From c5f72d30bff4e94555b1ee54416f447ba542c498 Mon Sep 17 00:00:00 2001
From: Michael <m.muenz@gmail.com>
Date: Wed, 15 Apr 2020 08:08:58 +0200
Subject: [PATCH] dns/unbound-plus: add DoT support (#1777)

---
 dns/unbound-plus/Makefile                            |  2 +-
 dns/unbound-plus/pkg-descr                           | 12 ++++++++++++
 .../OPNsense/Unboundplus/forms/miscellaneous.xml     |  8 ++++++++
 .../models/OPNsense/Unboundplus/Miscellaneous.xml    |  6 +++++-
 .../service/templates/OPNsense/Unboundplus/+TARGETS  |  1 +
 .../service/templates/OPNsense/Unboundplus/dot.conf  | 10 ++++++++++
 6 files changed, 37 insertions(+), 2 deletions(-)
 create mode 100644 dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/dot.conf

diff --git a/dns/unbound-plus/Makefile b/dns/unbound-plus/Makefile
index e49cf95d9..c0ffdf6ec 100644
--- a/dns/unbound-plus/Makefile
+++ b/dns/unbound-plus/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		unbound-plus
-PLUGIN_VERSION=		1.0
+PLUGIN_VERSION=		1.1
 PLUGIN_COMMENT=		Unbound additions
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
 
diff --git a/dns/unbound-plus/pkg-descr b/dns/unbound-plus/pkg-descr
index a93c1a94c..908838464 100644
--- a/dns/unbound-plus/pkg-descr
+++ b/dns/unbound-plus/pkg-descr
@@ -2,3 +2,15 @@ Unbound-Plus is a collecion of additional features to Unbound,
 including DNSBL and DNS-over-TLS support.
 
 WWW: https://github.com/opnsense/plugins/
+
+Plugin Changelog
+----------------
+
+1.1
+
+* Add DNS over TLS (DoT) support
+
+1.0
+
+* Add DNSBL feature
+* Allow to set private domains
diff --git a/dns/unbound-plus/src/opnsense/mvc/app/controllers/OPNsense/Unboundplus/forms/miscellaneous.xml b/dns/unbound-plus/src/opnsense/mvc/app/controllers/OPNsense/Unboundplus/forms/miscellaneous.xml
index 3945c3405..899ceb390 100644
--- a/dns/unbound-plus/src/opnsense/mvc/app/controllers/OPNsense/Unboundplus/forms/miscellaneous.xml
+++ b/dns/unbound-plus/src/opnsense/mvc/app/controllers/OPNsense/Unboundplus/forms/miscellaneous.xml
@@ -7,4 +7,12 @@
         <allownew>true</allownew>
         <help>List of domains to mark as private. You only need this for some DNSBL lists which resolve to private addresses.</help>
     </field>
+    <field>
+        <id>miscellaneous.dotservers</id>
+        <label>DNS over TLS Servers</label>
+        <type>select_multiple</type>
+        <style>tokenize</style>
+        <allownew>true</allownew>
+        <help>List of nameservers to use for DoT. Use syntax ip@port like 9.9.9.9@853</help>
+    </field>
 </form>
diff --git a/dns/unbound-plus/src/opnsense/mvc/app/models/OPNsense/Unboundplus/Miscellaneous.xml b/dns/unbound-plus/src/opnsense/mvc/app/models/OPNsense/Unboundplus/Miscellaneous.xml
index 5a3b3e858..3a4e3cb4f 100644
--- a/dns/unbound-plus/src/opnsense/mvc/app/models/OPNsense/Unboundplus/Miscellaneous.xml
+++ b/dns/unbound-plus/src/opnsense/mvc/app/models/OPNsense/Unboundplus/Miscellaneous.xml
@@ -1,10 +1,14 @@
 <model>
     <mount>//OPNsense/unboundplus/miscellaneous</mount>
     <description>Unbound Miscellaneous configuration</description>
-    <version>0.0.1</version>
+    <version>0.0.2</version>
     <items>
         <privatedomain type="CSVListField">
             <Required>N</Required>
         </privatedomain>
+        <dotservers type="CSVListField">
+            <Required>N</Required>
+            <mask>/^[a-fA-F0-9\.\@]{1,46}$/</mask>
+        </dotservers>
     </items>
 </model>
diff --git a/dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/+TARGETS b/dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/+TARGETS
index d7f6d3cbb..1166df58a 100644
--- a/dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/+TARGETS
+++ b/dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/+TARGETS
@@ -1,4 +1,5 @@
 dnsbl.inc:/var/unbound/etc/dnsbl.inc
 whitelist.inc:/var/unbound/etc/whitelist.inc
 miscellaneous.conf:/var/unbound/etc/miscellaneous.conf
+dot.conf:/var/unbound/etc/dot.conf
 lists.inc:/var/unbound/etc/lists.inc
diff --git a/dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/dot.conf b/dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/dot.conf
new file mode 100644
index 000000000..ae59c336b
--- /dev/null
+++ b/dns/unbound-plus/src/opnsense/service/templates/OPNsense/Unboundplus/dot.conf
@@ -0,0 +1,10 @@
+{% if helpers.exists('OPNsense.unboundplus.miscellaneous.dotservers') and OPNsense.unboundplus.miscellaneous.dotservers != '' %}
+server:
+  tls-cert-bundle: /etc/ssl/cert.pem
+forward-zone:
+  name: "."
+  forward-ssl-upstream: yes
+{%   for dot in OPNsense.unboundplus.miscellaneous.dotservers.split(',') %}
+  forward-addr: {{ dot }}
+{%   endfor %}
+{% endif %}