Skip to content

Commit 6d9ba2b

Browse files
bastelfreakbastelfreak
authored
Merge pull request #356 from b4ldr/dnstap
Dnstap: Add new class to manage dnstap configueration
2 parents 56b192c + 69948ca commit 6d9ba2b

File tree

5 files changed

+497
-0
lines changed

5 files changed

+497
-0
lines changed

‎REFERENCE.md‎

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
### Classes
88

99
* [`unbound`](#unbound): Installs and configures Unbound, the caching DNS resolver from NLnet Labs
10+
* [`unbound::dnstap`](#unbound--dnstap)
1011
* [`unbound::remote`](#unbound--remote): Configure remote control of the unbound daemon process
1112

1213
### Defined types
@@ -16,6 +17,10 @@
1617
* [`unbound::record`](#unbound--record): Create an unbound static DNS record override
1718
* [`unbound::stub`](#unbound--stub): Create an unbound stub zone for caching upstream name resolvers
1819

20+
### Functions
21+
22+
* [`unbound::print_config`](#unbound--print_config): Print a configuration value if it is defined and the version is supported
23+
1924
### Data types
2025

2126
* [`Unbound::Access_control`](#Unbound--Access_control): custom type for access control lists
@@ -1916,6 +1921,195 @@ specifying reduces the number of puppet runs
19161921

