head 1.1; branch 1.1.1; access; symbols netbsd-8-3-RELEASE:1.1.1.1.8.1 netbsd-9-4-RELEASE:1.1.1.4.2.2 netbsd-10-0-RELEASE:1.1.1.7.2.1 netbsd-10-0-RC6:1.1.1.7.2.1 netbsd-10-0-RC5:1.1.1.7.2.1 unbound-1-19-1:1.1.1.8 netbsd-10-0-RC4:1.1.1.7 netbsd-10-0-RC3:1.1.1.7 netbsd-10-0-RC2:1.1.1.7 netbsd-10-0-RC1:1.1.1.7 netbsd-10:1.1.1.7.0.2 netbsd-10-base:1.1.1.7 unbound-1-16-3:1.1.1.7 netbsd-9-3-RELEASE:1.1.1.4.2.1 cjep_sun2x-base1:1.1.1.6 cjep_sun2x:1.1.1.6.0.4 cjep_sun2x-base:1.1.1.6 cjep_staticlib_x-base1:1.1.1.6 netbsd-9-2-RELEASE:1.1.1.4.2.1 cjep_staticlib_x:1.1.1.6.0.2 cjep_staticlib_x-base:1.1.1.6 unbound-1-13-1:1.1.1.6 netbsd-9-1-RELEASE:1.1.1.4.2.1 phil-wifi-20200421:1.1.1.5 phil-wifi-20200411:1.1.1.5 is-mlppp:1.1.1.5.0.2 is-mlppp-base:1.1.1.5 phil-wifi-20200406:1.1.1.5 netbsd-8-2-RELEASE:1.1.1.1.8.1 netbsd-9-0-RELEASE:1.1.1.4.2.1 netbsd-9-0-RC2:1.1.1.4.2.1 unbound-1-9-6:1.1.1.5 netbsd-9-0-RC1:1.1.1.4 phil-wifi-20191119:1.1.1.4 netbsd-9:1.1.1.4.0.2 netbsd-9-base:1.1.1.4 phil-wifi-20190609:1.1.1.4 netbsd-8-1-RELEASE:1.1.1.1.8.1 unbound-1-9-1:1.1.1.4 netbsd-8-1-RC1:1.1.1.1.8.1 pgoyette-compat-merge-20190127:1.1.1.2.2.1 pgoyette-compat-20190127:1.1.1.3 pgoyette-compat-20190118:1.1.1.3 pgoyette-compat-1226:1.1.1.3 pgoyette-compat-1126:1.1.1.3 pgoyette-compat-1020:1.1.1.3 pgoyette-compat-0930:1.1.1.3 pgoyette-compat-0906:1.1.1.3 unbound-1-7-3:1.1.1.3 pgoyette-compat-0728:1.1.1.2 netbsd-8-0-RELEASE:1.1.1.1.8.1 phil-wifi:1.1.1.2.0.4 phil-wifi-base:1.1.1.2 pgoyette-compat-0625:1.1.1.2 netbsd-8-0-RC2:1.1.1.1.8.1 pgoyette-compat-0521:1.1.1.2 pgoyette-compat-0502:1.1.1.2 pgoyette-compat-0422:1.1.1.2 netbsd-8-0-RC1:1.1.1.1.8.1 pgoyette-compat-0415:1.1.1.2 pgoyette-compat-0407:1.1.1.2 pgoyette-compat-0330:1.1.1.2 pgoyette-compat-0322:1.1.1.2 pgoyette-compat-0315:1.1.1.2 pgoyette-compat:1.1.1.2.0.2 pgoyette-compat-base:1.1.1.2 unbound-1-6-8:1.1.1.2 matt-nb8-mediatek:1.1.1.1.0.12 matt-nb8-mediatek-base:1.1.1.1 perseant-stdc-iso10646:1.1.1.1.0.10 perseant-stdc-iso10646-base:1.1.1.1 netbsd-8:1.1.1.1.0.8 netbsd-8-base:1.1.1.1 prg-localcount2-base3:1.1.1.1 prg-localcount2-base2:1.1.1.1 prg-localcount2-base1:1.1.1.1 prg-localcount2:1.1.1.1.0.6 prg-localcount2-base:1.1.1.1 pgoyette-localcount-20170426:1.1.1.1 bouyer-socketcan-base1:1.1.1.1 pgoyette-localcount-20170320:1.1.1.1 bouyer-socketcan:1.1.1.1.0.4 bouyer-socketcan-base:1.1.1.1 pgoyette-localcount-20170107:1.1.1.1 pgoyette-localcount-20161104:1.1.1.1 pgoyette-localcount:1.1.1.1.0.2 localcount-20160914:1.1.1.1 unbound-1-5-9:1.1.1.1 NLNETLABS:1.1.1; locks; strict; comment @# @; 1.1 date 2016.08.20.11.09.09; author christos; state Exp; branches 1.1.1.1; next ; commitid TgCvoOC8yQxac2jz; 1.1.1.1 date 2016.08.20.11.09.09; author christos; state Exp; branches 1.1.1.1.2.1 1.1.1.1.8.1; next 1.1.1.2; commitid TgCvoOC8yQxac2jz; 1.1.1.2 date 2018.02.06.02.39.26; author christos; state Exp; branches 1.1.1.2.2.1 1.1.1.2.4.1; next 1.1.1.3; commitid qeqT9bPzhT9JaKpA; 1.1.1.3 date 2018.09.03.14.09.03; author christos; state Exp; branches; next 1.1.1.4; commitid o0zwx3bWVehagFQA; 1.1.1.4 date 2019.05.25.21.17.57; author christos; state Exp; branches 1.1.1.4.2.1; next 1.1.1.5; commitid N8Uz34hJGvap9DoB; 1.1.1.5 date 2019.12.15.15.28.38; author christos; state Exp; branches; next 1.1.1.6; commitid NCYfiiT7bQUbFOOB; 1.1.1.6 date 2021.03.15.20.00.56; author christos; state Exp; branches; next 1.1.1.7; commitid oSEdmWcDkMtAwrLC; 1.1.1.7 date 2022.09.24.18.08.47; author christos; state Exp; branches 1.1.1.7.2.1; next 1.1.1.8; commitid 7eVcc5iJVjgqX8VD; 1.1.1.8 date 2024.02.17.18.06.22; author christos; state Exp; branches; next ; commitid aM4iaBBqSvMRwOYE; 1.1.1.1.2.1 date 2016.08.20.11.09.09; author pgoyette; state dead; branches; next 1.1.1.1.2.2; commitid 0FvUzdNwg07UHcmz; 1.1.1.1.2.2 date 2016.09.14.03.04.07; author pgoyette; state Exp; branches; next ; commitid 0FvUzdNwg07UHcmz; 1.1.1.1.8.1 date 2018.04.12.01.38.44; author msaitoh; state Exp; branches; next ; commitid t5lnMt5mtvxvK5yA; 1.1.1.2.2.1 date 2018.09.06.06.51.51; author pgoyette; state Exp; branches; next ; commitid HCi1bXD317XIK0RA; 1.1.1.2.4.1 date 2019.06.10.21.51.41; author christos; state Exp; branches; next 1.1.1.2.4.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.2.4.2 date 2020.04.08.14.04.16; author martin; state Exp; branches; next ; commitid Qli2aW9E74UFuA3C; 1.1.1.4.2.1 date 2020.01.05.09.51.46; author martin; state Exp; branches; next 1.1.1.4.2.2; commitid 2CiUer1HYuOh8uRB; 1.1.1.4.2.2 date 2024.02.29.11.40.12; author martin; state Exp; branches; next ; commitid JxWuK0x3VE2xYj0F; 1.1.1.7.2.1 date 2024.02.24.13.06.29; author martin; state Exp; branches; next ; commitid CPCGsuzTHTgqDGZE; desc @@ 1.1 log @Initial revision @ text @.TH "unbound.conf" "5" "Jun 9, 2016" "NLnet Labs" "unbound 1.5.9" .\" .\" unbound.conf.5 -- unbound.conf manual .\" .\" Copyright (c) 2007, NLnet Labs. All rights reserved. .\" .\" See LICENSE for the license. .\" .\" .SH "NAME" .B unbound.conf \- Unbound configuration file. .SH "SYNOPSIS" .B unbound.conf .SH "DESCRIPTION" .B unbound.conf is used to configure \fIunbound\fR(8). The file format has attributes and values. Some attributes have attributes inside them. The notation is: attribute: value. .P Comments start with # and last to the end of line. Empty lines are ignored as is whitespace at the beginning of a line. .P The utility \fIunbound\-checkconf\fR(8) can be used to check unbound.conf prior to usage. .SH "EXAMPLE" An example config file is shown below. Copy this to /etc/unbound/unbound.conf and start the server with: .P .nf $ unbound \-c /etc/unbound/unbound.conf .fi .P Most settings are the defaults. Stop the server with: .P .nf $ kill `cat /etc/unbound/unbound.pid` .fi .P Below is a minimal config file. The source distribution contains an extensive example.conf file with all the options. .P .nf # unbound.conf(5) config file for unbound(8). server: directory: "/etc/unbound" username: unbound # make sure unbound can access entropy from inside the chroot. # e.g. on linux the use these commands (on BSD, devfs(8) is used): # mount \-\-bind \-n /dev/random /etc/unbound/dev/random # and mount \-\-bind \-n /dev/log /etc/unbound/dev/log chroot: "/etc/unbound" # logfile: "/etc/unbound/unbound.log" #uncomment to use logfile. pidfile: "/etc/unbound/unbound.pid" # verbosity: 1 # uncomment and increase to get more logging. # listen on all interfaces, answer queries from the local subnet. interface: 0.0.0.0 interface: ::0 access\-control: 10.0.0.0/8 allow access\-control: 2001:DB8::/64 allow .fi .SH "FILE FORMAT" There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute is followed by its containing attributes, or a value. .P Files can be included using the .B include: directive. It can appear anywhere, it accepts a single file name as argument. Processing continues as if the text from the included file was copied into the config file at that point. If also using chroot, using full path names for the included files works, relative pathnames for the included names work if the directory where the daemon is started equals its chroot/working directory. Wildcards can be used to include multiple files, see \fIglob\fR(7). .SS "Server Options" These options are part of the .B server: clause. .TP .B verbosity: \fI The verbosity number, level 0 means no verbosity, only errors. Level 1 gives operational information. Level 2 gives detailed operational information. Level 3 gives query level information, output per query. Level 4 gives algorithm level information. Level 5 logs client identification for cache misses. Default is level 1. The verbosity can also be increased from the commandline, see \fIunbound\fR(8). .TP .B statistics\-interval: \fI The number of seconds between printing statistics to the log for every thread. Disable with value 0 or "". Default is disabled. The histogram statistics are only printed if replies were sent during the statistics interval, requestlist statistics are printed for every interval (but can be 0). This is because the median calculation requires data to be present. .TP .B statistics\-cumulative: \fI If enabled, statistics are cumulative since starting unbound, without clearing the statistics counters after logging the statistics. Default is no. .TP .B extended\-statistics: \fI If enabled, extended statistics are printed from \fIunbound\-control\fR(8). Default is off, because keeping track of more statistics takes time. The counters are listed in \fIunbound\-control\fR(8). .TP .B num\-threads: \fI The number of threads to create to serve clients. Use 1 for no threading. .TP .B port: \fI The port number, default 53, on which the server responds to queries. .TP .B interface: \fI Interface to use to connect to the network. This interface is listened to for queries from clients, and answers to clients are given from it. Can be given multiple times to work on several interfaces. If none are given the default is to listen to localhost. The interfaces are not changed on a reload (kill \-HUP) but only on restart. A port number can be specified with @@port (without spaces between interface and port number), if not specified the default port (from \fBport\fR) is used. .TP .B ip\-address: \fI Same as interface: (for easy of compatibility with nsd.conf). .TP .B interface\-automatic: \fI Detect source interface on UDP queries and copy them to replies. This feature is experimental, and needs support in your OS for particular socket options. Default value is no. .TP .B outgoing\-interface: \fI Interface to use to connect to the network. This interface is used to send queries to authoritative servers and receive their replies. Can be given multiple times to work on several interfaces. If none are given the default (all) is used. You can specify the same interfaces in .B interface: and .B outgoing\-interface: lines, the interfaces are then used for both purposes. Outgoing queries are sent via a random outgoing interface to counter spoofing. .TP .B outgoing\-range: \fI Number of ports to open. This number of file descriptors can be opened per thread. Must be at least 1. Default depends on compile options. Larger numbers need extra resources from the operating system. For performance a a very large value is best, use libevent to make this possible. .TP .B outgoing\-port\-permit: \fI Permit unbound to open this port or range of ports for use to send queries. A larger number of permitted outgoing ports increases resilience against spoofing attempts. Make sure these ports are not needed by other daemons. By default only ports above 1024 that have not been assigned by IANA are used. Give a port number or a range of the form "low\-high", without spaces. .IP The \fBoutgoing\-port\-permit\fR and \fBoutgoing\-port\-avoid\fR statements are processed in the line order of the config file, adding the permitted ports and subtracting the avoided ports from the set of allowed ports. The processing starts with the non IANA allocated ports above 1024 in the set of allowed ports. .TP .B outgoing\-port\-avoid: \fI Do not permit unbound to open this port or range of ports for use to send queries. Use this to make sure unbound does not grab a port that another daemon needs. The port is avoided on all outgoing interfaces, both IP4 and IP6. By default only ports above 1024 that have not been assigned by IANA are used. Give a port number or a range of the form "low\-high", without spaces. .TP .B outgoing\-num\-tcp: \fI Number of outgoing TCP buffers to allocate per thread. Default is 10. If set to 0, or if do\-tcp is "no", no TCP queries to authoritative servers are done. For larger installations increasing this value is a good idea. .TP .B incoming\-num\-tcp: \fI Number of incoming TCP buffers to allocate per thread. Default is 10. If set to 0, or if do\-tcp is "no", no TCP queries from clients are accepted. For larger installations increasing this value is a good idea. .TP .B edns\-buffer\-size: \fI Number of bytes size to advertise as the EDNS reassembly buffer size. This is the value put into datagrams over UDP towards peers. The actual buffer size is determined by msg\-buffer\-size (both for TCP and UDP). Do not set higher than that value. Default is 4096 which is RFC recommended. If you have fragmentation reassembly problems, usually seen as timeouts, then a value of 1480 can fix it. Setting to 512 bypasses even the most stringent path MTU problems, but is seen as extreme, since the amount of TCP fallback generated is excessive (probably also for this resolver, consider tuning the outgoing tcp number). .TP .B max\-udp\-size: \fI Maximum UDP response size (not applied to TCP response). 