pfSense

<?php

/*

	part of pfSense (https://www.pfsense.org)

	All rights reserved.

	originally part of m0n0wall (http://m0n0.ch/wall)

	Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>.

	Redistribution and use in source and binary forms, with or without

	modification, are permitted provided that the following conditions are met:

	1. Redistributions of source code must retain the above copyright notice,

	   this list of conditions and the following disclaimer.

	2. Redistributions in binary form must reproduce the above copyright

	   the documentation and/or other materials provided with the

	   distribution.

	3. All advertising materials mentioning features or use of this software

	   must display the following acknowledgment:

	   "This product includes software developed by the pfSense Project

	   for use in the pfSense® software distribution. (http://www.pfsense.org/).

	4. The names "pfSense" and "pfSense Project" must not be used to

	   endorse or promote products derived from this software without

	   prior written permission. For written permission, please contact

	   coreteam@pfsense.org.

	5. Products derived from this software may not be called "pfSense"

	   nor may "pfSense" appear in their names without prior written

	   permission of the Electric Sheep Fencing, LLC.

	6. Redistributions of any form whatsoever must retain the following

	   acknowledgment:

	"This product includes software developed by the pfSense Project

	for use in the pfSense software distribution (http://www.pfsense.org/).

	THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY

	EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

	IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

	PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR

	ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

	NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

	LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

	HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

	STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

	OF THE POSSIBILITY OF SUCH DAMAGE.

/* include all configuration functions */

require_once("config.inc");

require_once("functions.inc");

require_once("shaper.inc");

	// Configure chroot

	if (!is_dir($g['unbound_chroot_path'])) {

		mkdir($g['unbound_chroot_path']);

		chown($g['unbound_chroot_path'], "unbound");

		chgrp($g['unbound_chroot_path'], "unbound");

	}

		$cfgdir = $g['unbound_chroot_path'] . $cfgsubdir;

		if (!is_dir($cfgdir)) {

			mkdir($cfgdir);

			chown($cfgdir, "unbound");

			chgrp($cfgdir, "unbound");

		}

	}

function unbound_optimization() {

	$optimization_settings = array();

	 * Use 1 to disable threading, if for some reason this sysctl fails.

	 */

	$numprocs = intval(get_single_sysctl('kern.smp.cpus'));

	}

	// Slabs to help reduce lock contention.

	$optimization['rrset_cache_slabs'] = "rrset-cache-slabs: {$optimize_num}";

	$optimization['infra_cache_slabs'] = "infra-cache-slabs: {$optimize_num}";

	$optimization['key_cache_slabs'] = "key-cache-slabs: {$optimize_num}";

	/*

	 * Larger socket buffer for busy servers

	 * Check that it is set to 4MB (by default the OS has it configured to 4MB)

	 */

		foreach ($config['sysctl']['item'] as $tunable) {

			if ($tunable['tunable'] == 'kern.ipc.maxsockbuf') {

					// Limit to 32MB, users might set maxsockbuf very high for other reasons.

	}

	// Safety check in case kern.ipc.maxsockbuf is not available.

	return $optimization;

}

	global $g;

	unbound_generate_config($unboundcfg, $cfgsubdir);

	unbound_remote_control_setup($cfgsubdir);

	do_as_unbound_user("unbound-anchor", $cfgsubdir);

	$cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";

	$rv = 0;

	rmdir_recursive($cfgdir);

	return $rv;

}

	// Configure static Host entries

	// Configure Domain Overrides

	// Configure Unbound access-lists

	file_put_contents("{$g['unbound_chroot_path']}{$cfgsubdir}/unbound.conf", $unboundcfgtxt);

		$unboundcfg = $config['unbound'];

	}

	// Setup optimization

	$optimization = unbound_optimization();

	// Setup DNSSEC support

	// Setup DNS Rebinding

	if (!isset($config['system']['webgui']['nodnsrebindcheck'])) {

		// Private-addresses for DNS Rebinding

		$private_addr = <<<EOF

private-address: 10.0.0.0/8

private-address: 172.16.0.0/12

private-address: fd00::/8

private-address: fe80::/10

EOF;

