git: 0640e0c19659 - main - unbound: Refresh manpages to latest version
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 17 Feb 2022 17:05:52 UTC
The branch main has been updated by cy:
URL: https://cgit.FreeBSD.org/src/commit/?id=0640e0c1965948da53e0baae9eece957919c0b43
commit 0640e0c1965948da53e0baae9eece957919c0b43
Author: Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2022-02-17 16:11:33 +0000
Commit: Cy Schubert <cy@FreeBSD.org>
CommitDate: 2022-02-17 17:05:34 +0000
unbound: Refresh manpages to latest version
Update unbound manpages by copying the current unbound manpages in
contrib/doc/*.in to their respective manpages,
PR: 262013
Reported by: Michael Osipov <michael.osipov@siemens.com>
Fixes: numerous previous updates
MFC after: 3 days
---
contrib/unbound/doc/example.conf | 289 +++++++++---
contrib/unbound/doc/libunbound.3 | 11 +-
contrib/unbound/doc/unbound-anchor.8 | 21 +-
contrib/unbound/doc/unbound-checkconf.8 | 4 +-
contrib/unbound/doc/unbound-control.8 | 44 +-
contrib/unbound/doc/unbound-host.1 | 4 +-
contrib/unbound/doc/unbound.8 | 11 +-
contrib/unbound/doc/unbound.conf.5 | 811 +++++++++++++++++++++++++++-----
8 files changed, 987 insertions(+), 208 deletions(-)
diff --git a/contrib/unbound/doc/example.conf b/contrib/unbound/doc/example.conf
index 3dc6d3f358d2..d9f4995e41ef 100644
--- a/contrib/unbound/doc/example.conf
+++ b/contrib/unbound/doc/example.conf
@@ -1,13 +1,17 @@
#
# Example configuration file.
#
-# See unbound.conf(5) man page, version 1.9.2.
+# See unbound.conf(5) man page, version 1.14.0.
#
# this is a comment.
-#Use this to include other text into the file.
+# Use this anywhere in the file to include other text into this file.
#include: "otherfile.conf"
+# Use this anywhere in the file to include other text, that explicitly starts a
+# clause, into this file. Text after this directive needs to start a clause.
+#include-toplevel: "otherfile.conf"
+
# The server clause sets the main parameters.
server:
# whitespace is not necessary, but looks cleaner.
@@ -70,6 +74,9 @@ server:
# Set this to yes to prefer ipv6 upstream servers over ipv4.
# prefer-ip6: no
+ # Prefer ipv4 upstream servers, even if ipv6 is available.
+ # prefer-ip4: no
+
# number of ports to allocate per thread, determines the size of the
# port range that can be open simultaneously. About double the
# num-queries-per-thread, or, use as many as the OS will allow you.
@@ -116,9 +123,14 @@ server:
# Linux only. On Linux you also have ip-transparent that is similar.
# ip-freebind: no
+ # the value of the Differentiated Services Codepoint (DSCP)
+ # in the differentiated services field (DS) of the outgoing
+ # IP packets
+ # ip-dscp: 0
+
# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
- # is set with msg-buffer-size). 1472 can solve fragmentation (timeouts)
- # edns-buffer-size: 4096
+ # is set with msg-buffer-size).
+ # edns-buffer-size: 1232
# Maximum UDP response size (not applied to TCP response).
# Suggested values are 512 to 4096. Default is 4096. 65536 disables it.
@@ -149,6 +161,12 @@ server:
# msec to wait before close of port on timeout UDP. 0 disables.
# delay-close: 0
+ # perform connect for UDP sockets to mitigate ICMP side channel.
+ # udp-connect: yes
+
+ # The number of retries when a non-positive response is received.
+ # outbound-msg-retry: 5
+
# msec for waiting for an unknown server to reply. Increase if you
# are behind a slow satellite link, to eg. 1128.
# unknown-server-time-limit: 376
@@ -180,6 +198,9 @@ server:
# minimum wait time for responses, increase if uplink is long. In msec.
# infra-cache-min-rtt: 50
+ # enable to make server probe down hosts more frequently.
+ # infra-keep-probing: no
+
# the number of slabs to use for the Infrastructure cache.
# the number of slabs must be a power of 2.
# more slabs reduce lock contention, but fragment memory usage.
@@ -286,23 +307,23 @@ server:
# The pid file can be absolute and outside of the chroot, it is
# written just prior to performing the chroot and dropping permissions.
#
- # Additionally, unbound may need to access /dev/random (for entropy).
+ # Additionally, unbound may need to access /dev/urandom (for entropy).
# How to do this is specific to your OS.
#
# If you give "" no chroot is performed. The path must not end in a /.
- # chroot: "/var/unbound"
+ # chroot: "@UNBOUND_CHROOT_DIR@"
# if given, user privileges are dropped (after binding port),
# and the given username is assumed. Default is user "unbound".
# If you give "" no privileges are dropped.
- # username: "unbound"
+ # username: "@UNBOUND_USERNAME@"
# the working directory. The relative files in this config are
# relative to this directory. If you give "" the working directory
# is not changed.
# If you give a server: directory: dir before include: file statements
# then those includes can be relative to the working directory.
- # directory: "/var/unbound"
+ # directory: "@UNBOUND_RUN_DIR@"
# the log file, "" means log to stderr.
# Use of this option sets use-syslog to "no".
@@ -338,7 +359,7 @@ server:
# log-servfail: no
# the pid file. Can be an absolute path outside of chroot/work dir.
- # pidfile: "/var/unbound/unbound.pid"
+ # pidfile: "@UNBOUND_PIDFILE@"
# file to read root hints from.
# get one from https://www.internic.net/domain/named.cache
@@ -353,12 +374,22 @@ server:
# enable to not answer trustanchor.unbound queries.
# hide-trustanchor: no
+ # enable to not set the User-Agent HTTP header.