65536 disables the udp response size maximum, and uses the choice from the client, always. Suggested values are 512 to 4096. Default is 4096. .TP .B msg\-buffer\-size: \fI Number of bytes size of the message buffers. Default is 65552 bytes, enough for 64 Kb packets, the maximum DNS message size. No message larger than this can be sent or received. Can be reduced to use less memory, but some requests for DNS data, such as for huge resource records, will result in a SERVFAIL reply to the client. .TP .B msg\-cache\-size: \fI Number of bytes size of the message cache. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B msg\-cache\-slabs: \fI Number of slabs in the message cache. Slabs reduce lock contention by threads. Must be set to a power of 2. Setting (close) to the number of cpus is a reasonable guess. .TP .B num\-queries\-per\-thread: \fI The number of queries that every thread will service simultaneously. If more queries arrive that need servicing, and no queries can be jostled out (see \fIjostle\-timeout\fR), then the queries are dropped. This forces the client to resend after a timeout; allowing the server time to work on the existing queries. Default depends on compile options, 512 or 1024. .TP .B jostle\-timeout: \fI Timeout used when the server is very busy. Set to a value that usually results in one roundtrip to the authority servers. If too many queries arrive, then 50% of the queries are allowed to run to completion, and the other 50% are replaced with the new incoming query if they have already spent more than their allowed time. This protects against denial of service by slow queries or high query rates. Default 200 milliseconds. The effect is that the qps for long-lasting queries is about (numqueriesperthread / 2) / (average time for such long queries) qps. The qps for short queries can be about (numqueriesperthread / 2) / (jostletimeout in whole seconds) qps per thread, about (1024/2)*5 = 2560 qps by default. .TP .B delay\-close: \fI Extra delay for timeouted UDP ports before they are closed, in msec. Default is 0, and that disables it. This prevents very delayed answer packets from the upstream (recursive) servers from bouncing against closed ports and setting off all sort of close-port counters, with eg. 1500 msec. When timeouts happen you need extra sockets, it checks the ID and remote IP of packets, and unwanted packets are added to the unwanted packet counter. .TP .B so\-rcvbuf: \fI If not 0, then set the SO_RCVBUF socket option to get more buffer space on UDP port 53 incoming queries. So that short spikes on busy servers do not drop packets (see counter in netstat \-su). Default is 0 (use system value). Otherwise, the number of bytes to ask for, try "4m" on a busy server. The OS caps it at a maximum, on linux unbound needs root permission to bypass the limit, or the admin can use sysctl net.core.rmem_max. On BSD change kern.ipc.maxsockbuf in /etc/sysctl.conf. On OpenBSD change header and recompile kernel. On Solaris ndd \-set /dev/udp udp_max_buf 8388608. .TP .B so\-sndbuf: \fI If not 0, then set the SO_SNDBUF socket option to get more buffer space on UDP port 53 outgoing queries. This for very busy servers handles spikes in answer traffic, otherwise 'send: resource temporarily unavailable' can get logged, the buffer overrun is also visible by netstat \-su. Default is 0 (use system value). Specify the number of bytes to ask for, try "4m" on a very busy server. The OS caps it at a maximum, on linux unbound needs root permission to bypass the limit, or the admin can use sysctl net.core.wmem_max. On BSD, Solaris changes are similar to so\-rcvbuf. .TP .B so\-reuseport: \fI If yes, then open dedicated listening sockets for incoming queries for each thread and try to set the SO_REUSEPORT socket option on each socket. May distribute incoming queries to threads more evenly. Default is no. On Linux it is supported in kernels >= 3.9. On other systems, FreeBSD, OSX it may also work. You can enable it (on any platform and kernel), it then attempts to open the port and passes the option if it was available at compile time, if that works it is used, if it fails, it continues silently (unless verbosity 3) without the option. .TP .B ip\-transparent: \fI If yes, then use IP_TRANSPARENT socket option on sockets where unbound is listening for incoming traffic. Default no. Allows you to bind to non\-local interfaces. For example for non\-existant IP addresses that are going to exist later on, with host failover configuration. This is a lot like interface\-automatic, but that one services all interfaces and with this option you can select which (future) interfaces unbound provides service on. This option needs unbound to be started with root permissions on some systems. The option uses IP_BINDANY on FreeBSD systems. .TP .B ip\-freebind: \fI If yes, then use IP_FREEBIND socket option on sockets where unbound is listening to incoming traffic. Default no. Allows you to bind to IP addresses that are nonlocal or do not exist, like when the network interface or IP adress is down. Exists only on Linux, where the similar ip\-transparent option is also available. .TP .B rrset\-cache\-size: \fI Number of bytes size of the RRset cache. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B rrset\-cache\-slabs: \fI Number of slabs in the RRset cache. Slabs reduce lock contention by threads. Must be set to a power of 2. .TP .B cache\-max\-ttl: \fI Time to live maximum for RRsets and messages in the cache. Default is 86400 seconds (1 day). If the maximum kicks in, responses to clients still get decrementing TTLs based on the original (larger) values. When the internal TTL expires, the cache item has expired. Can be set lower to force the resolver to query for data often, and not trust (very large) TTL values. .TP .B cache\-min\-ttl: \fI Time to live minimum for RRsets and messages in the cache. Default is 0. If the minimum kicks in, the data is cached for longer than the domain owner intended, and thus less queries are made to look up the data. Zero makes sure the data in the cache is as the domain owner intended, higher values, especially more than an hour or so, can lead to trouble as the data in the cache does not match up with the actual data any more. .TP .B cache\-max\-negative\-ttl: \fI Time to live maximum for negative responses, these have a SOA in the authority section that is limited in time. Default is 3600. .TP .B infra\-host\-ttl: \fI Time to live for entries in the host cache. The host cache contains roundtrip timing, lameness and EDNS support information. Default is 900. .TP .B infra\-cache\-slabs: \fI Number of slabs in the infrastructure cache. Slabs reduce lock contention by threads. Must be set to a power of 2. .TP .B infra\-cache\-numhosts: \fI Number of hosts for which information is cached. Default is 10000. .TP .B infra\-cache\-min\-rtt: \fI Lower limit for dynamic retransmit timeout calculation in infrastructure cache. Default is 50 milliseconds. Increase this value if using forwarders needing more time to do recursive name resolution. .TP .B do\-ip4: \fI Enable or disable whether ip4 queries are answered or issued. Default is yes. .TP .B do\-ip6: \fI Enable or disable whether ip6 queries are answered or issued. Default is yes. If disabled, queries are not answered on IPv6, and queries are not sent on IPv6 to the internet nameservers. With this option you can disable the ipv6 transport for sending DNS traffic, it does not impact the contents of the DNS traffic, which may have ip4 and ip6 addresses in it. .TP .B do\-udp: \fI Enable or disable whether UDP queries are answered or issued. Default is yes. .TP .B do\-tcp: \fI Enable or disable whether TCP queries are answered or issued. Default is yes. .TP .B tcp\-mss: \fI Maximum segment size (MSS) of TCP socket on which the server responds to queries. Value lower than common MSS on Ethernet (1220 for example) will address path MTU problem. Note that not all platform supports socket option to set MSS (TCP_MAXSEG). Default is system default MSS determined by interface MTU and negotiation between server and client. .TP .B outgoing\-tcp\-mss: \fI Maximum segment size (MSS) of TCP socket for outgoing queries (from Unbound to other servers). Value lower than common MSS on Ethernet (1220 for example) will address path MTU problem. Note that not all platform supports socket option to set MSS (TCP_MAXSEG). Default is system default MSS determined by interface MTU and negotiation between Unbound and other servers. .TP .B tcp\-upstream: \fI Enable or disable whether the upstream queries use TCP only for transport. Default is no. Useful in tunneling scenarios. .TP .B ssl\-upstream: \fI Enabled or disable whether the upstream queries use SSL only for transport. Default is no. Useful in tunneling scenarios. The SSL contains plain DNS in TCP wireformat. The other server must support this (see \fBssl\-service\-key\fR). .TP .B ssl\-service-key: \fI If enabled, the server provider SSL service on its TCP sockets. The clients have to use ssl\-upstream: yes. The file is the private key for the TLS session. The public certificate is in the ssl\-service\-pem file. Default is "", turned off. Requires a restart (a reload is not enough) if changed, because the private key is read while root permissions are held and before chroot (if any). Normal DNS TCP service is not provided and gives errors, this service is best run with a different \fBport:\fR config or \fI@@port\fR suffixes in the \fBinterface\fR config. .TP .B ssl\-service\-pem: \fI The public key certificate pem file for the ssl service. Default is "", turned off. .TP .B ssl\-port: \fI The port number on which to provide TCP SSL service, default 853, only interfaces configured with that port number as @@number get the SSL service. .TP .B do\-daemonize: \fI Enable or disable whether the unbound server forks into the background as a daemon. Default is yes. .TP .B access\-control: \fI The netblock is given as an IP4 or IP6 address with /size appended for a classless network block. The action can be \fIdeny\fR, \fIrefuse\fR, \fIallow\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or \fIrefuse_non_local\fR. The most specific netblock match is used, if none match \fIdeny\fR is used. .IP The