mirror of
https://github.com/klutchell/unbound-docker.git
synced 2026-10-15 16:02:46 +00:00
Merge pull request #466 from klutchell/kyle/build-time-root-key
Download root hints and generate root key at build time
This commit is contained in:
Kyle Harding
+9
-23
@@ -70,6 +70,10 @@ docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
|
||||
docker build . --tag klutchell/unbound:dev --platform linux/arm/v6
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> Outgoing port 53 must not be blocked on the network where the build is running
|
||||
> in order to generate initial root keys with unbound-anchor!
|
||||
|
||||
## Testing
|
||||
|
||||
1. Run a detached unbound container
|
||||
@@ -81,16 +85,16 @@ docker run --rm -d --name unbound klutchell/unbound:dev
|
||||
2. Run drill with DNSSEC to test NOERROR
|
||||
|
||||
```bash
|
||||
docker exec unbound drill @127.0.0.1 dnssec.works +dnssec +multi
|
||||
docker exec unbound drill @127.0.0.1 dnssec.works
|
||||
```
|
||||
|
||||
3. Run drill with dnssec to test SERVFAIL
|
||||
|
||||
```bash
|
||||
docker exec unbound drill @127.0.0.1 fail01.dnssec.works +dnssec +multi
|
||||
docker exec unbound drill @127.0.0.1 fail02.dnssec.works +dnssec +multi
|
||||
docker exec unbound drill @127.0.0.1 fail03.dnssec.works +dnssec +multi
|
||||
docker exec unbound drill @127.0.0.1 fail04.dnssec.works +dnssec +multi
|
||||
docker exec unbound drill @127.0.0.1 fail01.dnssec.works
|
||||
docker exec unbound drill @127.0.0.1 fail02.dnssec.works
|
||||
docker exec unbound drill @127.0.0.1 fail03.dnssec.works
|
||||
docker exec unbound drill @127.0.0.1 fail04.dnssec.works
|
||||
```
|
||||
|
||||
4. Stop and remove the test container
|
||||
@@ -123,24 +127,6 @@ docker build . --target conf-example --output rootfs_overlay/etc/unbound/
|
||||
|
||||
[Here](https://github.com/klutchell/unbound-docker/pull/235) is an example pull request for reference.
|
||||
|
||||
## Updating root.hints and root.key
|
||||
|
||||
These files should be updated once a year or so to ensure they have the latest valid information.
|
||||
|
||||
1. In your working copy, create a new branch if you haven't already.
|
||||
|
||||
2. Run the following build command to generate new files.
|
||||
|
||||
```bash
|
||||
export DOCKER_BUILDKIT=1
|
||||
export DOCKER_CLI_EXPERIMENTAL=enabled
|
||||
docker build . --target root-hints --output rootfs_overlay/var/unbound/
|
||||
```
|
||||
|
||||
3. [Build](#building) and [test](#testing) changes locally.
|
||||
|
||||
4. Commit changes in `root_overlay/var/unbound/*` and open a pull request for review.
|
||||
|
||||
## License
|
||||
|
||||
By contributing, you agree that your contributions will be licensed under its [Software License](LICENSE.md).
