git: f0a861efbafe - main - local-unbound-setup: Support IPv6-only systems

The branch main has been updated by des:

URL: https://cgit.FreeBSD.org/src/commit/?id=f0a861efbafeb81428d5e8c23dac9da73fe14007

commit f0a861efbafeb81428d5e8c23dac9da73fe14007
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2026-06-26 14:43:26 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2026-06-26 14:43:26 +0000

    local-unbound-setup: Support IPv6-only systems
    
    * In the server configuration, disable protocols not supported by the
      kernel.
    
    * In resolv.conf, instead of only using 127.0.0.1, use either 127.0.0.1,
      ::1, or both depending on which protocols the kernel supports.
    
    MFC after:      1 week
    Reviewed by:    jlduran
    Differential Revision:  https://reviews.freebsd.org/D57840
---
 usr.sbin/unbound/setup/local-unbound-setup.sh | 50 +++++++++++++++++++++------
 1 file changed, 40 insertions(+), 10 deletions(-)

diff --git a/usr.sbin/unbound/setup/local-unbound-setup.sh b/usr.sbin/unbound/setup/local-unbound-setup.sh
index ec3aeb673ecc..6b217ec574cd 100755
--- a/usr.sbin/unbound/setup/local-unbound-setup.sh
+++ b/usr.sbin/unbound/setup/local-unbound-setup.sh
@@ -72,6 +72,19 @@ RE_forward_addr="((${RE_ipv4}|${RE_ipv6})(@${RE_port})?)"
 RE_forward_name="(${RE_dnsname}(@${RE_port})?)"
 RE_forward_tls="(${RE_forward_addr}(#${RE_dnsname})?)"
 
+#
+# Check if a kernel feature is available
+#
+has_feature() {
+	local name=$1 v
+	eval "v=\$kern_features_${name}"
+	if [ -z "$v" ] ; then
+		v="$(sysctl -qn "kern.features.${name}")"
+		eval "kern_features_${name}=$((v))"
+	fi
+	return $((!v))
+}
+
 #
 # Set default values for unset configuration variables.
 #
@@ -136,13 +149,12 @@ get_nameservers() {
 
 #
 # Scan through /etc/resolv.conf looking for uncommented nameserver
-# lines.  Comment out any that don't point to localhost.  Finally,
-# append a nameserver line that points to localhost, if there wasn't
-# one already, and enable the edns0 option.
+# lines and comment out any that don't point to localhost.  Finally,
+# append the correct nameserver lines and enable the edns0 option.
 #
 gen_resolv_conf() {
-	local localhost=no
-	local edns0=no
+	local localhost4=false localhost6=false
+	local edns0=false
 	while read line ; do
 		local bareline=${line%%\#*}
 		local key=${bareline%%[[:space:]]*}
@@ -150,8 +162,17 @@ gen_resolv_conf() {
 		case ${key} in
 		nameserver)
 			case ${value} in
-			127.0.0.1|::1|localhost|localhost.*)
-				localhost=yes
+			127.0.0.1)
+				localhost4=true
+				if ! has_feature inet ; then
+					continue
+				fi
+				;;
+			::1)
+				localhost6=true
+				if ! has_feature inet6 ; then
+					continue
+				fi
 				;;
 			*)
 				echo -n "# "
@@ -161,17 +182,20 @@ gen_resolv_conf() {
 		options)
 			case ${value} in
 			*edns0*)
-				edns0=yes
+				edns0=true
 				;;
 			esac
 			;;
 		esac
 		echo "${line}"
 	done
-	if [ "${localhost}" = "no" ] ; then
+	if ! $localhost4 && has_feature inet ; then
 		echo "nameserver 127.0.0.1"
 	fi
-	if [ "${edns0}" = "no" ] ; then
+	if ! $localhost6 && has_feature inet6 ; then
+		echo "nameserver ::1"
+	fi
+	if ! $edns0 ; then
 		echo "options edns0"
 	fi
 }
@@ -261,6 +285,12 @@ gen_unbound_conf() {
 	if [ "${use_tls}" = "yes" ] ; then
 		echo "        tls-cert-bundle: /etc/ssl/cert.pem"
 	fi
+	if ! has_feature inet ; then
+		echo "        do-ip4: no"
+	fi
+	if ! has_feature inet6 ; then
+		echo "        do-ip6: no"
+	fi
 	echo "        so-sndbuf: 0"
 	echo ""
 	if [ -f "${forward_conf}" ] ; then