diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d457918 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/unbound-1.6.6.tar.gz diff --git a/.unbound.metadata b/.unbound.metadata new file mode 100644 index 0000000..4ccc03d --- /dev/null +++ b/.unbound.metadata @@ -0,0 +1 @@ +d205c03a402f5d900d5bad3d036849a12804a49e SOURCES/unbound-1.6.6.tar.gz diff --git a/README.md b/README.md deleted file mode 100644 index 0e7897f..0000000 --- a/README.md +++ /dev/null @@ -1,5 +0,0 @@ -The master branch has no content - -Look at the c7 branch if you are working with CentOS-7, or the c4/c5/c6 branch for CentOS-4, 5 or 6 - -If you find this file in a distro specific branch, it means that no content has been checked in yet diff --git a/SOURCES/block-example.com.conf b/SOURCES/block-example.com.conf new file mode 100644 index 0000000..4807448 --- /dev/null +++ b/SOURCES/block-example.com.conf @@ -0,0 +1,10 @@ +# entries in this file override toe global DNS +# +# Example blocking email going out to example.com +# +# local-data: "example.com. 3600 IN MX 5 127.0.0.1" +# local-data: "example.com. 3600 IN A 127.0.0.1" + +# This can also be done dynamically using: unbound-control local-data [...] + +# For more complicated redirection, use conf.d/ with stub-add: or forward-add: diff --git a/SOURCES/dlv.isc.org.key b/SOURCES/dlv.isc.org.key new file mode 100644 index 0000000..c73944f --- /dev/null +++ b/SOURCES/dlv.isc.org.key @@ -0,0 +1,2 @@ +; https://secure.isc.org/ops/dlv/dlv.isc.org.key +dlv.isc.org. IN DNSKEY 257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh diff --git a/SOURCES/example.com.conf b/SOURCES/example.com.conf new file mode 100644 index 0000000..30f7f03 --- /dev/null +++ b/SOURCES/example.com.conf @@ -0,0 +1,17 @@ +# Example of an override of the "public DNS tree" with an "internal view" +# override, for example to add an internal-only corporate DNS zone. +# +# The stub-zone/stub-addr must point to AUTHORITATIVE servers. If you want to +# point to an internal RECURSIVE server, use forward-zone/forward-addr instead. + +#stub-zone: +# name: example.com +# stub-prime: no +# # if you could trust a lookup, use: +# stub-host: a.iana-servers.net. +# stub-host: b.iana-servers.net. +# # else specify the IP's using: +# stub-addr: 199.43.132.53 +# stub-addr: 2001:500:8c::53 +# stub-addr: 199.43.133.53 +# stub-addr: 2001:500:8d::53 diff --git a/SOURCES/example.com.key b/SOURCES/example.com.key new file mode 100644 index 0000000..a70c13f --- /dev/null +++ b/SOURCES/example.com.key @@ -0,0 +1,7 @@ +; // format is BIND trusted-keys format +; // Ensure to only put KSKs (usually 257) here, not ZSKs (usually 256) + +; // trusted-keys { +; // "example.com." 257 3 8 "AwEAAawt7HplI5M8GGAsxuyCyjF0l+QlcgVN11CRZ4vP66qbDCX0BnShZ11BGb//4zSG/8mmBHirL2FLg+mVuIIxig+iroZYjh4iTKVOhv2hZftRwyrQHK++qXvCCWN3ki51RG/e8R4kOEV71rZ8OgQvPWx6F91qroqOPpcf7PPxippeHOn+PxnP0hpyLyo1mx1rPs/cMpL3jOMufGP+LJYh+fBU7lt0sP5i09HaJPruzyZML9BPtpv8ZAdQhwtXVG0+MnET2qT/1+TljpxZn6yeegFRCFRHBjMo6iiRJnUWra/klkrgEn2Q+BXGTOMTTKQdYz4OxYEa1z7apu3a09dYNBM="; // key id = 51605 +; // "example.com." 257 3 8 "AwEAAeikvxboZpn9VCxm3YDLHo40SvA9EmRwJHHQyJ0OCzrQSRBSipojrW7yESXWiDDyzflS8rgzDs7M3fIdSduOdyNi55DmXPdkS8HYORTMNyzFsSOg+xx6tUySK2p4WAhlbsJNLz4IkQCek59NoDBOLyQ15npsr7Tgfb/HHU7zmCMvnxh0SqO2lyhnQfk29Thc3nC4KNJNb3drjWKOuCw5mg+2GrEZYc/VqdeGvrOCQ2el8jWZpSU5cxb7EdEy4B9nEeZiBpHXaZ5XJ+ewi4vmcUK5/445mGJqV4rDeicy5/ShC/BJ81v3bIRPWebvDRJmDbjr2d9MnLXUE7yyETrQd18="; // key id = 31589 +; // }; diff --git a/SOURCES/icannbundle.pem b/SOURCES/icannbundle.pem new file mode 100644 index 0000000..d76ce0b --- /dev/null +++ b/SOURCES/icannbundle.pem @@ -0,0 +1,237 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha256WithRSAEncryption + Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US + Validity + Not Before: Dec 23 04:19:12 2009 GMT + Not After : Dec 18 04:19:12 2029 GMT + Subject: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:a0:db:70:b8:4f:34:da:9c:d4:d0:7e:bb:ea:15: + bc:e9:c9:11:2a:1f:61:2f:6a:b9:bd:3f:3d:76:a0: + 9a:0a:f7:ee:93:6e:6e:55:53:84:8c:f2:2c:f1:82: + 27:c8:0f:9a:cf:52:1b:54:da:28:d2:2c:30:8e:dd: + fb:92:20:33:2d:d6:c8:f1:0e:10:21:88:71:fa:84: + 22:4b:5d:47:56:16:7c:9b:9f:5d:c3:11:79:9c:14: + e2:ff:c0:74:ac:dd:39:d7:e0:38:d8:b0:73:aa:fb: + d1:db:84:af:52:22:a8:f6:d5:9b:94:f4:e6:5d:5e: + e8:3f:87:90:0b:c7:1a:77:f5:2e:d3:8f:1a:ce:02: + 1d:07:69:21:47:32:da:46:ae:00:4c:b6:a5:a2:9c: + 39:c1:c0:4a:f6:d3:1c:ae:d3:6d:bb:c7:18:f0:7e: + ed:f6:80:ce:d0:01:2e:89:de:12:ba:ee:11:cb:a6: + 7a:d7:0d:7c:f3:08:8d:72:9d:bf:55:75:13:70:bb: + 31:22:4a:cb:e8:c0:aa:a4:09:aa:36:68:40:60:74: + 9d:e7:19:81:43:22:52:fe:c9:2b:52:0f:41:13:36: + 09:72:65:95:cc:89:ae:6f:56:17:16:34:73:52:a3: + 04:ed:bd:88:82:8a:eb:d7:dc:82:52:9c:06:e1:52: + 85:41 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign + X509v3 Subject Key Identifier: + BA:52:E9:49:83:24:86:52:2F:C7:99:CD:FC:8D:6B:69:08:4D:C0:50 + Signature Algorithm: sha256WithRSAEncryption + 0f:f1:e9:82:a2:0a:87:9f:2d:94:60:5a:b2:c0:4b:a1:2f:2b: + 3b:47:d5:0a:99:86:38:b2:ec:c6:3b:89:e4:6e:07:cf:14:c7: + c7:e8:cf:99:8f:aa:30:c3:19:70:b9:e6:6d:d6:3f:c8:68:26: + b2:a0:a5:37:42:ca:d8:62:80:d1:a2:5a:48:2e:1f:85:3f:0c: + 7b:c2:c7:94:11:5f:19:2a:95:ac:a0:3a:03:d8:91:5b:2e:0d: + 9c:7c:1f:2e:fc:e9:44:e1:16:26:73:1c:45:4a:65:c1:83:4c: + 90:f3:f2:28:42:df:db:c4:e7:04:12:18:62:43:5e:bc:1f:6c: + 84:e6:bc:49:32:df:61:d7:99:ee:e4:90:52:7b:0a:c2:91:8a: + 98:62:66:b1:c8:e0:b7:5a:b5:46:7c:76:71:54:8e:cc:a4:81: + 5c:19:db:d2:6f:66:b5:bb:2b:ae:6b:c9:74:04:a8:24:de:e8: + c5:d3:fc:2c:1c:d7:8f:db:6a:8d:c9:53:be:5d:50:73:ac:cf: + 1f:93:c0:52:50:5b:a2:4f:fe:ad:65:36:17:46:d1:2d:e5:a2: + 90:66:05:db:29:4e:5d:50:5d:e3:4f:da:a0:8f:f0:6b:e4:16: + 70:dd:7f:f3:77:7d:b9:4e:f9:ec:c3:33:02:d7:e9:63:2f:31: + e7:40:61:a4 +-----BEGIN CERTIFICATE----- +MIIDdzCCAl+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO +TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV +BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTA5MTIyMzA0MTkxMloX +DTI5MTIxODA0MTkxMlowXTEOMAwGA1UEChMFSUNBTk4xJjAkBgNVBAsTHUlDQU5O +IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRYwFAYDVQQDEw1JQ0FOTiBSb290IENB +MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKDb +cLhPNNqc1NB+u+oVvOnJESofYS9qub0/PXagmgr37pNublVThIzyLPGCJ8gPms9S +G1TaKNIsMI7d+5IgMy3WyPEOECGIcfqEIktdR1YWfJufXcMReZwU4v/AdKzdOdfg +ONiwc6r70duEr1IiqPbVm5T05l1e6D+HkAvHGnf1LtOPGs4CHQdpIUcy2kauAEy2 +paKcOcHASvbTHK7TbbvHGPB+7faAztABLoneErruEcumetcNfPMIjXKdv1V1E3C7 +MSJKy+jAqqQJqjZoQGB0necZgUMiUv7JK1IPQRM2CXJllcyJrm9WFxY0c1KjBO29 +iIKK69fcglKcBuFShUECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B +Af8EBAMCAf4wHQYDVR0OBBYEFLpS6UmDJIZSL8eZzfyNa2kITcBQMA0GCSqGSIb3 +DQEBCwUAA4IBAQAP8emCogqHny2UYFqywEuhLys7R9UKmYY4suzGO4nkbgfPFMfH +6M+Zj6owwxlwueZt1j/IaCayoKU3QsrYYoDRolpILh+FPwx7wseUEV8ZKpWsoDoD +2JFbLg2cfB8u/OlE4RYmcxxFSmXBg0yQ8/IoQt/bxOcEEhhiQ168H2yE5rxJMt9h +15nu5JBSewrCkYqYYmaxyOC3WrVGfHZxVI7MpIFcGdvSb2a1uyuua8l0BKgk3ujF +0/wsHNeP22qNyVO+XVBzrM8fk8BSUFuiT/6tZTYXRtEt5aKQZgXbKU5dUF3jT9qg +j/Br5BZw3X/zd325TvnswzMC1+ljLzHnQGGk +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 11 (0xb) + Signature Algorithm: sha256WithRSAEncryption + Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US + Validity + Not Before: Nov 8 23:39:47 2016 GMT + Not After : Nov 6 23:39:47 2026 GMT + Subject: O=ICANN, CN=ICANN EMAIL CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:d2:19:1e:22:69:33:f6:a4:d2:76:c5:80:11:75: + 8e:d0:e8:6f:bf:89:f8:2a:6a:da:8a:85:28:40:ba: + c5:23:5f:47:ed:72:e2:8e:d3:5c:c8:8a:3a:99:a9: + 57:2c:0a:2b:22:f3:54:7b:8b:f7:8c:21:a2:50:01: + 4f:8b:af:34:df:72:fc:78:31:d0:1d:eb:bc:9b:e6: + fa:c1:84:d0:05:07:8a:74:53:a5:60:9e:eb:75:9e: + a8:5d:32:c8:02:32:e4:bf:cb:97:9b:7a:fa:2c:f6: + 6a:1d:b8:57:ad:e3:03:22:93:d0:f4:4f:a8:b8:01: + db:82:33:98:b6:87:ed:3d:67:40:00:27:2e:d5:95: + d2:ad:36:46:14:c6:17:79:65:7f:65:f3:88:80:65: + 7c:22:67:08:23:3c:cf:a5:10:38:72:30:97:92:6f: + 20:4a:ba:24:4c:4a:c8:4a:a5:dc:2a:44:a1:29:78: + b4:9f:fe:84:ff:27:5b:3a:72:ea:31:c1:ad:06:22: + d6:44:a0:4a:57:32:9c:f2:46:47:d0:89:6e:20:23: + 2c:ea:b0:83:7e:c1:f3:ea:da:dd:e3:63:59:97:21: + fa:1b:11:39:27:cf:82:8b:56:15:d4:36:92:0c:a5: + 7e:80:e0:18:c9:50:08:42:0a:df:97:3c:9c:b8:0a: + 4d:b1 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:BA:52:E9:49:83:24:86:52:2F:C7:99:CD:FC:8D:6B:69:08:4D:C0:50 + + X509v3 Subject Key Identifier: + 7B:3F:BA:CE:A1:B3:A6:13:2E:5A:82:84:D4:D2:EA:A5:24:F1:CD:B4 + Signature Algorithm: sha256WithRSAEncryption + 0e:8a:c9:ea:6f:9c:e9:23:b6:9c:a6:a4:c2:d1:b1:ee:25:18: + 24:2b:79:d4:a8:f2:99:b9:5c:91:4d:e6:2b:32:2e:01:f5:87: + 95:64:fc:6d:f1:87:fa:24:b4:43:4b:49:f3:84:54:44:eb:af: + 41:ab:49:ab:c8:b7:32:6c:14:83:5b:d7:2c:41:f9:89:d5:c4: + 2b:9a:55:c5:b6:ad:17:d5:4d:bc:41:58:56:72:0d:db:b7:7d: + 57:c6:a2:9c:7e:6b:67:ae:26:f8:26:45:bb:c4:95:2e:ea:71: + e3:b4:7a:69:95:a4:8a:80:f8:59:dc:88:6e:e1:a7:fc:bb:8e: + b2:aa:a8:b6:1b:2f:2c:97:a5:12:d5:82:ae:a0:e8:a6:15:fd: + d1:e0:5d:e4:84:b1:76:db:0a:e2:ca:58:2e:d3:df:48:4e:46: + ac:c6:35:79:17:99:ce:e9:be:2c:e4:c2:50:ff:5b:96:15:cd: + 64:ac:1b:db:fe:d2:ac:43:61:c8:5f:ee:24:b6:a4:3b:d2:ff: + 0a:f4:0c:88:58:a1:9d:a4:c1:1f:6a:6c:67:90:98:e8:1f:5e: + 2d:55:60:91:26:2a:b1:66:80:e4:e6:0e:05:2c:75:a9:ca:0b: + e4:a0:8f:e1:47:a8:8f:61:5d:7c:ce:09:60:88:48:c3:46:bf: + be:7e:36:be +-----BEGIN CERTIFICATE----- +MIIDZDCCAkygAwIBAgIBCzANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO +TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV +BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTE2MTEwODIzMzk0N1oX +DTI2MTEwNjIzMzk0N1owKTEOMAwGA1UEChMFSUNBTk4xFzAVBgNVBAMTDklDQU5O +IEVNQUlMIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0hkeImkz +9qTSdsWAEXWO0Ohvv4n4KmraioUoQLrFI19H7XLijtNcyIo6malXLAorIvNUe4v3 +jCGiUAFPi68033L8eDHQHeu8m+b6wYTQBQeKdFOlYJ7rdZ6oXTLIAjLkv8uXm3r6 +LPZqHbhXreMDIpPQ9E+ouAHbgjOYtoftPWdAACcu1ZXSrTZGFMYXeWV/ZfOIgGV8 +ImcIIzzPpRA4cjCXkm8gSrokTErISqXcKkShKXi0n/6E/ydbOnLqMcGtBiLWRKBK +VzKc8kZH0IluICMs6rCDfsHz6trd42NZlyH6GxE5J8+Ci1YV1DaSDKV+gOAYyVAI +QgrflzycuApNsQIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE +AwIBBjAfBgNVHSMEGDAWgBS6UulJgySGUi/Hmc38jWtpCE3AUDAdBgNVHQ4EFgQU +ez+6zqGzphMuWoKE1NLqpSTxzbQwDQYJKoZIhvcNAQELBQADggEBAA6KyepvnOkj +tpympMLRse4lGCQredSo8pm5XJFN5isyLgH1h5Vk/G3xh/oktENLSfOEVETrr0Gr +SavItzJsFINb1yxB+YnVxCuaVcW2rRfVTbxBWFZyDdu3fVfGopx+a2euJvgmRbvE +lS7qceO0emmVpIqA+FnciG7hp/y7jrKqqLYbLyyXpRLVgq6g6KYV/dHgXeSEsXbb +CuLKWC7T30hORqzGNXkXmc7pvizkwlD/W5YVzWSsG9v+0qxDYchf7iS2pDvS/wr0 +DIhYoZ2kwR9qbGeQmOgfXi1VYJEmKrFmgOTmDgUsdanKC+Sgj+FHqI9hXXzOCWCI +SMNGv75+Nr4= +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 10 (0xa) + Signature Algorithm: sha256WithRSAEncryption + Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US + Validity + Not Before: Nov 8 23:38:16 2016 GMT + Not After : Nov 6 23:38:16 2026 GMT + Subject: O=ICANN, CN=ICANN SSL CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:dd:c6:ab:bf:7c:66:9d:b3:2b:96:00:14:c7:60: + 7a:8d:62:5b:26:4b:30:d7:b3:4c:82:69:c6:4d:4d: + 73:f3:d4:91:21:5d:ab:35:f0:c8:04:0e:f4:a3:35: + e2:e1:18:a9:98:12:03:58:f8:9f:eb:77:54:5b:89: + 81:26:c9:aa:c2:f4:c9:0c:82:57:2a:5e:05:e9:61: + 17:cc:19:18:71:eb:35:83:c1:86:9d:ec:f1:6b:ca: + dd:a1:96:0b:95:d4:e1:0f:9e:24:6f:dc:3c:d0:28: + 9e:f2:53:47:2b:a1:ad:32:03:c8:3f:0d:80:80:7d: + f0:02:d2:6e:5a:2c:44:21:9b:09:50:15:3f:a1:3d: + d3:c9:c8:24:e7:ea:4e:92:2f:94:90:2e:de:e7:68: + f6:c6:b3:90:1f:bc:c9:7b:a2:65:d7:11:e9:8b:f0: + 3a:5a:b7:17:07:df:69:e3:6e:b9:54:6a:8e:3a:aa: + 94:7f:2c:0a:a1:ad:ba:b7:d9:60:62:27:a7:71:40: + 3b:8e:b0:84:7b:b8:c8:67:ef:66:ba:3d:ac:c3:85: + e5:86:bb:a7:9c:fd:b6:e1:c0:10:53:3d:d4:7e:1b: + 09:e6:9f:22:5c:a7:27:09:7e:27:12:33:fa:df:9b: + 20:2f:14:f7:17:c0:e4:1e:07:91:1f:f9:9a:cd:a8: + e2:c5 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:BA:52:E9:49:83:24:86:52:2F:C7:99:CD:FC:8D:6B:69:08:4D:C0:50 + + X509v3 Subject Key Identifier: + 6E:77:A8:40:10:4A:D8:9C:0C:F2:B7:5A:3A:A5:2F:79:4A:61:14:D8 + Signature Algorithm: sha256WithRSAEncryption + 47:46:4f:c7:5f:46:e3:d1:dc:fc:2b:f8:fc:65:ce:36:b1:f4: + 5f:ee:14:75:a3:d9:5f:de:75:4b:fa:7b:88:9f:10:8c:2e:97: + cc:35:1b:ce:24:d3:36:60:95:d5:ae:11:b6:3f:8b:f4:12:69: + 85:b5:3b:2a:b6:ab:7a:81:85:c2:55:57:ed:d0:b5:e7:4f:54: + 37:51:24:c9:d5:07:3a:ef:b6:c5:1a:3e:14:29:a7:a6:f8:08: + 2a:0b:26:79:f9:62:85:4a:e5:ea:90:ca:71:38:16:91:4e:7e: + fd:e3:b3:f3:55:8f:5a:d0:86:cf:33:94:88:f1:90:99:cb:81: + e2:81:92:68:2f:c3:61:d5:52:8d:e6:9a:5b:00:83:42:27:88: + f6:d9:fa:d1:bc:bb:b0:bc:b5:14:0b:4e:1a:54:ef:fa:d6:9d: + c4:0c:fc:ed:15:ab:21:4b:45:b5:d9:3b:ed:3c:d5:1e:2e:7a: + 83:6f:24:45:d4:4c:b4:ef:60:43:18:d0:84:5d:16:7b:f5:50: + 80:b1:a9:c2:8f:3b:c8:90:08:fd:aa:17:13:19:38:19:d1:8e: + 85:7c:1e:57:16:8c:f9:8a:e8:29:25:38:cd:bb:55:8e:4a:6a: + 6f:e5:7d:fc:d7:55:d6:ae:38:07:96:c1:97:ff:e5:2b:4f:99: + 2d:70:f2:08 +-----BEGIN CERTIFICATE----- +MIIDYjCCAkqgAwIBAgIBCjANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO +TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV +BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTE2MTEwODIzMzgxNloX +DTI2MTEwNjIzMzgxNlowJzEOMAwGA1UEChMFSUNBTk4xFTATBgNVBAMTDElDQU5O +IFNTTCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3Gq798Zp2z +K5YAFMdgeo1iWyZLMNezTIJpxk1Nc/PUkSFdqzXwyAQO9KM14uEYqZgSA1j4n+t3 +VFuJgSbJqsL0yQyCVypeBelhF8wZGHHrNYPBhp3s8WvK3aGWC5XU4Q+eJG/cPNAo +nvJTRyuhrTIDyD8NgIB98ALSblosRCGbCVAVP6E908nIJOfqTpIvlJAu3udo9saz +kB+8yXuiZdcR6YvwOlq3FwffaeNuuVRqjjqqlH8sCqGturfZYGInp3FAO46whHu4 +yGfvZro9rMOF5Ya7p5z9tuHAEFM91H4bCeafIlynJwl+JxIz+t+bIC8U9xfA5B4H +kR/5ms2o4sUCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC +AQYwHwYDVR0jBBgwFoAUulLpSYMkhlIvx5nN/I1raQhNwFAwHQYDVR0OBBYEFG53 +qEAQSticDPK3WjqlL3lKYRTYMA0GCSqGSIb3DQEBCwUAA4IBAQBHRk/HX0bj0dz8 +K/j8Zc42sfRf7hR1o9lf3nVL+nuInxCMLpfMNRvOJNM2YJXVrhG2P4v0EmmFtTsq +tqt6gYXCVVft0LXnT1Q3USTJ1Qc677bFGj4UKaem+AgqCyZ5+WKFSuXqkMpxOBaR +Tn7947PzVY9a0IbPM5SI8ZCZy4HigZJoL8Nh1VKN5ppbAINCJ4j22frRvLuwvLUU +C04aVO/61p3EDPztFashS0W12TvtPNUeLnqDbyRF1Ey072BDGNCEXRZ79VCAsanC +jzvIkAj9qhcTGTgZ0Y6FfB5XFoz5iugpJTjNu1WOSmpv5X3811XWrjgHlsGX/+Ur +T5ktcPII +-----END CERTIFICATE----- diff --git a/SOURCES/root.anchor b/SOURCES/root.anchor new file mode 100644 index 0000000..1d2f75d --- /dev/null +++ b/SOURCES/root.anchor @@ -0,0 +1,2 @@ +. 