|
||||
|
||||
+33
-12
@@ -23,7 +23,8 @@ ARG UNBOUND_GID=102
|
||||
RUN addgroup -S -g ${UNBOUND_GID} unbound \
|
||||
&& adduser -S -g unbound -h /var/unbound -u ${UNBOUND_UID} -D -H -G unbound unbound
|
||||
|
||||
# hadolint ignore=DL3007
|
||||
####################################################################################################
|
||||
|
||||
FROM build-base AS ldns
|
||||
|
||||
WORKDIR /src
|
||||
@@ -54,7 +55,8 @@ RUN make -j"$(nproc)" && \
|
||||
strip /opt/usr/bin/drill && \
|
||||
ln -s drill /opt/usr/bin/dig
|
||||
|
||||
# hadolint ignore=DL3007
|
||||
####################################################################################################
|
||||
|
||||
FROM build-base AS unbound
|
||||
|
||||
WORKDIR /src
|
||||
@@ -98,23 +100,40 @@ RUN make -j"$(nproc)" && \
|
||||
/opt/usr/sbin/unbound-control \
|
||||
/opt/usr/sbin/unbound-host
|
||||
|
||||
WORKDIR /var/unbound/
|
||||
WORKDIR /var/unbound
|
||||
|
||||
# download root hints and generate initial root key
|
||||
# https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound-anchor.html
|
||||
RUN wget -q https://www.internic.net/domain/named.root -O root.hints \
|
||||
&& { /opt/usr/sbin/unbound-anchor -v -r root.hints 2>&1 || true ; } | tee -a /dev/stderr | grep -q "success: the anchor is ok"
|
||||
####################################################################################################
|
||||
|
||||
FROM scratch AS conf-example
|
||||
|
||||
# docker build . --target conf-example --output rootfs_overlay/etc/unbound/
|
||||
COPY --from=unbound /etc/unbound/unbound.conf /unbound.conf.example
|
||||
|
||||
FROM scratch as root-hints
|
||||
####################################################################################################
|
||||
|
||||
# docker build . --target root-hints --output rootfs_overlay/var/unbound/
|
||||
COPY --from=unbound /var/unbound/root.key /root.key
|
||||
COPY --from=unbound /var/unbound/root.hints /root.hints
|
||||
FROM build-base AS root-hints
|
||||
|
||||
# https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound-anchor.html
|
||||
RUN wget -q https://www.internic.net/domain/named.root -O /root.hints
|
||||
|
||||
####################################################################################################
|
||||
|
||||
FROM unbound AS root-key
|
||||
|
||||
WORKDIR /var/unbound
|
||||
|
||||
SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
|
||||
|
||||
COPY --from=root-hints /root.hints .
|
||||
|
||||
# Generate initial root key with the provided root hints.
|
||||
# https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound-anchor.html
|
||||
# This tool exits with value 1 if the root anchor was updated using the certificate or
|
||||
# if the builtin root-anchor was used. It exits with code 0 if no update was necessary,
|
||||
# if the update was possible with RFC 5011 tracking, or if an error occurred.
|
||||
RUN { /opt/usr/sbin/unbound-anchor -v -r root.hints -a root.key || true ; } | tee -a /dev/stderr | grep -q "success: the anchor is ok"
|
||||
|
||||
####################################################################################################
|
||||
|
||||
FROM scratch AS final
|
||||
|
||||
@@ -130,7 +149,9 @@ COPY --from=unbound /opt/usr/sbin/ /usr/sbin/
|
||||
COPY --from=ldns /opt/usr/bin/ /usr/bin/
|
||||
|
||||
COPY --chown=unbound:unbound rootfs_overlay/etc/unbound/ /etc/unbound/
|
||||
COPY --chown=unbound:unbound rootfs_overlay/var/unbound/ /var/unbound/
|
||||
|
||||
COPY --from=root-key --chown=unbound:unbound /var/unbound/root.hints /var/unbound/root.hints
|
||||
COPY --from=root-key --chown=unbound:unbound /var/unbound/root.key /var/unbound/root.key
|
||||
|
||||
RUN [ "unbound", "-V" ]
|
||||
# hadolint ignore=DL3059
|
||||
|
||||
@@ -1,92 +0,0 @@
|
||||
; This file holds the information on root name servers needed to
|
||||
; initialize cache of Internet domain name servers
|
||||
; (e.g. reference this file in the "cache . <file>"
|
||||
; configuration file of BIND domain name servers).
|
||||
;
|
||||
; This file is made available by InterNIC
|
||||
; under anonymous FTP as
|
||||
; file /domain/named.cache
|
||||
; on server FTP.INTERNIC.NET
|
||||
; -OR- RS.INTERNIC.NET
|
||||
;
|
||||
; last update: October 24, 2023
|
||||
; related version of root zone: 2023102402
|
||||
;
|
||||
; FORMERLY NS.INTERNIC.NET
|
||||
;
|
||||
. 3600000 NS A.ROOT-SERVERS.NET.
