pfSense

<?php

/*

 * Copyright (c) 2013-2016 Electric Sheep Fencing

 * All rights reserved.

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

##|+PRIV

##|*MATCH=services_unbound.php*

require_once("guiconfig.inc");

require_once("unbound.inc");

init_config_arr(array('unbound', 'domainoverrides'));

$a_unboundcfg = &$config['unbound'];

$a_hosts = &$a_unboundcfg['hosts'];

	$pconfig['enablessl'] = true;

}

	$pconfig['python'] = true;

}

	$pconfig['forward_tls_upstream'] = true;

}

	$pconfig['regovpnclients'] = true;

}

$pconfig['python_script'] = $a_unboundcfg['python_script'];

$pconfig['sslcertref'] = $a_unboundcfg['sslcertref'];

	$pconfig['system_domain_local_zone_type'] = "transparent";

} else {

	$pconfig['system_domain_local_zone_type'] = $a_unboundcfg['system_domain_local_zone_type'];

}

$a_cert = &$config['cert'];

if (is_array($a_cert) && count($a_cert)) {

	$certs_available = true;

} else {

	$a_cert = array();

}

if ($_POST['apply']) {

	$retval = 0;

	$retval |= services_unbound_configure();

	if ($retval == 0) {

		clear_subsystem_dirty('unbound');

	}

	/* Update resolv.conf in case the interface bindings exclude localhost. */

	system_resolvconf_generate();

	/* Start or restart dhcpleases when it's necessary */

	system_dhcpleases_configure();

}

if ($_POST['save']) {

	$pconfig = $_POST;

	unset($input_errors);

	if (isset($pconfig['enable']) && isset($config['dnsmasq']['enable'])) {

		if ($pconfig['port'] == $config['dnsmasq']['port']) {

			$input_errors[] = gettext("The DNS Forwarder is enabled using this port. Choose a non-conflicting port, or disable the DNS Forwarder.");

		$input_errors[] = gettext("Acting as an SSL/TLS server requires a valid server certificate");

	}

	if (isset($pconfig['forwarding'])) {

		$founddns = false;

		if (isset($config['system']['dnsallowoverride'])) {

			$dns_servers = get_dns_servers();

			if (is_array($dns_servers)) {

				foreach ($dns_servers as $dns_server) {

					if (!ip_in_subnet($dns_server, "127.0.0.0/8")) {

					}

				}

			}

		if (is_array($config['system']['dnsserver'])) {

			foreach ($config['system']['dnsserver'] as $dnsserver) {

				if (is_ipaddr($dnsserver)) {

					$founddns = true;

				}

		}

			$input_errors[] = gettext("At least one DNS server must be specified under System > General Setup to enable Forwarding mode.");

		$input_errors[] = gettext("One or more Network Interfaces must be selected for binding.");

	} else if (!isset($config['system']['dnslocalhost']) && (!in_array("lo0", $pconfig['active_interface']) && !in_array("all", $pconfig['active_interface']))) {

		$input_errors[] = gettext("This system is configured to use the DNS Resolver as its DNS server, so Localhost or All must be selected in Network Interfaces.");

	}

		$input_errors[] = gettext("One or more Outgoing Network Interfaces must be selected.");

	}

		$input_errors[] = gettext("A valid port number must be specified.");

	}

		$input_errors[] = gettext("A valid SSL/TLS port number must be specified.");

	}

		$display_active_interface = $pconfig['active_interface'];

		$pconfig['active_interface'] = implode(",", $pconfig['active_interface']);

	}

		$input_errors[] = gettext("DHCP Server must be enabled for DHCP Registration to work in DNS Resolver.");

	}

		$input_errors[] = gettext('A System Domain Local Zone Type of "redirect" is not compatible with dynamic DHCP Registration.');

	}

	$pconfig['custom_options'] = base64_encode(str_replace("\r\n", "\n", $pconfig['custom_options']));

		$display_outgoing_interface = $pconfig['outgoing_interface'];

		$pconfig['outgoing_interface'] = implode(",", $pconfig['outgoing_interface']);

	}

	if (test_unbound_config($pconfig, $test_output)) {

		$input_errors[] = gettext("The generated config file cannot be parsed by unbound. Please correct the following errors:");

