unbound.in

#!/bin/sh
# Copyright (c) 2009-2023 Roy Marples
# All rights reserved

# unbound subscriber for resolvconf

# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#     * Redistributions of source code must retain the above copyright
#       notice, this list of conditions and the following disclaimer.
#     * Redistributions in binary form must reproduce the above
#       copyright notice, this list of conditions and the following
#       disclaimer in the documentation and/or other materials provided
#       with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

unbound_insecure=
unbound_private=

[ -f "@SYSCONFDIR@"/resolvconf.conf ] || exit 0
. "@SYSCONFDIR@/resolvconf.conf" || exit 1
[ -z "$unbound_conf" ] && exit 0
[ -z "$RESOLVCONF" ] && eval "$(@SBINDIR@/resolvconf -v)"
NL="
"

: ${unbound_pid:=/var/run/unbound.pid}
: ${unbound_service:=unbound}
newconf="# Generated by resolvconf$NL"

for d in $DOMAINS; do
	dn="${d%%:*}"
	ns="${d#*:}"
	create_unbound_insecure=false
	create_unbound_private=false
	case "$unbound_insecure" in
	[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]|[Oo][Nn]|1)
		create_unbound_insecure=true ;;
	esac
	case "$unbound_private" in
	[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]|[Oo][Nn]|1)
		create_unbound_private=true ;;
	esac
	if $create_unbound_insecure || $create_unbound_private; then
		newconf="$newconf${NL}server:$NL"
		if $create_unbound_insecure; then
			newconf="$newconf	domain-insecure: \"$dn\"$NL"
		fi
		if $create_unbound_private; then
			newconf="$newconf	private-domain: \"$dn\"$NL"
		fi
	fi
	newconf="$newconf${NL}forward-zone:$NL	name: \"$dn\"$NL"
	if [ -n "$unbound_forward_zone_options" ]; then
		newconf="$newconf	$unbound_forward_zone_options${NL}"
	fi
	while [ -n "$ns" ]; do
		newconf="$newconf	forward-addr: ${ns%%,*}$NL"
		[ "$ns" = "${ns#*,}" ] && break
		ns="${ns#*,}"
	done
done

if [ -n "$NAMESERVERS" ]; then
	newconf="$newconf${NL}forward-zone:$NL	name: \".\"$NL"
	if [ -n "$unbound_forward_zone_options" ]; then
		newconf="$newconf	$unbound_forward_zone_options${NL}"
	fi
	for n in $NAMESERVERS; do
		newconf="$newconf	forward-addr: $n$NL"
	done
fi

# Try to ensure that config dirs exist
if command -v config_mkdirs >/dev/null 2>&1; then
	config_mkdirs "$unbound_conf"
else
	@SBINDIR@/resolvconf -D "$unbound_conf"
fi

restart_unbound()
{
	if [ -n "$unbound_restart" ]; then
		eval $unbound_restart
	elif [ -n "$RESTARTCMD" ]; then
		set -- ${unbound_service}
		eval "$RESTARTCMD"
	else
		@SBINDIR@/resolvconf -r ${unbound_service}
	fi
}

if [ ! -f "$unbound_conf" ] || \
	[ "$(cat "$unbound_conf")" != "$(printf %s "$newconf")" ]
then
	printf %s "$newconf" >"$unbound_conf"
	# If we can't sent a HUP then force a restart
	if [ -s "$unbound_pid" ]; then
		if ! kill -HUP $(cat "$unbound_pid") 2>/dev/null; then
			restart_unbound
		fi
	else
		restart_unbound
	fi
fi