98799 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b} +. 98799 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} diff --git a/SOURCES/root.key b/SOURCES/root.key new file mode 100644 index 0000000..d8aca0c --- /dev/null +++ b/SOURCES/root.key @@ -0,0 +1,7 @@ +; // The root key in bind format. This can be read by most tools, including +; // named, unbound, et. For libunbound, use ub_ctx_trustedkeys() to load this +trusted-keys { +"." 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0="; // key id = 19036 +"." 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU="; // key id = 20326 + +}; diff --git a/SOURCES/tmpfiles-unbound.conf b/SOURCES/tmpfiles-unbound.conf new file mode 100644 index 0000000..d625589 --- /dev/null +++ b/SOURCES/tmpfiles-unbound.conf @@ -0,0 +1 @@ +D /var/run/unbound 0755 unbound unbound - diff --git a/SOURCES/unbound-1.6.3-coverity.patch b/SOURCES/unbound-1.6.3-coverity.patch new file mode 100644 index 0000000..bab7a68 --- /dev/null +++ b/SOURCES/unbound-1.6.3-coverity.patch @@ -0,0 +1,92 @@ +diff --git a/compat/arc4_lock.c b/compat/arc4_lock.c +index 0c45ad0..7fb9cdc 100644 +--- a/compat/arc4_lock.c ++++ b/compat/arc4_lock.c +@@ -32,7 +32,7 @@ + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + #include "config.h" +-#define LOCKRET(func) func ++#define LOCKRET(func) (void)func + #include "util/locks.h" + + void _ARC4_LOCK(void); +diff --git a/daemon/remote.c b/daemon/remote.c +index 243d94c..a377aca 100644 +--- a/daemon/remote.c ++++ b/daemon/remote.c +@@ -371,7 +371,9 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err, + (unsigned)cfg_uid, (unsigned)cfg_gid, + ip, strerror(errno)); + } +- chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP)); ++ if (chmod(ip, (mode_t)(S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP)) == -1) ++ verbose(VERB_QUERY, "cannot chmod %s: %s", ++ ip, strerror(errno)); + #else + (void)cfg; + #endif +@@ -387,7 +389,7 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err, + } + #endif /* USE_WINSOCK */ + log_err("control interface %s:%s getaddrinfo: %s %s", +- ip?ip:"default", port, gai_strerror(r), ++ ip, port, gai_strerror(r), + #ifdef EAI_SYSTEM + r==EAI_SYSTEM?(char*)strerror(errno):"" + #else +diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c +index 1bee85c..6bdfe41 100644 +--- a/iterator/iter_scrub.c ++++ b/iterator/iter_scrub.c +@@ -437,7 +437,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, + rrset->rrset_all_next = + nx->rrset_all_next; + nx->rrset_all_next = rrset; +- prev = nx; + } + } + +diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c +index 3b53676..36c67c6 100644 +--- a/services/listen_dnsport.c ++++ b/services/listen_dnsport.c +@@ -1072,11 +1072,11 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, + { + int s, noip6=0; + #ifdef USE_DNSCRYPT +- int is_dnscrypt = ((strchr(ifname, '@') && ++ const int is_dnscrypt = ((strchr(ifname, '@') && + atoi(strchr(ifname, '@')+1) == dnscrypt_port) || + (!strchr(ifname, '@') && atoi(port) == dnscrypt_port)); + #else +- int is_dnscrypt = 0; ++ const int is_dnscrypt = 0; + (void)dnscrypt_port; + #endif + +diff --git a/services/localzone.c b/services/localzone.c +index 6bde432..00d044a 100644 +--- a/services/localzone.c ++++ b/services/localzone.c +@@ -1079,7 +1079,7 @@ local_zones_tags_lookup(struct local_zones* zones, + key.name = name; + key.namelen = len; + key.namelabs = labs; +- rbtree_find_less_equal(&zones->ztree, &key, &res); ++ (void)rbtree_find_less_equal(&zones->ztree, &key, &res); + result = (struct local_zone*)res; + /* exact or smaller element (or no element) */ + if(!result || result->dclass != dclass) +diff --git a/smallapp/unbound-host.c b/smallapp/unbound-host.c +index d7a36a2..68f789a 100644 +--- a/smallapp/unbound-host.c ++++ b/smallapp/unbound-host.c +@@ -330,6 +330,7 @@ pretty_output(char* q, int t, int c, struct ub_result* result, int docname) + exit(1); + } + printf("%s\n", s); ++ free(s); + } else printf(" has no %s record", tstr); + printf(" %s\n", secstatus); + } diff --git a/SOURCES/unbound-1.6.3-longcheck-fixup.patch b/SOURCES/unbound-1.6.3-longcheck-fixup.patch new file mode 100644 index 0000000..8e63a3e --- /dev/null +++ b/SOURCES/unbound-1.6.3-longcheck-fixup.patch @@ -0,0 +1,71 @@ +diff --git a/testcode/do-tests.sh b/testcode/do-tests.sh +index 5439f0f..1e9a424 100755 +--- a/testcode/do-tests.sh ++++ b/testcode/do-tests.sh +@@ -1,6 +1,10 @@ + #!/usr/bin/env bash + . testdata/common.sh + ++# make sure that the binaries used during tests can find the libraries compiled with them ++LD_LIBRARY_PATH_BAK="$LD_LIBRARY_PATH" ++export LD_LIBRARY_PATH="$(pwd)/.libs" ++ + NEED_SPLINT='00-lint.tdir' + NEED_DOXYGEN='01-doc.tdir' + NEED_XXD='fwd_compress_c00c.tdir fwd_zero.tdir' +@@ -11,6 +15,20 @@ NEED_IPV6='fwd_ancil.tdir fwd_tcp_tc6.tdir stub_udp6.tdir edns_cache.tdir' + NEED_NOMINGW='tcp_sigpipe.tdir 07-confroot.tdir 08-host-lib.tdir fwd_ancil.tdir' + NEED_DNSCRYPT_PROXY='dnscrypt_queries.tdir dnscrypt_queries_chacha.tdir' + ++# 01-doc - checks for errors and warnings and there are warnings due to obsolted keywords ++# in the doxygen documentation. Not a big deal, therefore skipping this. ++# ++# 06-ianaports - This checks if the bundled copy is up to date, which is obviously not ++# as the version we are shipping is old version ++# ++# root_anchor - This fails because the pem file has been updated and re are shipping an ++# old copy of it. ++# ++# root_hints - This fails because addresses of root servers changed and we are shipping ++# an old copy of it. This is not an issue as all servers usually do priming on startup ++# ++ALWAYS_SKIP='01-doc.tdir 06-ianaports.tdir root_anchor.tdir root_hints.tdir' ++ + # test if dig and ldns-testns are available. + test_tool_avail "dig" + test_tool_avail "ldns-testns" +@@ -52,6 +70,11 @@ for test in `ls -d *.tdir`; do + SKIP=1; + fi + fi ++ ++ if echo $ALWAYS_SKIP | grep $test >/dev/null; then ++ SKIP=1; ++ fi ++ + if test $SKIP -eq 0; then + echo $test + sh ../testcode/mini_tdir.sh -a ../.. exe $test +@@ -59,5 +82,21 @@ for test in `ls -d *.tdir`; do + echo "skip $test" + fi + done +-sh ../testcode/mini_tdir.sh report ++sh ../testcode/mini_tdir.sh report > .report.txt ++cat .report.txt ++ ++# Make sure the test suite fails when some test failed ++if grep "FAILED" .report.txt >/dev/null; then ++ echo "Some tests FAILED!!!" ++ RESULTS=1 ++else ++ echo "All tests PASSED" ++ RESULTS=0 ++fi ++rm -f .report.txt + cat .perfstats.txt ++ ++# restore LD_LIBRARY_PATH ++export LD_LIBRARY_PATH=$LD_LIBRARY_PATH_BAK ++ ++exit $RESULTS diff --git a/SOURCES/unbound-1.6.3-print-test-fails.patch b/SOURCES/unbound-1.6.3-print-test-fails.patch new file mode 100644 index 0000000..367dc5f --- /dev/null +++ b/SOURCES/unbound-1.6.3-print-test-fails.patch @@ -0,0 +1,17 @@ +diff --git a/testcode/mini_tpkg.sh b/testcode/mini_tpkg.sh +index ebf27a7..d0a66aa 100755 +--- a/testcode/mini_tpkg.sh ++++ b/testcode/mini_tpkg.sh +@@ -116,6 +116,12 @@ if test -f $name.post; then + fi + echo "DateRunEnd: "`date "+%s" 2>/dev/null` >> $result + ++if test "$success" = "no"; then ++ echo "## Start of $name" ++ cat $result ++ echo "## End of $name" ++fi ++ + mv $result .. + cd .. + rm -rf $dir diff --git a/SOURCES/unbound-1.6.6-test-fwd_oneport.patch b/SOURCES/unbound-1.6.6-test-fwd_oneport.patch new file mode 100644 index 0000000..582790b --- /dev/null +++ b/SOURCES/unbound-1.6.6-test-fwd_oneport.patch @@ -0,0 +1,56 @@ +From f41fcb93de47ddf2ec5063be1df29e99cafc61c0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Wed, 11 Oct 2017 23:04:50 +0200 +Subject: [PATCH 1/2] Do not fail if two tests run on the same machine. + Randomize outgoing port too. + +--- + testdata/fwd_oneport.tdir/fwd_oneport.conf | 2 +- + testdata/fwd_oneport.tdir/fwd_oneport.pre | 7 +++++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/testdata/fwd_oneport.tdir/fwd_oneport.conf b/testdata/fwd_oneport.tdir/fwd_oneport.conf +index f3427fe..76cade4 100644 +--- a/testdata/fwd_oneport.tdir/fwd_oneport.conf ++++ b/testdata/fwd_oneport.tdir/fwd_oneport.conf +@@ -5,7 +5,7 @@ server: + port: @PORT@ + outgoing-range: 2 + outgoing-port-avoid: 0-65535 +- outgoing-port-permit: 20675 ++ outgoing-port-permit: @OUTPORT@ + directory: "" + pidfile: "unbound.pid" + chroot: "" +diff --git a/testdata/fwd_oneport.tdir/fwd_oneport.pre b/testdata/fwd_oneport.tdir/fwd_oneport.pre +index eeb5238..256d8dc 100644 +--- a/testdata/fwd_oneport.tdir/fwd_oneport.pre ++++ b/testdata/fwd_oneport.tdir/fwd_oneport.pre +@@ -5,11 +5,13 @@ + [ -f .tpkg.var.test ] && source .tpkg.var.test + + . ../common.sh +-get_random_port 2 ++get_random_port 3 + UNBOUND_PORT=$RND_PORT + FWD_PORT=$(($RND_PORT + 1)) ++OUT_PORT=$(($RND_PORT + 2)) + echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test + echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test ++echo "OUT_PORT=$OUT_PORT" >> .tpkg.var.test + + # start forwarder + get_ldns_testns +@@ -18,7 +20,8 @@ FWD_PID=$! + echo "FWD_PID=$FWD_PID" >> .tpkg.var.test + + # make config file +-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' < fwd_oneport.conf > ub.conf ++sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@OUTPORT\@/'$OUT_PORT'/' < fwd_oneport.conf > ub.conf ++ + # start unbound in the background + PRE="../.." + $PRE/unbound -d -c ub.conf >unbound.log 2>&1 & +-- +2.9.5 + diff --git a/SOURCES/unbound-anchor.service b/SOURCES/unbound-anchor.service new file mode 100644 index 0000000..26656b3 --- /dev/null +++ b/SOURCES/unbound-anchor.service @@ -0,0 +1,9 @@ +[Unit] +Description=update of the root trust anchor for DNSSEC validation in unbound +Documentation=man:unbound-anchor(8) + +[Service] +Type=oneshot +User=unbound +ExecStart=/usr/sbin/unbound-anchor -a /var/lib/unbound/root.key -c /etc/unbound/icannbundle.pem +SuccessExitStatus=1 diff --git a/SOURCES/unbound-anchor.timer b/SOURCES/unbound-anchor.timer new file mode 100644 index 0000000..a87bf5c --- /dev/null +++ b/SOURCES/unbound-anchor.timer @@ -0,0 +1,14 @@ +[Unit] +Description=daily update of the root trust anchor for DNSSEC +Documentation=man:unbound-anchor(8) + +[Timer] +# Current DNSKEY TTL in root zone is 172800 seconds, i.e. 172800/60/60/24 = 2 days. +# It means that unboud-anchor should be run at least once a day. +OnCalendar=daily +Persistent=true +AccuracySec=24h + +[Install] +WantedBy=timers.target + diff --git a/SOURCES/unbound-keygen.service b/SOURCES/unbound-keygen.service new file mode 100644 index 0000000..ccb2376 --- /dev/null +++ b/SOURCES/unbound-keygen.service @@ -0,0 +1,15 @@ +[Unit] +Description=Unbound Control Key And Certificate Generator +After=syslog.target +Before=unbound.service +ConditionPathExists=!/etc/unbound/unbound_control.key + +[Service] +Type=oneshot +Group=unbound +ExecStart=/usr/sbin/unbound-control-setup -d /etc/unbound/ +ExecStart=/sbin/restorecon /etc/unbound/* +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/SOURCES/unbound-munin.README b/SOURCES/unbound-munin.README new file mode 100644 index 0000000..8fa4329 --- /dev/null +++ b/SOURCES/unbound-munin.README @@ -0,0 +1,5 @@ + +To activate the munin plugins, run (as root): + +cd /etc/munin/plugins +for i in /usr/share/munin/plugins/unbound_*; do ln -s $i; done diff --git a/SOURCES/unbound.conf b/SOURCES/unbound.conf new file mode 100644 index 0000000..d62a38b --- /dev/null +++ b/SOURCES/unbound.conf @@ -0,0 +1,860 @@ +# +# See unbound.conf(5) man page. +# +# this is a comment. + +#Use this to include other text into the file. +#include: "otherfile.conf" + +# The server clause sets the main parameters. +server: + # whitespace is not necessary, but looks cleaner. + + # verbosity number, 0 is least verbose. 1 is default. + verbosity: 1 + + # print statistics to the log (for every thread) every N seconds. + # Set to "" or 0 to disable. Default is disabled. + # Needs to be disabled for munin plugin + statistics-interval: 0 + + # enable shm for stats, default no. if you enable also enable + # statistics-interval, every time it also writes stats to the + # shared memory segment keyed with shm-key. + # shm-enable: no + + # shm for stats uses this key, and key+1 for the shared mem segment. + # shm-key: 11777 + + # enable cumulative statistics, without clearing them after printing. + # Needs to be disabled for munin plugin + statistics-cumulative: no + + # enable extended statistics (query types, answer codes, status) + # printed from unbound-control. default off, because of speed. + # Needs to be enabled for munin plugin + extended-statistics: yes + + # number of threads to create. 