+ # hide-http-user-agent: no
+
# the identity to report. Leave "" or default to return hostname.
# identity: ""
# the version to report. Leave "" or default to return package version.
# version: ""
+ # NSID identity (hex string, or "ascii_somestring"). default disabled.
+ # nsid: "aabbccdd"
+
+ # User-Agent HTTP header to use. Leave "" or default to use package name
+ # and version.
+ # http-user-agent: ""
+
# the target fetch policy.
# series of integers describing the policy per dependency depth.
# The number of values in the list determines the maximum dependency
@@ -370,7 +401,7 @@ server:
# target-fetch-policy: "3 2 1 0 0"
# Harden against very small EDNS buffer sizes.
- # harden-short-bufsize: no
+ # harden-short-bufsize: yes
# Harden against unseemly large queries.
# harden-large-queries: no
@@ -419,8 +450,8 @@ server:
# Domains (and domains in them) without support for dns-0x20 and
# the fallback fails because they keep sending different answers.
- # caps-whitelist: "licdn.com"
- # caps-whitelist: "senderbase.org"
+ # caps-exempt: "licdn.com"
+ # caps-exempt: "senderbase.org"
# Enforce privacy of these addresses. Strips them away from answers.
# It may cause DNSSEC validation to additionally mark it as bogus.
@@ -465,7 +496,7 @@ server:
# deny-any: no
# if yes, Unbound rotates RRSet order in response.
- # rrset-roundrobin: no
+ # rrset-roundrobin: yes
# if yes, Unbound doesn't insert authority/additional sections
# into response messages when those sections are not required.
@@ -486,10 +517,11 @@ server:
# Use several entries, one per domain name, to track multiple zones.
#
# If you want to perform DNSSEC validation, run unbound-anchor before
- # you start unbound (i.e. in the system boot scripts). And enable:
+ # you start unbound (i.e. in the system boot scripts).
+ # And then enable the auto-trust-anchor-file config item.
# Please note usage of unbound-anchor root anchor is at your own risk
# and under the terms of our LICENSE (see that file in the source).
- # auto-trust-anchor-file: "/var/unbound/root.key"
+ # auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
# trust anchor signaling sends a RFC8145 key tag query after priming.
# trust-anchor-signaling: yes
@@ -497,11 +529,6 @@ server:
# Root key trust anchor sentinel (draft-ietf-dnsop-kskroll-sentinel)
# root-key-sentinel: yes
- # File with DLV trusted keys. Same format as trust-anchor-file.
- # There can be only one DLV configured, it is trusted from root down.
- # DLV is going to be decommissioned. Please do not use it any more.
- # dlv-anchor-file: "dlv.isc.org.key"
-
# File with trusted keys for validation. Specify more than one file
# with several entries, one file per entry.
# Zone file format, with DS and DNSKEY entries.
@@ -540,6 +567,10 @@ server:
# val-sig-skew-min: 3600
# val-sig-skew-max: 86400
+ # The maximum number the validator should restart validation with
+ # another authority in case of failed validation.
+ # val-max-restart: 5
+
# Should additional section of secure message also be kept clean of
# unsecure data. Useful to shield the users of this validator from
# potential bogus data in the additional section. All unsigned data
@@ -558,8 +589,8 @@ server:
# that set CD but cannot validate themselves.
# ignore-cd-flag: no
- # Serve expired responses from cache, with TTL 0 in the response,
- # and then attempt to fetch the data afresh.
+ # Serve expired responses from cache, with serve-expired-reply-ttl in
+ # the response, and then attempt to fetch the data afresh.
# serve-expired: no
#
# Limit serving of expired responses to configured seconds after
@@ -571,6 +602,23 @@ server:
# that the expired records will be served as long as there are queries
# for it.
# serve-expired-ttl-reset: no
+ #
+ # TTL value to use when replying with expired data.
+ # serve-expired-reply-ttl: 30
+ #
+ # Time in milliseconds before replying to the client with expired data.
+ # This essentially enables the serve-stale behavior as specified in
+ # RFC 8767 that first tries to resolve before
+ # immediately responding with expired data. 0 disables this behavior.
+ # A recommended value is 1800.
+ # serve-expired-client-timeout: 0
+
+ # Return the original TTL as received from the upstream name server rather
+ # than the decrementing TTL as stored in the cache. Enabling this feature
+ # does not impact cache expiry, it only changes the TTL unbound embeds in
+ # responses to queries. Note that enabling this feature implicitly disables
+ # enforcement of the configured minimum and maximum TTL.
+ # serve-original-ttl: no
# Have the validator log failed validations for your diagnosis.
# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
@@ -580,7 +628,10 @@ server:
# keysize. Keep this table very short, as linear search is done.
# A message with an NSEC3 with larger count is marked insecure.
# List in ascending order the keysize and count values.
- # val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
+ # val-nsec3-keysize-iterations: "1024 150 2048 150 4096 150"
+
+ # if enabled, ZONEMD verification failures do not block the zone.