		$input_errors = array_merge($input_errors, $test_output);

	}

		$a_unboundcfg['enable'] = isset($pconfig['enable']);

		$a_unboundcfg['sslcertref'] = $pconfig['sslcertref'];

		$a_unboundcfg['python'] = isset($pconfig['python']);

		if (isset($pconfig['python'])) {

			$a_unboundcfg['python_order'] = $pconfig['python_order'];

			$a_unboundcfg['python_script'] = $pconfig['python_script'];

		} else {

			if (isset($a_unboundcfg['python_order'])) {

				unset($a_unboundcfg['python_order']);

			}

			if (isset($a_unboundcfg['python_script'])) {

				unset($a_unboundcfg['python_script']);

			}

		}

		$a_unboundcfg['regdhcpstatic'] = isset($pconfig['regdhcpstatic']);

		$a_unboundcfg['outgoing_interface'] = $pconfig['outgoing_interface'];

		$a_unboundcfg['system_domain_local_zone_type'] = $pconfig['system_domain_local_zone_type'];

		$a_unboundcfg['custom_options'] = $pconfig['custom_options'];

		write_config(gettext("DNS Resolver configured."));

		mark_subsystem_dirty('unbound');

	$pconfig['active_interface'] = $display_active_interface;

	$pconfig['outgoing_interface'] = $display_outgoing_interface;

	$pconfig['custom_options'] = $display_custom_options;

	$customoptions = true;

} else {

	$customoptions = false;

}

	if ($_POST['type'] == 'host') {

		if ($a_hosts[$_POST['id']]) {

			unset($a_hosts[$_POST['id']]);

			header("Location: services_unbound.php");

			exit;

		}

		if ($a_domainOverrides[$_POST['id']]) {

			unset($a_domainOverrides[$_POST['id']]);

			header("Location: services_unbound.php");

			exit;

		}

	}

	$iflist = array('options' => array(), 'selected' => array());

	foreach ($interface_addresses as $laddr => $ldescr) {

		$iflist['options'][$laddr] = htmlspecialchars($ldescr);

	unset($interface_addresses);

	return($iflist);

}

	print_apply_result_box($retval);

$tab_array[] = array(gettext("Advanced Settings"), false, "services_unbound_advanced.php");

display_top_tabs($tab_array, true);

$form = new Form();

$section = new Form_Section('General DNS Resolver Options');

$section->addInput(new Form_Checkbox(

	'enable',

	'Enable',

	'Enable DNS resolver',

	$pconfig['enable']

));

$section->addInput(new Form_Input(

	'port',

	'Listen Port',

	['placeholder' => '53']

	'enablessl',

	'Enable SSL/TLS Service',

	'Respond to incoming SSL/TLS queries from local clients',

	$pconfig['enablessl']

))->setHelp('Configures the DNS Resolver to act as a DNS over SSL/TLS server which can answer queries from clients which also support DNS over TLS. ' .

		'Activating this option disables automatic interface response routing behavior, thus it works best with specific interface bindings.' );

if ($certs_available) {

	$section->addInput($input = new Form_Select(

		'sslcertref',

		'SSL/TLS Certificate',

		$pconfig['sslcertref'],

} else {

	$section->addInput(new Form_StaticText(

		'SSL/TLS Certificate',

		sprintf('No Certificates have been defined. A certificate is required before SSL/TLS can be enabled. %1$s Create or Import %2$s a Certificate.',

		'<a href="system_certmanager.php">', '</a>')

	));

}

$section->addInput(new Form_Input(

	'sslport',

	'SSL/TLS Listen Port',

	'number',

	$pconfig['sslport'],

	['placeholder' => '853']

))->setHelp('The port used for responding to SSL/TLS DNS queries. It should normally be left blank unless another service needs to bind to TCP/UDP port 853.');

$section->addInput(new Form_Select(

	'active_interface',

	$activeiflist['options'],

	'outgoing_interface',

	$outiflist['options'],

	'system_domain_local_zone_type',

	'dnssec',

	'DNSSEC',

	'Enable DNSSEC Support',

	$pconfig['dnssec']

));

	'python',

	'Python Module',

	'Enable Python Module',

	$pconfig['python']

))->setHelp('Enable the Python Module.');