19171922
Default value: `$facts['unbound_version']`
19181923

1924+
### <a name="unbound--dnstap"></a>`unbound::dnstap`
1925+
1926+
The unbound::dnstap class.
1927+
1928+
#### Parameters
1929+
1930+
The following parameters are available in the `unbound::dnstap` class:
1931+
1932+
* [`enable`](#-unbound--dnstap--enable)
1933+
* [`bidirectional`](#-unbound--dnstap--bidirectional)
1934+
* [`socket_path`](#-unbound--dnstap--socket_path)
1935+
* [`ip`](#-unbound--dnstap--ip)
1936+
* [`tls`](#-unbound--dnstap--tls)
1937+
* [`tls_host`](#-unbound--dnstap--tls_host)
1938+
* [`tls_cert_bundle`](#-unbound--dnstap--tls_cert_bundle)
1939+
* [`tls_cert_key_file`](#-unbound--dnstap--tls_cert_key_file)
1940+
* [`tls_cert_cert_file`](#-unbound--dnstap--tls_cert_cert_file)
1941+
* [`send_identity`](#-unbound--dnstap--send_identity)
1942+
* [`send_version`](#-unbound--dnstap--send_version)
1943+
* [`identity`](#-unbound--dnstap--identity)
1944+
* [`version`](#-unbound--dnstap--version)
1945+
* [`sample_rate`](#-unbound--dnstap--sample_rate)
1946+
* [`log_resolver_query_messages`](#-unbound--dnstap--log_resolver_query_messages)
1947+
* [`log_resolver_response_messages`](#-unbound--dnstap--log_resolver_response_messages)
1948+
* [`log_client_query_messages`](#-unbound--dnstap--log_client_query_messages)
1949+
* [`log_client_response_messages`](#-unbound--dnstap--log_client_response_messages)
1950+
* [`log_forwarder_query_messages`](#-unbound--dnstap--log_forwarder_query_messages)
1951+
* [`log_forwarder_response_messages`](#-unbound--dnstap--log_forwarder_response_messages)
1952+
1953+
##### <a name="-unbound--dnstap--enable"></a>`enable`
1954+
1955+
Data type: `Boolean`
1956+
1957+
Whether to enable dnstap.
1958+
1959+
Default value: `true`
1960+
1961+
##### <a name="-unbound--dnstap--bidirectional"></a>`bidirectional`
1962+
1963+
Data type: `Boolean`
1964+
1965+
Whether to enable bidirectional dnstap.
1966+
1967+
Default value: `true`
1968+
1969+
##### <a name="-unbound--dnstap--socket_path"></a>`socket_path`
1970+
1971+
Data type: `Optional[Stdlib::Absolutepath]`
1972+
1973+
The path to the dnstap socket.
1974+
1975+
Default value: `undef`
1976+
1977+
##### <a name="-unbound--dnstap--ip"></a>`ip`
1978+
1979+
Data type: `Optional[Unbound::Address]`
1980+
1981+
The IP address for dnstap.
1982+
1983+
Default value: `undef`
1984+
1985+
##### <a name="-unbound--dnstap--tls"></a>`tls`
1986+
1987+
Data type: `Boolean`
1988+
1989+
Whether to enable TLS for dnstap.
1990+
1991+
Default value: `true`
1992+
1993+
##### <a name="-unbound--dnstap--tls_host"></a>`tls_host`
1994+
1995+
Data type: `Optional[Stdlib::Host]`
1996+
1997+
The TLS host for dnstap.
1998+
1999+
Default value: `undef`
2000+
2001+
##### <a name="-unbound--dnstap--tls_cert_bundle"></a>`tls_cert_bundle`
2002+
2003+
Data type: `Optional[Stdlib::Absolutepath]`
2004+
2005+
The path to the TLS certificate bundle.
2006+
2007+
Default value: `undef`
2008+
2009+
##### <a name="-unbound--dnstap--tls_cert_key_file"></a>`tls_cert_key_file`
2010+
2011+
Data type: `Optional[Stdlib::Absolutepath]`
2012+
2013+
The path to the TLS certificate key file.
2014+
2015+
Default value: `undef`
2016+
2017+
##### <a name="-unbound--dnstap--tls_cert_cert_file"></a>`tls_cert_cert_file`
2018+
2019+
Data type: `Optional[Stdlib::Absolutepath]`
2020+
2021+
The path to the TLS certificate file.
2022+
2023+
Default value: `undef`
2024+
2025+
##### <a name="-unbound--dnstap--send_identity"></a>`send_identity`
2026+
2027+
Data type: `Boolean`
2028+
2029+
Whether to send the identity in dnstap messages.
2030+
2031+
Default value: `false`
2032+
2033+
##### <a name="-unbound--dnstap--send_version"></a>`send_version`
2034+
2035+
Data type: `Boolean`
2036+
2037+
Whether to send the version in dnstap messages.
2038+
2039+
Default value: `false`
2040+
2041+
##### <a name="-unbound--dnstap--identity"></a>`identity`
2042+
2043+
Data type: `Optional[String[1]]`
2044+
2045+
The identity to send in dnstap messages.
2046+
2047+
Default value: `undef`
2048+
2049+
##### <a name="-unbound--dnstap--version"></a>`version`
2050+
2051+
Data type: `Optional[String[1]]`
2052+
2053+
The version to send in dnstap messages.
2054+
2055+
Default value: `undef`
2056+
2057+
##### <a name="-unbound--dnstap--sample_rate"></a>`sample_rate`
2058+
2059+
Data type: `Integer[0,1000]`
2060+
2061+
The sample rate for dnstap messages.
2062+
2063+
Default value: `0`
2064+
2065+
##### <a name="-unbound--dnstap--log_resolver_query_messages"></a>`log_resolver_query_messages`
2066+
2067+
Data type: `Boolean`
2068+
2069+
Whether to log resolver query messages.
2070+
2071+
Default value: `false`
2072+
2073+
##### <a name="-unbound--dnstap--log_resolver_response_messages"></a>`log_resolver_response_messages`
2074+
2075+
Data type: `Boolean`
2076+
2077+
Whether to log resolver response messages.
2078+
2079+
Default value: `false`
2080+
2081+
##### <a name="-unbound--dnstap--log_client_query_messages"></a>`log_client_query_messages`
2082+
2083+
Data type: `Boolean`
2084+
2085+
Whether to log client query messages.
2086+
2087+
Default value: `false`
2088+
2089+
##### <a name="-unbound--dnstap--log_client_response_messages"></a>`log_client_response_messages`
2090+
2091+
Data type: `Boolean`
2092+
2093+
Whether to log client response messages.
2094+
2095+
Default value: `false`
2096+
2097+
##### <a name="-unbound--dnstap--log_forwarder_query_messages"></a>`log_forwarder_query_messages`
2098+
2099+
Data type: `Boolean`
2100+
2101+
Whether to log forwarder query messages.
2102+
2103+
Default value: `false`
2104+
2105+
##### <a name="-unbound--dnstap--log_forwarder_response_messages"></a>`log_forwarder_response_messages`
2106+
2107+
Data type: `Boolean`
2108+
2109+
Whether to log forwarder response messages.
2110+
2111+
Default value: `false`
2112+
19192113
### <a name="unbound--remote"></a>`unbound::remote`
19202114

