pfSense

<?php

/*

 *

 * part of pfSense (https://www.pfsense.org)

 *

 * originally part of m0n0wall (http://m0n0.ch/wall)

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions are met:

 *

 * 1. Redistributions of source code must retain the above copyright notice,

 *    this list of conditions and the following disclaimer.

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this software

 *    must display the following acknowledgment:

 *    "This product includes software developed by the pfSense Project

 *    for use in the pfSense® software distribution. (http://www.pfsense.org/).

 *

 * 4. The names "pfSense" and "pfSense Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    coreteam@pfsense.org.

 *

 * 5. Products derived from this software may not be called "pfSense"

 *    nor may "pfSense" appear in their names without prior written

 *    permission of the Electric Sheep Fencing, LLC.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *

 * "This product includes software developed by the pfSense Project

 * for use in the pfSense software distribution (http://www.pfsense.org/).

 *

 * THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 */

/* include all configuration functions */

require_once("config.inc");

require_once("functions.inc");

require_once("shaper.inc");

	// Configure chroot

	if (!is_dir($g['unbound_chroot_path'])) {

		mkdir($g['unbound_chroot_path']);

		chown($g['unbound_chroot_path'], "unbound");

		chgrp($g['unbound_chroot_path'], "unbound");

	}

		$cfgdir = $g['unbound_chroot_path'] . $cfgsubdir;

		if (!is_dir($cfgdir)) {

			mkdir($cfgdir);

			chown($cfgdir, "unbound");

			chgrp($cfgdir, "unbound");

		}

	}

function unbound_optimization() {

	$optimization_settings = array();

	 * Use 1 to disable threading, if for some reason this sysctl fails.

	 */

	$numprocs = intval(get_single_sysctl('kern.smp.cpus'));

	}

	// Slabs to help reduce lock contention.

	$optimization['rrset_cache_slabs'] = "rrset-cache-slabs: {$optimize_num}";

	$optimization['infra_cache_slabs'] = "infra-cache-slabs: {$optimize_num}";

	$optimization['key_cache_slabs'] = "key-cache-slabs: {$optimize_num}";

	/*

	 * Larger socket buffer for busy servers

	 * Check that it is set to 4MB (by default the OS has it configured to 4MB)

	 */

		foreach ($config['sysctl']['item'] as $tunable) {

			if ($tunable['tunable'] == 'kern.ipc.maxsockbuf') {

					// Limit to 32MB, users might set maxsockbuf very high for other reasons.

	}

	// Safety check in case kern.ipc.maxsockbuf is not available.

	return $optimization;

}

	global $g;

	unbound_generate_config($unboundcfg, $cfgsubdir);

	unbound_remote_control_setup($cfgsubdir);

	do_as_unbound_user("unbound-anchor", $cfgsubdir);

	$cfgdir = "{$g['unbound_chroot_path']}{$cfgsubdir}";

	$rv = 0;

	rmdir_recursive($cfgdir);

	return $rv;

}

	// Configure static Host entries

	// Configure Domain Overrides

	// Configure Unbound access-lists

	file_put_contents("{$g['unbound_chroot_path']}{$cfgsubdir}/unbound.conf", $unboundcfgtxt);

		$unboundcfg = $config['unbound'];

	}

	// Setup optimization

	$optimization = unbound_optimization();

	// Setup DNSSEC support

	// Setup DNS Rebinding

	if (!isset($config['system']['webgui']['nodnsrebindcheck'])) {

		// Private-addresses for DNS Rebinding

		$private_addr = <<<EOF

private-address: 10.0.0.0/8

private-address: 172.16.0.0/12

private-address: fd00::/8

private-address: fe80::/10

EOF;

	// Determine interfaces to run on

	$bindints = "";

		$active_interfaces = explode(",", $unboundcfg['active_interface']);

			$bindints .= "interface: 0.0.0.0\n";

			$bindints .= "interface: ::0\n";

					$intip = get_interface_ip($ubif);

	} else {

		$bindints .= "interface: 0.0.0.0\n";

		$bindints .= "interface: ::0\n";

		$bindints .= "interface-automatic: yes\n";

	// Determine interfaces to run on

	$outgoingints = "";

	}

	// Allow DNS Rebind for forwarded domains

			$private_domains = "# Set private domains in case authoritative name server returns a Private IP address\n";

			$private_domains .= unbound_add_domain_overrides("private");

