1
0
mirror of https://git.openwrt.org/feed/packages.git synced 2024-06-18 13:23:57 +02:00
Commit Graph

122 Commits

Author SHA1 Message Date
Eric Luehrsen
658c27ea97 unbound: clean up interface interpretation in UCI
DNS flag day 2020, software should reflect the minimum EDNS 1232 bytes.
Added iface_wan and iface_lan to control internal DNS assignemnts and
to control what is local service ACL. Interface wild cards are not
explicitly set so that they can be customized in extended conf.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-11-04 19:25:08 -05:00
Eric Luehrsen
2680dc239a unbound: update to 1.1.12
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-11-04 19:25:08 -05:00
Eric Luehrsen
b97cdaf612 unbound: improve odhcpd rapid update robustness
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-09-05 10:04:48 -04:00
Jan Pavlinec
2eacaacff3
unbound: add option for dnstap support
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
2020-09-03 17:01:04 +02:00
Eric Luehrsen
f8ba0fe7bf unbound: follow resolv.conf.auto to new location
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-08-07 01:30:52 -04:00
Eric Luehrsen
54164792aa unbound: update to 1.11.0
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-07-29 22:55:21 -04:00
Eric Luehrsen
e81529596d unbound: improve startup and dhcp script robustness
- prevent rapid overlap in DHCP script updates
- check and allow localhost forwards with specific applications
- add option for rate limiting inbound queries
- change UCI list to table format with Unbound conf references

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-07-12 14:56:46 -04:00
Eric Luehrsen
9c655aed3a unbound: add dns assistants on local host
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-06-27 17:17:41 -04:00
Eric Luehrsen
8e0b2d344e unbound: refactor build options to select switches
The two unique packages "Unbound light" and "Unbound heavy"
were not working well due to the fact that Unbound is mostly
its library. Tools and helpers would crash. Instead a reasonable
default Unbound is built. Also up select options like python
are added. libevent and libpthreads are options to down select.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-06-27 17:17:41 -04:00
Eric Luehrsen
af73a9b9a4 unbound: make option interface_auto default on
Unbound has a quirk and may reply on a different device address.
When Unbound answers with from-address different than it
received queries on, it may cause trouble for select VPN and
firewall configurations. Ensure Unbound replies with the same
address by changing this default.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-06-13 15:13:45 -04:00
Rosen Penev
b6caafef46
Merge pull request #12400 from EricLuehrsen/master
unbound: suggest matched domain option for dnsmasq link
2020-06-04 14:24:11 -07:00
David Bauer
b66955968d unbound: bump PKG_RELEASE
Fixes commit da76aeb24c ("unbound: expose interface-auto to UCI")

Signed-off-by: David Bauer <mail@david-bauer.net>
2020-06-04 16:02:29 +02:00
Eric Luehrsen
c95e3835e8 unbound: suggest matched domain option for dnsmasq link
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-06-04 01:13:46 -04:00
David Bauer
da76aeb24c unbound: expose interface-auto to UCI
This exposes the interface-auto option to UCI.

By default, interface-auto is disabled.
This leads to the DNS reply possibly originating from
a different address then the request was sent to.

Devices with a packet filter might not receive the reply in this case.

Enabling interface-auto ensures the reply is sent with the
source-address the request was sent to.

Signed-off-by: David Bauer <mail@david-bauer.net>
2020-06-03 16:05:52 +02:00
Josef Schlehofer
8ccff44ad1
unbound: update to version 1.10.1
Fixes:
CVE-2020-12662
CVE-2020-12663

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2020-05-19 11:23:57 +02:00
Stijn Segers
839c2e3cae unbound: enable ipset support for the unbound-daemon-heavy variant.
This patch enables ipset support in the unbound-daemon-heavy variant. See [1] for
instructions on how to use it.

Also fix a minor typo in the libunbound-light description.

