Mercurial > prosody-hg
diff net/unbound.lua @ 14216:2ec517d8d43e
net.unbound: Enable DNSSEC by default with option for turning off
You know what they say about opt-in security.
Enabling DNSSEC in libunbound without a way to turn it off would likely
be a problem for those whose DNS resolvers do not support, or outright
block DNSSEC. The merge algorithm already in place here doesn't have a
way to unset something, so instead a simpler boolean setting is
introduced, similar to some existing ones like use_ipv6/4 and use_dane.
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Sun, 07 Jun 2026 20:32:55 +0200 |
| parents | 2719dbb358c8 |
| children | 37612a03220d |
line wrap: on
line diff
--- a/net/unbound.lua Sun Jun 07 18:23:24 2026 +0200 +++ b/net/unbound.lua Sun Jun 07 20:32:55 2026 +0200 @@ -32,13 +32,22 @@ resolvconf = true; } -local function add_defaults(conf) +-- Path to file containing current DNSSEC trust anchors, needed to enable DNSSEC. +-- Packagers: Adjust this path if it is different on your distribution +local trustfile = "/usr/share/dns/root.ds"; + +local function add_defaults(conf, use_dnssec) conf = conf or {}; for option, default in pairs(builtin_defaults) do if conf[option] == nil then conf[option] = default; end end + if use_dnssec ~= false then + if conf["trustfile"] == nil and conf["trusted"] == nil then + conf["trustfile"] = trustfile; + end + end for option, default in pairs(libunbound.config) do if conf[option] == nil then conf[option] = default; @@ -170,10 +179,11 @@ end if prosody then - local config = require"prosody.core.configmanager"; - unbound_config = add_defaults(config.get("*", "unbound")); + -- TODO move this glue logic into util.startup? + local config = require "prosody.core.configmanager"; + unbound_config = add_defaults(config.get("*", "unbound"), config.get("*", "use_dnssec")); prosody.events.add_handler("config-reloaded", function() - unbound_config = add_defaults(config.get("*", "unbound")); + unbound_config = add_defaults(config.get("*", "unbound"), config.get("*", "use_dnssec")); purge(); end); prosody.events.add_handler("server-started", initialize);