1 disables threading. + num-threads: 4 + + # specify the interfaces to answer queries from by ip-address. + # The default is to listen to localhost (127.0.0.1 and ::1). + # specify 0.0.0.0 and ::0 to bind to all available interfaces. + # specify every interface[@port] on a new 'interface:' labelled line. + # The listen interfaces are not changed on reload, only on restart. + # interface: 0.0.0.0 + # interface: ::0 + # interface: 192.0.2.153 + # interface: 192.0.2.154 + # interface: 192.0.2.154@5003 + # interface: 2001:DB8::5 + # + # for dns over tls and raw dns over port 80 + # interface: 0.0.0.0@443 + # interface: ::0@443 + # interface: 0.0.0.0@80 + # interface: ::0@80 + + # enable this feature to copy the source address of queries to reply. + # Socket options are not supported on all platforms. experimental. + # interface-automatic: yes + # + # NOTE: Enable this option when specifying interface 0.0.0.0 or ::0 + # NOTE: Disabled per Fedora policy not to listen to * on default install + # NOTE: If deploying on non-default port, eg 80/443, this needs to be disabled + interface-automatic: no + + # port to answer queries from + # port: 53 + + # specify the interfaces to send outgoing queries to authoritative + # server from by ip-address. If none, the default (all) interface + # is used. Specify every interface on a 'outgoing-interface:' line. + # outgoing-interface: 192.0.2.153 + # outgoing-interface: 2001:DB8::5 + # outgoing-interface: 2001:DB8::6 + + # Specify a netblock to use remainder 64 bits as random bits for + # upstream queries. Uses freebind option (Linux). + # outgoing-interface: 2001:DB8::/64 + # Also (Linux:) ip -6 addr add 2001:db8::/64 dev lo + # And: ip -6 route add local 2001:db8::/64 dev lo + # And set prefer-ip6: yes to use the ip6 randomness from a netblock. + # Set this to yes to prefer ipv6 upstream servers over ipv4. + # prefer-ip6: no + + # number of ports to allocate per thread, determines the size of the + # port range that can be open simultaneously. About double the + # num-queries-per-thread, or, use as many as the OS will allow you. + # outgoing-range: 4096 + + # permit unbound to use this port number or port range for + # making outgoing queries, using an outgoing interface. + # outgoing-port-permit: 32768-65535 + + # deny unbound the use this of port number or port range for + # making outgoing queries, using an outgoing interface. + # Use this to make sure unbound does not grab a UDP port that some + # other server on this computer needs. The default is to avoid + # IANA-assigned port numbers. + # If multiple outgoing-port-permit and outgoing-port-avoid options + # are present, they are processed in order. + # outgoing-port-avoid: 0-32767 + + # number of outgoing simultaneous tcp buffers to hold per thread. + # outgoing-num-tcp: 10 + + # number of incoming simultaneous tcp buffers to hold per thread. + # incoming-num-tcp: 10 + + # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). + # 0 is system default. Use 4m to catch query spikes for busy servers. + # so-rcvbuf: 0 + + # buffer size for UDP port 53 outgoing (SO_SNDBUF socket option). + # 0 is system default. Use 4m to handle spikes on very busy servers. + # so-sndbuf: 0 + + # use SO_REUSEPORT to distribute queries over threads. + so-reuseport: yes + + # use IP_TRANSPARENT so the interface: addresses can be non-local + # and you can config non-existing IPs that are going to work later on + # (uses IP_BINDANY on FreeBSD). + ip-transparent: yes + + # use IP_FREEBIND so the interface: addresses can be non-local + # and you can bind to nonexisting IPs and interfaces that are down. + # Linux only. On Linux you also have ip-transparent that is similar. + # ip-freebind: no + + # EDNS reassembly buffer to advertise to UDP peers (the actual buffer + # is set with msg-buffer-size). 1472 can solve fragmentation (timeouts). + # edns-buffer-size: 4096 + + # Maximum UDP response size (not applied to TCP response). + # Suggested values are 512 to 4096. Default is 4096. 65536 disables it. + # 3072 causes +dnssec any isc.org queries to need TC=1. + # Helps mitigating DDOS + # max-udp-size: 3072 + + # buffer size for handling DNS data. No messages larger than this + # size can be sent or received, by UDP or TCP. In bytes. + # msg-buffer-size: 65552 + + # the amount of memory to use for the message cache. + # plain value in bytes or you can append k, m or G. default is "4Mb". + # msg-cache-size: 4m + + # the number of slabs to use for the message cache. + # the number of slabs must be a power of 2. + # more slabs reduce lock contention, but fragment memory usage. + # msg-cache-slabs: 4 + + # the number of queries that a thread gets to service. + # num-queries-per-thread: 1024 + + # if very busy, 50% queries run to completion, 50% get timeout in msec + # jostle-timeout: 200 + + # msec to wait before close of port on timeout UDP. 0 disables. + # delay-close: 0 + + # the amount of memory to use for the RRset cache. + # plain value in bytes or you can append k, m or G. default is "4Mb". + # rrset-cache-size: 4m + + # the number of slabs to use for the RRset cache. + # the number of slabs must be a power of 2. + # more slabs reduce lock contention, but fragment memory usage. + # rrset-cache-slabs: 4 + + # the time to live (TTL) value lower bound, in seconds. Default 0. + # If more than an hour could easily give trouble due to stale data. + # cache-min-ttl: 0 + + # the time to live (TTL) value cap for RRsets and messages in the + # cache. Items are not cached for longer. In seconds. + # cache-max-ttl: 86400 + + # the time to live (TTL) value cap for negative responses in the cache + # cache-max-negative-ttl: 3600 + + # the time to live (TTL) value for cached roundtrip times, lameness and + # EDNS version information for hosts. In seconds. + # infra-host-ttl: 900 + + # minimum wait time for responses, increase if uplink is long. In msec. + # infra-cache-min-rtt: 50 + + # the number of slabs to use for the Infrastructure cache. + # the number of slabs must be a power of 2. + # more slabs reduce lock contention, but fragment memory usage. + # infra-cache-slabs: 4 + + # the maximum number of hosts that are cached (roundtrip, EDNS, lame). + # infra-cache-numhosts: 10000 + + # define a number of tags here, use with local-zone, access-control. + # repeat the define-tag statement to add additional tags. + # define-tag: "tag1 tag2 tag3" + + # Enable IPv4, "yes" or "no". + # do-ip4: yes + + # Enable IPv6, "yes" or "no". + # do-ip6: yes + + # Enable UDP, "yes" or "no". + # NOTE: if setting up an unbound on tls443 for public use, you might want to + # disable UDP to avoid being used in DNS amplification attacks. + # do-udp: yes + + # Enable TCP, "yes" or "no". + # do-tcp: yes + + # upstream connections use TCP only (and no UDP), "yes" or "no" + # useful for tunneling scenarios, default no. + # tcp-upstream: no + + # Maximum segment size (MSS) of TCP socket on which the server + # responds to queries. Default is 0, system default MSS. + # tcp-mss: 0 + + # Maximum segment size (MSS) of TCP socket for outgoing queries. + # Default is 0, system default MSS. + # outgoing-tcp-mss: 0 + + # Detach from the terminal, run in background, "yes" or "no". + # Set the value to "no" when unbound runs as systemd service. + # do-daemonize: yes + + # control which clients are allowed to make (recursive) queries + # to this server. Specify classless netblocks with /size and action. + # By default everything is refused, except for localhost. + # Choose deny (drop message), refuse (polite error reply), + # allow (recursive ok), allow_snoop (recursive and nonrecursive ok) + # deny_non_local (drop queries unless can be answered from local-data) + # refuse_non_local (like deny_non_local but polite error reply). + # access-control: 0.0.0.0/0 refuse + # access-control: 127.0.0.0/8 allow + # access-control: ::0/0 refuse + # access-control: ::1 allow + # access-control: ::ffff:127.0.0.1 allow + + # tag access-control with list of tags (in "" with spaces between) + # Clients using this access control element use localzones that + # are tagged with one of these tags. + # access-control-tag: 192.0.2.0/24 "tag2 tag3" + + # set action for particular tag for given access control element + # if you have multiple tag values, the tag used to lookup the action + # is the first tag match between access-control-tag and local-zone-tag + # where "first" comes from the order of the define-tag values. + # access-control-tag-action: 192.0.2.0/24 tag3 refuse + + # set redirect data for particular tag for access control element + # access-control-tag-data: 192.0.2.0/24 tag2 "A 127.0.0.1" + + # Set view for access control element + # access-control-view: 192.0.2.0/24 viewname + + # if given, a chroot(2) is done to the given directory. + # i.e. you can chroot to the working directory, for example, + # for extra security, but make sure all files are in that directory. + # + # If chroot is enabled, you should pass the configfile (from the + # commandline) as a full path from the original root. After the + # chroot has been performed the now defunct portion of the config + # file path is removed to be able to reread the config after a reload. + # + # All other file paths (working dir, logfile, roothints, and + # key files) can be specified in several ways: + # o as an absolute path relative to the new root. + # o as a relative path to the working directory. + # o as an absolute path relative to the original root. + # In the last case the path is adjusted to remove the unused portion. + # + # The pid file can be absolute and outside of the chroot, it is + # written just prior to performing the chroot and dropping permissions. + # + # Additionally, unbound may need to access /dev/random (for entropy). + # How to do this is specific to your OS. + # + # If you give "" no chroot is performed. The path must not end in a /. + # chroot: "/var/lib/unbound" + chroot: "" + + # if given, user privileges are dropped (after binding port), + # and the given username is assumed. Default is user "unbound". + # If you give "" no privileges are dropped. + username: "unbound" + + # the working directory. The relative files in this config are + # relative to this directory. If you give "" the working directory + # is not changed. + # If you give a server: directory: dir before include: file statements + # then those includes can be relative to the working directory. + directory: "/etc/unbound" + + # the log file, "" means log to stderr. + # Use of this option sets use-syslog to "no". + # logfile: "" + + # Log to syslog(3) if yes. The log facility LOG_DAEMON is used to + # log to, with identity "unbound". If yes, it overrides the logfile. + # use-syslog: yes + + # Log identity to report. if empty, defaults to the name of argv[0] + # (usually "unbound"). + # log-identity: "" + + # print UTC timestamp in ascii to logfile, default is epoch in seconds. + log-time-ascii: yes + + # print one line with time, IP, name, type, class for every query. + # log-queries: no + + # print one line per reply, with time, IP, name, type, class, rcode, + # timetoresolve, fromcache and responsesize. + # log-replies: no + + # the pid file. Can be an absolute path outside of chroot/work dir. + pidfile: "/var/run/unbound/unbound.pid" + + # file to read root hints from. + # get one from https://www.internic.net/domain/named.cache + # root-hints: "" + + # enable to not answer id.server and hostname.bind queries. + # hide-identity: no + + # enable to not answer version.server and version.bind queries. + # hide-version: no + + # enable to not answer trustanchor.unbound queries. + # hide-trustanchor: no + + # the identity to report. Leave "" or default to return hostname. + # identity: "" + + # the version to report. Leave "" or default to return package version. + # version: "" + + # the target fetch policy. + # series of integers describing the policy per dependency depth. + # The number of values in the list determines the maximum dependency + # depth the recursor will pursue before giving up. Each integer means: + # -1 : fetch all targets opportunistically, + # 0: fetch on demand, + # positive value: fetch that many targets opportunistically. + # Enclose the list of numbers between quotes (""). + # target-fetch-policy: "3 2 1 0 0" + + # Harden against very small EDNS buffer sizes. + # harden-short-bufsize: no + + # Harden against unseemly large queries. + # harden-large-queries: no + + # Harden against out of zone rrsets, to avoid spoofing attempts. + harden-glue: yes + + # Harden against receiving dnssec-stripped data. If you turn it + # off, failing to validate dnskey data for a trustanchor will + # trigger insecure mode for that zone (like without a trustanchor). + # Default on, which insists on dnssec data for trust-anchored zones. + harden-dnssec-stripped: yes + + # Harden against queries that fall under dnssec-signed nxdomain names. + harden-below-nxdomain: yes + + # Harden the referral path by performing additional queries for + # infrastructure data. Validates the replies (if possible). + # Default off, because the lookups burden the server. Experimental + # implementation of draft-wijngaards-dnsext-resolver-side-mitigation. + harden-referral-path: yes + + # Harden against algorithm downgrade when multiple algorithms are + # advertised in the DS record. If no, allows the weakest algorithm + # to validate the zone. + # harden-algo-downgrade: no + + # Sent minimum amount of information to upstream servers to enhance + # privacy. Only sent minimum required labels of the QNAME and set QTYPE + # to NS when possible. + # qname-minimisation: no + + # QNAME minimisation in strict mode. Do not fall-back to sending full + # QNAME to potentially broken nameservers. A lot of domains will not be + # resolvable when this option