From fe4b0a4801c35af316c643bebf51a6841e6e61b5 Mon Sep 17 00:00:00 2001 From: Franz Pletz Date: Sun, 7 Feb 2016 18:40:15 +0100 Subject: [PATCH 1/5] unbound service: retab --- nixos/modules/services/networking/unbound.nix | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index 73b10c1d5611..677cc2ce0c3a 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -38,28 +38,28 @@ in services.unbound = { enable = mkOption { - default = false; - description = "Whether to enable the Unbound domain name server."; + default = false; + description = "Whether to enable the Unbound domain name server."; }; allowedAccess = mkOption { - default = ["127.0.0.0/24"]; - description = "What networks are allowed to use unbound as a resolver."; + default = ["127.0.0.0/24"]; + description = "What networks are allowed to use unbound as a resolver."; }; interfaces = mkOption { - default = [ "127.0.0.1" "::1" ]; - description = "What addresses the server should listen on."; + default = [ "127.0.0.1" "::1" ]; + description = "What addresses the server should listen on."; }; forwardAddresses = mkOption { - default = [ ]; - description = "What servers to forward queries to."; + default = [ ]; + description = "What servers to forward queries to."; }; extraConfig = mkOption { - default = ""; - description = "Extra lines of unbound config."; + default = ""; + description = "Extra lines of unbound config."; }; }; @@ -88,9 +88,9 @@ in preStart = '' mkdir -m 0755 -p ${stateDir}/dev/ - cp ${confFile} ${stateDir}/unbound.conf - chown unbound ${stateDir} - touch ${stateDir}/dev/random + cp ${confFile} ${stateDir}/unbound.conf + chown unbound ${stateDir} + touch ${stateDir}/dev/random ${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random ''; From 9ba533ee4a68db8afda83b6f6584424c1aee8b76 Mon Sep 17 00:00:00 2001 From: Franz Pletz Date: Mon, 15 Feb 2016 03:37:45 +0100 Subject: [PATCH 2/5] unbound service: add types to options --- nixos/modules/services/networking/unbound.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index 677cc2ce0c3a..bad0d2d4e858 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -39,26 +39,31 @@ in enable = mkOption { default = false; + type = types.bool; description = "Whether to enable the Unbound domain name server."; }; allowedAccess = mkOption { default = ["127.0.0.0/24"]; + type = types.listOf types.str; description = "What networks are allowed to use unbound as a resolver."; }; interfaces = mkOption { default = [ "127.0.0.1" "::1" ]; + type = types.listOf types.str; description = "What addresses the server should listen on."; }; forwardAddresses = mkOption { default = [ ]; + type = types.listOf types.str; description = "What servers to forward queries to."; }; extraConfig = mkOption { default = ""; + type = types.str; description = "Extra lines of unbound config."; }; From 483e78d0f078d9449f892058b914a864d80d09f8 Mon Sep 17 00:00:00 2001 From: Franz Pletz Date: Mon, 15 Feb 2016 03:35:25 +0100 Subject: [PATCH 3/5] unbound service: add fetching root anchor for DNSSEC --- nixos/modules/services/networking/unbound.nix | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix index bad0d2d4e858..e154aed0843a 100644 --- a/nixos/modules/services/networking/unbound.nix +++ b/nixos/modules/services/networking/unbound.nix @@ -16,6 +16,11 @@ let "forward-zone:\n name: .\n" + concatMapStrings (x: " forward-addr: ${x}\n") cfg.forwardAddresses; + rootTrustAnchorFile = "${stateDir}/root.key"; + + trustAnchor = optionalString cfg.enableRootTrustAnchor + "auto-trust-anchor-file: ${rootTrustAnchorFile}"; + confFile = pkgs.writeText "unbound.conf" '' server: directory: "${stateDir}" @@ -24,6 +29,7 @@ let pidfile: "" ${interfaces} ${access} + ${trustAnchor} ${cfg.extraConfig} ${forward} ''; @@ -61,6 +67,12 @@ in description = "What servers to forward queries to."; }; + enableRootTrustAnchor = mkOption { + default = true; + type = types.bool; + description = "Use and update root trust anchor for DNSSEC validation."; + }; + extraConfig = mkOption { default = ""; type = types.str; @@ -94,7 +106,8 @@ in preStart = '' mkdir -m 0755 -p ${stateDir}/dev/ cp ${confFile} ${stateDir}/unbound.conf - chown unbound ${stateDir} + ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile} + chown unbound ${stateDir} ${rootTrustAnchorFile} touch ${stateDir}/dev/random ${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random ''; From 7bf80c9875e0b9fba892c9e50046a9914bf172f5 Mon Sep 17 00:00:00 2001 From: Franz Pletz Date: Mon, 8 Feb 2016 02:20:00 +0100 Subject: [PATCH 4/5] unbound: 1.5.3 -> 1.5.7 --- pkgs/tools/networking/unbound/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix index b15473ddf4c9..035b637031c7 100644 --- a/pkgs/tools/networking/unbound/default.nix +++ b/pkgs/tools/networking/unbound/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { name = "unbound-${version}"; - version = "1.5.3"; + version = "1.5.7"; src = fetchurl { url = "http://unbound.net/downloads/${name}.tar.gz"; - sha256 = "1jly2apag4yg649w3flaq73wdrcfyxnhx5py9j73y7adxmswigbn"; + sha256 = "1a0wfgp6wqpf7cxlcbprqhnjx6z9ywf0rhrpcf7x98l1mbjqh82b"; }; buildInputs = [ openssl expat libevent ]; @@ -21,11 +21,11 @@ stdenv.mkDerivation rec { installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf" ]; - meta = { + meta = with stdenv.lib; { description = "Validating, recursive, and caching DNS resolver"; - license = stdenv.lib.licenses.bsd3; + license = licenses.bsd3; homepage = http://www.unbound.net; - maintainers = [ stdenv.lib.maintainers.ehmry ]; + maintainers = with maintainers; [ ehmry fpletz ]; platforms = stdenv.lib.platforms.unix; }; } From f415c07703496a468ebee17e90b05f3b9a69cc93 Mon Sep 17 00:00:00 2001 From: Franz Pletz Date: Mon, 15 Feb 2016 04:27:49 +0100 Subject: [PATCH 5/5] unbound: enable compilation with PIE & relro/now --- pkgs/tools/networking/unbound/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix index 035b637031c7..4819c004c1b8 100644 --- a/pkgs/tools/networking/unbound/default.nix +++ b/pkgs/tools/networking/unbound/default.nix @@ -17,6 +17,8 @@ stdenv.mkDerivation rec { "--with-libevent=${libevent}" "--localstatedir=/var" "--sysconfdir=/etc" + "--enable-pie" + "--enable-relro-now" ]; installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf" ];