|
||||
A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4
|
||||
A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30
|
||||
;
|
||||
; FORMERLY NS1.ISI.EDU
|
||||
;
|
||||
. 3600000 NS B.ROOT-SERVERS.NET.
|
||||
B.ROOT-SERVERS.NET. 3600000 A 199.9.14.201
|
||||
B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:200::b
|
||||
;
|
||||
; FORMERLY C.PSI.NET
|
||||
;
|
||||
. 3600000 NS C.ROOT-SERVERS.NET.
|
||||
C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12
|
||||
C.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2::c
|
||||
;
|
||||
; FORMERLY TERP.UMD.EDU
|
||||
;
|
||||
. 3600000 NS D.ROOT-SERVERS.NET.
|
||||
D.ROOT-SERVERS.NET. 3600000 A 199.7.91.13
|
||||
D.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2d::d
|
||||
;
|
||||
; FORMERLY NS.NASA.GOV
|
||||
;
|
||||
. 3600000 NS E.ROOT-SERVERS.NET.
|
||||
E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
|
||||
E.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:a8::e
|
||||
;
|
||||
; FORMERLY NS.ISC.ORG
|
||||
;
|
||||
. 3600000 NS F.ROOT-SERVERS.NET.
|
||||
F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
|
||||
F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2f::f
|
||||
;
|
||||
; FORMERLY NS.NIC.DDN.MIL
|
||||
;
|
||||
. 3600000 NS G.ROOT-SERVERS.NET.
|
||||
G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
|
||||
G.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:12::d0d
|
||||
;
|
||||
; FORMERLY AOS.ARL.ARMY.MIL
|
||||
;
|
||||
. 3600000 NS H.ROOT-SERVERS.NET.
|
||||
H.ROOT-SERVERS.NET. 3600000 A 198.97.190.53
|
||||
H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::53
|
||||
;
|
||||
; FORMERLY NIC.NORDU.NET
|
||||
;
|
||||
. 3600000 NS I.ROOT-SERVERS.NET.
|
||||
I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17
|
||||
I.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fe::53
|
||||
;
|
||||
; OPERATED BY VERISIGN, INC.
|
||||
;
|
||||
. 3600000 NS J.ROOT-SERVERS.NET.
|
||||
J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30
|
||||
J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:c27::2:30
|
||||
;
|
||||
; OPERATED BY RIPE NCC
|
||||
;
|
||||
. 3600000 NS K.ROOT-SERVERS.NET.
|
||||
K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129
|
||||
K.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fd::1
|
||||
;
|
||||
; OPERATED BY ICANN
|
||||
;
|
||||
. 3600000 NS L.ROOT-SERVERS.NET.
|
||||
L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42
|
||||
L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:9f::42
|
||||
;
|
||||
; OPERATED BY WIDE
|
||||
;
|
||||
. 3600000 NS M.ROOT-SERVERS.NET.
|
||||
M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
|
||||
M.ROOT-SERVERS.NET. 3600000 AAAA 2001:dc3::35
|
||||
; End of file
|
||||
@@ -1,9 +0,0 @@
|
||||
; autotrust trust anchor file
|
||||
;;id: . 1
|
||||
;;last_queried: 1699995358 ;;Tue Nov 14 20:55:58 2023
|
||||
;;last_success: 1699995358 ;;Tue Nov 14 20:55:58 2023
|
||||
;;next_probe_time: 1700035155 ;;Wed Nov 15 07:59:15 2023
|
||||
;;query_failed: 0
|
||||
;;query_interval: 43200
|
||||
;;retry_time: 8640
|
||||
. 86400 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=1699995358 ;;Tue Nov 14 20:55:58 2023
|
||||
Reference in New Issue
Block a user