action \fIdeny\fR stops queries from hosts from that netblock. .IP The action \fIrefuse\fR stops queries too, but sends a DNS rcode REFUSED error message back. .IP The action \fIallow\fR gives access to clients from that netblock. It gives only access for recursion clients (which is what almost all clients need). Nonrecursive queries are refused. .IP The \fIallow\fR action does allow nonrecursive queries to access the local\-data that is configured. The reason is that this does not involve the unbound server recursive lookup algorithm, and static data is served in the reply. This supports normal operations where nonrecursive queries are made for the authoritative data. For nonrecursive queries any replies from the dynamic cache are refused. .IP The action \fIallow_snoop\fR gives nonrecursive access too. This give both recursive and non recursive access. The name \fIallow_snoop\fR refers to cache snooping, a technique to use nonrecursive queries to examine the cache contents (for malicious acts). However, nonrecursive queries can also be a valuable debugging tool (when you want to examine the cache contents). In that case use \fIallow_snoop\fR for your administration host. .IP By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd. The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS protocol is not designed to handle dropped packets due to policy, and dropping may result in (possibly excessive) retried queries. .IP The deny_non_local and refuse_non_local settings are for hosts that are only allowed to query for the authoritative local\-data, they are not allowed full recursion but only the static data. With deny_non_local, messages that are disallowed are dropped, with refuse_non_local they receive error code REFUSED. .TP .B chroot: \fI If chroot is enabled, you should pass the configfile (from the commandline) as a full path from the original root. After the chroot has been performed the now defunct portion of the config file path is removed to be able to reread the config after a reload. .IP All other file paths (working dir, logfile, roothints, and key files) can be specified in several ways: as an absolute path relative to the new root, as a relative path to the working directory, or as an absolute path relative to the original root. In the last case the path is adjusted to remove the unused portion. .IP The pidfile can be either a relative path to the working directory, or an absolute path relative to the original root. It is written just prior to chroot and dropping permissions. This allows the pidfile to be /var/run/unbound.pid and the chroot to be /var/unbound, for example. .IP Additionally, unbound may need to access /dev/random (for entropy) from inside the chroot. .IP If given a chroot is done to the given directory. The default is "@@UNBOUND_CHROOT_DIR@@". If you give "" no chroot is performed. .TP .B username: \fI If given, after binding the port the user privileges are dropped. Default is "@@UNBOUND_USERNAME@@". If you give username: "" no user change is performed. .IP If this user is not capable of binding the port, reloads (by signal HUP) will still retain the opened ports. If you change the port number in the config file, and that new port number requires privileges, then a reload will fail; a restart is needed. .TP .B directory: \fI Sets the working directory for the program. Default is "@@UNBOUND_RUN_DIR@@". On Windows the string "%EXECUTABLE%" tries to change to the directory that unbound.exe resides in. .TP .B logfile: \fI If "" is given, logging goes to stderr, or nowhere once daemonized. The logfile is appended to, in the following format: .nf [seconds since 1970] unbound[pid:tid]: type: message. .fi If this option is given, the use\-syslog is option is set to "no". The logfile is reopened (for append) when the config file is reread, on SIGHUP. .TP .B use\-syslog: \fI Sets unbound to send log messages to the syslogd, using \fIsyslog\fR(3). The log facility LOG_DAEMON is used, with identity "unbound". The logfile setting is overridden when use\-syslog is turned on. The default is to log to syslog. .TP .B log\-time\-ascii: \fI Sets logfile lines to use a timestamp in UTC ascii. Default is no, which prints the seconds since 1970 in brackets. No effect if using syslog, in that case syslog formats the timestamp printed into the log files. .TP .B log\-queries: \fI Prints one line per query to the log, with the log timestamp and IP address, name, type and class. Default is no. Note that it takes time to print these lines which makes the server (significantly) slower. Odd (nonprintable) characters in names are printed as '?'. .TP .B pidfile: \fI The process id is written to the file. Default is "@@UNBOUND_PIDFILE@@". So, .nf kill \-HUP `cat @@UNBOUND_PIDFILE@@` .fi triggers a reload, .nf kill \-TERM `cat @@UNBOUND_PIDFILE@@` .fi gracefully terminates. .TP .B root\-hints: \fI Read the root hints from this file. Default is nothing, using builtin hints for the IN class. The file has the format of zone files, with root nameserver names and addresses only. The default may become outdated, when servers change, therefore it is good practice to use a root\-hints file. .TP .B hide\-identity: \fI If enabled id.server and hostname.bind queries are refused. .TP .B identity: \fI Set the identity to report. If set to "", the default, then the hostname of the server is returned. .TP .B hide\-version: \fI If enabled version.server and version.bind queries are refused. .TP .B version: \fI Set the version to report. If set to "", the default, then the package version is returned. .TP .B target\-fetch\-policy: \fI<"list of numbers"> Set the target fetch policy used by unbound to determine if it should fetch nameserver target addresses opportunistically. The policy is described per dependency depth. .IP The number of values determines the maximum dependency depth that unbound will pursue in answering a query. A value of \-1 means to fetch all targets opportunistically for that dependency depth. A value of 0 means to fetch on demand only. A positive value fetches that many targets opportunistically. .IP Enclose the list between quotes ("") and put spaces between numbers. The default is "3 2 1 0 0". Setting all zeroes, "0 0 0 0 0" gives behaviour closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour rumoured to be closer to that of BIND 8. .TP .B harden\-short\-bufsize: \fI Very small EDNS buffer sizes from queries are ignored. Default is off, since it is legal protocol wise to send these, and unbound tries to give very small answers to these queries, where possible. .TP .B harden\-large\-queries: \fI Very large queries are ignored. Default is off, since it is legal protocol wise to send these, and could be necessary for operation if TSIG or EDNS payload is very large. .TP .B harden\-glue: \fI Will trust glue only if it is within the servers authority. Default is on. .TP .B harden\-dnssec\-stripped: \fI Require DNSSEC data for trust\-anchored zones, if such data is absent, the zone becomes bogus. If turned off, and no DNSSEC data is received (or the DNSKEY data fails to validate), then the zone is made insecure, this behaves like there is no trust anchor. You could turn this off if you are sometimes behind an intrusive firewall (of some sort) that removes DNSSEC data from packets, or a zone changes from signed to unsigned to badly signed often. If turned off you run the risk of a downgrade attack that disables security for a zone. Default is on. .TP .B harden\-below\-nxdomain: \fI From draft\-vixie\-dnsext\-resimprove, returns nxdomain to queries for a name below another name that is already known to be nxdomain. DNSSEC mandates noerror for empty nonterminals, hence this is possible. Very old software might return nxdomain for empty nonterminals (that usually happen for reverse IP address lookups), and thus may be incompatible with this. To try to avoid this only DNSSEC-secure nxdomains are used, because the old software does not have DNSSEC. Default is off. Currently, draft\-ietf\-dnsop\-nxdomain\-cut promotes this technique. .TP .B harden\-referral\-path: \fI Harden the referral path by performing additional queries for infrastructure data. Validates the replies if trust anchors are configured and the zones are signed. This enforces DNSSEC validation on nameserver NS sets and the nameserver addresses that are encountered on the referral path to the answer. Default off, because it burdens the authority servers, and it is not RFC standard, and could lead to performance problems because of the extra query load that is generated. Experimental option. If you enable it consider adding more numbers after the target\-fetch\-policy to increase the max depth that is checked to. .TP .B harden\-algo\-downgrade: \fI Harden against algorithm downgrade when multiple algorithms are advertised in the DS record. If no, allows the weakest algorithm to validate the zone. Default is no. Zone signers must produce zones that allow this feature to work, but sometimes they do not, and turning this option off avoids that validation failure. .TP .B use\-caps\-for\-id: \fI Use 0x20\-encoded random bits in the query to foil spoof attempts. This perturbs the lowercase and uppercase of query names sent to authority servers and checks if the reply still has the correct casing. Disabled by default. This feature is an experimental implementation of draft dns\-0x20. .TP .B caps\-whitelist: \fI Whitelist the domain so that it does not receive caps\-for\-id perturbed queries. For domains that do not support 0x20 and also fail with fallback because they keep sending different answers, like some load balancers. Can be given multiple times, for different domains. .TP .B qname\-minimisation: \fI Send minimum amount of information to upstream servers to enhance privacy. Only sent minimum required labels of the QNAME and set QTYPE to NS when possible. Best effort approach, full QNAME and original QTYPE will be sent when upstream replies with a RCODE other than NOERROR. Default is off. .TP .B private\-address: \fI Give IPv4 of IPv6 addresses or classless subnets. These are addresses on your private network, and are not allowed to be returned for public internet names. Any occurrence of such addresses are removed from DNS answers. Additionally, the DNSSEC validator may mark the answers bogus. This protects against so\-called DNS Rebinding, where a user browser is turned into a network proxy, allowing remote access through the browser to other parts of your private network. Some names can be allowed to contain your private addresses, by default all the \fBlocal\-data\fR that you configured is allowed to, and you can specify additional names using \fBprivate\-domain\fR. No private addresses are enabled by default. We consider to enable this for the RFC1918 private IP address space by default in later releases. That would enable private addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fd00::/8 and fe80::/10, since the RFC standards say these addresses should not be visible on the public internet. Turning on 127.0.0.0/8 would hinder many spamblocklists as they use that. Adding ::ffff:0:0/96 stops IPv4-mapped IPv6 addresses from bypassing the filter. .TP .B private\-domain: \fI Allow this domain, and all its subdomains to contain private addresses. Give multiple times to allow multiple domain names to contain private addresses. Default is none. .TP .B unwanted\-reply\-threshold: \fI If set, a total number of unwanted replies is kept track of in every thread. When it reaches the threshold, a defensive action is taken and a warning is printed to the log. The defensive action is to clear the rrset and message caches, hopefully flushing away any poison. A value of 10 million is suggested. Default is 0 (turned off). .TP .B do\-not\-query\-address: \fI Do not query the given IP address. Can be IP4 or IP6. Append /num to indicate a classless delegation netblock, for example like 10.2.3.4/24 or 2001::11/64. .TP .B do\-not\-query\-localhost: \fI If yes, localhost is added to the do\-not\-query\-address entries, both IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send queries to. Default is yes. .TP .B prefetch: \fI If yes, message cache elements are prefetched before they expire to keep the cache up to date. Default is no. Turning it on gives about 10 percent more traffic and load on the machine, but popular items do not expire from the cache. .TP .B prefetch-key: \fI If yes, fetch the DNSKEYs earlier in the validation process, when a DS record is encountered. This lowers the latency of requests. It does use a little more CPU. Also if the cache is set to 0, it is no use. Default is no. .TP .B rrset-roundrobin: \fI If yes, Unbound rotates RRSet order in response (the random number is taken from the query ID, for speed and thread safety). Default is no. .TP .B minimal-responses: \fI If yes, Unbound doesn't insert authority/additional sections into response messages when those sections are not required. This reduces response size significantly, and may avoid TCP fallback for some responses. This may cause a slight speedup. The default is no, because the DNS protocol RFCs mandate these sections, and the additional content could be of use and save roundtrips for clients. .TP .B disable-dnssec-lame-check: \fI If true, disables the DNSSEC lameness check in the iterator. This check sees if RRSIGs are present in the answer, when dnssec is expected, and retries another authority if RRSIGs are unexpectedly missing. The validator will insist in RRSIGs for DNSSEC signed domains regardless of this setting, if a trust anchor is loaded. .TP .B module\-config: \fI<"module names"> Module configuration, a list of module names separated by spaces, surround the string with quotes (""). The modules can be validator, iterator. Setting this to "iterator" will result in a non\-validating server. Setting this to "validator iterator" will turn on DNSSEC validation. The ordering of the modules is important. You must also set trust\-anchors for validation to be useful. .TP .B trust\-anchor\-file: \fI File with trusted keys for validation. Both DS and DNSKEY entries can appear in the file. The format of the file is the standard DNS Zone file format. Default is "", or no trust anchor file. .TP .B auto\-trust\-anchor\-file: \fI File with trust anchor for one zone, which is tracked with RFC5011 probes. The probes are several times per month, thus the machine must be online frequently. The initial file can be one with contents as described in \fBtrust\-anchor\-file\fR. The file is written to when the anchor is updated, so the unbound user must have write permission. Write permission to the file, but also to the directory it is in (to create a temporary file, which is necessary to deal with filesystem full events). .TP .B trust\-anchor: \fI<"Resource Record"> A DS or DNSKEY RR for a key to use for validation. Multiple entries can be given to specify multiple trusted keys, in addition to the trust\-anchor\-files. The resource record is entered in the same format as 'dig' or 'drill' prints them, the same format as in the zone file. Has to be on a single line, with "" around it. A TTL can be specified for ease of cut and paste, but is ignored. A class can be specified, but class IN is default. .TP .B trusted\-keys\-file: \fI File with trusted keys for validation. Specify more than one file with several entries, one file per entry. Like \fBtrust\-anchor\-file\fR but has a different file format. Format is BIND\-9 style format, the trusted\-keys { name flag proto algo "key"; }; clauses are read. It is possible to use wildcards with this statement, the wildcard is expanded on start and on reload. .TP .B dlv\-anchor\-file: \fI This option was used during early days DNSSEC deployment when no parent-side DS record registrations were easily available. Nowadays, it is best to have DS records registered with the parent zone (many top level zones are signed). File with trusted keys for DLV (DNSSEC Lookaside Validation). Both DS and DNSKEY entries can be used in the file, in the same format as for \fItrust\-anchor\-file:\fR statements. Only one DLV can be configured, more would be slow. The DLV configured is used as a root trusted DLV, this means that it is a lookaside for the root. Default is "", or no dlv anchor file. DLV is going to be decommissioned. Please do not use it any more. .TP .B dlv\-anchor: \fI<"Resource Record"> Much like trust\-anchor, this is a DLV anchor with the DS or DNSKEY inline. DLV is going to be decommissioned. Please do not use it any more. .TP .B domain\-insecure: \fI Sets domain name to be insecure, DNSSEC chain of trust is ignored towards the domain name. So a trust anchor above the domain name can not make the domain secure with a DS record, such a DS record is then ignored. Also keys from DLV are ignored for the domain. Can be given multiple times to specify multiple domains that are treated as if unsigned. If you set trust anchors for the domain they override this setting (and the domain is secured). .IP This can be useful if you want to make sure a trust anchor for external lookups does not affect an (unsigned) internal domain. A DS record externally can create validation failures for that internal domain. .TP .B val\-override\-date: \fI Default is "" or "0", which disables this debugging feature. If enabled by giving a RRSIG style date, that date is used for verifying RRSIG inception and expiration dates, instead of the current date. Do not set this unless you are debugging signature inception and expiration. The value \-1 ignores the date altogether, useful for some special applications. .TP .B val\-sig\-skew\-min: \fI Minimum number of seconds of clock skew to apply to validated signatures. A value of 10% of the signature lifetime (expiration \- inception) is used, capped by this setting. Default is 3600 (1 hour) which allows for daylight savings differences. Lower this value for more strict checking of short lived signatures. .TP .B val\-sig\-skew\-max: \fI Maximum number of seconds of clock skew to apply to validated signatures. A value of 10% of the signature lifetime (expiration \- inception) is used, capped by this setting. Default is 86400 (24 hours) which allows for timezone setting problems in stable domains. Setting both min and max very low disables the clock skew allowances. Setting both min and max very high makes the validator check the signature timestamps less strictly. .TP .B val\-bogus\-ttl: \fI The time to live for bogus data. This is data that has failed validation; due to invalid signatures or other checks. The TTL from that data cannot be trusted, and this value is used instead. The value is in seconds, default 60. The time interval prevents repeated revalidation of bogus data. .TP .B val\-clean\-additional: \fI Instruct the validator to remove data from the additional section of secure messages that are not signed properly. Messages that are insecure, bogus, indeterminate or unchecked are not affected. Default is yes. Use this setting to protect the users that rely on this validator for authentication from potentially bad data in the additional section. .TP .B val\-log\-level: \fI Have the validator print validation failures to the log. Regardless of the verbosity setting. Default is 0, off. At 1, for every user query that fails a line is printed to the logs. This way you can monitor what happens with validation. Use a diagnosis tool, such as dig or drill, to find out why validation is failing for these queries. At 2, not only the query that failed is printed but also the reason why unbound thought it was wrong and which server sent the faulty data. .TP .B val\-permissive\-mode: \fI Instruct the validator to mark bogus messages as indeterminate. The security checks are performed, but if the result is bogus (failed security), the reply is not withheld from the client with SERVFAIL as usual. The client receives the bogus data. For messages that are found to be secure the AD bit is set in replies. Also logging is performed as for full validation. The default value is "no". .TP .B ignore\-cd\-flag: \fI Instruct unbound to ignore the CD flag from clients and refuse to return bogus answers to them. Thus, the CD (Checking Disabled) flag does not disable checking any more. This is useful if legacy (w2008) servers that set the CD flag but cannot validate DNSSEC themselves are the clients, and then unbound provides them with DNSSEC protection. The default value is "no". .TP .B val\-nsec3\-keysize\-iterations: \fI<"list of values"> List of keysize and iteration count values, separated by spaces, surrounded by quotes. Default is "1024 150 2048 500 4096 2500". This determines the maximum allowed NSEC3 iteration count before a message is simply marked insecure instead of performing the many hashing iterations. The list must be in ascending order and have at least one entry. If you set it to "1024 65535" there is no restriction to NSEC3 iteration values. This table must be kept short; a very long list could cause slower operation. .TP .B add\-holddown: \fI Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011 autotrust updates to add new trust anchors only after they have been visible for this time. Default is 30 days as per the RFC. .TP .B del\-holddown: \fI Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011 autotrust updates to remove revoked trust anchors after they have been kept in the revoked list for this long. Default is 30 days as per the RFC. .TP .B keep\-missing: \fI Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011 autotrust updates to remove missing trust anchors after they have been unseen for this long. This cleans up the state file if the target zone does not perform trust anchor revocation, so this makes the auto probe mechanism work with zones that perform regular (non\-5011) rollovers. The default is 366 days. The value 0 does not remove missing anchors, as per the RFC. .TP .B permit\-small\-holddown: \fI Debug option that allows the autotrust 5011 rollover timers to assume very small values. Default is no. .TP .B key\-cache\-size: \fI Number of bytes size of the key cache. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B key\-cache\-slabs: \fI Number of slabs in the key cache. Slabs reduce lock contention by threads. Must be set to a power of 2. Setting (close) to the number of cpus is a reasonable guess. .TP .B neg\-cache\-size: \fI Number of bytes size of the aggressive negative cache. Default is 1 megabyte. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B unblock\-lan\-zones: \fI Default is disabled. If enabled, then for private address space, the reverse lookups are no longer filtered. This allows unbound when running as dns service on a host where it provides service for that host, to put out all of the queries for the 'lan' upstream. When enabled, only localhost, 127.0.0.1 reverse and ::1 reverse zones are configured with default local zones. Disable the option when unbound is running as a (DHCP-) DNS network resolver for a group of machines, where such lookups should be filtered (RFC compliance), this also stops potential data leakage about the local network to the upstream DNS servers. .TP .B insecure\-lan\-zones: \fI Default is disabled. If enabled, then reverse lookups in private address space are not validated. This is usually required whenever \fIunblock\-lan\-zones\fR is used. .TP .B local\-zone: \fI Configure a local zone. The type determines the answer to give if there is no match from local\-data. The types are deny, refuse, static, transparent, redirect, nodefault, typetransparent, inform, inform_deny, and are explained below. After that the default settings are listed. Use local\-data: to enter data into the local zone. Answers for local zones are authoritative DNS answers. By default the zones are class IN. .IP If you need more complicated authoritative data, with referrals, wildcards, CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for it as detailed in the stub zone section below. .TP 10 \h'5'\fIdeny\fR Do not send an answer, drop the query. If there is a match from local data, the query is answered. .TP 10 \h'5'\fIrefuse\fR Send an error message reply, with rcode REFUSED. If there is a match from local data, the query is answered. .TP 10 \h'5'\fIstatic\fR If there is a match from local data, the query is answered. Otherwise, the query is answered with nodata or nxdomain. For a negative answer a SOA is included in the answer if present as local\-data for the zone apex domain. .TP 10 \h'5'\fItransparent\fR If there is a match from local data, the query is answered. Otherwise if the query has a different name, the query is resolved normally. If the query is for a name given in localdata but no such type of data is given in localdata, then a noerror nodata answer is returned. If no local\-zone is given local\-data causes a transparent zone to be created by default. .TP 10 \h'5'\fItypetransparent\fR If there is a match from local data, the query is answered. If the query is for a different name, or for the same name but for a different type, the query is resolved normally. So, similar to transparent but types that are not listed in local data are resolved normally, so if an A record is in the local data that does not cause a nodata reply for AAAA queries. .TP 10 \h'5'\fIredirect\fR The query is answered from the local data for the zone name. There may be no local data beneath the zone name. This answers queries for the zone, and all subdomains of the zone with the local data for the zone. It can be used to redirect a domain to return a different address record to the end user, with local\-zone: "example.com." redirect and local\-data: "example.com. A 127.0.0.1" queries for www.example.com and www.foo.example.com are redirected, so that users with web browsers cannot access sites with suffix example.com. .TP 10 \h'5'\fIinform\fR The query is answered normally. The client IP address (@@portnumber) is printed to the logfile. The log message is: timestamp, unbound-pid, info: zonename inform IP@@port queryname type class. This option can be used for normal resolution, but machines looking up infected names are logged, eg. to run antivirus on them. .TP 10 \h'5'\fIinform_deny\fR The query is dropped, like 'deny', and logged, like 'inform'. Ie. find infected machines without answering the queries. .TP 10 \h'5'\fInodefault\fR Used to turn off default contents for AS112 zones. The other types also turn off default contents for the zone. The 'nodefault' option has no other effect than turning off default contents for the given zone. Use \fInodefault\fR if you use exactly that zone, if you want to use a subzone, use \fItransparent\fR. .P The default zones are localhost, reverse 127.0.0.1 and ::1, the onion and the AS112 zones. The AS112 zones are reverse DNS zones for private use and reserved IP addresses for which the servers on the internet cannot provide correct answers. They are configured by default to give nxdomain (no reverse information) answers. The defaults can be turned off by specifying your own local\-zone of that name, or using the 'nodefault' type. Below is a list of the default zone contents. .TP 10 \h'5'\fIlocalhost\fR The IP4 and IP6 localhost information is given. NS and SOA records are provided for completeness and to satisfy some DNS update tools. Default content: .nf local\-zone: "localhost." static local\-data: "localhost. 10800 IN NS localhost." local\-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local\-data: "localhost. 10800 IN A 127.0.0.1" local\-data: "localhost. 10800 IN AAAA ::1" .fi .TP 10 \h'5'\fIreverse IPv4 loopback\fR Default content: .nf local\-zone: "127.in\-addr.arpa." static local\-data: "127.in\-addr.arpa. 10800 IN NS localhost." local\-data: "127.in\-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN PTR localhost." .fi .TP 10 \h'5'\fIreverse IPv6 loopback\fR Default content: .nf local\-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost." local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost." .fi .TP 10 \h'5'\fIonion (RFC 7686)\fR Default content: .nf local\-zone: "onion." static local\-data: "onion. 10800 IN NS localhost." local\-data: "onion. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" .fi .TP 10 \h'5'\fIreverse RFC1918 local use zones\fR Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to 31.172.in\-addr.arpa, 168.192.in\-addr.arpa. The \fBlocal\-zone:\fR is set static and as \fBlocal\-data:\fR SOA and NS records are provided. .TP 10 \h'5'\fIreverse RFC3330 IP4 this, link\-local, testnet and broadcast\fR Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa, 2.0.192.in\-addr.arpa (TEST NET 1), 100.51.198.in\-addr.arpa (TEST NET 2), 113.0.203.in\-addr.arpa (TEST NET 3), 255.255.255.255.in\-addr.arpa. And from 64.100.in\-addr.arpa to 127.100.in\-addr.arpa (Shared Address Space). .TP 10 \h'5'\fIreverse RFC4291 IP6 unspecified\fR Reverse data for zone .nf 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. .fi .TP 10 \h'5'\fIreverse RFC4193 IPv6 Locally Assigned Local Addresses\fR Reverse data for zone D.F.ip6.arpa. .TP 10 \h'5'\fIreverse RFC4291 IPv6 Link Local Addresses\fR Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa. .TP 10 \h'5'\fIreverse IPv6 Example Prefix\fR Reverse data for zone 8.B.D.0.1.0.0.2.ip6.arpa. This zone is used for tutorials and examples. You can remove the block on this zone with: .nf local\-zone: 8.B.D.0.1.0.0.2.ip6.arpa. nodefault .fi You can also selectively unblock a part of the zone by making that part transparent with a local\-zone statement. This also works with the other default zones. .\" End of local-zone listing. .TP 5 .B local\-data: \fI"" Configure local data, which is served in reply to queries for it. The query has to match exactly unless you configure the local\-zone as redirect. If not matched exactly, the local\-zone type determines further processing. If local\-data is configured that is not a subdomain of a local\-zone, a transparent local\-zone is configured. For record types such as TXT, use single quotes, as in local\-data: 'example. TXT "text"'. .IP If you need more complicated authoritative data, with referrals, wildcards, CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for it as detailed in the stub zone section below. .TP 5 .B local\-data\-ptr: \fI"IPaddr name" Configure local data shorthand for a PTR record with the reversed IPv4 or IPv6 address and the host name. For example "192.0.2.4 www.example.com". TTL can be inserted like this: "2001:DB8::4 7200 www.example.com" .TP 5 .B ratelimit: \fI Enable ratelimiting of queries sent to nameserver for performing recursion. If 0, the default, it is disabled. This option is experimental at this time. The ratelimit is in queries per second that are allowed. More queries are turned away with an error (servfail). This stops recursive floods, eg. random query names, but not spoofed reflection floods. Cached responses are not ratelimited by this setting. The zone of the query is determined by examining the nameservers for it, the zone name is used to keep track of the rate. For example, 1000 may be a suitable value to stop the server from being overloaded with random names, and keeps unbound from sending traffic to the nameservers for those zones. .TP 5 .B ratelimit\-size: \fI Give the size of the data structure in which the current ongoing rates are kept track in. Default 4m. In bytes or use m(mega), k(kilo), g(giga). The ratelimit structure is small, so this data structure likely does not need to be large. .TP 5 .B ratelimit\-slabs: \fI Give power of 2 number of slabs, this is used to reduce lock contention in the ratelimit tracking data structure. Close to the number of cpus is a fairly good setting. .TP 5 .B ratelimit\-factor: \fI Set the amount of queries to rate limit when the limit is exceeded. If set to 0, all queries are dropped for domains where the limit is exceeded. If set to another value, 1 in that number is allowed through to complete. Default is 10, allowing 1/10 traffic to flow normally. This can make ordinary queries complete (if repeatedly queried for), and enter the cache, whilst also mitigating the traffic flow by the factor given. .TP 5 .B ratelimit\-for\-domain: \fI Override the global ratelimit for an exact match domain name with the listed number. You can give this for any number of names. For example, for a top\-level\-domain you may want to have a higher limit than other names. .TP 5 .B ratelimit\-below\-domain: \fI Override the global ratelimit for a domain name that ends in this name. You can give this multiple times, it then describes different settings in different parts of the namespace. The closest matching suffix is used to determine the qps limit. The rate for the exact matching domain name is not changed, use ratelimit\-for\-domain to set that, you might want to use different settings for a top\-level\-domain and subdomains. .SS "Remote Control Options" In the .B remote\-control: clause are the declarations for the remote control facility. If this is enabled, the \fIunbound\-control\fR(8) utility can be used to send commands to the running unbound server. The server uses these clauses to setup SSLv3 / TLSv1 security for the connection. The \fIunbound\-control\fR(8) utility also reads the \fBremote\-control\fR section for options. To setup the correct self\-signed certificates use the \fIunbound\-control\-setup\fR(8) utility. .TP 5 .B control\-enable: \fI The option is used to enable remote control, default is "no". If turned off, the server does not listen for control commands. .TP 5 .B control\-interface: \fI Give IPv4 or IPv6 addresses or local socket path to listen on for control commands. By default localhost (127.0.0.1 and ::1) is listened to. Use 0.0.0.0 and ::0 to listen to all interfaces. If you change this and permissions have been dropped, you must restart the server for the change to take effect. .TP 5 .B control\-port: \fI The port number to listen on for IPv4 or IPv6 control interfaces, default is 8953. If you change this and permissions have been dropped, you must restart the server for the change to take effect. .TP 5 .B control\-use\-cert: \fI Whether to require certificate authentication of control connections. The default is "yes". This should