[1] https://github.com/NLnetLabs/unbound/pull/28

Signed-off-by: Stijn Segers <foss@volatilesystems.org>
2020-02-23 16:03:37 +01:00
Stijn Segers
f779ef48cd Unbound: update to 1.10.0
Signed-off-by: Stijn Segers <foss@volatilesystems.org>
2020-02-23 12:02:26 +01:00
Eric Luehrsen
6505154a74 unbound: improve dependencies for okpg
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-01-17 22:41:56 -05:00
Eric Luehrsen
b101dd76fb unbound: fix TLS forwards with optional suffix
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2020-01-11 15:42:03 -05:00
Eric Luehrsen
173f2d6c9f unbound: update to 1.9.6
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-12-18 01:32:30 -05:00
Josef Schlehofer
24667753a2
unbound: Update to version 1.9.5
Fixes CVE-2019-18934

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-11-21 09:01:56 +01:00
Jeffery To
53e1692ae9 treewide: Use default PKG_BUILD_DIR when possible
This removes lines that set PKG_BUILD_DIR when the set value is no
different from the default value.

Specifically, the line is removed if the assigned value is:

* $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)

  The default PKG_BUILD_DIR was updated[1] to incorporate BUILD_VARIANT
  if it is set, so now this is identical to the default value.

* $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_SOURCE_SUBDIR)

  if PKG_SOURCE_SUBDIR is set to $(PKG_NAME)-$(PKG_VERSION), making it
  the same as the previous case

* $(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

  This is the same as the default PKG_BUILD_DIR when there is no
  BUILD_VARIANT.

* $(BUILD_DIR)/[name]-$(PKG_VERSION)

  where [name] is a string that is identical to PKG_NAME

[1]: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=e545fac8d968864a965edb9e50c6f90940b0a6c9

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-10-13 02:01:34 +08:00
Josef Schlehofer
1caf170daf
unbound: Update to version 1.9.4
Fixes CVE-2019-16866

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2019-10-04 11:58:32 +02:00
Eric Luehrsen
c36d8a49fd unbound: update to 1.9.3
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-08-31 01:12:16 -04:00
Eric Luehrsen
68b094d411 unbound: improve a few UCI settings
- treat RFC6762 'local.' as nxdomain because avahi and other services
will disable if SOA or NS records appear in central DNS.
- allow two threads to be enabled with the 'heavy traffic' variant of
Unbound packages.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-06-19 00:50:28 -04:00
Eric Luehrsen
fb2757146f unbound: update to 1.9.2
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-06-19 00:50:28 -04:00
Alexander Ryzhov
4618c74150
unbound: fix library double packing
Signed-off-by: Alexander Ryzhov <github@ryzhov-al.ru>
2019-06-06 20:18:27 +03:00
Eric Luehrsen
e6812324c6 unbound: add compile options to library and daemon
Two seperate package names were chosen instead of menu selected options
because dependents need a ready (large) package in release directory.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-05-28 09:52:47 +08:00
Eric Luehrsen
f1d1530f48 unbound: replace obsolete test expressions
Expressions '-o', '-a', and '\( \)' within test or '[ ]' are obsolete.
POSIX allows few arguments to test, so long expressions are not
portable. '[ p -a q ]' can be replaced with '[ p ] && [ q ]' instead.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-05-28 09:52:47 +08:00
Eric Luehrsen
1077a04b76 unbound: fix local dns synthesis corner cases
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-04-29 22:34:08 -04:00
Eric Luehrsen
3613928b81
unbound: update readme.md
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-04-17 02:27:30 -04:00
Rosen Penev
e57a46ab6e unbound: Fix ECC dependency
Signed-off-by: Rosen Penev <rosenp@gmail.com>
2019-04-05 08:53:53 -03:00
Rosen Penev
f6aeed3187
unbound: Make ECDSA support explicit
Added a dependency to OPENSSL_WITH_EC to prevent any build failures.

Switched URLs to HTTPS.

Added PKG_CPE_ID for proper CVE tracking.

