From d2ec584453eb7491e1453d9d95731d30fe52cc97 Mon Sep 17 00:00:00 2001 From: stilez Date: Fri, 1 Dec 2017 11:46:39 +0000 Subject: [PATCH 1/3] Unbound: Disable IPv6 outgoing queries if IPv6 blocked in firewall, as they can never go anywhere If IPv6 is disallowed in system->advanced->network, then any IPv6 lookups by Unbound will always be blocked, so there's no point sending them. The practical purpose is that they also clog up the log and may fractionally slow down the resolver because the resolver then has to deal with IPv6 not replying, fallback lookups, etc. I'm aware that we state that the system setting doesn't affect any service, but in this case the service simply doesn't send packets that we know will be blocked anyway on egress, so it's probably not going to be an issue. If it is, we can add an explicit "Disable IPv6" setting to this and other functions, but then if IPv6 is later used, the user has to remember to unset "IPv6 not allowed" in all the pages they were set, which is a pain and pretty much duplicates the main setting for all practical purposes. --- src/etc/inc/unbound.inc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/etc/inc/unbound.inc b/src/etc/inc/unbound.inc index 2effa40149..d6f1c654ef 100644 --- a/src/etc/inc/unbound.inc +++ b/src/etc/inc/unbound.inc @@ -246,6 +246,7 @@ EOF; $port = (is_port($unboundcfg['port'])) ? $unboundcfg['port'] : "53"; $hide_identity = isset($unboundcfg['hideidentity']) ? "yes" : "no"; $hide_version = isset($unboundcfg['hideversion']) ? "yes" : "no"; + $ipv6_allow = ($config['system']['ipv6allow'] ? "yes" : "no"; $harden_dnssec_stripped = isset($unboundcfg['dnssecstripped']) ? "yes" : "no"; $prefetch = isset($unboundcfg['prefetch']) ? "yes" : "no"; $prefetch_key = isset($unboundcfg['prefetchkey']) ? "yes" : "no"; @@ -337,7 +338,7 @@ hide-identity: {$hide_identity} hide-version: {$hide_version} harden-glue: yes do-ip4: yes -do-ip6: yes +do-ip6: {$ipv6_allow} do-udp: yes do-tcp: yes do-daemonize: yes From d30fa3637d277fcc127c8f8256f922cb0fdbbc38 Mon Sep 17 00:00:00 2001 From: stilez Date: Fri, 1 Dec 2017 11:48:52 +0000 Subject: [PATCH 2/3] typo --- src/etc/inc/unbound.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/etc/inc/unbound.inc b/src/etc/inc/unbound.inc index d6f1c654ef..a6d29c7ee0 100644 --- a/src/etc/inc/unbound.inc +++ b/src/etc/inc/unbound.inc @@ -246,7 +246,7 @@ EOF; $port = (is_port($unboundcfg['port'])) ? $unboundcfg['port'] : "53"; $hide_identity = isset($unboundcfg['hideidentity']) ? "yes" : "no"; $hide_version = isset($unboundcfg['hideversion']) ? "yes" : "no"; - $ipv6_allow = ($config['system']['ipv6allow'] ? "yes" : "no"; + $ipv6_allow = $config['system']['ipv6allow'] ? "yes" : "no"; $harden_dnssec_stripped = isset($unboundcfg['dnssecstripped']) ? "yes" : "no"; $prefetch = isset($unboundcfg['prefetch']) ? "yes" : "no"; $prefetch_key = isset($unboundcfg['prefetchkey']) ? "yes" : "no"; From deb575abbfcc621fd9dba90b3e513a1a6aca6ce6 Mon Sep 17 00:00:00 2001 From: stilez Date: Fri, 1 Dec 2017 11:50:38 +0000 Subject: [PATCH 3/3] Add isset, other vars seem to use it Doesn't seem to have a point though :) --- src/etc/inc/unbound.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/etc/inc/unbound.inc b/src/etc/inc/unbound.inc index a6d29c7ee0..96cc9ebd2d 100644 --- a/src/etc/inc/unbound.inc +++ b/src/etc/inc/unbound.inc @@ -246,7 +246,7 @@ EOF; $port = (is_port($unboundcfg['port'])) ? $unboundcfg['port'] : "53"; $hide_identity = isset($unboundcfg['hideidentity']) ? "yes" : "no"; $hide_version = isset($unboundcfg['hideversion']) ? "yes" : "no"; - $ipv6_allow = $config['system']['ipv6allow'] ? "yes" : "no"; + $ipv6_allow = isset($config['system']['ipv6allow']) ? "yes" : "no"; $harden_dnssec_stripped = isset($unboundcfg['dnssecstripped']) ? "yes" : "no"; $prefetch = isset($unboundcfg['prefetch']) ? "yes" : "no"; $prefetch_key = isset($unboundcfg['prefetchkey']) ? "yes" : "no";