dns/unbound-plus: add DoT support (#1777)

dns/unbound-plus/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		unbound-plus
-PLUGIN_VERSION=		1.0
+PLUGIN_VERSION=		1.1
 PLUGIN_COMMENT=		Unbound additions
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
 

dns/unbound-plus/pkg-descr

@@ -2,3 +2,15 @@ Unbound-Plus is a collecion of additional features to Unbound,
 including DNSBL and DNS-over-TLS support.
 
 WWW: https://github.com/opnsense/plugins/
+
+Plugin Changelog
+----------------
+
+1.1
+
+* Add DNS over TLS (DoT) support
+
+1.0
+
+* Add DNSBL feature
+* Allow to set private domains

dns/unbound-plus/src/opnsense/mvc/app/controllers/OPNsense/Unboundplus/forms/miscellaneous.xml

@@ -7,4 +7,12 @@
         <allownew>true</allownew>
         <help>List of domains to mark as private. You only need this for some DNSBL lists which resolve to private addresses.</help>
     </field>
+    <field>
+        <id>miscellaneous.dotservers</id>
+        <label>DNS over TLS Servers</label>
+        <type>select_multiple</type>
+        <style>tokenize</style>
+        <allownew>true</allownew>
+        <help>List of nameservers to use for DoT. Use syntax ip@port like 9.9.9.9@853</help>
+    </field>
 </form>

dns/unbound-plus/src/opnsense/mvc/app/models/OPNsense/Unboundplus/Miscellaneous.xml

@@ -1,10 +1,14 @@
 <model>
     <mount>//OPNsense/unboundplus/miscellaneous</mount>
     <description>Unbound Miscellaneous configuration</description>
-    <version>0.0.1</version>
+    <version>0.0.2</version>
     <items>
         <privatedomain type="CSVListField">
             <Required>N</Required>
         </privatedomain>
+        <dotservers type="CSVListField">
+            <Required>N</Required>
+            <mask>/^[a-fA-F0-9\.\@]{1,46}$/</mask>
+        </dotservers>
     </items>
 </model>

dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/+TARGETS

@@ -1,4 +1,5 @@
 dnsbl.inc:/var/unbound/etc/dnsbl.inc
 whitelist.inc:/var/unbound/etc/whitelist.inc
 miscellaneous.conf:/var/unbound/etc/miscellaneous.conf
+dot.conf:/var/unbound/etc/dot.conf
 lists.inc:/var/unbound/etc/lists.inc

dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/dot.conf

@@ -0,0 +1,10 @@
+{% if helpers.exists('OPNsense.unboundplus.miscellaneous.dotservers') and OPNsense.unboundplus.miscellaneous.dotservers != '' %}
+server:
+  tls-cert-bundle: /etc/ssl/cert.pem
+forward-zone:
+  name: "."
+  forward-ssl-upstream: yes
+{%   for dot in OPNsense.unboundplus.miscellaneous.dotservers.split(',') %}
+  forward-addr: {{ dot }}
+{%   endfor %}
+{% endif %}