		}

		$reverse_zones .= unbound_add_domain_overrides("reverse");

	$statistics = unbound_statistics();

		$custom_options_source = explode("\n", base64_decode($unboundcfg['custom_options']));

	// Server configuration variables

	$hide_identity = isset($unboundcfg['hideidentity']) ? "yes" : "no";

	$hide_version = isset($unboundcfg['hideversion']) ? "yes" : "no";

	$harden_dnssec_stripped = isset($unboundcfg['dnssecstripped']) ? "yes" : "no";

	$prefetch = isset($unboundcfg['prefetch']) ? "yes" : "no";

	$prefetch_key = isset($unboundcfg['prefetchkey']) ? "yes" : "no";

	$incoming_num_tcp = isset($unboundcfg['incoming_num_tcp']) ? $unboundcfg['incoming_num_tcp'] : "10";

	$num_queries_per_thread = (!empty($unboundcfg['num_queries_per_thread'])) ? $unboundcfg['num_queries_per_thread'] : "4096";

	$jostle_timeout = (!empty($unboundcfg['jostle_timeout'])) ? $unboundcfg['jostle_timeout'] : "200";

	$cache_max_ttl = (!empty($unboundcfg['cache_max_ttl'])) ? $unboundcfg['cache_max_ttl'] : "86400";

	$cache_min_ttl = (!empty($unboundcfg['cache_min_ttl'])) ? $unboundcfg['cache_min_ttl'] : "0";

	$infra_host_ttl = (!empty($unboundcfg['infra_host_ttl'])) ? $unboundcfg['infra_host_ttl'] : "900";

	$infra_cache_numhosts = (!empty($unboundcfg['infra_cache_numhosts'])) ? $unboundcfg['infra_cache_numhosts'] : "10000";

	$unwanted_reply_threshold = (!empty($unboundcfg['unwanted_reply_threshold'])) ? $unboundcfg['unwanted_reply_threshold'] : "0";

	$verbosity = isset($unboundcfg['log_verbosity']) ? $unboundcfg['log_verbosity'] : 1;

	$use_caps = isset($unboundcfg['use_caps']) ? "yes" : "no";

		if (isset($config['system']['dnsallowoverride'])) {

			$ns = array_unique(get_nameservers());

				if ($nameserver) {

			$ns = array();

		$sys_dnsservers = array_unique(get_dns_servers());

		foreach ($sys_dnsservers as $sys_dnsserver) {

			if ($sys_dnsserver && (!in_array($sys_dnsserver, $ns))) {

				$dnsservers[] = $sys_dnsserver;

		}

		if (!empty($dnsservers)) {

			$forward_conf .=<<<EOD

EOD;

					$forward_conf .= "\tforward-addr: $dnsserver\n";

				}

	$rrset_cache_size = $msg_cache_size * 2;

# Unbound Configuration

##########################

##

# Server configuration

##

server:

username: "unbound"

use-syslog: yes

hide-version: {$hide_version}

do-ip6: yes

do-udp: yes

do-tcp: yes

do-daemonize: yes

module-config: "{$module_config}"

num-queries-per-thread: {$num_queries_per_thread}

jostle-timeout: {$jostle_timeout}

infra-host-ttl: {$infra_host_ttl}

infra-cache-numhosts: {$infra_cache_numhosts}

outgoing-num-tcp: {$outgoing_num_tcp}

incoming-num-tcp: {$incoming_num_tcp}

edns-buffer-size: {$edns_buffer_size}

cache-min-ttl: {$cache_min_ttl}

msg-cache-size: {$msg_cache_size}m

{$optimization['msg_cache_slabs']}

{$optimization['rrset_cache_slabs']}

{$optimization['infra_cache_slabs']}

{$optimization['key_cache_slabs']}

{$anchor_file}

prefetch-key: {$prefetch_key}

{$statistics}

# Interface IP(s) to bind to

# DNS Rebinding

{$private_addr}

{$private_domains}

###

# Remote Control Config

###

EOD;

	control-interface: 127.0.0.1

	control-port: 953

	server-cert-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_server.pem"

	control-key-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_control.key"

	control-cert-file: "{$g['unbound_chroot_path']}{$cfgsubdir}/unbound_control.pem"

		file_put_contents("{$g['unbound_chroot_path']}{$cfgsubdir}/remotecontrol.conf", $remotcfg);

function sync_unbound_service() {

	// Configure our Unbound service

	do_as_unbound_user("unbound-anchor");

	unbound_remote_control_setup();

	unbound_generate_config();

	do_as_unbound_user("start");

	require_once("service-utils.inc");