in enabled. + # This option only has effect when qname-minimisation is enabled. + # qname-minimisation-strict: no + + # Use 0x20-encoded random bits in the query to foil spoof attempts. + # This feature is an experimental implementation of draft dns-0x20. + # use-caps-for-id: no + + # Domains (and domains in them) without support for dns-0x20 and + # the fallback fails because they keep sending different answers. + # caps-whitelist: "licdn.com" + # caps-whitelist: "senderbase.org" + + # Enforce privacy of these addresses. Strips them away from answers. + # It may cause DNSSEC validation to additionally mark it as bogus. + # Protects against 'DNS Rebinding' (uses browser as network proxy). + # Only 'private-domain' and 'local-data' names are allowed to have + # these private addresses. No default. + # private-address: 10.0.0.0/8 + # private-address: 172.16.0.0/12 + # private-address: 192.168.0.0/16 + # private-address: 169.254.0.0/16 + # private-address: fd00::/8 + # private-address: fe80::/10 + # private-address: ::ffff:0:0/96 + + # Allow the domain (and its subdomains) to contain private addresses. + # local-data statements are allowed to contain private addresses too. + # private-domain: "example.com" + + # If nonzero, unwanted replies are not only reported in statistics, + # but also a running total is kept per thread. If it reaches the + # threshold, a warning is printed and a defensive action is taken, + # the cache is cleared to flush potential poison out of it. + # A suggested value is 10000000, the default is 0 (turned off). + unwanted-reply-threshold: 10000000 + + # Do not query the following addresses. No DNS queries are sent there. + # List one address per entry. List classless netblocks with /size, + # do-not-query-address: 127.0.0.1/8 + # do-not-query-address: ::1 + + # if yes, the above default do-not-query-address entries are present. + # if no, localhost can be queried (for testing and debugging). + # do-not-query-localhost: yes + + # if yes, perform prefetching of almost expired message cache entries. + prefetch: yes + + # if yes, perform key lookups adjacent to normal lookups. + prefetch-key: yes + + # if yes, Unbound rotates RRSet order in response. + rrset-roundrobin: yes + + # if yes, Unbound doesn't insert authority/additional sections + # into response messages when those sections are not required. + minimal-responses: yes + + # true to disable DNSSEC lameness check in iterator. + # disable-dnssec-lame-check: no + + # module configuration of the server. A string with identifiers + # separated by spaces. Syntax: "[dns64] [validator] iterator" + # module-config: "validator iterator" + module-config: "ipsecmod validator iterator" + + # File with trusted keys, kept uptodate using RFC5011 probes, + # initial file like trust-anchor-file, then it stores metadata. + # Use several entries, one per domain name, to track multiple zones. + # + # If you want to perform DNSSEC validation, run unbound-anchor before + # you start unbound (i.e. in the system boot scripts). And enable: + # Please note usage of unbound-anchor root anchor is at your own risk + # and under the terms of our LICENSE (see that file in the source). + # auto-trust-anchor-file: "/var/lib/unbound/root.key" + + # trust anchor signaling sends a RFC8145 key tag query after priming. + trust-anchor-signaling: yes + + # File with DLV trusted keys. Same format as trust-anchor-file. + # There can be only one DLV configured, it is trusted from root down. + # DLV is going to be decommissioned. Please do not use it any more. + # dlv-anchor-file: "dlv.isc.org.key" + + # File with trusted keys for validation. Specify more than one file + # with several entries, one file per entry. + # Zone file format, with DS and DNSKEY entries. + # Note this gets out of date, use auto-trust-anchor-file please. + # trust-anchor-file: "" + + # Trusted key for validation. DS or DNSKEY. specify the RR on a + # single line, surrounded by "". TTL is ignored. class is IN default. + # Note this gets out of date, use auto-trust-anchor-file please. + # (These examples are from August 2007 and may not be valid anymore). + # trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ==" + # trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A" + + # File with trusted keys for validation. Specify more than one file + # with several entries, one file per entry. Like trust-anchor-file + # but has a different file format. Format is BIND-9 style format, + # the trusted-keys { name flag proto algo "key"; }; clauses are read. + # you need external update procedures to track changes in keys. + # trusted-keys-file: "" + # + trusted-keys-file: /etc/unbound/keys.d/*.key + auto-trust-anchor-file: "/var/lib/unbound/root.key" + + # Ignore chain of trust. Domain is treated as insecure. + # domain-insecure: "example.com" + + # Override the date for validation with a specific fixed date. + # Do not set this unless you are debugging signature inception + # and expiration. "" or "0" turns the feature off. -1 ignores date. + # val-override-date: "" + + # The time to live for bogus data, rrsets and messages. This avoids + # some of the revalidation, until the time interval expires. in secs. + # val-bogus-ttl: 60 + + # The signature inception and expiration dates are allowed to be off + # by 10% of the signature lifetime (expir-incep) from our local clock. + # This leeway is capped with a minimum and a maximum. In seconds. + # val-sig-skew-min: 3600 + # val-sig-skew-max: 86400 + + # Should additional section of secure message also be kept clean of + # unsecure data. Useful to shield the users of this validator from + # potential bogus data in the additional section. All unsigned data + # in the additional section is removed from secure messages. + val-clean-additional: yes + + # Turn permissive mode on to permit bogus messages. Thus, messages + # for which security checks failed will be returned to clients, + # instead of SERVFAIL. It still performs the security checks, which + # result in interesting log files and possibly the AD bit in + # replies if the message is found secure. The default is off. + # NOTE: TURNING THIS ON DISABLES ALL DNSSEC SECURITY + val-permissive-mode: no + + # Ignore the CD flag in incoming queries and refuse them bogus data. + # Enable it if the only clients of unbound are legacy servers (w2008) + # that set CD but cannot validate themselves. + # ignore-cd-flag: no + + # Serve expired responses from cache, with TTL 0 in the response, + # and then attempt to fetch the data afresh. + # serve-expired: no + + # Have the validator log failed validations for your diagnosis. + # 0: off. 1: A line per failed user query. 2: With reason and bad IP. + val-log-level: 1 + + # It is possible to configure NSEC3 maximum iteration counts per + # keysize. Keep this table very short, as linear search is done. + # A message with an NSEC3 with larger count is marked insecure. + # List in ascending order the keysize and count values. + # val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500" + + # instruct the auto-trust-anchor-file probing to add anchors after ttl. + # add-holddown: 2592000 # 30 days + + # instruct the auto-trust-anchor-file probing to del anchors after ttl. + # del-holddown: 2592000 # 30 days + + # auto-trust-anchor-file probing removes missing anchors after ttl. + # If the value 0 is given, missing anchors are not removed. + # keep-missing: 31622400 # 366 days + + # debug option that allows very small holddown times for key rollover, + # otherwise the RFC mandates probe intervals must be at least 1 hour. + # permit-small-holddown: no + + # the amount of memory to use for the key cache. + # plain value in bytes or you can append k, m or G. default is "4Mb". + # key-cache-size: 4m + + # the number of slabs to use for the key cache. + # the number of slabs must be a power of 2. + # more slabs reduce lock contention, but fragment memory usage. + # key-cache-slabs: 4 + + # the amount of memory to use for the negative cache (used for DLV). + # plain value in bytes or you can append k, m or G. default is "1Mb". + # neg-cache-size: 1m + + # By default, for a number of zones a small default 'nothing here' + # reply is built-in. Query traffic is thus blocked. If you + # wish to serve such zone you can unblock them by uncommenting one + # of the nodefault statements below. + # You may also have to use domain-insecure: zone to make DNSSEC work, + # unless you have your own trust anchors for this zone. + # local-zone: "localhost." nodefault + # local-zone: "127.in-addr.arpa." nodefault + # local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault + # local-zone: "onion." nodefault + # local-zone: "test." nodefault + # local-zone: "invalid." nodefault + # local-zone: "10.in-addr.arpa." nodefault + # local-zone: "16.172.in-addr.arpa." nodefault + # local-zone: "17.172.in-addr.arpa." nodefault + # local-zone: "18.172.in-addr.arpa." nodefault + # local-zone: "19.172.in-addr.arpa." nodefault + # local-zone: "20.172.in-addr.arpa." nodefault + # local-zone: "21.172.in-addr.arpa." nodefault + # local-zone: "22.172.in-addr.arpa." nodefault + # local-zone: "23.172.in-addr.arpa." nodefault + # local-zone: "24.172.in-addr.arpa." nodefault + # local-zone: "25.172.in-addr.arpa." nodefault + # local-zone: "26.172.in-addr.arpa." nodefault + # local-zone: "27.172.in-addr.arpa." nodefault + # local-zone: "28.172.in-addr.arpa." nodefault + # local-zone: "29.172.in-addr.arpa." nodefault + # local-zone: "30.172.in-addr.arpa." nodefault + # local-zone: "31.172.in-addr.arpa." nodefault + # local-zone: "168.192.in-addr.arpa." nodefault + # local-zone: "0.in-addr.arpa." nodefault + # local-zone: "254.169.in-addr.arpa." nodefault + # local-zone: "2.0.192.in-addr.arpa." nodefault + # local-zone: "100.51.198.in-addr.arpa." nodefault + # local-zone: "113.0.203.in-addr.arpa." nodefault + # local-zone: "255.255.255.255.in-addr.arpa." nodefault + # local-zone: "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault + # local-zone: "d.f.ip6.arpa." nodefault + # local-zone: "8.e.f.ip6.arpa." nodefault + # local-zone: "9.e.f.ip6.arpa." nodefault + # local-zone: "a.e.f.ip6.arpa." nodefault + # local-zone: "b.e.f.ip6.arpa." nodefault + # local-zone: "8.b.d.0.1.0.0.2.ip6.arpa." nodefault + # And for 64.100.in-addr.arpa. to 127.100.in-addr.arpa. + + # If unbound is running service for the local host then it is useful + # to perform lan-wide lookups to the upstream, and unblock the + # long list of local-zones above. If this unbound is a dns server + # for a network of computers, disabled is better and stops information + # leakage of local lan information. + # unblock-lan-zones: no + + # The insecure-lan-zones option disables validation for + # these zones, as if they were all listed as domain-insecure. + # insecure-lan-zones: no + + # The insecure-lan-zones option disables validation for + # these zones, as if they were all listed as domain-insecure. + # insecure-lan-zones: no + + # a number of locally served zones can be configured. + # local-zone: + # local-data: "" + # o deny serves local data (if any), else, drops queries. + # o refuse serves local data (if any), else, replies with error. + # o static serves local data, else, nxdomain or nodata answer. + # o transparent gives local data, but resolves normally for other names + # o redirect serves the zone data for any subdomain in the zone. + # o nodefault can be used to normally resolve AS112 zones. + # o typetransparent resolves normally for other types and other names + # o inform resolves normally, but logs client IP address + # o inform_deny drops queries and logs client IP address + # o always_transparent, always_refuse, always_nxdomain, resolve in + # that way but ignore local data for that name. + # + # defaults are localhost address, reverse for 127.0.0.1 and ::1 + # and nxdomain for AS112 zones. If you configure one of these zones + # the default content is omitted, or you can omit it with 'nodefault'. + # + # If you configure local-data without specifying local-zone, by + # default a transparent local-zone is created for the data. + # + # You can add locally served data with + # local-zone: "local." static + # local-data: "mycomputer.local. IN A 192.0.2.51" + # local-data: 'mytext.local TXT "content of text record"' + # + # You can override certain queries with + # local-data: "adserver.example.com A 127.0.0.1" + # + # You can redirect a domain to a fixed address with + # (this makes example.com, www.example.com, etc, all go to 192.0.2.3) + # local-zone: "example.com" redirect + # local-data: "example.com A 192.0.2.3" + # + # Shorthand to make PTR records, "IPv4 name" or "IPv6 name". + # You can also add PTR records using local-data directly, but then + # you need to do the reverse notation yourself. + # local-data-ptr: "192.0.2.3 www.example.com" + + include: /etc/unbound/local.d/*.conf + + # tag a localzone with a list of tag names (in "" with spaces between) + # local-zone-tag: "example.com" "tag2 tag3" + + # add a netblock specific override to a localzone, with zone type + # local-zone-override: "example.com" 192.0.2.0/24 refuse + + # service clients over SSL (on the TCP sockets), with plain DNS inside + # the SSL stream. Give the certificate to use and private key. + # default is "" (disabled). requires restart to take effect. + # ssl-service-key: "/etc/unbound/unbound_server.key" + # ssl-service-pem: "/etc/unbound/unbound_server.pem" + # ssl-port: 443 + # + # request upstream over SSL (with plain DNS inside the SSL stream). + # Default is no. Can be turned on and off with unbound-control. + # ssl-upstream: no + + # DNS64 prefix. Must be specified when DNS64 is use. + # Enable dns64 in module-config. Used to synthesize IPv6 from IPv4. + # dns64-prefix: 64:ff9b::0/96 + + # ratelimit for uncached, new queries, this limits recursion effort. + # ratelimiting is experimental, and may help against randomqueryflood. + # if 0(default) it is disabled, otherwise state qps allowed per zone. + # ratelimit: 0 + + # ratelimits are tracked in a cache, size in bytes of cache (or k,m). + # ratelimit-size: 4m + # ratelimit cache slabs, reduces lock contention if equal to cpucount. + # ratelimit-slabs: 4 + + # 0 blocks when ratelimited, otherwise let 1/xth traffic through + # ratelimit-factor: 10 + + # override the ratelimit for a specific domain name. + # give this setting multiple times to have multiple overrides. + # ratelimit-for-domain: example.com 1000 + # override the ratelimits for all domains below a domain name + # can give this multiple times, the name closest to the zone is used. + # ratelimit-below-domain: com 1000 + + # global query ratelimit for all ip addresses. + # feature is experimental. + # if 0(default) it is disabled, otherwise states qps allowed per ip address + # ip-ratelimit: 0 + + # ip ratelimits are tracked in a cache, size in bytes of cache (or k,m). + # ip-ratelimit-size: 4m + # ip ratelimit cache slabs, reduces lock contention if equal to cpucount. + # ip-ratelimit-slabs: 4 + + # 0 blocks when ip is ratelimited, otherwise let 1/xth traffic through + # ip-ratelimit-factor: 10 + + # Specific options for ipsecmod. + # + # Enable or disable ipsecmod (it still needs to be defined in + # module-config above). Can be used when ipsecmod needs to be + # enabled/disabled via remote-control(below). + ipsecmod-enabled: no + # + # Path to executable external hook. It must be defined when ipsecmod is + # listed in module-config (above). + ipsecmod-hook: "/usr/libexec/ipsec/_unbound-hook" + # + # When enabled unbound will reply with SERVFAIL if the return value of + # the ipsecmod-hook is not 0. + # ipsecmod-strict: no + # + # Maximum time to live (TTL) for cached A/AAAA records with IPSECKEY. + # ipsecmod-max-ttl: 3600 + # + # Reply with A/AAAA even if the relevant IPSECKEY is bogus. Mainly used for + # testing. + # ipsecmod-ignore-bogus: no + # + # Domains for which ipsecmod will be triggered. If not defined (default) + # all domains are treated as being whitelisted. + # ipsecmod-whitelist: "example.com" + # ipsecmod-whitelist: "nlnetlabs.nl" + +# Python config section. To enable: +# o use --with-pythonmodule to configure before compiling. +# o list python in the module-config string (above) to enable. +# o and give a python-script to run. +python: + # Script file to load + # python-script: "/etc/unbound/ubmodule-tst.py" + +# Remote control config section. +remote-control: + # Enable remote control with unbound-control(8) here. + # set up the keys and certificates with unbound-control-setup. + # Note: required for unbound-munin package + control-enable: yes + + # Set to no and use an absolute path as control-interface to use + # a unix local named pipe for unbound-control. + # control-use-cert: yes + + # what interfaces are listened to for remote control. + # give 0.0.0.0 and ::0 to listen to all interfaces. + # control-interface: 127.0.0.1 + # control-interface: ::1 + + # port number for remote control operations. + # control-port: 8953 + + # unbound server key file. + server-key-file: "/etc/unbound/unbound_server.key" + + # unbound server certificate file. + server-cert-file: "/etc/unbound/unbound_server.pem" + + # unbound-control key file. + control-key-file: "/etc/unbound/unbound_control.key" + + # unbound-control certificate file. + control-cert-file: "/etc/unbound/unbound_control.pem" + +# Stub and Forward zones +include: /etc/unbound/conf.d/*.conf + +# Stub zones. +# Create entries like below, to make all queries for 'example.com' and +# 'example.org' go to the given list of nameservers. list zero or more +# nameservers by hostname or by ipaddress. If you set stub-prime to yes, +# the list is treated as priming hints (default is no). +# With stub-first yes, it attempts without the stub if it fails. +# Consider adding domain-insecure: name and local-zone: name nodefault +# to the server: section if the stub is a locally served zone. +# stub-zone: +# name: "example.com" +# stub-addr: 192.0.2.68 +# stub-prime: no +# stub-first: no +# stub-ssl-upstream: no +# stub-zone: +# name: "example.org" +# stub-host: ns.example.com. + +# You can now also dynamically create and delete stub-zone's using +# unbound-control stub_add domain.com 1.2.3.4 5.6.7.8 +# unbound-control stub_remove domain.com 1.2.3.4 5.6.7.8 + +# Forward zones +# Create entries like below, to make all queries for 'example.com' and +# 'example.org' go to the given list of servers. These servers have to handle +# recursion to other nameservers. List zero or more nameservers by hostname +# or by ipaddress. Use an entry with name "." to forward all queries. +# If you enable forward-first, it attempts without the forward if it fails. +# forward-zone: +# name: "example.com" +# forward-addr: 192.0.2.68 +# forward-addr: 192.0.2.73@5355 # forward to port 5355. +# forward-first: no +# forward-ssl-upstream: no +# forward-zone: +# name: "example.org" +# forward-host: fwd.example.com +# +# You can now also dynamically create and delete forward-zone's using +# unbound-control forward_add domain.com 1.2.3.4 5.6.7.8 +# unbound-control forward_remove domain.com 1.2.3.4 5.6.7.8 + +# Views +# Create named views. Name must be unique. Map views to requests using +# the access-control-view option. Views can contain zero or more local-zone +# and local-data options. Options from matching views will override global +# options. Global options will be used if no matching view is found. +# With view-first yes, it will try to answer using the global local-zone and +# local-data elements if there is no view specific match. +# view: +# name: "viewname" +# local-zone: "example.com" redirect +# local-data: "example.com A 192.0.2.3" +# local-data-ptr: "192.0.2.3 www.example.com" +# view-first: no +# view: +# name: "anotherview" +# local-zone: "example.com" refuse + diff --git a/SOURCES/unbound.munin b/SOURCES/unbound.munin new file mode 100644 index 0000000..9056575 --- /dev/null +++ b/SOURCES/unbound.munin @@ -0,0 +1,11 @@ +# +# For this plugin to work, unbound.conf needs to have: +# remote-control: control-enable: yes +# +[unbound*] +user root +env.statefile /var/lib/munin/plugin-state/unbound-state +env.unbound_conf /etc/unbound/unbound.conf +env.unbound_control /usr/sbin/unbound-control +env.spoof_warn 1000 +env.spoof_crit 100000 diff --git a/SOURCES/unbound.service b/SOURCES/unbound.service new file mode 100644 index 0000000..9b49cb9 --- /dev/null +++ b/SOURCES/unbound.service @@ -0,0 +1,18 @@ +[Unit] +Description=Unbound recursive Domain Name Server +After=syslog.target network.target +After=unbound-keygen.service +Wants=unbound-keygen.service +Wants=unbound-anchor.timer +Before=nss-lookup.target +Wants=nss-lookup.target + +[Service] +Type=simple +EnvironmentFile=-/etc/sysconfig/unbound +ExecStartPre=/usr/sbin/unbound-checkconf +ExecStartPre=-/usr/sbin/unbound-anchor -a /var/lib/unbound/root.key -c /etc/unbound/icannbundle.pem +ExecStart=/usr/sbin/unbound -d $UNBOUND_OPTIONS + +[Install] +WantedBy=multi-user.target diff --git a/SOURCES/unbound.sysconfig b/SOURCES/unbound.sysconfig new file mode 100644 index 0000000..fae3306 --- /dev/null +++ b/SOURCES/unbound.sysconfig @@ -0,0 +1,3 @@ +# for extra debug, add "-v -v" or change verbosity: in unbound.conf + +UNBOUND_OPTIONS="" diff --git a/SOURCES/unbound_munin_ b/SOURCES/unbound_munin_ new file mode 100644 index 0000000..779532d --- /dev/null +++ b/SOURCES/unbound_munin_ @@ -0,0 +1,553 @@ +#!/bin/sh +# +# plugin for munin to monitor usage of unbound servers. +# +# (C) 2008 W.C.A. Wijngaards. BSD Licensed. +# +# To install; enable statistics and unbound-control in unbound.conf +# server: extended-statistics: yes +# statistics-cumulative: no +# statistics-interval: 0 +# remote-control: control-enable: yes +# Run the command unbound-control-setup to generate the key files. +# +# Environment variables for this script +# statefile - where to put temporary statefile. +# unbound_conf - where the unbound.conf file is located. +# unbound_control - where to find unbound-control executable. +# spoof_warn - what level to warn about spoofing +# spoof_crit - what level to crit about spoofing +# +# You can set them in your munin/plugin-conf.d/plugins.conf file +# with: +# [unbound*] +# user root +# env.statefile /usr/local/var/munin/plugin-state/unbound-state +# env.unbound_conf /usr/local/etc/unbound/unbound.conf +# env.unbound_control /usr/local/sbin/unbound-control +# env.spoof_warn 1000 +# env.spoof_crit 100000 +# +# This plugin can create different graphs depending on what name +# you link it as (with ln -s) into the plugins directory +# You can link it multiple times. +# If you are only a casual user, the _hits and _by_type are most interesting, +# possibly followed by _by_rcode. +# +# unbound_munin_hits - base volume, cache hits, unwanted traffic +# unbound_munin_queue - to monitor the internal requestlist +# unbound_munin_memory - memory usage +# unbound_munin_by_type - incoming queries by type +# unbound_munin_by_class - incoming queries by class +# unbound_munin_by_opcode - incoming queries by opcode +# unbound_munin_by_rcode - answers by rcode, validation status +# unbound_munin_by_flags - incoming queries by flags +# unbound_munin_histogram - histogram of query resolving times +# +# Magic markers - optional - used by installation scripts and +# munin-config: +# +#%# family=contrib +#%# capabilities=autoconf suggest + +# POD documentation +: <<=cut +=head1 NAME + +unbound_munin_ - Munin plugin to monitor the Unbound DNS resolver. + +=head1 APPLICABLE SYSTEMS + +System with unbound daemon. + +=head1 CONFIGURATION + + [unbound*] + user root + env.statefile /var/lib/munin/plugin-state/unbound-state + env.unbound_conf /etc/unbound/unbound.conf + env.unbound_control /usr/sbin/unbound-control + env.spoof_warn 1000 + env.spoof_crit 100000 + +Use the .env settings to override the defaults. + +=head1 USAGE + +Can be used to present different graphs. Use ln -s for that name in +the plugins directory to enable the graph. +unbound_munin_hits - base volume, cache hits, unwanted traffic +unbound_munin_queue - to monitor the internal requestlist +unbound_munin_memory - memory usage +unbound_munin_by_type - incoming queries by type +unbound_munin_by_class - incoming queries by class +unbound_munin_by_opcode - incoming queries by opcode +unbound_munin_by_rcode - answers by rcode, validation status +unbound_munin_by_flags - incoming queries by flags +unbound_munin_histogram - histogram of query resolving times + +=head1 AUTHOR + +Copyright 2008 W.C.A. Wijngaards + +=head1 LICENSE + +BSD + +=cut + +state=${statefile:-/var/lib/munin/plugin-state/unbound-state} +conf=${unbound_conf:-/etc/unbound/unbound.conf} +ctrl=${unbound_control:-/usr/sbin/unbound-control} +warn=${spoof_warn:-1000} +crit=${spoof_crit:-100000} +lock=$state.lock + +# number of seconds between polling attempts. +# makes the statefile hang around for at least this many seconds, +# so that multiple links of this script can share the results. +lee=55 + +# to keep things within 19 characters +ABBREV="-e s/total/t/ -e s/thread/t/ -e s/num/n/ -e s/query/q/ -e s/answer/a/ -e s/unwanted/u/ -e s/requestlist/ql/ -e s/type/t/ -e s/class/c/ -e s/opcode/o/ -e s/rcode/r/ -e s/edns/e/ -e s/mem/m/ -e s/cache/c/ -e s/mod/m/" + +# get value from $1 into return variable $value +get_value ( ) { + value="`grep '^'$1'=' $state | sed -e 's/^.*=//'`" + if test "$value"x = ""x; then + value="0" + fi +} + +# download the state from the unbound server. +get_state ( ) { + # obtain lock for fetching the state + # because there is a race condition in fetching and writing to file + + # see if the lock is stale, if so, take it + if test -f $lock ; then + pid="`cat $lock 2>&1`" + kill -0 "$pid" >/dev/null 2>&1 + if test $? -ne 0 -a "$pid" != $$ ; then + echo $$ >$lock + fi + fi + + i=0 + while test ! -f $lock || test "`cat $lock 2>&1`" != $$; do + while test -f $lock; do + # wait + i=`expr $i + 1` + if test $i -gt 1000; then + sleep 1; + fi + if test $i -gt 1500; then + echo "error locking $lock" "=" `cat $lock` + rm -f $lock + exit 1 + fi + done + # try to get it + echo $$ >$lock + done + # do not refetch if the file exists and only LEE seconds old + if test -f $state; then + now=`date +%s` + get_value "time.now" + value="`echo $value | sed -e 's/\..*$//'`" + if test $now -lt `expr $value + $lee`; then + rm -f $lock + return + fi + fi + $ctrl -c $conf stats > $state + if test $? -ne 0; then + echo "error retrieving data from unbound server" + rm -f $lock + exit 1 + fi + rm -f $lock +} + +if test "$1" = "autoconf" ; then + if test ! -f $conf; then + echo no "($conf does not exist)" + exit 1 + fi + if test ! -d `dirname $state`; then + echo no "($state directory does not exist)" + exit 1 + fi + echo yes + exit 0 +fi + +if test "$1" = "suggest" ; then + echo "hits" + echo "queue" + echo "memory" + echo "by_type" + echo "by_class" + echo "by_opcode" + echo "by_rcode" + echo "by_flags" + echo "histogram" + exit 0 +fi + +# determine my type, by name +id=`echo $0 | sed -e 's/^.