+ # zonemd-permissive-mode: no
# instruct the auto-trust-anchor-file probing to add anchors after ttl.
# add-holddown: 2592000 # 30 days
@@ -605,7 +656,7 @@ server:
# more slabs reduce lock contention, but fragment memory usage.
# key-cache-slabs: 4
- # the amount of memory to use for the negative cache (used for DLV).
+ # the amount of memory to use for the negative cache.
# plain value in bytes or you can append k, m or G. default is "1Mb".
# neg-cache-size: 1m
@@ -618,6 +669,7 @@ server:
# local-zone: "localhost." nodefault
# local-zone: "127.in-addr.arpa." nodefault
# local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." nodefault
+ # local-zone: "home.arpa." nodefault
# local-zone: "onion." nodefault
# local-zone: "test." nodefault
# local-zone: "invalid." nodefault
@@ -654,6 +706,9 @@ server:
# local-zone: "8.b.d.0.1.0.0.2.ip6.arpa." nodefault
# And for 64.100.in-addr.arpa. to 127.100.in-addr.arpa.
+ # Add example.com into ipset
+ # local-zone: "example.com" ipset
+
# If unbound is running service for the local host then it is useful
# to perform lan-wide lookups to the upstream, and unblock the
# long list of local-zones above. If this unbound is a dns server
@@ -678,8 +733,10 @@ server:
# o inform acts like transparent, but logs client IP address
# o inform_deny drops queries and logs client IP address
# o inform_redirect redirects queries and logs client IP address
- # o always_transparent, always_refuse, always_nxdomain, resolve in
- # that way but ignore local data for that name
+ # o always_transparent, always_refuse, always_nxdomain, always_nodata,
+ # always_deny resolve in that way but ignore local data for
+ # that name
+ # o always_null returns 0.0.0.0 or ::0 for any name in the zone.
# o noview breaks out of that view towards global local-zones.
#
# defaults are localhost address, reverse for 127.0.0.1 and ::1
@@ -713,18 +770,30 @@ server:
# add a netblock specific override to a localzone, with zone type
# local-zone-override: "example.com" 192.0.2.0/24 refuse
- # service clients over TLS (on the TCP sockets), with plain DNS inside
- # the TLS stream. Give the certificate to use and private key.
+ # service clients over TLS (on the TCP sockets) with plain DNS inside
+ # the TLS stream, and over HTTPS using HTTP/2 as specified in RFC8484.
+ # Give the certificate to use and private key.
# default is "" (disabled). requires restart to take effect.
# tls-service-key: "path/to/privatekeyfile.key"
# tls-service-pem: "path/to/publiccertfile.pem"
# tls-port: 853
+ # https-port: 443
# cipher setting for TLSv1.2
# tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256"
# cipher setting for TLSv1.3
# tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
+ # Pad responses to padded queries received over TLS
+ # pad-responses: yes
+
+ # Padded responses will be padded to the closest multiple of this size.
+ # pad-responses-block-size: 468
+
+ # Use the SNI extension for TLS connections. Default is yes.
+ # Changing the value requires a reload.
+ # tls-use-sni: yes
+
# Add the secret file for TLS Session Ticket.
# Secret file must be 80 bytes of random data.
# First key use to encrypt and decrypt TLS session tickets.
@@ -743,9 +812,34 @@ server:
# Add system certs to the cert bundle, from the Windows Cert Store
# tls-win-cert: no
+ # Pad queries over TLS upstreams
+ # pad-queries: yes
+
+ # Padded queries will be padded to the closest multiple of this size.
+ # pad-queries-block-size: 128
+
# Also serve tls on these port numbers (eg. 443, ...), by listing
# tls-additional-port: portno for each of the port numbers.
+ # HTTP endpoint to provide DNS-over-HTTPS service on.
+ # http-endpoint: "/dns-query"
+
+ # HTTP/2 SETTINGS_MAX_CONCURRENT_STREAMS value to use.
+ # http-max-streams: 100
+
+ # Maximum number of bytes used for all HTTP/2 query buffers.
+ # http-query-buffer-size: 4m
+
+ # Maximum number of bytes used for all HTTP/2 response buffers.
+ # http-response-buffer-size: 4m
+
+ # Set TCP_NODELAY socket option on sockets used for DNS-over-HTTPS
+ # service.
+ # http-nodelay: yes
+
+ # Disable TLS for DNS-over-HTTP downstream service.
+ # http-notls-downstream: no
+
# DNS64 prefix. Must be specified when DNS64 is use.
# Enable dns64 in module-config. Used to synthesize IPv6 from IPv4.
# dns64-prefix: 64:ff9b::0/96
@@ -819,9 +913,16 @@ server:
# ipsecmod-ignore-bogus: no
#
# Domains for which ipsecmod will be triggered. If not defined (default)
- # all domains are treated as being whitelisted.
- # ipsecmod-whitelist: "example.com"
- # ipsecmod-whitelist: "nlnetlabs.nl"
+ # all domains are treated as being allowed.
+ # ipsecmod-allow: "example.com"
+ # ipsecmod-allow: "nlnetlabs.nl"
+
+ # Timeout for REUSE entries in milliseconds.
