syslog: yes module-config: "{$module_config}" unwanted-reply-threshold: 10000000 {$anchor_file} -# Networks allowed to utilize service +#### Access Control #### +# Local attached networks allowed to utilize service and any user added ACLs access-control: 127.0.0.0/8 allow {$unbound_allowed_networks} {$pvt_addr} @@ -502,10 +523,25 @@ function unbound_validate($post, $acl=false) { $input_errors[] = "The system dns-forwarder is still active. Disable it before enabling the Unbound service."; if($acl) { - if(isset($post['row']['acl_network'])) - print_r($post); exit; - } - + $acls = $post; + // Check to ensure values entered is an action that is in the list + if ($acls['aclaction'] != 'refuse' && $acls['aclaction'] != 'allow' && $acls['aclaction'] && 'allow_snoop' && $acls['aclaction'] != 'deny') + $input_errors[] = "{$acls['aclaction']} is not a valid ACL Action. Please select one of the four actions defined in the list."; + + // Make sure there is at least 1 network defined. + if (!isset($acls['acl_network0'])) + $input_errors[] = "You need to specify at least one network to create a valid ACL."; + + $count = 0; + // Get number of rows added, should be passed by the form - will look into that later + for($i=0; $i<99; $i++) { + if (isset($acls['acl_network'.$i])) { + // Check to ensure values entered are networks + if(!is_ipaddr($acls['acl_network'.$i]) && !is_subnet($acls['mask'.$i])) + $input_errors[] = "{$acls['acl_network'.$i]}/{$acls['mask'.$i]} is not a valid network."; + } + } + } } function unbound_reconfigure() { diff --git a/config/unbound/unbound.xml b/config/unbound/unbound.xml index a3660c1f..eeb384a9 100644 --- a/config/unbound/unbound.xml +++ b/config/unbound/unbound.xml @@ -40,7 +40,7 @@ unbound - 1.4.6 + 1.4.7 Services: Unbound DNS Forwarder /usr/local/pkg/unbound.inc @@ -70,12 +70,21 @@ 0644 http://www.pfsense.org/packages/config/unbound/unbound_status.php + + /usr/local/pkg/ + 0644 + http://www.pfsense.org/packages/config/unbound/unbound_acls.xml + Unbound DNS Settings /pkg_edit.php?xml=unbound.xml&id=0 + + Unbound ACLs + /pkg.php?xml=unbound_acls.xml + Unbound DNS Status /unbound_status.php diff --git a/config/unbound/unbound_acls.xml b/config/unbound/unbound_acls.xml new file mode 100644 index 00000000..9a22d888 --- /dev/null +++ b/config/unbound/unbound_acls.xml @@ -0,0 +1,181 @@ + + + + + + + + Unbound is a validating, recursive, and caching DNS resolver. + + + unboundacls + 1.4.7 + Services: Unbound DNS Forwarder: ACLs + /usr/local/pkg/unbound.inc + + Unbound DNS + Setup Unbound specific settings +
Services
+ pkg_edit.php?xml=unbound.xml&id=0 + + + + Unbound DNS Settings + /pkg_edit.php?xml=unbound.xml&id=0 + + + Unbound ACLs + /pkg.php?xml=unbound_acls.xml + + + + Unbound DNS Status + /unbound_status.php + + + + + ACL Name + aclname + + + Action + acl_action + + + Description + description + + + + + Edit Unbound ACL + listtopic + + + aclname + ACL name + Provide an ACL name. + input + + + + aclaction + Action + <br/>Choose an action:<br/><br/> + <b>Allow:</b> This actions allows queries from hosts within the netblock(s) defined below.<br/> + <b>Allow Snoop:</b> This actions allows recursive and nonrecursive access from hosts within the netblock(s) defined below. Used for cache snooping and ideally should only be configured for your administrative host.<br/> + <b>Deny:</b> This actions stops queries from hosts within the netblock(s) defined below.<br/> + <b>Refuse:</b> This actions also stops queries from hosts within the netblock(s) defined below, but sends back DNS rcode REFUSED error message back to the client. + select + + + + + + + + + + rowhelper + Network(s) + + + + Network + acl_network + + input + 20 + + + CIDR + mask + / + select + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Description + description + Enter a description for your reference. + input + 25 + + + + + + + unbound_validate($_POST, true); + + + unbound_reconfigure(); + + diff --git a/config/unbound/unbound_status.php b/config/unbound/unbound_status.php index 8ea10b73..d5752b82 100644 --- a/config/unbound/unbound_status.php +++ b/config/unbound/unbound_status.php @@ -132,6 +132,7 @@ function execCmds() { -- cgit v1.2.3