openwrt / openwrt/packages

unbound: Feature Request UCI Support for specifying the "interface:" option

Open
#20,334 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

release/22.03 stale
Dominant language
Makefile
Stars
4.6k
Forks
4k
Avg merge
3d 12h
Merged PRs (30d)
134

Description

Maintainer: @EricLuehrsen
Environment: OpenWrt 22.03.2 r19803-9a599fee93 / LuCI openwrt-22.03 branch git-22.288.45147-96ec0cd

Description:

Hello, I am looking to add a feature request to the unbound UCI option to allow forward the "interface:" option through the UCI.

I know there is currently a an iface_lan option in UCI that supports specifying a physical interface to unbound and that gets mapped into the UB_LIST_NEW_LAN variable.
The iface_lan option copies the ip subnet of the physical interface and stores it into the UB_LIST_NEW_LAN variable.

So for example if there was a bridge interface of "br-lan" with ip network address of 192.168.1.1/24

10: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether c0:56:27:68:17:47 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fe80::c256:27ff:fe68:1747/64 scope link 
       valid_lft forever preferred_lft forever

It gets mapped into the UB_LIST_NEW_LAN variable with the value of "192.168.1.1/24"

The $UB_LIST_NEW_LAN variable then gets transformed into an unbound "access-control:" option which is based on the IP netblock here in unbound.sh.

That ultimately results in the following option being written to the generated unbound.conf in the example above.

access-control: 192.168.1.1/24 allow

The feature I am looking for is to support forwarding the physical interface directly as the interface: option to unbound.
i.e

interface: br-lan

This would allow interface-* based tag and view options to be used within the unbound_srv.conf file, as unbound requires that there is previous "interface:" option in order to use the tag and view options
Here is the documentation for the interface-view option.

It would be useful if it was possible in the UCI file to be able to specify the "interface: similar to the following

list interface "br-lan"
list interface "wan"
list interface "lo"
Additional Information

The unbound "interface-auto:" cannot be used for the "interface-*: options as that option causes the use of the "interface:" option to be ignored per this issue in the unbound github: https://github.com/NLnetLabs/unbound/issues/433#issuecomment-783962175

Workaround

There is an simple workaround involved by just adding the interface: option directly to the unbound_srv.conf file and disabling the interface_auto in UCI by setting it to 0

Side Note

The motivation for this feature request is me looking to use the interface-view option to perform interface base filtering using unbound on an interface such as "br-lan" instead of IP netblock based filtering on ranges such as "192.168.1.0/24"

I currently have to add a configuration like the following to the unbound_srv.conf to fit my use case

interface: br-lan
interface: open-lan
interface: lo
# Allow listening on localhost
do-not-query-localhost: no

interface-view: br-lan adblock-view

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with net/unbound/files/unbound.uci and net/unbound/files/unbound.sh, especially the existing iface_lan, interface_auto, and generated configuration handling referenced in the issue. Trace how UCI options become unbound.conf directives; done means listed interfaces produce interface: entries while preserving the existing interface_auto behavior and enabling interface-view use.

Written by the indexing model from the issue text.

Assessment

Domain
networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.