+ # tcp-reuse-timeout: 60000
+ # Max number of queries on a reuse connection.
+ # max-reuse-tcp-queries: 200
+ # Timeout in milliseconds for TCP queries to auth servers.
+ # tcp-auth-query-timeout: 3000
# Python config section. To enable:
@@ -832,7 +933,18 @@ server:
# o and give a python-script to run.
python:
# Script file to load
- # python-script: "/var/unbound/ubmodule-tst.py"
+ # python-script: "@UNBOUND_SHARE_DIR@/ubmodule-tst.py"
+
+# Dynamic library config section. To enable:
+# o use --with-dynlibmodule to configure before compiling.
+# o list dynlib in the module-config string (above) to enable.
+# It can be placed anywhere, the dynlib module is only a very thin wrapper
+# to load modules dynamically.
+# o and give a dynlib-file to run. If more than one dynlib entry is listed in
+# the module-config then you need one dynlib-file per instance.
+dynlib:
+ # Script file to load
+ # dynlib-file: "@UNBOUND_SHARE_DIR@/dynlib.so"
# Remote control config section.
remote-control:
@@ -855,16 +967,16 @@ remote-control:
# control-use-cert: "yes"
# unbound server key file.
- # server-key-file: "/var/unbound/unbound_server.key"
+ # server-key-file: "@UNBOUND_RUN_DIR@/unbound_server.key"
# unbound server certificate file.
- # server-cert-file: "/var/unbound/unbound_server.pem"
+ # server-cert-file: "@UNBOUND_RUN_DIR@/unbound_server.pem"
# unbound-control key file.
- # control-key-file: "/var/unbound/unbound_control.key"
+ # control-key-file: "@UNBOUND_RUN_DIR@/unbound_control.key"
# unbound-control certificate file.
- # control-cert-file: "/var/unbound/unbound_control.pem"
+ # control-cert-file: "@UNBOUND_RUN_DIR@/unbound_control.pem"
# Stub zones.
# Create entries like below, to make all queries for 'example.com' and
@@ -879,6 +991,7 @@ remote-control:
# stub-addr: 192.0.2.68
# stub-prime: no
# stub-first: no
+# stub-tcp-upstream: no
# stub-tls-upstream: no
# stub-no-cache: no
# stub-zone:
@@ -896,6 +1009,7 @@ remote-control:
# forward-addr: 192.0.2.68
# forward-addr: 192.0.2.73@5355 # forward to port 5355.
# forward-first: no
+# forward-tcp-upstream: no
# forward-tls-upstream: no
# forward-no-cache: no
# forward-zone:
@@ -908,27 +1022,27 @@ remote-control:
# upstream (which saves a lookup to the upstream). The first example
# has a copy of the root for local usage. The second serves example.org
# authoritatively. zonefile: reads from file (and writes to it if you also
-# download it), master: fetches with AXFR and IXFR, or url to zonefile.
-# With allow-notify: you can give additional (apart from masters) sources of
+# download it), primary: fetches with AXFR and IXFR, or url to zonefile.
+# With allow-notify: you can give additional (apart from primaries) sources of
# notifies.
# auth-zone:
# name: "."
-# master: 199.9.14.201 # b.root-servers.net
-# master: 192.33.4.12 # c.root-servers.net
-# master: 199.7.91.13 # d.root-servers.net
-# master: 192.5.5.241 # f.root-servers.net
-# master: 192.112.36.4 # g.root-servers.net
-# master: 193.0.14.129 # k.root-servers.net
-# master: 192.0.47.132 # xfr.cjr.dns.icann.org
-# master: 192.0.32.132 # xfr.lax.dns.icann.org
-# master: 2001:500:200::b # b.root-servers.net
-# master: 2001:500:2::c # c.root-servers.net
-# master: 2001:500:2d::d # d.root-servers.net
-# master: 2001:500:2f::f # f.root-servers.net
-# master: 2001:500:12::d0d # g.root-servers.net
-# master: 2001:7fd::1 # k.root-servers.net
-# master: 2620:0:2830:202::132 # xfr.cjr.dns.icann.org
-# master: 2620:0:2d0:202::132 # xfr.lax.dns.icann.org
+# primary: 199.9.14.201 # b.root-servers.net
+# primary: 192.33.4.12 # c.root-servers.net
+# primary: 199.7.91.13 # d.root-servers.net
+# primary: 192.5.5.241 # f.root-servers.net
+# primary: 192.112.36.4 # g.root-servers.net
+# primary: 193.0.14.129 # k.root-servers.net
+# primary: 192.0.47.132 # xfr.cjr.dns.icann.org
+# primary: 192.0.32.132 # xfr.lax.dns.icann.org
+# primary: 2001:500:200::b # b.root-servers.net
+# primary: 2001:500:2::c # c.root-servers.net
+# primary: 2001:500:2d::d # d.root-servers.net
+# primary: 2001:500:2f::f # f.root-servers.net
+# primary: 2001:500:12::d0d # g.root-servers.net
+# primary: 2001:7fd::1 # k.root-servers.net
+# primary: 2620:0:2830:202::132 # xfr.cjr.dns.icann.org
+# primary: 2620:0:2d0:202::132 # xfr.lax.dns.icann.org
# fallback-enabled: yes
# for-downstream: no
# for-upstream: yes
@@ -936,6 +1050,8 @@ remote-control:
# name: "example.org"
# for-downstream: yes
# for-upstream: yes
+# zonemd-check: no
+# zonemd-reject-absence: no
# zonefile: "example.org.zone"
# Views
@@ -992,3 +1108,68 @@ remote-control:
# redis-server-port: 6379
# # timeout (in ms) for communication with the redis server
# redis-timeout: 100
+# # set timeout on redis records based on DNS response TTL
+# redis-expire-records: no
+
+# IPSet
+# Add specify domain into set via ipset.