19212115
Configure remote control of the unbound daemon process
@@ -2341,6 +2535,38 @@ Name of the unbound config file
23412535

23422536
Default value: `undef`
23432537

2538+
## Functions
2539+
2540+
### <a name="unbound--print_config"></a>`unbound::print_config`
2541+
2542+
Type: Puppet Language
2543+
2544+
Print a configuration value if it is defined and the version is supported
2545+
2546+
#### `unbound::print_config(String[1] $name, Optional[Variant[Boolean, Integer, String, Array[String, 1]]] $value = undef, Optional[String[1]] $version = undef)`
2547+
2548+
The unbound::print_config function.
2549+
2550+
Returns: `String` the config item as a string or an empty string if the version is not supported
2551+
2552+
##### `name`
2553+
2554+
Data type: `String[1]`
2555+
2556+
the config item name
2557+
2558+
##### `value`
2559+
2560+
Data type: `Optional[Variant[Boolean, Integer, String, Array[String, 1]]]`
2561+
2562+
the config item value
2563+
2564+
##### `version`
2565+
2566+
Data type: `Optional[String[1]]`
2567+
2568+
the version when the config item was introduced
2569+
23442570
## Data types
23452571

23462572
### <a name="Unbound--Access_control"></a>`Unbound::Access_control`

‎functions/print_config.pp‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# @summary Print a configuration value if it is defined and the version is supported
2+
# @param name the config item name
3+
# @param value the config item value
4+
# @param version the version when the config item was introduced
5+
# @return the config item as a string or an empty string if the version is not supported
6+
function unbound::print_config (
7+
String[1] $name,
8+
Optional[Variant[Boolean, Integer, String, Array[String, 1]]] $value = undef,
9+
Optional[String[1]] $version = undef,
10+
) >> String {
11+
$unbound_version = $facts['unbound_version'].lest || { '0.a' }
12+
if ($value =~ Undef or ($version =~ NotUndef and versioncmp($unbound_version, $version) < 0)) {
13+
return ''
14+
}
15+
$value ? {
16+
String => " ${name}: \"${value}\"",
17+
Integer => " ${name}: ${value}",
18+
Boolean => " ${name}: ${value.bool2str('yes', 'no')}",
19+
Array => $value.map |$v| { " ${name}: \"${v}\"" }.join("\n"),
20+
}
21+
}