not be changed unless there are other mechanisms in place to prevent untrusted users from accessing the remote control interface. .TP 5 .B server\-key\-file: \fI Path to the server private key, by default unbound_server.key. This file is generated by the \fIunbound\-control\-setup\fR utility. This file is used by the unbound server, but not by \fIunbound\-control\fR. .TP 5 .B server\-cert\-file: \fI Path to the server self signed certificate, by default unbound_server.pem. This file is generated by the \fIunbound\-control\-setup\fR utility. This file is used by the unbound server, and also by \fIunbound\-control\fR. .TP 5 .B control\-key\-file: \fI Path to the control client private key, by default unbound_control.key. This file is generated by the \fIunbound\-control\-setup\fR utility. This file is used by \fIunbound\-control\fR. .TP 5 .B control\-cert\-file: \fI Path to the control client certificate, by default unbound_control.pem. This certificate has to be signed with the server certificate. This file is generated by the \fIunbound\-control\-setup\fR utility. This file is used by \fIunbound\-control\fR. .SS "Stub Zone Options" .LP There may be multiple .B stub\-zone: clauses. Each with a name: and zero or more hostnames or IP addresses. For the stub zone this list of nameservers is used. Class IN is assumed. The servers should be authority servers, not recursors; unbound performs the recursive processing itself for stub zones. .P The stub zone can be used to configure authoritative data to be used by the resolver that cannot be accessed using the public internet servers. This is useful for company\-local data or private zones. Setup an authoritative server on a different host (or different port). Enter a config entry for unbound with .B stub\-addr: . The unbound resolver can then access the data, without referring to the public internet for it. .P This setup allows DNSSEC signed zones to be served by that authoritative server, in which case a trusted key entry with the public key can be put in config, so that unbound can validate the data and set the AD bit on replies for the private zone (authoritative servers do not set the AD bit). This setup makes unbound capable of answering queries for the private zone, and can even set the AD bit ('authentic'), but the AA ('authoritative') bit is not set on these replies. .P Consider adding \fBserver:\fR statements for \fBdomain\-insecure:\fR and for \fBlocal\-zone:\fI name nodefault\fR for the zone if it is a locally served zone. The insecure clause stops DNSSEC from invalidating the zone. The local zone nodefault (or \fItransparent\fR) clause makes the (reverse\-) zone bypass unbound's filtering of RFC1918 zones. .TP .B name: \fI Name of the stub zone. .TP .B stub\-host: \fI Name of stub zone nameserver. Is itself resolved before it is used. .TP .B stub\-addr: \fI IP address of stub zone nameserver. Can be IP 4 or IP 6. To use a nondefault port for DNS communication append '@@' with the port number. .TP .B stub\-prime: \fI This option is by default off. If enabled it performs NS set priming, which is similar to root hints, where it starts using the list of nameservers currently published by the zone. Thus, if the hint list is slightly outdated, the resolver picks up a correct list online. .TP .B stub\-first: \fI If enabled, a query is attempted without the stub clause if it fails. The data could not be retrieved and would have caused SERVFAIL because the servers are unreachable, instead it is tried without this clause. The default is no. .SS "Forward Zone Options" .LP There may be multiple .B forward\-zone: clauses. Each with a \fBname:\fR and zero or more hostnames or IP addresses. For the forward zone this list of nameservers is used to forward the queries to. The servers listed as \fBforward\-host:\fR and \fBforward\-addr:\fR have to handle further recursion for the query. Thus, those servers are not authority servers, but are (just like unbound is) recursive servers too; unbound does not perform recursion itself for the forward zone, it lets the remote server do it. Class IN is assumed. A forward\-zone entry with name "." and a forward\-addr target will forward all queries to that other server (unless it can answer from the cache). .TP .B name: \fI Name of the forward zone. .TP .B forward\-host: \fI Name of server to forward to. Is itself resolved before it is used. .TP .B forward\-addr: \fI IP address of server to forward to. Can be IP 4 or IP 6. To use a nondefault port for DNS communication append '@@' with the port number. .TP .B forward\-first: \fI If enabled, a query is attempted without the forward clause if it fails. The data could not be retrieved and would have caused SERVFAIL because the servers are unreachable, instead it is tried without this clause. The default is no. .SS "Python Module Options" .LP The .B python: clause gives the settings for the \fIpython\fR(1) script module. This module acts like the iterator and validator modules do, on queries and answers. To enable the script module it has to be compiled into the daemon, and the word "python" has to be put in the \fBmodule\-config:\fR option (usually first, or between the validator and iterator). .TP .B python\-script: \fI\fR The script file to load. .SS "DNS64 Module Options" .LP The dns64 module must be configured in the \fBmodule\-config:\fR "dns64 validator iterator" directive and be compiled into the daemon to be enabled. These settings go in the \fBserver:\fR section. .TP .B dns64\-prefix: \fI\fR This sets the DNS64 prefix to use to synthesize AAAA records with. It must be /96 or shorter. The default prefix is 64:ff9b::/96. .TP .B dns64\-synthall: \fI\fR Debug option, default no. If enabled, synthesize all AAAA records despite the presence of actual AAAA records. .SH "MEMORY CONTROL EXAMPLE" In the example config settings below memory usage is reduced. Some service levels are lower, notable very large data and a high TCP load are no longer supported. Very large data and high TCP loads are exceptional for the DNS. DNSSEC validation is enabled, just add trust anchors. If you do not have to worry about programs using more than 3 Mb of memory, the below example is not for you. Use the defaults to receive full service, which on BSD\-32bit tops out at 30\-40 Mb after heavy usage. .P .nf # example settings that reduce memory usage server: num\-threads: 1 outgoing\-num\-tcp: 1 # this limits TCP service, uses less buffers. incoming\-num\-tcp: 1 outgoing\-range: 60 # uses less memory, but less performance. msg\-buffer\-size: 8192 # note this limits service, 'no huge stuff'. msg\-cache\-size: 100k msg\-cache\-slabs: 1 rrset\-cache\-size: 100k rrset\-cache\-slabs: 1 infra\-cache\-numhosts: 200 infra\-cache\-slabs: 1 key\-cache\-size: 100k key\-cache\-slabs: 1 neg\-cache\-size: 10k num\-queries\-per\-thread: 30 target\-fetch\-policy: "2 1 0 0 0 0" harden\-large\-queries: "yes" harden\-short\-bufsize: "yes" .fi .SH "FILES" .TP .I @@UNBOUND_RUN_DIR@@ default unbound working directory. .TP .I @@UNBOUND_CHROOT_DIR@@ default \fIchroot\fR(2) location. .TP .I @@ub_conf_file@@ unbound configuration file. .TP .I @@UNBOUND_PIDFILE@@ default unbound pidfile with process ID of the running daemon. .TP .I unbound.log unbound log file. default is to log to \fIsyslog\fR(3). .SH "SEE ALSO" \fIunbound\fR(8), \fIunbound\-checkconf\fR(8). .SH "AUTHORS" .B Unbound was written by NLnet Labs. Please see CREDITS file in the distribution for further details. @ 1.1.1.1 log @Import unbound 1.5.9 @ text @@ 1.1.1.1.8.1 log @Pull up following revision(s) (requested by snj in ticket #744): doc/3RDPARTY: 1.1502 distrib/sets/lists/base/shl.mi: 1.829 distrib/sets/lists/debug/shl.mi: 1.191 external/bsd/unbound/Makefile.inc: up to 1.4 external/bsd/unbound/dist/.gitattributes: up to 1.1.1.1 external/bsd/unbound/dist/.gitignore: up to 1.1.1.2 external/bsd/unbound/dist/Makefile.in: up to 1.1.1.2 external/bsd/unbound/dist/ac_pkg_swig.m4: up to 1.1.1.2 external/bsd/unbound/dist/aclocal.m4: up to 1.1.1.2 external/bsd/unbound/dist/acx_nlnetlabs.m4: up to 1.1.1.2 external/bsd/unbound/dist/acx_python.m4: up to 1.1.1.2 external/bsd/unbound/dist/cachedb/cachedb.c: up to 1.1.1.2 external/bsd/unbound/dist/compat/arc4_lock.c: up to 1.1.1.2 external/bsd/unbound/dist/compat/arc4random.c: up to 1.1.1.2 external/bsd/unbound/dist/compat/ctime_r.c: up to 1.1.1.2 external/bsd/unbound/dist/compat/getentropy_linux.c: up to 1.1.1.2 external/bsd/unbound/dist/config.h.in: up to 1.1.1.2 external/bsd/unbound/dist/configure: up to 1.1.1.2 external/bsd/unbound/dist/configure.ac: up to 1.1.1.2 external/bsd/unbound/dist/contrib/README: up to 1.1.1.2 external/bsd/unbound/dist/contrib/aaaa-filter-iterator.patch: up to 1.1.1.2 external/bsd/unbound/dist/contrib/fastrpz.patch: up to 1.1.1.1 external/bsd/unbound/dist/contrib/libunbound.pc.in: up to 1.1.1.1 external/bsd/unbound/dist/contrib/parseunbound.pl: up to 1.1.1.2 external/bsd/unbound/dist/contrib/redirect-bogus.patch: up to 1.1.1.1 external/bsd/unbound/dist/contrib/unbound.service.in: up to 1.1.1.1 external/bsd/unbound/dist/contrib/unbound.socket.in: up to 1.1.1.1 external/bsd/unbound/dist/contrib/unbound_munin_: up to 1.1.1.2 external/bsd/unbound/dist/daemon/acl_list.c: up to 1.1.1.2 external/bsd/unbound/dist/daemon/acl_list.h: up to 1.1.1.2 external/bsd/unbound/dist/daemon/cachedump.c: up to 1.1.1.2 external/bsd/unbound/dist/daemon/daemon.c: up to 1.1.1.2 external/bsd/unbound/dist/daemon/daemon.h: up to 1.1.1.2 external/bsd/unbound/dist/daemon/remote.c: up to 1.1.1.2 external/bsd/unbound/dist/daemon/remote.h: up to 1.1.1.2 external/bsd/unbound/dist/daemon/stats.c: up to 1.1.1.2 external/bsd/unbound/dist/daemon/stats.h: up to 1.1.1.2 external/bsd/unbound/dist/daemon/unbound.c: up to 1.1.1.2 external/bsd/unbound/dist/daemon/worker.c: up to 1.1.1.2 external/bsd/unbound/dist/daemon/worker.h: up to 1.1.1.2 external/bsd/unbound/dist/dns64/dns64.c: up to 1.1.1.2 external/bsd/unbound/dist/dnscrypt/cert.h: up to 1.1.1.1 external/bsd/unbound/dist/dnscrypt/dnscrypt.c: up to 1.1.1.1 external/bsd/unbound/dist/dnscrypt/dnscrypt.h: up to 1.1.1.1 external/bsd/unbound/dist/dnscrypt/dnscrypt.m4: up to 1.1.1.1 external/bsd/unbound/dist/dnscrypt/dnscrypt_config.h.in: up to 1.1.1.1 external/bsd/unbound/dist/dnscrypt/testdata/gencert.sh: up to 1.1.1.1 external/bsd/unbound/dist/dnscrypt/testdata/keys1/public.key: up to 1.1.1.1 external/bsd/unbound/dist/dnscrypt/testdata/keys1/secret.key: up to 1.1.1.1 external/bsd/unbound/dist/dnscrypt/testdata/keys2/public.key: up to 1.1.1.1 external/bsd/unbound/dist/dnscrypt/testdata/keys2/secret.key: up to 1.1.1.1 external/bsd/unbound/dist/dnstap/dnstap.c: up to 1.1.1.2 external/bsd/unbound/dist/doc/CNAME-basedRedirectionDesignNotes.pdf: up to 1.1.1.1 external/bsd/unbound/dist/doc/Changelog: up to 1.1.1.2 external/bsd/unbound/dist/doc/IP-BasedActions.pdf: up to 1.1.1.1 external/bsd/unbound/dist/doc/README: up to 1.1.1.2 external/bsd/unbound/dist/doc/example.conf.in: up to 1.1.1.2 external/bsd/unbound/dist/doc/libunbound.3.in: up to 1.1.1.2 external/bsd/unbound/dist/doc/requirements.txt: up to 1.1.1.2 external/bsd/unbound/dist/doc/unbound-anchor.8.in: up to 1.1.1.2 external/bsd/unbound/dist/doc/unbound-checkconf.8.in: up to 1.1.1.2 external/bsd/unbound/dist/doc/unbound-control.8.in: up to 1.1.1.2 external/bsd/unbound/dist/doc/unbound-host.1.in: up to 1.1.1.2 external/bsd/unbound/dist/doc/unbound.8.in: up to 1.1.1.2 