+# Note: To enable ipset unbound needs to run as root user.
+# ipset:
+# # set name for ip v4 addresses
+# name-v4: "list-v4"
+# # set name for ip v6 addresses
+# name-v6: "list-v6"
+#
+
+# Dnstap logging support, if compiled in. To enable, set the dnstap-enable
+# to yes and also some of dnstap-log-..-messages to yes. And select an
+# upstream log destination, by socket path, TCP or TLS destination.
+# dnstap:
+# dnstap-enable: no
+# # if set to yes frame streams will be used in bidirectional mode
+# dnstap-bidirectional: yes
+# dnstap-socket-path: "@DNSTAP_SOCKET_PATH@"
+# # if "" use the unix socket in dnstap-socket-path, otherwise,
+# # set it to "IPaddress[@port]" of the destination.
+# dnstap-ip: ""
+# # if set to yes if you want to use TLS to dnstap-ip, no for TCP.
+# dnstap-tls: yes
+# # name for authenticating the upstream server. or "" disabled.
+# dnstap-tls-server-name: ""
+# # if "", it uses the cert bundle from the main unbound config.
+# dnstap-tls-cert-bundle: ""
+# # key file for client authentication, or "" disabled.
+# dnstap-tls-client-key-file: ""
+# # cert file for client authentication, or "" disabled.
+# dnstap-tls-client-cert-file: ""
+# dnstap-send-identity: no
+# dnstap-send-version: no
+# # if "" it uses the hostname.
+# dnstap-identity: ""
+# # if "" it uses the package version.
+# dnstap-version: ""
+# dnstap-log-resolver-query-messages: no
+# dnstap-log-resolver-response-messages: no
+# dnstap-log-client-query-messages: no
+# dnstap-log-client-response-messages: no
+# dnstap-log-forwarder-query-messages: no
+# dnstap-log-forwarder-response-messages: no
+
+# Response Policy Zones
+# RPZ policies. Applied in order of configuration. QNAME, Response IP
+# Address, nsdname, nsip and clientip triggers are supported. Supported
+# actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp-only
+# and drop. Policies can be loaded from a file, or using zone
+# transfer, or using HTTP. The respip module needs to be added
+# to the module-config, e.g.: module-config: "respip validator iterator".
+# rpz:
+# name: "rpz.example.com"
+# zonefile: "rpz.example.com"
+# primary: 192.0.2.0
+# allow-notify: 192.0.2.0/32
+# url: http://www.example.com/rpz.example.org.zone
+# rpz-action-override: cname
+# rpz-cname-override: www.example.org
+# rpz-log: yes
+# rpz-log-name: "example policy"
+# tags: "example"
diff --git a/contrib/unbound/doc/libunbound.3 b/contrib/unbound/doc/libunbound.3
index fd5c336e0903..6c5217aa04c4 100644
--- a/contrib/unbound/doc/libunbound.3
+++ b/contrib/unbound/doc/libunbound.3
@@ -1,4 +1,4 @@
-.TH "libunbound" "3" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
+.TH "libunbound" "3" "Dec 9, 2021" "NLnet Labs" "unbound 1.14.0"
.\"
.\" libunbound.3 -- unbound library functions manual
.\"
@@ -44,7 +44,7 @@
.B ub_ctx_zone_remove,
.B ub_ctx_data_add,
.B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.9.2 functions.
+\- Unbound DNS validating resolver 1.14.0 functions.
.SH "SYNOPSIS"
.B #include <unbound.h>
.LP
@@ -396,12 +396,13 @@ The result of the DNS resolution and validation is returned as
char* canonname; /* canonical name of result */
int rcode; /* additional error code in case of no data */
void* answer_packet; /* full network format answer packet */
- int answer_len; /* length of packet in octets */
+ int answer_len; /* length of packet in octets */
int havedata; /* true if there is data */
int nxdomain; /* true if nodata because name does not exist */
- int secure; /* true if result is secure */
- int bogus; /* true if a security failure happened */
+ int secure; /* true if result is secure */
+ int bogus; /* true if a security failure happened */
char* why_bogus; /* string with error if bogus */
+ int was_ratelimited; /* true if the query was ratelimited (SERVFAIL) by unbound */
int ttl; /* number of seconds the result is valid */
};
.fi
diff --git a/contrib/unbound/doc/unbound-anchor.8 b/contrib/unbound/doc/unbound-anchor.8
index 60759eb19f4f..ddab3d27f120 100644
--- a/contrib/unbound/doc/unbound-anchor.8
+++ b/contrib/unbound/doc/unbound-anchor.8
@@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
+.TH "unbound-anchor" "8" "Dec 9, 2021" "NLnet Labs" "unbound 1.14.0"
.\"
.\" unbound-anchor.8 -- unbound anchor maintenance utility manual
.\"
@@ -26,13 +26,13 @@ Suggested usage:
.nf
# in the init scripts.
# provide or update the root anchor (if necessary)
- unbound-anchor \-a "/var/unbound/root.key"
+ unbound-anchor \-a "@UNBOUND_ROOTKEY_FILE@"
# Please note usage of this root anchor is at your own risk
# and under the terms of our LICENSE (see source).
#
# start validating resolver
# the unbound.conf contains:
- # auto-trust-anchor-file: "/var/unbound/root.key"
+ # auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
unbound \-c unbound.conf
.fi
.P
@@ -53,12 +53,12 @@ The available options are:
.TP
.B \-a \fIfile
The root anchor key file, that is read in and written out.