	// Determine interfaces to run on

	$bindints = "";

		$active_interfaces = explode(",", $unboundcfg['active_interface']);

			$bindints .= "interface: 0.0.0.0\n";

			$bindints .= "interface: ::0\n";

					$intip = get_interface_ip($ubif);

	} else {

		$bindints .= "interface: 0.0.0.0\n";

		$bindints .= "interface: ::0\n";

		$bindints .= "interface-automatic: yes\n";

	// Determine interfaces to run on

	$outgoingints = "";

	}

	// Allow DNS Rebind for forwarded domains

			$private_domains = "# Set private domains in case authoritative name server returns a Private IP address\n";

			$private_domains .= unbound_add_domain_overrides("private");

		}

		$reverse_zones .= unbound_add_domain_overrides("reverse");

	$statistics = unbound_statistics();

		$custom_options_source = explode("\n", base64_decode($unboundcfg['custom_options']));

	// Server configuration variables

	$hide_identity = isset($unboundcfg['hideidentity']) ? "yes" : "no";

	$hide_version = isset($unboundcfg['hideversion']) ? "yes" : "no";

	$harden_dnssec_stripped = isset($unboundcfg['dnssecstripped']) ? "yes" : "no";

	$prefetch = isset($unboundcfg['prefetch']) ? "yes" : "no";

	$prefetch_key = isset($unboundcfg['prefetchkey']) ? "yes" : "no";

	$outgoing_num_tcp = (!empty($unboundcfg['outgoing_num_tcp'])) ? $unboundcfg['outgoing_num_tcp'] : "10";

	$incoming_num_tcp = (!empty($unboundcfg['incoming_num_tcp'])) ? $unboundcfg['incoming_num_tcp'] : "10";

	$edns_buffer_size = (!empty($unboundcfg['edns_buffer_size'])) ? $unboundcfg['edns_buffer_size'] : "4096";

	$num_queries_per_thread = (!empty($unboundcfg['num_queries_per_thread'])) ? $unboundcfg['num_queries_per_thread'] : "4096";

	$jostle_timeout = (!empty($unboundcfg['jostle_timeout'])) ? $unboundcfg['jostle_timeout'] : "200";

	$cache_max_ttl = (!empty($unboundcfg['cache_max_ttl'])) ? $unboundcfg['cache_max_ttl'] : "86400";

	$cache_min_ttl = (!empty($unboundcfg['cache_min_ttl'])) ? $unboundcfg['cache_min_ttl'] : "0";

	$infra_host_ttl = (!empty($unboundcfg['infra_host_ttl'])) ? $unboundcfg['infra_host_ttl'] : "900";

	$infra_cache_numhosts = (!empty($unboundcfg['infra_cache_numhosts'])) ? $unboundcfg['infra_cache_numhosts'] : "10000";

	$unwanted_reply_threshold = (!empty($unboundcfg['unwanted_reply_threshold'])) ? $unboundcfg['unwanted_reply_threshold'] : "0";

	$verbosity = isset($unboundcfg['log_verbosity']) ? $unboundcfg['log_verbosity'] : 1;

	$use_caps = isset($unboundcfg['use_caps']) ? "yes" : "no";

		if (isset($config['system']['dnsallowoverride'])) {

			$ns = array_unique(get_nameservers());

				if ($nameserver) {

			$ns = array();

		$sys_dnsservers = array_unique(get_dns_servers());

		foreach ($sys_dnsservers as $sys_dnsserver) {

			if ($sys_dnsserver && (!in_array($sys_dnsserver, $ns))) {

				$dnsservers[] = $sys_dnsserver;

		}

		if (!empty($dnsservers)) {

			$forward_conf .=<<<EOD

EOD;

	$rrset_cache_size = $msg_cache_size * 2;

