Changeset 13696 in genesis for tools/gformat.py

Timestamp:

Jan 14, 2017, 12:31:50 AM (8 years ago)

Author:

rick

Message:

Implement named replacement for FreeBSD 11.

Unbound via ports, configured to listen to only specific interfaces.
For security purposes do not listen to outside world.

Depending on it's location, making sure the forwarders are internal
or external.

Note: Dropping support for autoritive nameserver, this feature is not
required anymore since our network is running stable now.

File:

• tools/gformat.py (modified) (6 diffs)

tools/gformat.py

@@ -108 +108 @@
     'ntp.conf',
     'pf.hybrid.conf.local',
+    'unbound.wleiden.conf',
     'wleiden.yaml',
     ]
@@ -729 +730 @@
 
 
-def generate_rc_conf_local(datadump):
-  """ Generate configuration file '/etc/rc.conf.local' """
-  item = datadump['autogen_item']
-  if rc_conf_local_cache.has_key(item):
-    return rc_conf_local_cache[item]
-
-  if not datadump.has_key('ileiden'):
-    datadump['autogen_ileiden_enable'] = False
-  else:
-    datadump['autogen_ileiden_enable'] = datadump['ileiden']
-
-  datadump['autogen_ileiden_enable'] = switchFormat(datadump['autogen_ileiden_enable'])
-
-
-  for i in range(1,50):
-    ileiden_proxies['172.31.254.%i' % i] = {'nodename' : 'unused'}
-
+def create_proxies_list():
   if not ileiden_proxies or not normal_proxies:
+    for i in range(1,50):
+      ileiden_proxies['172.31.254.%i' % i] = {'nodename' : 'unused'}
+
     for host in get_hostlist():
       hostdump = get_yaml(host)
@@ -755 +743 @@
           normal_proxies.append(hostdump)
 
+
+
+def generate_rc_conf_local(datadump):
+  """ Generate configuration file '/etc/rc.conf.local' """
+  item = datadump['autogen_item']
+  if rc_conf_local_cache.has_key(item):
+    return rc_conf_local_cache[item]
+
+  if not datadump.has_key('ileiden'):
+    datadump['autogen_ileiden_enable'] = False
+  else:
+    datadump['autogen_ileiden_enable'] = datadump['ileiden']
+
+  datadump['autogen_ileiden_enable'] = switchFormat(datadump['autogen_ileiden_enable'])
+
+  create_proxies_list()
   datadump['autogen_ileiden_proxies'] = ileiden_proxies
   datadump['autogen_normal_proxies'] = normal_proxies
@@ -878 +882 @@
     dnsmasq_enable="NO"
     named_enable="YES"
+    unbound_enable="YES"
     {% if autogen_dhcp_interfaces -%}
     dhcpd_enable="YES"
@@ -1149 +1154 @@
 rdr on $ext_if inet proto {{ protocol }} from any to $ext_if port {{ src_port }} tag SRV -> {{ dest_ip }} port {{ dest_port }}
 {% endfor -%}
+""").render(datadump)
+
+def generate_unbound_wleiden_conf(datadump):
+  """ Generate configuration file '/usr/local/etc/unbound.wleiden.conf' """
+  datadump['autogen_header'] = generate_header(datadump, "#")
+
+  autogen_ips = []
+  (addrs_list, _, _, dhclient_if, _, extra_ouput) = make_interface_list(datadump)
+  for iface,addrs in sorted(addrs_list.iteritems()):
+    for addr, comment in sorted(addrs,key=lambda x: parseaddr(x[0].split('/')[0])):
+      if addr.startswith('172'):
+        autogen_ips.append((addr.split('/')[0], comment))
+  datadump['autogen_ips'] = autogen_ips
+
+  create_proxies_list()
+  datadump['autogen_ileiden_proxies'] = ileiden_proxies
+  return Template("""\
+{{ autogen_header }}
+
+server:
+{%- for ip,comment in autogen_ips %}
+    interface: {{ "%-16s"|format(ip) }} # {{ comment }}
+{%- endfor %}
+
+forward-zone:
+    name: '.'
+{%- if service_proxy_ileiden %}
+    forward-addr: 8.8.8.8        # Google DNS A
+    forward-addr: 8.8.4.4        # Google DNS B
+    forward-addr: 208.67.222.222 # OpenDNS DNS A
+    forward-addr: 208.67.220.220 # OpenDNS DNS B
+{% else -%}
+{% for serviceid,item in autogen_ileiden_proxies.iteritems() %}
+    forward-addr: {{ "%-16s"|format(serviceid) }} # {{ item.nodename }}
+{%- endfor %}
+{% endif -%}
 """).render(datadump)
 
@@ -1345 +1386 @@
     elif config == 'pf.hybrid.conf.local':
       output += generate_pf_hybrid_conf_local(datadump)
+    elif config == 'unbound.wleiden.conf':
+      output += generate_unbound_wleiden_conf(datadump)
     elif config.startswith('vr'):
       interface, ns_type = config.strip('.yaml').split('-')