mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add a TLS option for DNS Resolver Domain Overrides. Implements #8431

Browse Source
This commit is contained in:
jim-p 2018-04-04 14:09:05 -04:00
parent 547e51b887
commit f39ba24b36
2 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/etc/inc/unbound.inc
View File

@ -531,12 +531,17 @@ function unbound_add_domain_overrides($pvt_rev="", $cfgsubdir = "") {
$sorted_domains = msort($domains, "domain");
$result = array();
$tls_domains = array();
foreach ($sorted_domains as $domain) {
$domain_key = current($domain);
if (!isset($result[$domain_key])) {
$result[$domain_key] = array();
}
$result[$domain_key][] = $domain['ip'];
/* If any entry for a domain has TLS set, it will be active for all entries. */
if (isset($domain['forward_tls_upstream'])) {
$tls_domains[] = $domain_key;
}
}
// Domain overrides that have multiple entries need multiple stub-addr: added
@ -552,8 +557,18 @@ function unbound_add_domain_overrides($pvt_rev="", $cfgsubdir = "") {
} else {
$domain_entries .= "forward-zone:\n";
$domain_entries .= "\tname: \"$domain\"\n";
$fwdport = "";
/* Enable TLS forwarding for this domain if needed. */
if (in_array($domain, $tls_domains)) {
$domain_entries .= "\tforward-tls-upstream: yes\n";
$fwdport = "@853";
}
foreach ($ips as $ip) {
$domain_entries .= "\tforward-addr: $ip\n";
/* If an IP address already contains a port specification, do not add another. */
if (strstr($ip, '@') !== false) {
$fwdport = "";
}
$domain_entries .= "\tforward-addr: {$ip}{$fwdport}\n";
}
}
}

9
src/usr/local/www/services_unbound_domainoverride_edit.php
View File

@ -45,6 +45,7 @@ if (isset($id) && $a_domainOverrides[$id]) {
$pconfig['domain'] = $a_domainOverrides[$id]['domain'];
$pconfig['ip'] = $a_domainOverrides[$id]['ip'];
$pconfig['descr'] = $a_domainOverrides[$id]['descr'];
$pconfig['forward_tls_upstream'] = isset($a_domainOverrides[$id]['forward_tls_upstream']);
}
if ($_POST['save']) {
@ -87,6 +88,7 @@ if ($_POST['save']) {
$doment['domain'] = $_POST['domain'];
$doment['ip'] = $_POST['ip'];
$doment['descr'] = $_POST['descr'];
$doment['forward_tls_upstream'] = isset($_POST['forward_tls_upstream']);
if (isset($id) && $a_domainOverrides[$id]) {
$a_domainOverrides[$id] = $doment;
@ -130,6 +132,13 @@ $section->addInput(new Form_IpAddress(
))->setHelp('IPv4 or IPv6 address of the authoritative DNS server for this domain. e.g.: 192.168.100.100%1$s' .
'To use a non-default port for communication, append an \'@\' with the port number.', '<br />')->setPattern('[a-zA-Z0-9@.:]+');
$section->addInput(new Form_Checkbox(
'forward_tls_upstream',
'TLS Queries',
'Use SSL/TLS for DNS Queries forwarded to this server',
$pconfig['forward_tls_upstream']
))->setHelp('When set, queries to %1$sall DNS servers for this domain%2$s will be sent using SSL/TLS on the default port of 853.', '<b>', '</b>');
$section->addInput(new Form_Input(
'descr',
'Description',