*unbound_munin_//'` +if test "$id"x = ""x; then + # some default to keep people sane. + id="hits" +fi + +# if $1 exists in statefile, config is echoed with label $2 +exist_config ( ) { + mn=`echo $1 | sed $ABBREV | tr . _` + if grep '^'$1'=' $state >/dev/null 2>&1; then + echo "$mn.label $2" + echo "$mn.min 0" + fi +} + +# print label and min 0 for a name $1 in unbound format +p_config ( ) { + mn=`echo $1 | sed $ABBREV | tr . _` + echo $mn.label "$2" + echo $mn.min 0 +} + +if test "$1" = "config" ; then + if test ! -f $state; then + get_state + fi + case $id in + hits) + echo "graph_title Unbound DNS traffic and cache hits" + echo "graph_args --base 1000 -l 0" + echo "graph_vlabel queries / second" + echo "graph_category DNS" + for x in thread0.num.queries thread1.num.queries \ + thread2.num.queries thread3.num.queries thread4.num.queries \ + thread5.num.queries thread6.num.queries thread7.num.queries; do + exist_config $x "queries handled by `basename $x .num.queries`" + done + p_config "total.num.queries" "total queries from clients" + p_config "total.num.cachehits" "cache hits" + p_config "total.num.prefetch" "cache prefetch" + p_config "num.query.tcp" "TCP queries" + p_config "num.query.ipv6" "IPv6 queries" + p_config "unwanted.queries" "queries that failed acl" + p_config "unwanted.replies" "unwanted or unsolicited replies" + echo "u_replies.warning $warn" + echo "u_replies.critical $crit" + echo "graph_info DNS queries to the recursive resolver. The unwanted replies could be innocent duplicate packets, late replies, or spoof threats." + ;; + queue) + echo "graph_title Unbound requestlist size" + echo "graph_args --base 1000 -l 0" + echo "graph_vlabel number of queries" + echo "graph_category DNS" + p_config "total.requestlist.avg" "Average size of queue on insert" + p_config "total.requestlist.max" "Max size of queue (in 5 min)" + p_config "total.requestlist.overwritten" "Number of queries replaced by new ones" + p_config "total.requestlist.exceeded" "Number of queries dropped due to lack of space" + echo "graph_info The queries that did not hit the cache and need recursion service take up space in the requestlist. If there are too many queries, first queries get overwritten, and at last resort dropped." + ;; + memory) + echo "graph_title Unbound memory usage" + echo "graph_args --base 1024 -l 0" + echo "graph_vlabel memory used in bytes" + echo "graph_category DNS" + p_config "mem.total.sbrk" "Total memory" + p_config "mem.cache.rrset" "RRset cache memory" + p_config "mem.cache.message" "Message cache memory" + p_config "mem.mod.iterator" "Iterator module memory" + p_config "mem.mod.validator" "Validator module and key cache memory" + echo "graph_info The memory used by unbound." + ;; + by_type) + echo "graph_title Unbound DNS queries by type" + echo "graph_args --base 1000 -l 0" + echo "graph_vlabel queries / second" + echo "graph_category DNS" + for x in `grep "^num.query.type" $state`; do + nm=`echo $x | sed -e 's/=.*$//'` + tp=`echo $nm | sed -e s/num.query.type.//` + p_config "$nm" "$tp" + done + echo "graph_info queries by DNS RR type queried for" + ;; + by_class) + echo "graph_title Unbound DNS queries by class" + echo "graph_args --base 1000 -l 0" + echo "graph_vlabel queries / second" + echo "graph_category DNS" + for x in `grep "^num.query.class" $state`; do + nm=`echo $x | sed -e 's/=.*$//'` + tp=`echo $nm | sed -e s/num.query.class.//` + p_config "$nm" "$tp" + done + echo "graph_info queries by DNS RR class queried for." + ;; + by_opcode) + echo "graph_title Unbound DNS queries by opcode" + echo "graph_args --base 1000 -l 0" + echo "graph_vlabel queries / second" + echo "graph_category DNS" + for x in `grep "^num.query.opcode" $state`; do + nm=`echo $x | sed -e 's/=.*$//'` + tp=`echo $nm | sed -e s/num.query.opcode.//` + p_config "$nm" "$tp" + done + echo "graph_info queries by opcode in the query packet." + ;; + by_rcode) + echo "graph_title Unbound DNS answers by return code" + echo "graph_args --base 1000 -l 0" + echo "graph_vlabel answer packets / second" + echo "graph_category DNS" + for x in `grep "^num.answer.rcode" $state`; do + nm=`echo $x | sed -e 's/=.*$//'` + tp=`echo $nm | sed -e s/num.answer.rcode.//` + p_config "$nm" "$tp" + done + p_config "num.answer.secure" "answer secure" + p_config "num.answer.bogus" "answer bogus" + p_config "num.rrset.bogus" "num rrsets marked bogus" + echo "graph_info answers sorted by return value. rrsets bogus is the number of rrsets marked bogus per second by the validator" + ;; + by_flags) + echo "graph_title Unbound DNS incoming queries by flags" + echo "graph_args --base 1000 -l 0" + echo "graph_vlabel queries / second" + echo "graph_category DNS" + p_config "num.query.flags.QR" "QR (query reply) flag" + p_config "num.query.flags.AA" "AA (auth answer) flag" + p_config "num.query.flags.TC" "TC (truncated) flag" + p_config "num.query.flags.RD" "RD (recursion desired) flag" + p_config "num.query.flags.RA" "RA (rec avail) flag" + p_config "num.query.flags.Z" "Z (zero) flag" + p_config "num.query.flags.AD" "AD (auth data) flag" + p_config "num.query.flags.CD" "CD (check disabled) flag" + p_config "num.query.edns.present" "EDNS OPT present" + p_config "num.query.edns.DO" "DO (DNSSEC OK) flag" + echo "graph_info This graphs plots the flags inside incoming queries. For example, if QR, AA, TC, RA, Z flags are set, the query can be rejected. RD, AD, CD and DO are legitimately set by some software." + ;; + histogram) + echo "graph_title Unbound DNS histogram of reply time" + echo "graph_args --base 1000 -l 0" + echo "graph_vlabel queries / second" + echo "graph_category DNS" + echo hcache.label "cache hits" + echo hcache.min 0 + echo hcache.draw AREA + echo hcache.colour 999999 + echo h64ms.label "0 msec - 66 msec" + echo h64ms.min 0 + echo h64ms.draw STACK + echo h64ms.colour 0000FF + echo h128ms.label "66 msec - 131 msec" + echo h128ms.min 0 + echo h128ms.colour 1F00DF + echo h128ms.draw STACK + echo h256ms.label "131 msec - 262 msec" + echo h256ms.min 0 + echo h256ms.draw STACK + echo h256ms.colour 3F00BF + echo h512ms.label "262 msec - 524 msec" + echo h512ms.min 0 + echo h512ms.draw STACK + echo h512ms.colour 5F009F + echo h1s.label "524 msec - 1 sec" + echo h1s.min 0 + echo h1s.draw STACK + echo h1s.colour 7F007F + echo h2s.label "1 sec - 2 sec" + echo h2s.min 0 + echo h2s.draw STACK + echo h2s.colour 9F005F + echo h4s.label "2 sec - 4 sec" + echo h4s.min 0 + echo h4s.draw STACK + echo h4s.colour BF003F + echo h8s.label "4 sec - 8 sec" + echo h8s.min 0 + echo h8s.draw STACK + echo h8s.colour DF001F + echo h16s.label "8 sec - ..." + echo h16s.min 0 + echo h16s.draw STACK + echo h16s.colour FF0000 + echo "graph_info Histogram of the reply times for queries." + ;; + esac + + exit 0 +fi + +# do the stats itself +get_state + +# get the time elapsed +get_value "time.elapsed" +if test $value = 0 || test $value = "0.000000"; then + echo "error: time elapsed 0 or could not retrieve data" + exit 1 +fi +elapsed="$value" + +# print value for $1 / elapsed +print_qps ( ) { + mn=`echo $1 | sed $ABBREV | tr . _` + get_value $1 + echo "$mn.value" `echo scale=6';' $value / $elapsed | bc ` +} + +# print qps if line already found in $2 +print_qps_line ( ) { + mn=`echo $1 | sed $ABBREV | tr . _` + value="`echo $2 | sed -e 's/^.*=//'`" + echo "$mn.value" `echo scale=6';' $value / $elapsed | bc ` +} + +# print value for $1 +print_value ( ) { + mn=`echo $1 | sed $ABBREV | tr . _` + get_value $1 + echo "$mn.value" $value +} + +case $id in +hits) + for x in thread0.num.queries thread1.num.queries thread2.num.queries \ + thread3.num.queries thread4.num.queries thread5.num.queries \ + thread6.num.queries thread7.num.queries total.num.queries \ + total.num.cachehits total.num.prefetch num.query.tcp \ + num.query.ipv6 unwanted.queries unwanted.replies; do + if grep "^"$x"=" $state >/dev/null 2>&1; then + print_qps $x + fi + done + ;; +queue) + for x in total.requestlist.avg total.requestlist.max \ + total.requestlist.overwritten total.requestlist.exceeded; do + print_value $x + done + ;; +memory) + mn=`echo mem.total.sbrk | sed $ABBREV | tr . _` + get_value 'mem.total.sbrk' + if test $value -eq 0; then + chk=`echo $ctrl | sed -e 's/-control$/-checkconf/'` + pidf=`$chk -o pidfile $conf 2>&1` + pid=`cat $pidf 2>&1` + value=`ps -p "$pid" -o rss= 2>&1` + if test "`expr $value + 1 - 1 2>&1`" -eq "$value" 2>&1; then + value=`expr $value \* 1024` + else + value=0 + fi + fi + echo "$mn.value" $value + for x in mem.cache.rrset mem.cache.message \ + mem.mod.iterator mem.mod.validator; do + print_value $x + done + ;; +by_type) + for x in `grep "^num.query.type" $state`; do + nm=`echo $x | sed -e 's/=.*$//'` + print_qps_line $nm $x + done + ;; +by_class) + for x in `grep "^num.query.class" $state`; do + nm=`echo $x | sed -e 's/=.*$//'` + print_qps_line $nm $x + done + ;; +by_opcode) + for x in `grep "^num.query.opcode" $state`; do + nm=`echo $x | sed -e 's/=.*$//'` + print_qps_line $nm $x + done + ;; +by_rcode) + for x in `grep "^num.answer.rcode" $state`; do + nm=`echo $x | sed -e 's/=.*$//'` + print_qps_line $nm $x + done + print_qps "num.answer.secure" + print_qps "num.answer.bogus" + print_qps "num.rrset.bogus" + ;; +by_flags) + for x in num.query.flags.QR num.query.flags.AA num.query.flags.TC num.query.flags.RD num.query.flags.RA num.query.flags.Z num.query.flags.AD num.query.flags.CD num.query.edns.present num.query.edns.DO; do + print_qps $x + done + ;; +histogram) + get_value total.num.cachehits + echo hcache.value `echo scale=6';' $value / $elapsed | bc ` + r=0 + for x in histogram.000000.000000.to.000000.000001 \ + histogram.000000.000001.to.000000.000002 \ + histogram.000000.000002.to.000000.000004 \ + histogram.000000.000004.to.000000.000008 \ + histogram.000000.000008.to.000000.000016 \ + histogram.000000.000016.to.000000.000032 \ + histogram.000000.000032.to.000000.000064 \ + histogram.000000.000064.to.000000.000128 \ + histogram.000000.000128.to.000000.000256 \ + histogram.000000.000256.to.000000.000512 \ + histogram.000000.000512.to.000000.001024 \ + histogram.000000.001024.to.000000.002048 \ + histogram.000000.002048.to.000000.004096 \ + histogram.000000.004096.to.000000.008192 \ + histogram.000000.008192.to.000000.016384 \ + histogram.000000.016384.to.000000.032768 \ + histogram.000000.032768.to.000000.065536; do + get_value $x + r=`expr $r + $value` + done + echo h64ms.value `echo scale=6';' $r / $elapsed | bc ` + get_value histogram.000000.065536.to.000000.131072 + echo h128ms.value `echo scale=6';' $value / $elapsed | bc ` + get_value histogram.000000.131072.to.000000.262144 + echo h256ms.value `echo scale=6';' $value / $elapsed | bc ` + get_value histogram.000000.262144.to.000000.524288 + echo h512ms.value `echo scale=6';' $value / $elapsed | bc ` + get_value histogram.000000.524288.to.000001.000000 + echo h1s.value `echo scale=6';' $value / $elapsed | bc ` + get_value histogram.000001.000000.to.000002.000000 + echo h2s.value `echo scale=6';' $value / $elapsed | bc ` + get_value histogram.000002.000000.to.000004.000000 + echo h4s.value `echo scale=6';' $value / $elapsed | bc ` + get_value histogram.000004.000000.to.000008.000000 + echo h8s.value `echo scale=6';' $value / $elapsed | bc ` + r=0 + for x in histogram.000008.000000.to.000016.000000 \ + histogram.000016.000000.to.000032.000000 \ + histogram.000032.000000.to.000064.000000 \ + histogram.000064.000000.to.000128.000000 \ + histogram.000128.000000.to.000256.000000 \ + histogram.000256.000000.to.000512.000000 \ + histogram.000512.000000.to.001024.000000 \ + histogram.001024.000000.to.002048.000000 \ + histogram.002048.000000.to.004096.000000 \ + histogram.004096.000000.to.008192.000000 \ + histogram.008192.000000.to.016384.000000 \ + histogram.016384.000000.to.032768.000000 \ + histogram.032768.000000.to.065536.000000 \ + histogram.065536.000000.to.131072.000000 \ + histogram.131072.000000.to.262144.000000 \ + histogram.262144.000000.to.524288.000000; do + get_value $x + r=`expr $r + $value` + done + echo h16s.value `echo scale=6';' $r / $elapsed | bc ` + ;; +esac diff --git a/SPECS/unbound.spec b/SPECS/unbound.spec new file mode 100644 index 0000000..fcb5457 --- /dev/null +++ b/SPECS/unbound.spec @@ -0,0 +1,801 @@ +%{?!with_python: %global with_python 1} +%{?!with_munin: %global with_munin 0} +%{?!with_test: %global with_test 1} + +%if %{with_python} +%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")} +%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")} +%endif + +%global _hardened_build 1 + +Summary: Validating, recursive, and caching DNS(SEC) resolver +Name: unbound +Version: 1.6.6 +Release: 1%{?dist} +License: BSD +Url: https://unbound.net/ +Source: https://www.unbound.net/downloads/%{name}-%{version}.tar.gz +Source1: unbound.service +Source2: unbound.conf +Source3: unbound.munin +Source4: unbound_munin_ +Source5: root.key +Source6: dlv.isc.org.key +Source7: unbound-keygen.service +Source8: tmpfiles-unbound.conf +Source9: example.com.key +Source10: example.com.conf +Source11: block-example.com.conf +Source12: https://data.iana.org/root-anchors/icannbundle.pem +Source13: root.anchor +Source14: unbound.sysconfig +Source15: unbound-anchor.timer +Source16: unbound-munin.README +Source17: unbound-anchor.service + +Patch1: unbound-1.6.3-longcheck-fixup.patch +Patch3: unbound-1.6.3-print-test-fails.patch +Patch4: unbound-1.6.3-coverity.patch +# Randomize outgoing port too, do not fail on two running builds on one host +Patch5: unbound-1.6.6-test-fwd_oneport.patch +Group: System Environment/Daemons +BuildRequires: openssl-devel +%if %{with_test} +# needed for the test suite +BuildRequires: bind-utils +BuildRequires: ldns +BuildRequires: vim-common nmap-ncat +%endif +# needed to regenerate configparser +BuildRequires: flex, byacc +BuildRequires: libevent-devel expat-devel +BuildRequires: pkgconfig +%if %{with_python} +BuildRequires: python-devel swig +%endif +BuildRequires: systemd-units +# Required for SVN versions +# BuildRequires: bison + +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +Requires(pre): shadow-utils +# Needed because /usr/sbin/unbound links unbound libs staticly +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +%description +Unbound is a validating, recursive, and caching DNS(SEC) resolver. + +The C implementation of Unbound is developed and maintained by NLnet +Labs. It is based on ideas and algorithms taken from a java prototype +developed by Verisign labs, Nominet, Kirei and ep.net. + +Unbound is designed as a set of modular components, so that also +DNSSEC (secure DNS) validation and stub-resolvers (that do not run +as a server, but are linked into an application) are easily possible. + +%if %{with_munin} +%package munin +Summary: Plugin for the munin / munin-node monitoring package +Group: System Environment/Daemons +Requires: munin-node +Requires: %{name} = %{version}-%{release}, bc +BuildArch: noarch + +%description munin +Plugin for the munin / munin-node monitoring package +%endif + +%package devel +Summary: Development package that includes the unbound header files +Group: Development/Libraries +Requires: %{name}-libs%{?