external/bsd/unbound/dist/doc/unbound.conf.5.in: up to 1.1.1.2 external/bsd/unbound/dist/doc/unbound.doxygen: up to 1.1.1.2 external/bsd/unbound/dist/edns-subnet/addrtree.c: up to 1.1.1.1 external/bsd/unbound/dist/edns-subnet/addrtree.h: up to 1.1.1.1 external/bsd/unbound/dist/edns-subnet/edns-subnet.c: up to 1.1.1.1 external/bsd/unbound/dist/edns-subnet/edns-subnet.h: up to 1.1.1.1 external/bsd/unbound/dist/edns-subnet/subnet-whitelist.c: up to 1.1.1.1 external/bsd/unbound/dist/edns-subnet/subnet-whitelist.h: up to 1.1.1.1 external/bsd/unbound/dist/edns-subnet/subnetmod.c: up to 1.1.1.1 external/bsd/unbound/dist/edns-subnet/subnetmod.h: up to 1.1.1.1 external/bsd/unbound/dist/ipsecmod/ipsecmod-whitelist.c: up to 1.1.1.1 external/bsd/unbound/dist/ipsecmod/ipsecmod-whitelist.h: up to 1.1.1.1 external/bsd/unbound/dist/ipsecmod/ipsecmod.c: up to 1.1.1.1 external/bsd/unbound/dist/ipsecmod/ipsecmod.h: up to 1.1.1.1 external/bsd/unbound/dist/iterator/iter_delegpt.c: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_delegpt.h: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_donotq.h: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_fwd.c: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_fwd.h: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_hints.c: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_hints.h: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_priv.h: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_scrub.c: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_utils.c: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_utils.h: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iterator.c: up to 1.1.1.2 external/bsd/unbound/dist/iterator/iterator.h: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/context.c: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/context.h: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/libunbound.c: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/libworker.c: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/libworker.h: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/conf.py: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/example1a.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/example1b.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/example2.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/example3.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/example4.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/example5.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/example6.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/example7.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/example8.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/examples/index.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/install.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/python/doc/intro.rst: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/unbound-event.h: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/unbound.h: up to 1.1.1.2 external/bsd/unbound/dist/libunbound/worker.h: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/conf.py: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/examples/example0-1.py: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/examples/example0.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/examples/example1.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/examples/example2.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/examples/example3.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/examples/example4.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/examples/example5.rst: up to 1.1.1.1 external/bsd/unbound/dist/pythonmod/doc/examples/example6.rst: up to 1.1.1.1 external/bsd/unbound/dist/pythonmod/doc/examples/index.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/install.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/modules/functions.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/modules/struct.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/usecase.rst: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/examples/edns.py: up to 1.1.1.1 external/bsd/unbound/dist/pythonmod/examples/inplace_callbacks.py: up to 1.1.1.1 external/bsd/unbound/dist/pythonmod/interface.i: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/pythonmod.c: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/pythonmod.h: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/pythonmod_utils.c: up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/test-edns.conf: up to 1.1.1.1 external/bsd/unbound/dist/pythonmod/test-inplace_callbacks.conf: up to 1.1.1.1 external/bsd/unbound/dist/respip/respip.c: up to 1.1.1.1 external/bsd/unbound/dist/respip/respip.h: up to 1.1.1.1 external/bsd/unbound/dist/services/authzone.c: up to 1.1.1.1 external/bsd/unbound/dist/services/authzone.h: up to 1.1.1.1 external/bsd/unbound/dist/services/cache/dns.c: up to 1.1.1.2 external/bsd/unbound/dist/services/cache/dns.h: up to 1.1.1.2 external/bsd/unbound/dist/services/cache/infra.c: up to 1.1.1.2 external/bsd/unbound/dist/services/cache/infra.h: up to 1.1.1.2 external/bsd/unbound/dist/services/cache/rrset.c: up to 1.1.1.2 external/bsd/unbound/dist/services/cache/rrset.h: up to 1.1.1.2 external/bsd/unbound/dist/services/listen_dnsport.c: up to 1.1.1.2 external/bsd/unbound/dist/services/listen_dnsport.h: up to 1.1.1.2 external/bsd/unbound/dist/services/localzone.c: up to 1.1.1.2 external/bsd/unbound/dist/services/localzone.h: up to 1.1.1.2 external/bsd/unbound/dist/services/mesh.c: up to 1.1.1.2 external/bsd/unbound/dist/services/mesh.h: up to 1.1.1.2 external/bsd/unbound/dist/services/modstack.c: up to 1.1.1.2 external/bsd/unbound/dist/services/modstack.h: up to 1.1.1.2 external/bsd/unbound/dist/services/outside_network.c: up to 1.1.1.2 external/bsd/unbound/dist/services/outside_network.h: up to 1.1.1.2 external/bsd/unbound/dist/services/view.c: up to 1.1.1.1 external/bsd/unbound/dist/services/view.h: up to 1.1.1.1 external/bsd/unbound/dist/sldns/keyraw.c: up to 1.1.1.2 external/bsd/unbound/dist/sldns/keyraw.h: up to 1.1.1.2 external/bsd/unbound/dist/sldns/parse.c: up to 1.1.1.2 external/bsd/unbound/dist/sldns/parse.h: up to 1.1.1.2 external/bsd/unbound/dist/sldns/parseutil.c: up to 1.1.1.2 external/bsd/unbound/dist/sldns/parseutil.h: up to 1.1.1.2 external/bsd/unbound/dist/sldns/rrdef.c: up to 1.1.1.2 external/bsd/unbound/dist/sldns/rrdef.h: up to 1.1.1.2 external/bsd/unbound/dist/sldns/sbuffer.c: up to 1.1.1.2 external/bsd/unbound/dist/sldns/sbuffer.h: up to 1.1.1.2 external/bsd/unbound/dist/sldns/str2wire.c: up to 1.1.1.2 external/bsd/unbound/dist/sldns/str2wire.h: up to 1.1.1.2 external/bsd/unbound/dist/sldns/wire2str.c: up to 1.1.1.2 external/bsd/unbound/dist/sldns/wire2str.h: up to 1.1.1.2 external/bsd/unbound/dist/smallapp/unbound-anchor.c: up to 1.1.1.2 external/bsd/unbound/dist/smallapp/unbound-checkconf.c: up to 1.1.1.2 external/bsd/unbound/dist/smallapp/unbound-control.c: up to 1.1.1.2 external/bsd/unbound/dist/smallapp/unbound-host.c: up to 1.1.1.2 external/bsd/unbound/dist/smallapp/worker_cb.c: up to 1.1.1.2 external/bsd/unbound/dist/systemd.m4: up to 1.1.1.1 external/bsd/unbound/dist/testcode/asynclook.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/checklocks.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/checklocks.h: up to 1.1.1.2 external/bsd/unbound/dist/testcode/do-tests.sh: up to 1.1.1.2 external/bsd/unbound/dist/testcode/fake_event.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/lock_verify.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/memstats.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/mini_tdir.sh: up to 1.1.1.1 external/bsd/unbound/dist/testcode/perf.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/petal.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/replay.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/replay.h: up to 1.1.1.2 external/bsd/unbound/dist/testcode/run_vm.sh: up to 1.1.1.2 external/bsd/unbound/dist/testcode/signit.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/streamtcp.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/testbound.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/testpkts.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/testpkts.h: up to 1.1.1.2 external/bsd/unbound/dist/testcode/unitauth.c: up to 1.1.1.1 external/bsd/unbound/dist/testcode/unitecs.c: up to 1.1.1.1 external/bsd/unbound/dist/testcode/unitlruhash.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/unitmain.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/unitmain.h: up to 1.1.1.2 external/bsd/unbound/dist/testcode/unitneg.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/unitslabhash.c: up to 1.1.1.2 external/bsd/unbound/dist/testcode/unitverify.c: up to 1.1.1.2 external/bsd/unbound/dist/testdata/00-lint.tdir/00-lint.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/00-lint.tdir/00-lint.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/00-lint.tpkg delete external/bsd/unbound/dist/testdata/01-doc.tdir/01-doc.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/01-doc.tdir/01-doc.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/01-doc.tpkg delete external/bsd/unbound/dist/testdata/02-unittest.tdir/02-unittest.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/02-unittest.tdir/02-unittest.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/02-unittest.tpkg delete external/bsd/unbound/dist/testdata/03-testbound.tdir/03-testbound.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/03-testbound.tdir/03-testbound.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/03-testbound.tpkg delete external/bsd/unbound/dist/testdata/04-checkconf.tdir/04-checkconf.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/04-checkconf.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.badfwd: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.badif: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.badip: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.bind: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.user: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/good.all: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/good.ifport: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/good.include: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/warn.algo: up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tpkg delete external/bsd/unbound/dist/testdata/05-asynclook.tdir/05-asynclook.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/05-asynclook.tdir/05-asynclook.hosts: up to 1.1.1.1 external/bsd/unbound/dist/testdata/05-asynclook.tdir/05-asynclook.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/05-asynclook.tdir/05-asynclook.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/05-asynclook.tdir/05-asynclook.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/05-asynclook.tdir/05-asynclook.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/05-asynclook.tpkg delete external/bsd/unbound/dist/testdata/06-ianaports.tdir/06-ianaports.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/06-ianaports.tdir/06-ianaports.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/06-ianaports.tpkg delete external/bsd/unbound/dist/testdata/07-confroot.tdir/07-confroot.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/07-confroot.tdir/07-confroot.