Feature #16444 » granular-serve-expire-unbound-pfsense.patch
| /etc/inc/unbound.inc 2025-09-21 20:35:22.638223000 +0100 | ||
|---|---|---|
|
$harden_dnssec_stripped = isset($unboundcfg['dnssecstripped']) ? "yes" : "no";
|
||
|
$prefetch = isset($unboundcfg['prefetch']) ? "yes" : "no";
|
||
|
$prefetch_key = isset($unboundcfg['prefetchkey']) ? "yes" : "no";
|
||
|
$dns_record_cache = isset($unboundcfg['dnsrecordcache']) ? "yes" : "no";
|
||
|
if (is_null($unboundcfg['dnsrecordcache']) || ($unboundcfg['dnsrecordcache'] == '0')) {
|
||
|
$dns_record_cache = "no";
|
||
|
} else {
|
||
|
$dns_record_cache = "yes";
|
||
|
}
|
||
|
if ($unboundcfg['dnsrecordcache'] == '1') {
|
||
|
$dns_record_cache_ttl = "serve-expired-client-timeout: 0";
|
||
|
}
|
||
|
$sock_queue_timeout = empty($unboundcfg['sock_queue_timeout']) ? '0' : $unboundcfg['sock_queue_timeout'];
|
||
|
$aggressivensec = isset($unboundcfg['aggressivensec']) ? "yes" : "no";
|
||
|
$outgoing_num_tcp = isset($unboundcfg['outgoing_num_tcp']) ? $unboundcfg['outgoing_num_tcp'] : "10";
|
||
| ... | ... | |
|
prefetch-key: {$prefetch_key}
|
||
|
use-caps-for-id: {$use_caps}
|
||
|
serve-expired: {$dns_record_cache}
|
||
|
{$dns_record_cache_ttl}
|
||
|
# Not supported on FreeBSD. See https://redmine.pfsense.org/issues/16299
|
||
|
# sock-queue-timeout: {$sock_queue_timeout}
|
||
|
aggressive-nsec: {$aggressivensec}
|
||
|
-- /usr/local/www/services_unbound_advanced.php 2025-09-21 19:05:38.754169000 +0100
|
||
|
++ /usr/local/www/services_unbound_advanced.php 2025-09-21 20:43:39.841217000 +0100
|
||
| ... | ... | |
|
$pconfig['prefetch'] = config_path_enabled('unbound', 'prefetch');
|
||
|
$pconfig['prefetchkey'] = config_path_enabled('unbound', 'prefetchkey');
|
||
|
$pconfig['dnssecstripped'] = config_path_enabled('unbound', 'dnssecstripped');
|
||
|
$pconfig['dnsrecordcache'] = config_path_enabled('unbound', 'dnsrecordcache');
|
||
|
$pconfig['dnsrecordcache'] = config_get_path('unbound/dnsrecordcache', 0);
|
||
|
$pconfig['sock_queue_timeout'] = config_get_path('unbound/sock_queue_timeout', 0);
|
||
|
$pconfig['aggressivensec'] = config_path_enabled('unbound', 'aggressivensec');
|
||
|
|
||
| ... | ... | |
|
} else {
|
||
|
config_del_path('unbound/dnssecstripped');
|
||
|
}
|
||
|
if (isset($_POST['dnsrecordcache'])) {
|
||
|
config_set_path('unbound/dnsrecordcache', true);
|
||
|
} else {
|
||
|
config_del_path('unbound/dnsrecordcache');
|
||
|
}
|
||
|
config_set_path('unbound/dnsrecordcache', $_POST['dnsrecordcache']);
|
||
|
config_set_path('unbound/sock_queue_timeout', $_POST['sock_queue_timeout']);
|
||
|
if (isset($_POST['aggressivensec'])) {
|
||
|
config_set_path('unbound/aggressivensec', true);
|
||
| ... | ... | |
|
$pconfig['dnssecstripped']
|
||
|
))->setHelp('If such data is absent, the zone becomes bogus. If Disabled and no DNSSEC data is received, then the zone is made insecure. Requires DNSSEC enabled. ');
|
||
|
|
||
|
$section->addInput(new Form_Checkbox(
|
||
|
$section->addInput(new Form_Select(
|
||
|
'dnsrecordcache',
|
||
|
'Serve Expired',
|
||
|
'Serve cache records even with TTL of 0',
|
||
|
$pconfig['dnsrecordcache']
|
||
|
))->setHelp('When enabled, allows unbound to serve one query even with a TTL of 0, if TTL is 0 then new record will be requested in the background when the cache is served to ensure cache is updated without latency on service of the DNS request.');
|
||
|
$pconfig['dnsrecordcache'],
|
||
|
array_combine(array("0", "1", "2"), array("Off: Unbound Default", "Serve Expired/Stale - Old behaviour", "Serve Stale - RFC8767"))
|
||
|
))->setHelp('When enabled, allows unbound cache to serve one query even with a TTL of 0, if TTL is 0 then new record will be requested in the background when the cache is served to ensure cache is updated without latency on service of the DNS request.');
|
||
|
|
||
|
/* Not supported on FreeBSD. See https://redmine.pfsense.org/issues/16299
|
||
|
$section->addInput(new Form_Input(
|
||