_isa} = %{version}-%{release}, openssl-devel +Requires: pkgconfig + +%description devel +The devel package contains the unbound library and the include files + +%package libs +Summary: Libraries used by the unbound server and client applications +Group: Applications/System +Requires(post): /sbin/ldconfig +Requires(post): systemd +Requires(post): grep +Requires(post): sed +Requires(post): util-linux +Requires(preun): systemd +Requires(postun): /sbin/ldconfig +Requires(postun): systemd +Requires: openssl >= 0.9.8g-12 + +# needed to make sure the redhat-release-xxx contains the presets file +# which enables unbound-anchor.timer. +# See https://bugzilla.redhat.com/show_bug.cgi?id=1215645#c5 +Conflicts: redhat-release-server < 7.2-7 +Conflicts: redhat-release-workstation < 7.2-5 +Conflicts: redhat-release-computenode < 7.2-5 +Conflicts: redhat-release-client < 7.2-4 + +%description libs +Contains libraries used by the unbound server and client applications + +%if %{with_python} +%package python +Summary: Python modules and extensions for unbound +Group: Applications/System +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +%description python +Python modules and extensions for unbound +%endif + +%prep +%setup -q +%patch1 -p1 -b .longcheck-fixup +%patch3 -p1 -b .testlog +%patch4 -p1 -b .coverity +%patch5 -p1 -b .test-fwd_oneport + +# regrnerate config parser due to new options added +echo "#include \"config.h\"" > util/configlexer.c || echo "Failed to create configlexer" +echo "#include \"util/configyyrename.h\"" >> util/configlexer.c || echo "Failed to create configlexer" +flex -i -t util/configlexer.lex >> util/configlexer.c || echo "Failed to create configlexer" +yacc -y -d -o util/configparser.c util/configparser.y || echo "Failed to create configparser" + +%build +%configure --with-libevent --with-pthreads --with-ssl \ + --disable-rpath --disable-static \ + --enable-subnet --enable-ipsecmod \ + --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \ + --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \ +%if %{with_python} + --with-pythonmodule --with-pyunbound \ +%endif + --enable-sha2 --disable-gost --enable-ecdsa \ + --with-rootkey-file=%{_sharedstatedir}/unbound/root.key + +%{__make} %{?_smp_mflags} +%{__make} %{?_smp_mflags} streamtcp + +%install +%{__make} DESTDIR=%{buildroot} install +%{__make} DESTDIR=%{buildroot} unbound-event-install +install -d 0755 %{buildroot}%{_unitdir} %{buildroot}%{_sysconfdir}/sysconfig +install -p -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/unbound.service +install -p -m 0644 %{SOURCE7} %{buildroot}%{_unitdir}/unbound-keygen.service +install -p -m 0644 %{SOURCE15} %{buildroot}%{_unitdir}/unbound-anchor.timer +install -p -m 0644 %{SOURCE17} %{buildroot}%{_unitdir}/unbound-anchor.service +install -p -m 0755 %{SOURCE2} %{buildroot}%{_sysconfdir}/unbound +install -p -m 0644 %{SOURCE12} %{buildroot}%{_sysconfdir}/unbound +install -p -m 0644 %{SOURCE14} %{buildroot}%{_sysconfdir}/sysconfig/unbound +install -p -m 0644 %{SOURCE16} . +%if %{with_munin} +# Install munin plugin and its softlinks +install -d -m 0755 %{buildroot}%{_sysconfdir}/munin/plugin-conf.d +install -p -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/munin/plugin-conf.d/unbound +install -d -m 0755 %{buildroot}%{_datadir}/munin/plugins/ +install -p -m 0755 %{SOURCE4} %{buildroot}%{_datadir}/munin/plugins/unbound +for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unbound_munin_by_type unbound_munin_by_class unbound_munin_by_opcode unbound_munin_by_rcode unbound_munin_by_flags unbound_munin_histogram; do + ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin +done +%endif + +# install streamtcp used for monitoring / debugging unbound's port 80/443 modes +install -m 0755 streamtcp %{buildroot}%{_sbindir}/unbound-streamtcp +# install streamtcp man page +install -m 0644 testcode/streamtcp.1 %{buildroot}/%{_mandir}/man1/unbound-streamtcp.1 + +install -D -m 0644 contrib/libunbound.pc %{buildroot}/%{_libdir}/pkgconfig/libunbound.pc + + +# Install tmpfiles.d config +install -d -m 0755 %{buildroot}%{_tmpfilesdir} %{buildroot}%{_sharedstatedir}/unbound +install -m 0644 %{SOURCE8} %{buildroot}%{_tmpfilesdir}/unbound.conf + +# install root and DLV key - we keep a copy of the root key in old location, +# in case user has changed the configuration and we wouldn't update it there +install -m 0644 %{SOURCE5} %{SOURCE6} %{buildroot}%{_sysconfdir}/unbound/ +install -m 0644 %{SOURCE13} %{buildroot}%{_sharedstatedir}/unbound/root.key + +# remove static library from install (fedora packaging guidelines) +rm %{buildroot}%{_libdir}/*.la +%if %{with_python} +rm %{buildroot}%{python_sitearch}/*.la +%endif + +# create softlink for all functions of libunbound man pages +for mpage in ub_ctx ub_result ub_ctx_create ub_ctx_delete ub_ctx_set_option ub_ctx_get_option ub_ctx_config ub_ctx_set_fwd ub_ctx_resolvconf ub_ctx_hosts ub_ctx_add_ta ub_ctx_add_ta_file ub_ctx_trustedkeys ub_ctx_debugout ub_ctx_debuglevel ub_ctx_async ub_poll ub_wait ub_fd ub_process ub_resolve ub_resolve_async ub_cancel ub_resolve_free ub_strerror ub_ctx_print_local_zones ub_ctx_zone_add ub_ctx_zone_remove ub_ctx_data_add ub_ctx_data_remove; +do + echo ".so man3/libunbound.3" > %{buildroot}%{_mandir}/man3/$mpage ; +done + +mkdir -p %{buildroot}%{_localstatedir}/run/unbound + +# Install directories for easier config file drop in + +mkdir -p %{buildroot}%{_sysconfdir}/unbound/{keys.d,conf.d,local.d} +install -p %{SOURCE9} %{buildroot}%{_sysconfdir}/unbound/keys.d/ +install -p %{SOURCE10} %{buildroot}%{_sysconfdir}/unbound/conf.d/ +install -p %{SOURCE11} %{buildroot}%{_sysconfdir}/unbound/local.d/ + +# Link unbound-control-setup.8 manpage to unbound-control.8 +echo ".so man8/unbound-control.8" > %{buildroot}/%{_mandir}/man8/unbound-control-setup.8 + +%files +%doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES +%{_unitdir}/%{name}.service +%{_unitdir}/%{name}-keygen.service +%attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name} +%attr(0644,root,root) %{_tmpfilesdir}/unbound.conf +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/%{name} +%dir %attr(0755,root,unbound) %{_sysconfdir}/%{name}/keys.d +%attr(0664,root,unbound) %config(noreplace) %{_sysconfdir}/%{name}/keys.d/*.key +%dir %attr(0755,root,unbound) %{_sysconfdir}/%{name}/conf.d +%attr(0664,root,unbound) %config(noreplace) %{_sysconfdir}/%{name}/conf.d/*.conf +%dir %attr(0755,root,unbound) %{_sysconfdir}/%{name}/local.d +%attr(0664,root,unbound) %config(noreplace) %{_sysconfdir}/%{name}/local.d/*.conf +%{_sbindir}/unbound +%{_sbindir}/unbound-checkconf +%{_sbindir}/unbound-control +%{_sbindir}/unbound-control-setup +%{_sbindir}/unbound-host +%{_sbindir}/unbound-streamtcp +%{_mandir}/man1/* +%{_mandir}/man5/* +%{_mandir}/man8/* + +%if %{with_python} +%files python +%{python_sitearch}/* +%doc libunbound/python/examples/* +%doc pythonmod/examples/* +%endif + +%if %{with_munin} +%files munin +%config(noreplace) %{_sysconfdir}/munin/plugin-conf.d/unbound +%{_datadir}/munin/plugins/unbound* +%doc unbound-munin.README +%endif + +%files devel +%{_libdir}/libunbound.so +%{_includedir}/unbound.h +%{_includedir}/unbound-event.h +%{_mandir}/man3/* +%doc README +%{_libdir}/pkgconfig/*.pc + +%files libs +%attr(0755,root,root) %dir %{_sysconfdir}/%{name} +%{_sbindir}/unbound-anchor +%{_libdir}/libunbound.so.* +%{_sysconfdir}/%{name}/icannbundle.pem +%{_unitdir}/unbound-anchor.timer +%{_unitdir}/unbound-anchor.service +%dir %attr(0755,unbound,unbound) %{_sharedstatedir}/%{name} +# this file will be modified always after installation +%attr(0644,unbound,unbound) %config(noreplace) %{_sharedstatedir}/%{name}/root.key +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key +# just left for backwards compat with user changed unbound.conf files - format is different! +%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/root.key +%doc doc/README doc/LICENSE + +%pre libs +getent group unbound >/dev/null || groupadd -r unbound +getent passwd unbound >/dev/null || \ +useradd -r -g unbound -d %{_sysconfdir}/unbound -s /sbin/nologin \ +-c "Unbound DNS resolver" unbound +exit 0 + +%post +%systemd_post unbound.service +%systemd_post unbound-keygen.service + +%post libs +/sbin/ldconfig +# If update contains new keys not already in database, use package keys +if [ "$1" -eq 2 -a -f %{_sharedstatedir}/unbound/root.key.rpmnew ]; then + /sbin/runuser --command=" + cp -pf %{_sharedstatedir}/unbound/root.key %{_sharedstatedir}/unbound/root.key.rpmupdate && \ + sed -e 's/;.*//' -e '/^[[:space:]]*$/ d' %{_sharedstatedir}/unbound/root.key.rpmnew | while read KEY; + do + if ! grep -q \"\$KEY\" %{_sharedstatedir}/unbound/root.key.rpmupdate; then + echo \"\$KEY\" >> %{_sharedstatedir}/unbound/root.key.rpmupdate || exit 1; + fi; + done && \ + mv %{_sharedstatedir}/unbound/root.key.rpmupdate %{_sharedstatedir}/unbound/root.key" --shell /bin/sh unbound || : +fi +%{_sbindir}/runuser --command="%{_sbindir}/unbound-anchor -a %{_sharedstatedir}/unbound/root.key -c %{_sysconfdir}/unbound/icannbundle.pem" --shell /bin/sh unbound ||: +%systemd_post unbound-anchor.timer +# the Unit is in presets, but would be started afte reboot +/bin/systemctl start unbound-anchor.timer >/dev/null 2>&1 || : + +%preun +%systemd_preun unbound.service +%systemd_preun unbound-keygen.service + +%preun libs +%systemd_preun unbound-anchor.timer + +%postun +%systemd_postun_with_restart unbound.service +%systemd_postun unbound-keygen.service + +%postun libs +/sbin/ldconfig +%systemd_postun_with_restart unbound-anchor.timer + +%triggerun -- unbound < 1.4.12-4 +# Save the current service runlevel info +# User must manually run systemd-sysv-convert --apply unbound +# to migrate them to systemd targets +/usr/bin/systemd-sysv-convert --save unbound >/dev/null 2>&1 ||: + +# Run these because the SysV package being removed won't do them +/sbin/chkconfig --del unbound >/dev/null 2>&1 || : +/bin/systemctl try-restart unbound.service >/dev/null 2>&1 || : +/bin/systemctl try-restart unbound-keygen.service >/dev/null 2>&1 || : + + +%check +%if %{with_test} + make check + make longcheck +%endif + +%changelog +* Wed Oct 11 2017 Petr Menšík - 1.6.6-1 +- Rebase to 1.6.6 +- Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics +- Enable ipsecmod support + +* Sun Sep 17 2017 Petr Menšík - 1.6.3-3 +- Update project website and ICANN key + +* Wed Aug 30 2017 Petr Menšík - 1.6.3-2 +- Install unbound-event.h + +* Fri Aug 18 2017 Petr Menšík - 1.6.3-1 +- Rebase to 1.6.3 + +* Fri Jun 02 2017 Petr Menšík - 1.4.20-34 +- Make merge of updated database more safe + +* Wed May 24 2017 Petr Menšík - 1.4.20-33 +- Update also built-in digest in unbound-anchor + +* Wed May 24 2017 Petr Menšík - 1.4.20-32 +- Update trust anchors (#1452636) +- Update managed keys from trigger + +* Mon Mar 27 2017 Tomas Hozza - 1.4.20-31 +- Run internal test suite during build (#1383722) + +* Thu Feb 02 2017 Tomas Hozza - 1.4.20-30 +- Added cache-max-negative-ttl option to the default configuration file (#1382383) + +* Tue Oct 11 2016 Tomas Hozza - 1.4.20-29 +- Added cache-max-negative-ttl option (#1382383) + +* Fri May 20 2016 Pavel Šimerda - 1.4.20-28 +- Related: #1245250 - depend on the right ldns version + +* Thu May 19 2016 Pavel Šimerda - 1.4.20-27 +- Resolves: #1245250 - enable ecdsa + +* Tue Sep 22 2015 Tomas Hozza - 1.4.20-26 +- Added Conficts on redhat-release packages without unbound-anchor.timer in presets (Related #1215645) + +* Tue Sep 15 2015 Tomas Hozza - 1.4.20-25 +- Resolve ordering loop with nss-lookup.target and ntpdate (#1259806) + +* Wed Aug 19 2015 Tomas Hozza - 1.4.20-24 +- Fix CVE-2014-8602 (#1253961) + +* Tue May 26 2015 Tomas Hozza - 1.4.20-23 +- Removed usage of DLV from the default configuration (#1223339) + +* Wed May 13 2015 Tomas Hozza - 1.4.20-22 +- unbound.service now Wants unbound-anchor.timer (Related: #1180267) + +* Tue May 12 2015 Tomas Hozza - 1.4.20-21 +- Fix dependencies and minor scriptlet issues due to systemd timer unit (Related: #1180267) + +* Mon Apr 27 2015 Tomas Hozza - 1.4.20-20 +- Install tmpfiles configuration into /usr/lib/tmpfiles.d (#1180995) +- Fix root key management to comply to RFC5011 (#1180267) + +* Fri Jan 24 2014 Daniel Mach - 1.4.20-19 +- Mass rebuild 2014-01-24 + +* Fri Dec 27 2013 Daniel Mach - 1.4.20-18 +- Mass rebuild 2013-12-27 + +* Wed Sep 04 2013 Tomas Hozza - 1.4.20-17 +- Don't build unbound-munin package (#1002874) + +* Mon Aug 26 2013 Tomas Hozza - 1.4.20-16 +- Fix errors found by static analysis of source + +* Mon Jul 22 2013 Tomas Hozza - 1.4.20-15 +- provide man page for unbound-streamtcp + +* Wed Jul 03 2013 Tomas Hozza - 1.4.20-14 +- remove missing unbound-rootkey.service from post/preun/postun sections +- don't hardcode hardening flags, let hardened build macro handles it + +* Sat Jun 01 2013 Paul Wouters - 1.4.20-13 +- Run unbound-anchor as user unbound in unbound.service + +* Tue May 28 2013 Paul Wouters - 1.4.20-12 +- Enable round-robin (with noths() patch) +- Change cron and systemd service to use root.key, not root.anchor + +* Sat May 25 2013 Paul Wouters - 1.4.20-10 +- Use /var/lib/unbound/root.key (more consistent with other distros) +- Enable minimal responses + +* Mon Apr 22 2013 Paul Wouters - 1.4.20-8 +- Refix + +* Fri Apr 19 2013 Paul Wouters - 1.4.20-7 +- Fix runuser call in post. + +* Tue Apr 16 2013 Paul Wouters - 1.4.20-6 +- /var/lib/unbound should be owned by unbound. group write is not enough + +* Fri Apr 12 2013 Paul Wouters - 1.4.20-5 +- Fix cron job syntax (rhbz#951725) +- Use install -p to prevent .rpmnew files that are identical to originals + +* Mon Apr 8 2013 Paul Wouters - 1.4.20-4 +- Updated to 1.4.20 +- Build with full RELRO (not use -z,relro but with -z,relo,-z,now) +- Fixup man page for unbound-control-setup +- unbound.service should start before nss-lookup.target (rhbz#919955) +- Removed patch for rhbz#888759 merged in upstream +- Move root.anchor to /var/lib/unbound to make selinux policy easier for updating (rhbz#896599/rhbz#891008) +- Move cronjob for root.anchor from unbound to unbound-libs, require crontabs +- /etc/unbound (and all) should be owned by unbound-libs (rhbz#909691) +- Remove Obsolete/Provides for dnssec-conf which was last seen in f13 +- Ensure any unbound-anchor failure in post is ignored + +* Tue Mar 05 2013 Adam Tkac - 1.4.19-5 +- build with full RELRO +- symlink unbound-control-setup.8 manpage to unbound-control.8 + +* Fri Feb 15 2013 Fedora Release Engineering - 1.4.19-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Wed Dec 12 2012 Paul Wouters - 1.4.19-3 +- Updated to 1.4.19 - this integrates all existing patches +- Patch for unbound-anchor (rhbz#888759) + +* Fri Nov 09 2012 Paul Wouters - 1.4.18-6 +- Patch to ensure stube-zone's aren't lost when using dnssec-triggerd +- added unbound-munin.README file + +* Wed Sep 26 2012 Paul Wouters - 1.4.18-5 +- Patch to allow wildcards in include: statements +- Add directories /etc/unbound/keys.d,conf.d,local.d with + example entries +- Added /etc/unbound/root.anchor, maintained by unbound-anchor + which is installed as monthly cron and PreExec in systemd config + (root.key is unused, but left installed in case people depend on it) +- Native systemd (simple) and /etc/sysconfig/unbound support +- Run unbound-checkconf in PreExec +- Moved trust anchor related files to unbound-libs, as they can + be used without the daemon. +- sub packages now depends on base package of same arch +- Build munin package as noarch +- unbound-anchor moved to unbound-libs package. It is needed + to update the root.anchor key file. + +* Tue Sep 04 2012 Paul Wouters - 1.4.18-3 +- Fix openssl thread locking bug under high query load + +* Thu Aug 23 2012 Paul Wouters - 1.4.18-2 +- Use new systemd-rpm macros (rhbz#850351) +- Clean up old obsoleted dnssec-conf from < fedora 15 + +* Fri Aug 03 2012 Paul Wouters - 1.4.18-1 +- Updated to 1.4.18 (FIPS related fixes mostly) +- Removed patches that were merged in upstream +- Added comment to root.key + +* Mon Jul 23 2012 Paul Wouters - 1.4.17-5 +- Fix for unbound crasher (upstream bug #452) +- Support libunbound functions in man pages and place in -devel + +* Sun Jul 22 2012 Fedora Release Engineering - 1.4.17-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Tue Jul 03 2012 Paul Wouters - 1.4.17-3 +- unbound FIPS patches for MD5,randomness (rhbz#835106) + +* Fri Jun 15 2012 Adam Tkac - 1.4.17-2 +- don't build unbound-munin on RHEL + +* Thu May 24 2012 Paul Wouters - 1.4.17-1 +- Updated to 1.4.17 (which mostly brings in patches we already + applied from svn trunk) + +* Wed Feb 29 2012 Paul Wouters - 1.4.16-3 +- Since the daemon links to the libs staticly, add Requires: + (this is rhbz#745288) +- Package up streamtcp as unbound-streamtcp (for monitoring) + +* Mon Feb 27 2012 Paul Wouters - 1.4.16-2 +- Don't ghost the directory (rhbz#788805) +- Patch for unbound to support unbound-control forward_zone + (needed for openswan in XAUTH mode) + +* Thu Feb 02 2012 Paul Wouters - 1.4.16-1 +- Upgraded to 1.4.16, which was relesed due to the soname + and some DNSSEC validation failures + +* Wed Feb 01 2012 Paul Wouters - 1.4.15-2 +- Patch for SONAME version (libtool's -version-number vs -version-info) + +* Fri Jan 27 2012 Paul Wouters - 1.4.15-1 +- Upgraded to 1.4.15 +- Updated unbound.conf to show how to configure listening on tls443 + +* Sat Jan 14 2012 Fedora Release Engineering - 1.4.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Mon Dec 19 2011 Paul Wouters - 1.4.14-1 +- Upgraded to 1.4.14 for CVE-2011-4528 / VU#209659 +- SSL-wrapped query support for dnssec-trigger +- EDNS handling changes +- Removed integrated EDNS patches +- Disabled use-caps-for-id, GoDaddy domains now break on it +- Enabled new harden-below-nxdomain + +* Thu Sep 15 2011 Paul Wouters - 1.4.13-1 +- Upgraded to 1.4.13 +- Removed merged in pythonmod patch +- Added EDNS1480 patch to fix unbound on broken EDNS/UDP networks +- Fix python to go into sitearch instead of sitelib + +* Wed Sep 14 2011 Tom Callaway - 1.4.12-4 +- convert to systemd, tmpfiles.d + +* Mon Aug 08 2011 Paul Wouters - 1.4.12-3 +- Added pythonmod docs and examples + +* Mon Aug 08 2011 Paul Wouters - 1.4.12-2 +- Fix for python module load in the server (Tom Hendrikx) +- No longer enable --enable-debug as it causes degraded performance + under load. + +* Mon Jul 18 2011 Paul Wouters - 1.4.12-1 +- Updated to 1.4.12 + +* Sun Jul 03 2011 Paul Wouters - 1.4.11-1 +- Updated to 1.4.11 +- removed integrated CVE patch +- updated stock unbound.conf for new options introduced + +* Mon Jun 06 2011 Paul Wouters - 1.4.10-1 +- Added ghost for /var/run/unbound (bz#656710) + +* Mon Jun 06 2011 Paul Wouters - 1.4.9-3 +- rebuilt + +* Wed May 25 2011 Paul Wouters - 1.4.9-2 +- Applied patch for CVE-2011-1922 DoS vulnerability + +* Sun Mar 27 2011 Paul Wouters - 1.4.9-1 +- Updated to 1.4.9 + +* Sat Feb 12 2011 Paul Wouters - 1.4.8-2 +- rebuilt + +* Tue Jan 25 2011 Paul Wouters - 1.4.8-1 +- Updated to 1.4.8 +- Enable root key for DNSSEC +- Fix unbound-munin to use proper file (could cause excessive logging) +- Build unbound-python per default +- Disable gost as Fedora/EPEL does not allow ECC and has mangled openssl + +* Tue Oct 26 2010 Paul Wouters - 1.4.5-4 +- Revert last build - it was on the wrong branch + +* Tue Oct 26 2010 Paul Wouters - 1.4.5-3 +- Disable do-ipv6 per default - causes severe degradation on non-ipv6 machines + (see comments in inbound.conf) + +* Tue Jun 15 2010 Paul Wouters - 1.4.5-2 +- Bump release - forgot to upload the new tar ball. + +* Tue Jun 15 2010 Paul Wouters - 1.4.5-1 +- Upgraded to 1.4.5 + +* Mon May 31 2010 Paul Wouters - 1.4.4-2 +- Added accidentally omitted svn patches to cvs + +* Mon May 31 2010 Paul Wouters - 1.4.4-1 +- Upgraded to 1.4.4 with svn patches +- Obsolete dnssec-conf to ensure it is de-installed + +* Thu Mar 11 2010 Paul Wouters - 1.4.3-1 +- Update to 1.4.3 that fixes 64bit crasher + +* Tue Mar 09 2010 Paul Wouters - 1.4.2-1 +- Updated to 1.4.2 +- Updated unbound.conf with new options +- Enabled pre-fetching DNSKEY records (DNSSEC speedup) +- Enabled re-fetching popular records before they expire +- Enabled logging of DNSSEC validation errors + +* Mon Mar 01 2010 Paul Wouters - 1.4.1-5 +- Overriding -D_GNU_SOURCE is no longer needed. This fixes DSO issues + with pthreads + +* Wed Feb 24 2010 Paul Wouters - 1.4.1-3 +- Change make/configure lines to attempt to fix -lphtread linking issue + +* Thu Feb 18 2010 Paul Wouters - 1.4.1-2 +- Removed dependancy for dnssec-conf +- Added ISC DLV key (formerly in dnssec-conf) +- Fixup old DLV locations in unbound.conf file via %%post +- Fix parent child disagreement handling and no-ipv6 present [svn r1953] + +* Tue Jan 05 2010 Paul Wouters - 1.4.1-1 +- Updated to 1.4.1 +- Changed %%define to %%global + +* Thu Oct 08 2009 Paul Wouters - 1.3.4-2 +- Bump version + +* Thu Oct 08 2009 Paul Wouters - 1.3.4-1 +- Upgraded to 1.3.4. Security fix with validating NSEC3 records + +* Fri Aug 21 2009 Tomas Mraz - 1.3.3-2 +- rebuilt with new openssl + +* Mon Aug 17 2009 Paul Wouters - 1.3.3-1 +- Updated to 1.3.3 + +* Sun Jul 26 2009 Fedora Release Engineering - 1.3.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Sat Jun 20 2009 Paul Wouters - 1.3.0-2 +- Added missing glob patch to cvs +- Place python macros within the %%with_python check + +* Sat Jun 20 2009 Paul Wouters - 1.3.0-1 +- Updated to 1.3.0 +- Added unbound-python sub package. disabled for now +- Patch from svn to fix DLV lookups +- Patches from svn to detect wrong truncated response from BIND 9.6.1 with + minimal-responses) +- Added Default-Start and Default-Stop to unbound.init +- Re-enabled --enable-sha2 +- Re-enabled glob.patch + +* Wed May 20 2009 Paul Wouters - 1.2.1-7 +- unbound-iterator.patch was not commited + +* Wed May 20 2009 Paul Wouters - 1.2.1-6 +- Fix for https://bugzilla.redhat.com/show_bug.cgi?id=499793 + +* Tue Mar 17 2009 Paul Wouters - 1.2.1-5 +- Use --nocheck to avoid giving an error on missing unbound-remote certs/keys + +* Tue Mar 10 2009 Adam Tkac - 1.2.1-4 +- enable DNSSEC only if it is enabled in sysconfig/dnssec + +* Mon Mar 09 2009 Adam Tkac - 1.2.1-3 +- add DNSSEC support to initscript and enabled it per default +- add requires dnssec-conf + +* Wed Feb 25 2009 Fedora Release Engineering - 1.2.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Tue Feb 10 2009 Paul Wouters - 1.2.0-2 +- rebuild with new openssl + +* Wed Jan 14 2009 Paul Wouters - 1.1.1-7 +- Modified scandir patch to silently fail when wildcard matches nothing +- Patch to allow unbound-checkconf to find empty wildcard matches + +* Mon Jan 5 2009 Paul Wouters - 1.1.1-6 +- Added scandir patch for trusted-keys-file: option, which + is used to load multiple dnssec keys in bind file format + +* Mon Dec 8 2008 Paul Wouters - 1.1.1-4 +- Added Requires: for selinux-policy >= 3.5.13-33 for proper SElinux rules. + +* Mon Dec 1 2008 Paul Wouters - 1.1.1-3 +- We did not own the /etc/unbound directory (#474020) +- Fixed cvs anomalies + +* Fri Nov 28 2008 Adam Tkac - 1.1.1-2 +- removed all obsolete chroot related stuff +- label control certs after generation correctly + +* Thu Nov 20 2008 Paul Wouters - 1.1.1-1 +- Updated to unbound 1.1.1 which fixes a crasher and + addresses nlnetlabs bug #219 + +* Wed Nov 19 2008 Paul Wouters - 1.1.0-3 +- Remove the chroot, obsoleted by SElinux +- Add additional munin plugin links supported by unbound plugin +- Move configuration directory from /var/lib/unbound to /etc/unbound +- Modified unbound.init and unbound.conf to account for chroot changes +- Updated unbound.conf with new available options +- Enabled dns-0x20 protection per default + +* Wed Nov 19 2008 Adam Tkac - 1.1.0-2 +- unbound-1.1.0-log_open.patch + - make sure log is opened before chroot call + - tracked as http://www.nlnetlabs.nl/bugs/show_bug.cgi?id=219 +- removed /dev/log and /var/run/unbound and /etc/resolv.conf from + chroot, not needed +- don't mount files in chroot, it causes problems during updates +- fixed typo in default config file + +* Fri Nov 14 2008 Paul Wouters - 1.1.0-1 +- Updated to version 1.1.0 +- Updated unbound.conf's statistics options and remote-control + to work properly for munin +- Added unbound-munin package +- Generate unbound remote-control key/certs on first startup +- Required ldns is now 1.4.0 + +* Wed Oct 22 2008 Paul Wouters - 1.0.2-5 +- Only call ldconfig in -libs package +- Move configure into build section +- devel subpackage should only depend on libs subpackage + +* Tue Oct 21 2008 Paul Wouters - 1.0.2-4 +- Fix CFLAGS getting lost in build +- Don't enable interface-automatic:yes because that + causes unbound to listen on 0.0.0.0 instead of 127.0.0.1 + +* Sun Oct 19 2008 Paul Wouters - 1.0.2-3 +- Split off unbound-libs, make build verbose + +* Thu Oct 9 2008 Paul Wouters - 1.0.2-2 +- FSB compliance, chroot fixes, initscript fixes + +* Thu Sep 11 2008 Paul Wouters - 1.0.2-1 +- Upgraded to 1.0.2 + +* Wed Jul 16 2008 Paul Wouters - 1.0.1-1 +- upgraded to new release + +* Wed May 21 2008 Paul Wouters - 1.0.0-2 +- Build against ldns-1.3.0 + +* Wed May 21 2008 Paul Wouters - 1.0.0-1 +- Split of -devel package, fixed dependancies, make rpmlint happy + +* Thu Apr 25 2008 Wouter Wijngaards - 0.12 +- Using parts from ports collection entry by Jaap Akkerhuis. +- Using Fedoraproject wiki guidelines. + +* Wed Apr 23 2008 Wouter Wijngaards - 0.11 +- Initial version.