Some Makefile reorganization for consistency between packages.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2019-04-01 12:29:17 -07:00
Eric Luehrsen
874b65b3b0 unbound: update to 1.9.1 and remove upstream patches
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2019-03-12 20:02:34 -04:00
Jan Pavlinec
f986379802
unbound: update to version 1.9.0
Changes:
-remove old dns64 patch
-refresh openssl deprecated patch
-add DoT error log patch https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
2019-02-11 12:34:22 +01:00
Jan Pavlinec
c4a57c3f07
unbound: add patch to fix dns64 crash
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
2018-12-19 10:19:06 +01:00
Eric Luehrsen
705335c286 unbound: update to 1.8.3
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-12-12 16:39:02 -05:00
Eric Luehrsen
0b4da5d97d unbound: update to 1.8.2
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-12-05 00:31:05 -05:00
Rosen Penev
1200c508fb unbound: Remove deprecated OpenSSL API
This will become pointless once OpenSSL 1.1.1 enters the tree.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2018-11-05 16:32:11 -08:00
Eric Luehrsen
04f4ab9b92 unbound: fix odhcpd link and axfr zone scripts
- fix AXFR zones to delay a potentially large download with ntp-hotplug
- fix odhcpd link script to properly delete expired lease data from DNS

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-10-24 21:11:45 -04:00
Eric Luehrsen
361446f409 unbound: update to 1.8.1
bug fixes for memory leaks
bug fixes for DNS over TLS

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-10-09 22:23:03 -04:00
Eric Luehrsen
10665f5ce9 unbound: add patches for leaks during TLS query
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-09-27 23:21:58 -04:00
Eric Luehrsen
32ad87ca80 unbound: update to 1.8.0
- adjust a few UCI translations to coordinate with upstream defaults
- remove OpenSSL < 1.1.0 API log error patch which is included upstream

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-09-15 20:42:10 -04:00
Eric Luehrsen
59617f076d unbound: drop odhcpd leases with wrong field count
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-08-16 22:46:49 -04:00
Eric Luehrsen
1cccacf359 unbound: log openssl-1.0.2 lacks TLS host verification
ssl_set1_host() is not available without openssl-1.1.0. Unbound can not do
host cert verification. DNS over TLS connects, but hosts are unverified. A
patch for log err is added with a noitce in README.md.
(see: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=658)

Also, squash some minor robustness and TLS usability fixes.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-08-10 02:11:13 -04:00
Eric Luehrsen
8830d72bbd unbound: fix boot time and default run directory
Unbound struggles with boot ifup, so procd triggers changed to push
outside of this noise. Unbound has run in /var/lib/unbound/, so chroot
(jail) protects /etc/, and it can save flash wear. Compiled defaults
reflect this now, so Unbound tools are easier run on the command line.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-08-03 03:27:03 -04:00
Eric Luehrsen
408047628e unbound: add UCI for forward stub and auth zone clauses
With growing interest, DNS over TLS can be setup in Unbounds foward-zone:
clause. A broader UCI solution is added to support forward-, stub-, and
auth- zone clauses in a new 'zone' section. This implentation required
reworking scripts, because they did not scale. 'forward_domain' and
'prefetch_root' options are removed, and superceded by 'zone' section.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-07-29 23:24:09 -04:00
Eric Luehrsen
0d8159f5c1 unbound: add README recipe for DNS/TLS outside of UCI
Unbound UCI so far has limited forward configuration lacking
DNS over TLS connection setup tools. User override files
'unbound_srv.conf' and 'unbound_ext.conf' can implement this.

Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-07-09 01:38:08 -04:00
Eric Luehrsen
21864670fa unbound: limit outside script source to init funciton scope
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-06-26 22:41:00 -04:00
Eric Luehrsen
9493e27e69 unbound: clean up domain periods and unnecessary quotes
Signed-off-by: Eric Luehrsen <ericluehrsen@gmail.com>
2018-06-26 22:41:00 -04:00