}

function unbound_acl_id_used($id) {

		foreach ($config['unbound']['acls'] as & $acls) {

			if ($id == $acls['aclid']) {

		}

	}

function unbound_get_next_id() {

// Execute commands as the user unbound

	switch ($cmd) {

			mwexec("/usr/local/sbin/unbound -c {$g['unbound_chroot_path']}/unbound.conf");

			break;

		case "stop":

		case "reload":

		case "unbound-anchor":

				$rootkeycheck = mwexec("/usr/bin/grep 'autotrust trust anchor file' {$root_key_file}", true);

					unlink_if_exists($root_key_file);

			}

			// Only sync the file if this is the real (default) one, not a test one.

			if ($param1 == "") {

				pfSense_fsync($root_key_file);

			}

		case "unbound-control-setup":

		default:

			break;

	$domains = $config['unbound']['domainoverrides'];

	$sorted_domains = msort($domains, "domain");

	$result = array();

	}

	// Domain overrides that have multiple entries need multiple stub-addr: added

	$domain_entries = "";

			$domain_entries .= "domain-insecure: \"$domain\"\n";

			}

	}

		file_put_contents("{$g['unbound_chroot_path']}{$cfgsubdir}/domainoverrides.conf", $domain_entries);

		if (!$added_ptr[$host['ipaddr']]) {

		if ((($host['name'] == "localhost") && ($domain == $config['system']['domain'])) || $always_add_short_names) {

			$zone_data .= "local-data: \"{$host['name']}. {$type} {$host['ipaddr']}\"\n";

		 * local-data record exactly, it cannot have entries "under" the

		 * domain.

		 */

		if ($zone_type == "redirect") {

			$zone_data .= "local-zone: \"{$host['fqdn']}.\" {$zone_type}\n";;

		}

		$zone_data .= "local-data: \"{$host['fqdn']}. {$type} {$host['ipaddr']}\"\n";

	}

	return $zone_data;

}

function unbound_add_host_entries($cfgsubdir = "") {

	global $config, $g;

	$hosts = system_hosts_entries($config['unbound']);

	/* Pass 1: Build domain list and hosts inside domains */

	$hosts_by_domain = array();

	foreach ($hosts as $host) {

		if (!array_key_exists($host['domain'], $hosts_by_domain)) {

			$hosts_by_domain[$host['domain']] = array();

		}

		$hosts_by_domain[$host['domain']][] = $host;

	}

	$added_ptr = array();

	/* Build local zone data */

	// Check if auto add host entries is not set

	$system_domain_local_zone_type = "transparent";

	if (!isset($config['unbound']['disable_auto_added_host_entries'])) {

		// Make sure the config setting is a valid unbound local zone type.  If not use "transparent".

		if (array_key_exists($config['unbound']['system_domain_local_zone_type'], unbound_local_zone_types())) {

			$system_domain_local_zone_type = $config['unbound']['system_domain_local_zone_type'];

		}

	}

	/* Add entries for the system domain before all others */

	if (array_key_exists($config['system']['domain'], $hosts_by_domain)) {

		$unbound_entries .= unbound_generate_zone_data($config['system']['domain'],

					$hosts_by_domain[$config['system']['domain']],

					$added_ptr,

					$system_domain_local_zone_type,

					true);

		/* Unset this so it isn't processed again by the loop below. */

		unset($hosts_by_domain[$config['system']['domain']]);

	}

	/* Build zone data for other domain */

	foreach ($hosts_by_domain as $domain => $hosts) {

		$unbound_entries .= unbound_generate_zone_data($domain,

					$hosts,

					$added_ptr,

					"transparent",

					false,

					isset($config['unbound']['always_add_short_names']));

	// Write out entries

	file_put_contents("{$g['unbound_chroot_path']}{$cfgsubdir}/host_entries.conf", $unbound_entries);

	/* dhcpleases will write to this config file, make sure it exists */

	$cache_dumpfile = "/var/tmp/unbound_cache";

	switch ($action) {

	case "start":

		// Start Unbound

		if ($config['unbound']['enable'] == "on") {

		break;

	case "stop":

	case "reload":