-Default is /var/unbound/root.key.
+Default is @UNBOUND_ROOTKEY_FILE@.
If the file does not exist, or is empty, a builtin root key is written to it.
.TP
.B \-c \fIfile
The root update certificate file, that is read in.
-Default is /var/unbound/icannbundle.pem.
+Default is @UNBOUND_ROOTCERT_FILE@.
If the file does not exist, or is empty, a builtin certificate is used.
.TP
.B \-l
@@ -69,6 +69,13 @@ The server name, it connects to https://name. Specify without https:// prefix.
The default is "data.iana.org". It connects to the port specified with \-P.
You can pass an IPv4 address or IPv6 address (no brackets) if you want.
.TP
+.B \-S
+Do not use SNI for the HTTPS connection. Default is to use SNI.
+.TP
+.B \-b \fIaddress
+The source address to bind to for domain resolution and contacting the server
+on https. May be either an IPv4 address or IPv6 address (no brackets).
+.TP
.B \-x \fIpath
The pathname to the root\-anchors.xml file on the server. (forms URL with \-u).
The default is /root\-anchors/root\-anchors.xml.
@@ -162,11 +169,11 @@ The build\-in configuration can be overridden by providing a root\-cert
file and a rootkey file.
.SH "FILES"
.TP
-.I /var/unbound/root.key
+.I @UNBOUND_ROOTKEY_FILE@
The root anchor file, updated with 5011 tracking, and read and written to.
The file is created if it does not exist.
.TP
-.I /var/unbound/icannbundle.pem
+.I @UNBOUND_ROOTCERT_FILE@
The trusted self\-signed certificate that is used to verify the downloaded
DNSSEC root trust anchor. You can update it by fetching it from
https://data.iana.org/root\-anchors/icannbundle.pem (and validate it).
diff --git a/contrib/unbound/doc/unbound-checkconf.8 b/contrib/unbound/doc/unbound-checkconf.8
index affb2996bdf7..bd1ab8ad696d 100644
--- a/contrib/unbound/doc/unbound-checkconf.8
+++ b/contrib/unbound/doc/unbound-checkconf.8
@@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
+.TH "unbound-checkconf" "8" "Dec 9, 2021" "NLnet Labs" "unbound 1.14.0"
.\"
.\" unbound-checkconf.8 -- unbound configuration checker manual
.\"
@@ -45,7 +45,7 @@ The unbound\-checkconf program exits with status code 1 on error,
0 for a correct config file.
.SH "FILES"
.TP
-.I /var/unbound/unbound.conf
+.I @ub_conf_file@
unbound configuration file.
.SH "SEE ALSO"
\fIunbound.conf\fR(5),
diff --git a/contrib/unbound/doc/unbound-control.8 b/contrib/unbound/doc/unbound-control.8
index 7b4026378146..ab5413c9a0ba 100644
--- a/contrib/unbound/doc/unbound-control.8
+++ b/contrib/unbound/doc/unbound-control.8
@@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
+.TH "unbound-control" "8" "Dec 9, 2021" "NLnet Labs" "unbound 1.14.0"
.\"
.\" unbound-control.8 -- unbound remote control manual
.\"
@@ -32,7 +32,7 @@ Show the version and commandline option help.
.TP
.B \-c \fIcfgfile
The config file to read with settings. If not given the default
-config file /var/unbound/unbound.conf is used.
+config file @ub_conf_file@ is used.
.TP
.B \-s \fIserver[@port]
IPv4 or IPv6 address of the server to contact. If not given, the
@@ -89,8 +89,7 @@ it. If the zone does not exist, the command succeeds.
Add new local data, the given resource record. Like \fBlocal\-data\fR
config statement, except for when no covering zone exists. In that case
this remote control command creates a transparent zone with the same
-name as this record. This command is not good at returning detailed syntax
-errors.
+name as this record.
.TP
.B local_data_remove \fIname
Remove all RR data from local name. If the name already has no items,
@@ -305,6 +304,12 @@ Transfer the auth zone from master. The auth zone probe sequence is started,
where the masters are probed to see if they have an updated zone (with the SOA
serial check). And then the zone is transferred for a newer zone version.
.TP
+.B rpz_enable \fIzone\fR
+Enable the RPZ zone if it had previously been disabled.
+.TP
+.B rpz_disable \fIzone\fR
+Disable the RPZ zone.
+.TP
.B view_list_local_zones \fIview\fR
\fIlist_local_zones\fR for given view.
.TP
@@ -323,6 +328,9 @@ serial check). And then the zone is transferred for a newer zone version.
.B view_local_data_remove \fIview\fR \fIname
\fIlocal_data_remove\fR for given view.
