unbound_insecure can disable DNSSEC for all domains processed.
[openresolv] / unbound.in
1 #!/bin/sh
2 # Copyright (c) 2009-2011 Roy Marples
3 # All rights reserved
4
5 # unbound subscriber for resolvconf
6
7 # Redistribution and use in source and binary forms, with or without
8 # modification, are permitted provided that the following conditions
9 # are met:
10 #     * Redistributions of source code must retain the above copyright
11 #       notice, this list of conditions and the following disclaimer.
12 #     * Redistributions in binary form must reproduce the above
13 #       copyright notice, this list of conditions and the following
14 #       disclaimer in the documentation and/or other materials provided
15 #       with the distribution.
16 #
17 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18 # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19 # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
20 # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
21 # OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
22 # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
23 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
27 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28
29 unbound_insecure=
30
31 [ -f "@SYSCONFDIR@"/resolvconf.conf ] || exit 0
32 . "@SYSCONFDIR@/resolvconf.conf" || exit 1
33 [ -z "$unbound_conf" ] && exit 0
34 [ -z "$RESOLVCONF" ] && eval "$(@SBINDIR@/resolvconf -v)"
35 NL="
36 "
37
38 : ${unbound_pid:=/var/run/unbound.pid}
39 : ${unbound_service:=unbound}
40 : ${unbound_restart:=@RESTARTCMD ${unbound_service}@}
41 newconf="# Generated by resolvconf$NL"
42
43 for d in $DOMAINS; do
44         dn="${d%%:*}"
45         ns="${d#*:}"
46         if [ -n "$unbound_insecure" ]; then
47                 newconf="$newconf${NL}domain-insecure: \"$dn\""
48         fi
49         newconf="$newconf${NL}forward-zone:$NL  name: \"$dn\"$NL"
50         while [ -n "$ns" ]; do
51                 newconf="$newconf       forward-addr: ${ns%%,*}$NL"
52                 [ "$ns" = "${ns#*,}" ] && break
53                 ns="${ns#*,}"
54         done
55 done
56
57 if [ -n "$NAMESERVERS" ]; then
58         newconf="$newconf${NL}forward-zone:$NL  name: \".\"$NL"
59         for n in $NAMESERVERS; do
60                 newconf="$newconf       forward-addr: $n$NL"
61         done
62 fi
63
64 # Try to ensure that config dirs exist
65 if type config_mkdirs >/dev/null 2>&1; then
66         config_mkdirs "$unbound_conf"
67 else
68         @SBINDIR@/resolvconf -D "$unbound_conf"
69 fi
70
71 if [ ! -f "$unbound_conf" ] || \
72         [ "$(cat "$unbound_conf")" != "$(printf %s "$newconf")" ]
73 then
74         printf %s "$newconf" >"$unbound_conf"
75         # If we can't sent a HUP then force a restart
76         if [ -s "$unbound_pid" ]; then
77                 if ! kill -HUP $(cat "$unbound_pid") 2>/dev/null; then
78                         eval $unbound_restart
79                 fi
80         else
81                 eval $unbound_restart
82         fi
83 fi