$python_files = glob("{$g['unbound_chroot_path']}/*.py");

$python_scripts = array();

if (!empty($python_files)) {

	foreach ($python_files as $file) {

		$file = pathinfo($file, PATHINFO_FILENAME);

		$python_scripts[$file] = $file;

	}

}

else {

	$python_scripts = array('' => 'No Python Module scripts found');

}

$section->addInput(new Form_Select(

	'python_order',

	'Python Module Order',

	$pconfig['python_order'],

	[ 'pre_validator' => 'Pre Validator', 'post_validator' => 'Post Validator' ]

))->setHelp('Select the Python Module ordering.');

$section->addInput(new Form_Select(

	'python_script',

	'Python Module Script',

	$pconfig['python_script'],

	$python_scripts

))->setHelp('Select the Python module script to utilize.');

	'forwarding',

	'DNS Query Forwarding',

	'Enable Forwarding Mode',

	$pconfig['forwarding']

	'forward_tls_upstream',

	null,

))->setHelp('When set in conjunction with DNS Query Forwarding, queries to all upstream forwarding DNS servers will be sent using SSL/TLS on the default port of 853. Note that ALL configured forwarding servers MUST support SSL/TLS queries on port 853.');

	'regdhcp',

	'DHCP Registration',

	'Register DHCP leases in the DNS Resolver',

	$pconfig['regdhcp']

$section->addInput(new Form_Checkbox(

	'regdhcpstatic',

	'Static DHCP',

	'Register DHCP static mappings in the DNS Resolver',

	$pconfig['regdhcpstatic']

					'The domain in %1$sSystem &gt; General Setup%2$s should also be set to the proper value.','<a href="system.php">','</a>');

	'regovpnclients',

	'OpenVPN Clients',

	'Register connected OpenVPN clients in the DNS Resolver',

	$pconfig['regovpnclients']

	'btnadvcustom',

	'fa-cog'

$section->addInput(new Form_StaticText(

	$btnadv

	'Custom options',

	$pconfig['custom_options']

$form->add($section);

print($form);

?>

	var showadvcustom = false;

	function show_advcustom(ispageload) {

		var text;

		// On page load decide the initial state based on the data.

		if (ispageload) {

			// It was a click, swap the state.

			showadvcustom = !showadvcustom;

		}

		hideInput('custom_options', !showadvcustom);

		if (showadvcustom) {

			text = "<?=gettext('Hide Custom Options');?>";

		} else {

			text = "<?=gettext('Display Custom Options');?>";

		}

		$('#btnadvcustom').html('<i class="fa fa-cog"></i> ' + text);

	}

	function hideGeneral() {

		hideInput('port', hide);

		hideSelect('system_domain_local_zone_type', hide);

		hideCheckbox('dnssec', hide);

		hideCheckbox('forwarding', hide);

		hideCheckbox('regdhcp', hide);

		hideCheckbox('regdhcpstatic', hide);

		hideInput('custom_options', hide || !showadvcustom);

	$('#btnadvcustom').click(function(event) {

		show_advcustom();

	// On initial load

	}

	function show_python_script() {

		var python = $('#python').prop('checked');

		hideInput('python_order', !python);

		hideInput('python_script', !python);

	}

	show_python_script();

	$('#python').click(function () {

		show_python_script();

	});

//]]>

</script>

<div class="panel panel-default">

			<tbody>

<?php

$i = 0;

foreach ($a_hosts as $hostent):

?>

					<td>

					<td>

					<td>

						<?=htmlspecialchars($hostent['descr'])?>

					</td>

					<td>

<?php

	if ($hostent['aliases']['item'] && is_array($hostent['aliases']['item'])):

		foreach ($hostent['aliases']['item'] as $alias):

?>

					<td>

					<td>

					<td>

					</td>

					<td>

		endforeach;

	endif;

	$i++;

endforeach;

?>

			</tbody>

		</table>

	</div>

</div>

	Enter any individual hosts for which the resolver's standard DNS lookup process should be overridden and a specific

	can be entered, such as 'test', 'mycompany.localdomain', '1.168.192.in-addr.arpa', or 'somesite.com'. Any lookup attempt for

	the host will automatically return the given IP address, and the usual lookup server for the domain will not be queried for

	</a>

<div class="panel panel-default">