# Unbound Configuration

##########################

##

# Server configuration

##

server:

username: "unbound"

use-syslog: yes

hide-version: {$hide_version}

do-ip6: yes

do-udp: yes

do-tcp: yes

do-daemonize: yes

module-config: "{$module_config}"

num-queries-per-thread: {$num_queries_per_thread}

jostle-timeout: {$jostle_timeout}

infra-host-ttl: {$infra_host_ttl}

infra-cache-numhosts: {$infra_cache_numhosts}

outgoing-num-tcp: {$outgoing_num_tcp}

incoming-num-tcp: {$incoming_num_tcp}

edns-buffer-size: {$edns_buffer_size}

cache-min-ttl: {$cache_min_ttl}

msg-cache-size: {$msg_cache_size}m

{$optimization['msg_cache_slabs']}

{$optimization['rrset_cache_slabs']}

{$optimization['infra_cache_slabs']}

{$optimization['key_cache_slabs']}

{$anchor_file}

prefetch-key: {$prefetch_key}

{$statistics}

# Interface IP(s) to bind to

# DNS Rebinding

{$private_addr}

{$private_domains}

###

# Remote Control Config

###

EOD;

	control-interface: 127.0.0.1

	control-port: 953

	server-cert-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_server.pem"

	control-key-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_control.key"

	control-cert-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_control.pem"

		file_put_contents("{$g['unbound_chroot_path']}{$cfgsubdir}/remotecontrol.conf", $remotcfg);

	 * XXX - to convert to an unbound C library which reads /etc/hosts automatically

	 */

	$etc_hosts = array();

	foreach (file('/etc/hosts') as $line) {

		$fqdn = array_shift($d);

		$name = array_shift($d);

		if (!empty($fqdn) && $fqdn != "empty") {

	}

	return $etc_hosts;

function sync_unbound_service() {

	// Configure our Unbound service

	do_as_unbound_user("unbound-anchor");

	unbound_remote_control_setup();

	unbound_generate_config();

	do_as_unbound_user("start");

	require_once("service-utils.inc");

}

function unbound_acl_id_used($id) {

		foreach ($config['unbound']['acls'] as & $acls) {

			if ($id == $acls['aclid']) {

		}

	}

function unbound_get_next_id() {

// Execute commands as the user unbound

	switch ($cmd) {

			mwexec("/usr/local/sbin/unbound -c {$g['unbound_chroot_path']}/unbound.conf");

			break;

		case "stop":

			mwexec("echo '/usr/local/sbin/unbound-control stop' | /usr/bin/su -m unbound", true);

			break;

		case "reload":

			mwexec("echo '/usr/local/sbin/unbound-control reload' | /usr/bin/su -m unbound", true);

			break;

		case "unbound-anchor":

				$rootkeycheck = mwexec("/usr/bin/grep 'autotrust trust anchor file' {$root_key_file}", true);

					unlink_if_exists($root_key_file);

			}

			// Only sync the file if this is the real (default) one, not a test one.

			if ($param1 == "") {

				pfSense_fsync($root_key_file);

			}

		case "unbound-control-setup":

		default:

			break;

	$domains = $config['unbound']['domainoverrides'];

	$sorted_domains = msort($domains, "domain");

	$result = array();

	}

	// Domain overrides that have multiple entries need multiple stub-addr: added

	$domain_entries = "";

			$domain_entries .= "domain-insecure: \"$domain\"\n";

			}

			$domain_entries .= "stub-zone:\n";

			$domain_entries .= "\tname: \"$domain\"\n";

		}

	}

		file_put_contents("{$g['unbound_chroot_path']}{$cfgsubdir}/domainoverrides.conf", $domain_entries);

	if (array_key_exists($config['unbound']['system_domain_local_zone_type'], unbound_local_zone_types())) {

		$system_domain_local_zone_type = "transparent";

	// Write out entries

	file_put_contents("{$g['unbound_chroot_path']}{$cfgsubdir}/host_entries.conf", $unbound_entries);

	/* dhcpleases will write to this config file, make sure it exists */

	$cache_dumpfile = "/var/tmp/unbound_cache";

	switch ($action) {

	case "start":

		// Start Unbound

		if ($config['unbound']['enable'] == "on") {

		break;

	case "stop":

	case "reload":

	case "dump_cache":

		// Dump Unbound's Cache

	case "restore_cache":

		// Restore Unbound's Cache

		if ((is_service_running("unbound")) && ($config['unbound']['dumpcache'] == "on")) {

		break;

	default:

		break;