.TP
+.B view_local_datas_remove \fIview\fR
+Remove a list of \fIlocal_data\fR for given view from stdin. Like local_datas_remove.
+.TP
.B view_local_datas \fIview\fR
Add a list of \fIlocal_data\fR for given view from stdin. Like local_datas.
.SH "EXIT CODE"
@@ -379,8 +387,8 @@ and resulted in recursive processing, taking a slot in the requestlist.
Not part of the recursivereplies (or the histogram thereof) or cachemiss,
as a cache response was sent.
.TP
-.I threadX.num.zero_ttl
-number of replies with ttl zero, because they served an expired cache entry.
+.I threadX.num.expired
+number of replies that served an expired cache entry.
.TP
.I threadX.num.recursivereplies
The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
@@ -443,7 +451,7 @@ summed over threads.
.I total.num.prefetch
summed over threads.
.TP
-.I total.num.zero_ttl
+.I total.num.expired
summed over threads.
.TP
.I total.num.recursivereplies
@@ -503,6 +511,14 @@ negative cache.
Memory in bytes in used by the TCP and TLS stream wait buffers. These are
answers waiting to be written back to the clients.
.TP
+.I mem.http.query_buffer
+Memory in bytes used by the HTTP/2 query buffers. Containing (partial) DNS
+queries waiting for request stream completion.
+.TP
+.I mem.http.response_buffer
+Memory in bytes used by the HTTP/2 response buffers. Containing DNS responses
+waiting to be written back to the clients.
+.TP
.I histogram.<sec>.<usec>.to.<sec>.<usec>
Shows a histogram, summed over all threads. Every element counts the
recursive queries whose reply time fit between the lower and upper bound.
@@ -542,6 +558,11 @@ These are also counted in num.query.tcp, because TLS uses TCP.
Number of TLS session resumptions, these are queries over TLS towards
the unbound server where the client negotiated a TLS session resumption key.
.TP
+.I num.query.https
+Number of queries that were made using HTTPS towards the unbound server.
+These are also counted in num.query.tcp and num.query.tls, because HTTPS
+uses TLS and TCP.
+.TP
.I num.query.ipv6
Number of queries that were made using IPv6 towards the unbound server.
.TP
@@ -660,12 +681,17 @@ Number of queries that got an answer that contained EDNS client subnet data.
Number of queries answered from the edns client subnet cache. These are
counted as cachemiss by the main counters, but hit the client subnet
specific cache, after getting processed by the edns client subnet module.
+.TP
+.I num.rpz.action.<rpz_action>
+Number of queries answered using configured RPZ policy, per RPZ action type.
+Possible actions are: nxdomain, nodata, passthru, drop, tcp\-only, local\-data,
+disabled, and cname\-override.
.SH "FILES"
.TP
-.I /var/unbound/unbound.conf
+.I @ub_conf_file@
unbound configuration file.
.TP
-.I /var/unbound
+.I @UNBOUND_RUN_DIR@
directory with private keys (unbound_server.key and unbound_control.key) and
self\-signed certificates (unbound_server.pem and unbound_control.pem).
.SH "SEE ALSO"
diff --git a/contrib/unbound/doc/unbound-host.1 b/contrib/unbound/doc/unbound-host.1
index 296bd5994dbe..b7d4d2350074 100644
--- a/contrib/unbound/doc/unbound-host.1
+++ b/contrib/unbound/doc/unbound-host.1
@@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
+.TH "unbound\-host" "1" "Dec 9, 2021" "NLnet Labs" "unbound 1.14.0"
.\"
.\" unbound-host.1 -- unbound DNS lookup utility
.\"
@@ -73,7 +73,7 @@ For example \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546
.TP
.B \-D
Enables DNSSEC validation. Reads the root anchor from the default configured
-root anchor at the default location, \fI/var/unbound/root.key\fR.
+root anchor at the default location, \fI@UNBOUND_ROOTKEY_FILE@\fR.
.TP
.B \-f \fIkeyfile
Reads keys from a file. Every line has a DS or DNSKEY record, in the format
diff --git a/contrib/unbound/doc/unbound.8 b/contrib/unbound/doc/unbound.8
index 50a51aa3d93e..11b02aebcb2e 100644
--- a/contrib/unbound/doc/unbound.8
+++ b/contrib/unbound/doc/unbound.8
@@ -1,4 +1,4 @@
-.TH "unbound" "8" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
+.TH "unbound" "8" "Dec 9, 2021" "NLnet Labs" "unbound 1.14.0"
.\"
.\" unbound.8 -- unbound manual
.\"
@@ -9,7 +9,7 @@
.\"
.SH "NAME"
.B unbound
-\- Unbound DNS validating resolver 1.9.2.
+\- Unbound DNS validating resolver 1.14.0.
.SH "SYNOPSIS"
.B unbound
.RB [ \-h ]
@@ -54,11 +54,11 @@ resolvers are using the same port number (53).
The available options are:
.TP
.B \-h
-Show the version and commandline option help.
+Show the version number and commandline option help, and exit.
.TP
.B \-c\fI cfgfile
Set the config file with settings for unbound to read instead of reading the
-file at the default location, /var/unbound/unbound.conf. The syntax is
+file at the default location, @ub_conf_file@. The syntax is
described in \fIunbound.conf\fR(5).
