From f533951b54d3217325f7fcfb8444f922119fe59c Mon Sep 17 00:00:00 2001 From: Kyle Harding Date: Tue, 25 Jun 2024 12:25:22 -0400 Subject: [PATCH] Download root hints and generate root key at build time There is no need for these to be included with the source and it just adds a manual step to be considered. Signed-off-by: Kyle Harding --- CONTRIBUTING.md | 32 +++------- Dockerfile | 45 +++++++++---- rootfs_overlay/var/unbound/root.hints | 92 --------------------------- rootfs_overlay/var/unbound/root.key | 9 --- 4 files changed, 42 insertions(+), 136 deletions(-) delete mode 100644 rootfs_overlay/var/unbound/root.hints delete mode 100644 rootfs_overlay/var/unbound/root.key diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 114f1e7..263c8f6 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -70,6 +70,10 @@ docker run --rm --privileged multiarch/qemu-user-static --reset -p yes docker build . --tag klutchell/unbound:dev --platform linux/arm/v6 ``` +> [!NOTE] +> Outgoing port 53 must not be blocked on the network where the build is running +> in order to generate initial root keys with unbound-anchor! + ## Testing 1. Run a detached unbound container @@ -81,16 +85,16 @@ docker run --rm -d --name unbound klutchell/unbound:dev 2. Run drill with DNSSEC to test NOERROR ```bash -docker exec unbound drill @127.0.0.1 dnssec.works +dnssec +multi +docker exec unbound drill @127.0.0.1 dnssec.works ``` 3. Run drill with dnssec to test SERVFAIL ```bash -docker exec unbound drill @127.0.0.1 fail01.dnssec.works +dnssec +multi -docker exec unbound drill @127.0.0.1 fail02.dnssec.works +dnssec +multi -docker exec unbound drill @127.0.0.1 fail03.dnssec.works +dnssec +multi -docker exec unbound drill @127.0.0.1 fail04.dnssec.works +dnssec +multi +docker exec unbound drill @127.0.0.1 fail01.dnssec.works +docker exec unbound drill @127.0.0.1 fail02.dnssec.works +docker exec unbound drill @127.0.0.1 fail03.dnssec.works +docker exec unbound drill @127.0.0.1 fail04.dnssec.works ``` 4. Stop and remove the test container @@ -123,24 +127,6 @@ docker build . --target conf-example --output rootfs_overlay/etc/unbound/ [Here](https://github.com/klutchell/unbound-docker/pull/235) is an example pull request for reference. -## Updating root.hints and root.key - -These files should be updated once a year or so to ensure they have the latest valid information. - -1. In your working copy, create a new branch if you haven't already. - -2. Run the following build command to generate new files. - -```bash -export DOCKER_BUILDKIT=1 -export DOCKER_CLI_EXPERIMENTAL=enabled -docker build . --target root-hints --output rootfs_overlay/var/unbound/ -``` - -3. [Build](#building) and [test](#testing) changes locally. - -4. Commit changes in `root_overlay/var/unbound/*` and open a pull request for review. - ## License By contributing, you agree that your contributions will be licensed under its [Software License](LICENSE.md). diff --git a/Dockerfile b/Dockerfile index 9f38c17..533c026 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,7 +23,8 @@ ARG UNBOUND_GID=102 RUN addgroup -S -g ${UNBOUND_GID} unbound \ && adduser -S -g unbound -h /var/unbound -u ${UNBOUND_UID} -D -H -G unbound unbound -# hadolint ignore=DL3007 +#################################################################################################### + FROM build-base AS ldns WORKDIR /src @@ -54,7 +55,8 @@ RUN make -j"$(nproc)" && \ strip /opt/usr/bin/drill && \ ln -s drill /opt/usr/bin/dig -# hadolint ignore=DL3007 +#################################################################################################### + FROM build-base AS unbound WORKDIR /src @@ -98,23 +100,40 @@ RUN make -j"$(nproc)" && \ /opt/usr/sbin/unbound-control \ /opt/usr/sbin/unbound-host -WORKDIR /var/unbound/ +WORKDIR /var/unbound -# download root hints and generate initial root key -# https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound-anchor.html -RUN wget -q https://www.internic.net/domain/named.root -O root.hints \ - && { /opt/usr/sbin/unbound-anchor -v -r root.hints 2>&1 || true ; } | tee -a /dev/stderr | grep -q "success: the anchor is ok" +#################################################################################################### FROM scratch AS conf-example # docker build . --target conf-example --output rootfs_overlay/etc/unbound/ COPY --from=unbound /etc/unbound/unbound.conf /unbound.conf.example -FROM scratch as root-hints +#################################################################################################### -# docker build . --target root-hints --output rootfs_overlay/var/unbound/ -COPY --from=unbound /var/unbound/root.key /root.key -COPY --from=unbound /var/unbound/root.hints /root.hints +FROM build-base AS root-hints + +# https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound-anchor.html +RUN wget -q https://www.internic.net/domain/named.root -O /root.hints + +#################################################################################################### + +FROM unbound AS root-key + +WORKDIR /var/unbound + +SHELL ["/bin/ash", "-eo", "pipefail", "-c"] + +COPY --from=root-hints /root.hints . + +# Generate initial root key with the provided root hints. +# https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound-anchor.html +# This tool exits with value 1 if the root anchor was updated using the certificate or +# if the builtin root-anchor was used. It exits with code 0 if no update was necessary, +# if the update was possible with RFC 5011 tracking, or if an error occurred. +RUN { /opt/usr/sbin/unbound-anchor -v -r root.hints -a root.key || true ; } | tee -a /dev/stderr | grep -q "success: the anchor is ok" + +#################################################################################################### FROM scratch AS final @@ -130,7 +149,9 @@ COPY --from=unbound /opt/usr/sbin/ /usr/sbin/ COPY --from=ldns /opt/usr/bin/ /usr/bin/ COPY --chown=unbound:unbound rootfs_overlay/etc/unbound/ /etc/unbound/ -COPY --chown=unbound:unbound rootfs_overlay/var/unbound/ /var/unbound/ + +COPY --from=root-key --chown=unbound:unbound /var/unbound/root.hints /var/unbound/root.hints +COPY --from=root-key --chown=unbound:unbound /var/unbound/root.key /var/unbound/root.key RUN [ "unbound", "-V" ] # hadolint ignore=DL3059 diff --git a/rootfs_overlay/var/unbound/root.hints b/rootfs_overlay/var/unbound/root.hints deleted file mode 100644 index 6db8239..0000000 --- a/rootfs_overlay/var/unbound/root.hints +++ /dev/null @@ -1,92 +0,0 @@ -; This file holds the information on root name servers needed to -; initialize cache of Internet domain name servers -; (e.g. reference this file in the "cache . " -; configuration file of BIND domain name servers). -; -; This file is made available by InterNIC -; under anonymous FTP as -; file /domain/named.cache -; on server FTP.INTERNIC.NET -; -OR- RS.INTERNIC.NET -; -; last update: October 24, 2023 -; related version of root zone: 2023102402 -; -; FORMERLY NS.INTERNIC.NET -; -. 3600000 NS A.ROOT-SERVERS.NET. -A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4 -A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 -; -; FORMERLY NS1.ISI.EDU -; -. 3600000 NS B.ROOT-SERVERS.NET. -B.ROOT-SERVERS.NET. 3600000 A 199.9.14.201 -B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:200::b -; -; FORMERLY C.PSI.NET -; -. 3600000 NS C.ROOT-SERVERS.NET. -C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12 -C.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2::c -; -; FORMERLY TERP.UMD.EDU -; -. 3600000 NS D.ROOT-SERVERS.NET. -D.ROOT-SERVERS.NET. 3600000 A 199.7.91.13 -D.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2d::d -; -; FORMERLY NS.NASA.GOV -; -. 3600000 NS E.ROOT-SERVERS.NET. -E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10 -E.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:a8::e -; -; FORMERLY NS.ISC.ORG -; -. 3600000 NS F.ROOT-SERVERS.NET. -F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241 -F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2f::f -; -; FORMERLY NS.NIC.DDN.MIL -; -. 3600000 NS G.ROOT-SERVERS.NET. -G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 -G.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:12::d0d -; -; FORMERLY AOS.ARL.ARMY.MIL -; -. 3600000 NS H.ROOT-SERVERS.NET. -H.ROOT-SERVERS.NET. 3600000 A 198.97.190.53 -H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::53 -; -; FORMERLY NIC.NORDU.NET -; -. 3600000 NS I.ROOT-SERVERS.NET. -I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17 -I.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fe::53 -; -; OPERATED BY VERISIGN, INC. -; -. 3600000 NS J.ROOT-SERVERS.NET. -J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30 -J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:c27::2:30 -; -; OPERATED BY RIPE NCC -; -. 3600000 NS K.ROOT-SERVERS.NET. -K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129 -K.ROOT-SERVERS.NET. 3600000 AAAA 2001:7fd::1 -; -; OPERATED BY ICANN -; -. 3600000 NS L.ROOT-SERVERS.NET. -L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42 -L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:9f::42 -; -; OPERATED BY WIDE -; -. 3600000 NS M.ROOT-SERVERS.NET. -M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 -M.ROOT-SERVERS.NET. 3600000 AAAA 2001:dc3::35 -; End of file \ No newline at end of file diff --git a/rootfs_overlay/var/unbound/root.key b/rootfs_overlay/var/unbound/root.key deleted file mode 100644 index e9ebe2d..0000000 --- a/rootfs_overlay/var/unbound/root.key +++ /dev/null @@ -1,9 +0,0 @@ -; autotrust trust anchor file -;;id: . 1 -;;last_queried: 1699995358 ;;Tue Nov 14 20:55:58 2023 -;;last_success: 1699995358 ;;Tue Nov 14 20:55:58 2023 -;;next_probe_time: 1700035155 ;;Wed Nov 15 07:59:15 2023 -;;query_failed: 0 -;;query_interval: 43200 -;;retry_time: 8640 -. 86400 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=1699995358 ;;Tue Nov 14 20:55:58 2023