‎manifests/dnstap.pp‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# @summary
2+
# @param enable
3+
# Whether to enable dnstap.
4+
# @param bidirectional
5+
# Whether to enable bidirectional dnstap.
6+
# @param socket_path
7+
# The path to the dnstap socket.
8+
# @param ip
9+
# The IP address for dnstap.
10+
# @param tls
11+
# Whether to enable TLS for dnstap.
12+
# @param tls_host
13+
# The TLS host for dnstap.
14+
# @param tls_cert_bundle
15+
# The path to the TLS certificate bundle.
16+
# @param tls_cert_key_file
17+
# The path to the TLS certificate key file.
18+
# @param tls_cert_cert_file
19+
# The path to the TLS certificate file.
20+
# @param send_identity
21+
# Whether to send the identity in dnstap messages.
22+
# @param send_version
23+
# Whether to send the version in dnstap messages.
24+
# @param identity
25+
# The identity to send in dnstap messages.
26+
# @param version
27+
# The version to send in dnstap messages.
28+
# @param sample_rate
29+
# The sample rate for dnstap messages.
30+
# @param log_resolver_query_messages
31+
# Whether to log resolver query messages.
32+
# @param log_resolver_response_messages
33+
# Whether to log resolver response messages.
34+
# @param log_client_query_messages
35+
# Whether to log client query messages.
36+
# @param log_client_response_messages
37+
# Whether to log client response messages.
38+
# @param log_forwarder_query_messages
39+
# Whether to log forwarder query messages.
40+
# @param log_forwarder_response_messages
41+
# Whether to log forwarder response messages.
42+
class unbound::dnstap (
43+
Boolean $enable = true, # version 1.11
44+
Boolean $bidirectional = true, # version 1.11
45+
Optional[Stdlib::Absolutepath] $socket_path = undef, # version 1.11
46+
Optional[Unbound::Address] $ip = undef, # version 1.11
47+
Boolean $tls = true, # version 1.11
48+
Optional[Stdlib::Host] $tls_host = undef, # version 1.11
49+
Optional[Stdlib::Absolutepath] $tls_cert_bundle = undef, # version 1.11
50+
Optional[Stdlib::Absolutepath] $tls_cert_key_file = undef, # version 1.11
51+
Optional[Stdlib::Absolutepath] $tls_cert_cert_file = undef, # version 1.11
52+
Boolean $send_identity = false, # version 1.11
53+
Boolean $send_version = false, # version 1.11
54+
Optional[String[1]] $identity = undef, # version 1.11
55+
Optional[String[1]] $version = undef, # version 1.11
56+
Integer[0,1000] $sample_rate = 0, # version 1.21
57+
Boolean $log_resolver_query_messages = false, # version 1.11
58+
Boolean $log_resolver_response_messages = false, # version 1.11
59+
Boolean $log_client_query_messages = false, # version 1.11
60+
Boolean $log_client_response_messages = false, # version 1.11
61+
Boolean $log_forwarder_query_messages = false, # version 1.11
62+
Boolean $log_forwarder_response_messages = false, # version 1.11
63+
64+
) {
65+
include unbound
66+
if $enable and $socket_path == undef and $ip == undef {
67+
fail('Either ip or socket_path is required when dnstap is enabled')
68+
}
69+
if $enable {
70+
$ip_config = $ip.then |$v| {
71+
@("CONFIG")
72+
${unbound::print_config('dnstap-ip', $v, '1.11')}
73+
${unbound::print_config('dnstap-tls', $tls, '1.11')}
74+
${unbound::print_config('dnstap-tls-host', $tls_host, '1.11')}
75+
${unbound::print_config('dnstap-tls-cert-bundle', $tls_cert_bundle, '1.11')}
76+
${unbound::print_config('dnstap-tls-cert-key-file', $tls_cert_key_file, '1.11')}
77+
${unbound::print_config('dnstap-tls-cert-cert-file', $tls_cert_cert_file, '1.11')}
78+
| CONFIG
79+
}
80+
$config = @("CONFIG")
81+
dnstap:
82+
${unbound::print_config('dnstap-enable', $enable, '1.11')}
83+
${unbound::print_config('dnstap-bidirectional', $bidirectional, '1.11')}
84+
${unbound::print_config('dnstap-socket-path', $socket_path, '1.11')}
85+
${$ip_config}
86+
${unbound::print_config('dnstap-send-identity', $send_identity, '1.11')}
87+
${unbound::print_config('dnstap-send-version', $send_version, '1.11')}
88+
${unbound::print_config('dnstap-identity', $identity, '1.11')}
89+
${unbound::print_config('dnstap-version', $version, '1.11')}
90+
${unbound::print_config('dnstap-sample-rate', $sample_rate, '1.21')}
91+
${unbound::print_config('dnstap-log-resolver-query-messages', $log_resolver_query_messages, '1.11')}
92+
${unbound::print_config('dnstap-log-resolver-response-messages', $log_resolver_response_messages, '1.11')}
93+
${unbound::print_config('dnstap-log-client-query-messages', $log_client_query_messages, '1.11')}
94+
${unbound::print_config('dnstap-log-client-response-messages', $log_client_response_messages, '1.11')}
95+
${unbound::print_config('dnstap-log-forwarder-query-messages', $log_forwarder_query_messages, '1.11')}
96+
${unbound::print_config('dnstap-log-forwarder-response-messages', $log_forwarder_response_messages, '1.11')}
97+
| CONFIG
98+
concat::fragment { 'unbound-dnstap':
99+
order => '20',
100+
target => $unbound::config_file,
101+
content => $config.split("\n").filter |$x| { !$x.empty }.join("\n"),
102+
}
103+
}
104+
}

0 commit comments

Comments
 (0)