.TP
.B \-d
@@ -76,6 +76,9 @@ concurrently.
.B \-v
Increase verbosity. If given multiple times, more information is logged.
This is in addition to the verbosity (if any) from the config file.
+.TP
+.B \-V
+Show the version number and build options, and exit.
.SH "SEE ALSO"
\fIunbound.conf\fR(5),
\fIunbound\-checkconf\fR(8),
diff --git a/contrib/unbound/doc/unbound.conf.5 b/contrib/unbound/doc/unbound.conf.5
index 9320d167d9f1..4c144db22ab5 100644
--- a/contrib/unbound/doc/unbound.conf.5
+++ b/contrib/unbound/doc/unbound.conf.5
@@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "Jun 17, 2019" "NLnet Labs" "unbound 1.9.2"
+.TH "unbound.conf" "5" "Dec 9, 2021" "NLnet Labs" "unbound 1.14.0"
.\"
.\" unbound.conf.5 -- unbound.conf manual
.\"
@@ -50,7 +50,7 @@ server:
username: unbound
# make sure unbound can access entropy from inside the chroot.
# e.g. on linux the use these commands (on BSD, devfs(8) is used):
- # mount \-\-bind \-n /dev/random /etc/unbound/dev/random
+ # mount \-\-bind \-n /dev/urandom /etc/unbound/dev/urandom
# and mount \-\-bind \-n /dev/log /etc/unbound/dev/log
chroot: "/etc/unbound"
# logfile: "/etc/unbound/unbound.log" #uncomment to use logfile.
@@ -63,8 +63,10 @@ server:
access\-control: 2001:DB8::/64 allow
.fi
.SH "FILE FORMAT"
-There must be whitespace between keywords. Attribute keywords end with a colon ':'.
-An attribute is followed by its containing attributes, or a value.
+There must be whitespace between keywords. Attribute keywords end with a
+colon ':'. An attribute is followed by a value, or its containing attributes
+in which case it is referred to as a clause. Clauses can be repeated throughout
+the file (or included files) to group attributes under the same clause.
.P
Files can be included using the
.B include:
@@ -75,17 +77,23 @@ for the included files works, relative pathnames for the included names work
if the directory where the daemon is started equals its chroot/working
directory or is specified before the include statement with directory: dir.
Wildcards can be used to include multiple files, see \fIglob\fR(7).
+.P
+For a more structural include option, the
+.B include\-toplevel:
+directive can be used. This closes whatever clause is currently active (if any)
+and forces the use of clauses in the included files and right after this
+directive.
.SS "Server Options"
These options are part of the
.B server:
clause.
.TP
.B verbosity: \fI<number>
-The verbosity number, level 0 means no verbosity, only errors. Level 1
-gives operational information. Level 2 gives detailed operational
-information. Level 3 gives query level information, output per query.
-Level 4 gives algorithm level information. Level 5 logs client
-identification for cache misses. Default is level 1.
+The verbosity number, level 0 means no verbosity, only errors. Level 1
+gives operational information. Level 2 gives detailed operational
+information including short information per query. Level 3 gives query level
+information, output per query. Level 4 gives algorithm level information.
+Level 5 logs client identification for cache misses. Default is level 1.
The verbosity can also be increased from the commandline, see \fIunbound\fR(8).
.TP
.B statistics\-interval: \fI<seconds>
@@ -114,7 +122,8 @@ The port number, default 53, on which the server responds to queries.
Interface to use to connect to the network. This interface is listened to
for queries from clients, and answers to clients are given from it.
Can be given multiple times to work on several interfaces. If none are
-given the default is to listen to localhost.
+given the default is to listen to localhost. If an interface name is used
+instead of an ip address, the list of ip addresses on that interface are used.
The interfaces are not changed on a reload (kill \-HUP) but only on restart.
A port number can be specified with @port (without spaces between
interface and port number), if not specified the default port (from
@@ -124,9 +133,12 @@ interface and port number), if not specified the default port (from
Same as interface: (for ease of compatibility with nsd.conf).
.TP
.B interface\-automatic: \fI<yes or no>
-Detect source interface on UDP queries and copy them to replies. This
-feature is experimental, and needs support in your OS for particular socket
-options. Default value is no.
+Listen on all addresses on all (current and future) interfaces, detect the
+source interface on UDP queries and copy them to replies. This is a lot like
+ip\-transparent, but this option services all interfaces whilst with
+ip\-transparent you can select which (future) interfaces unbound provides
+service on. This feature is experimental, and needs support in your OS for
+particular socket options. Default value is no.
.TP
.B outgoing\-interface: \fI<ip address or ip6 netblock>
Interface to use to connect to the network. This interface is used to send
@@ -195,12 +207,11 @@ accepted. For larger installations increasing this value is a good idea.
Number of bytes size to advertise as the EDNS reassembly buffer size.
This is the value put into datagrams over UDP towards peers. The actual
buffer size is determined by msg\-buffer\-size (both for TCP and UDP). Do
-not set higher than that value. Default is 4096 which is RFC recommended.
-If you have fragmentation reassembly problems, usually seen as timeouts,
-then a value of 1472 can fix it. Setting to 512 bypasses even the most
-stringent path MTU problems, but is seen as extreme, since the amount
-of TCP fallback generated is excessive (probably also for this resolver,
*** 1209 LINES SKIPPED ***