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/07-confroot.tpkg delete external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.hosts: up to 1.1.1.1 external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/08-host-lib.tpkg delete external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/bad_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/bad_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/bad_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/bad_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/local_data: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/local_data_remove: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/local_zones: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/local_zones_remove: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/unbound_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/unbound_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/unbound_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/unbound_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tpkg delete external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/10-unbound-anchor.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/10-unbound-anchor.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/10-unbound-anchor.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/10-unbound-anchor.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/10-unbound-anchor.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/10-unbound-anchor.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/127.0.0.1/bad.p7s: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/127.0.0.1/bad.xml: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.xml: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/127.0.0.1/root.xml: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/K.+005+37348.ds: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/K.+005+37348.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/K.+005+37348.private: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/test_cert.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/test_cert.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound-control-setup: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/petal.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/petal.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/signit: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/test_cert.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/test_cert.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/10-unbound-anchor.tpkg delete external/bsd/unbound/dist/testdata/autotrust_10key.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_addpend_2exceed.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_addpend_early.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_addpend_nosign.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_addpend_nosignnew.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_addpend_once.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_addpend_twice.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_init.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_init_ds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_init_fail.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_init_failsig.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_init_legacy.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_init_sigs.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_init_zsk.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_missing.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_missing_all.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_missing_returns.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_probefail.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_probefailsig.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_revoked_use.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_revoked_with_invalid.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_revtp.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_revtp_read.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_revtp_use.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_rollalgo.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_rollalgo_unknown.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_rollover.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_valid_use.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/black_data.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/black_dnskey.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/black_ds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/black_ds_entry.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/black_ent.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/black_key_entry.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/black_prime.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/black_prime_entry.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/chaos_trustanchor.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/common.sh: up to 1.1.1.2 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/bad_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/bad_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/bad_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/bad_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/ctrl_itr.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/ctrl_itr.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/ctrl_itr.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/ctrl_itr.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/ctrl_itr.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/ctrl_itr.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/unbound_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/unbound_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/unbound_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/unbound_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_itr.tpkg delete external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._bad_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._bad_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._bad_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._bad_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._ctrl_pipe.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._ctrl_pipe.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._ctrl_pipe.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._ctrl_pipe.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._ctrl_pipe.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._ctrl_pipe.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._unbound_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._unbound_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._unbound_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/._unbound_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/bad_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/bad_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/bad_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/bad_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/ctrl_pipe.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/ctrl_pipe.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/ctrl_pipe.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/ctrl_pipe.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/ctrl_pipe.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/ctrl_pipe.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/unbound_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/unbound_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/unbound_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/unbound_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ctrl_pipe.tpkg delete external/bsd/unbound/dist/testdata/dlv_anchor.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_ask_higher.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_below_ta.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_delegation.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_ds_lookup.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_insecure.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_insecure_negcache.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_keyretry.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_negnx.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_optout.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_remove.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_remove_empty.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_remove_nodel.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_remove_pos.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dlv_unused.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/1.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/1.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/1_chacha.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/1_salsa.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/2.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/2.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/2_chacha.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/2_salsa.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/precheck.sh: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/1.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/1.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/1_chacha.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/1_salsa.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/2.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/2.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/2_chacha.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/2_salsa.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/precheck.sh: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/1.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/1.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/1_chacha.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/1_salsa.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/2.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/2.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/2_chacha.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/2_salsa.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/1.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/1_chacha.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/1_salsa.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/2.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/2_chacha.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/2_salsa.cert: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/precheck.sh: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_cache.tdir/edns_cache.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_cache.tdir/edns_cache.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_cache.tdir/edns_cache.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_cache.tdir/edns_cache.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_cache.tdir/edns_cache.stub1: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_cache.tdir/edns_cache.stub2: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_cache.tdir/edns_cache.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_cache.tpkg delete external/bsd/unbound/dist/testdata/edns_lame.tdir/edns_lame.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_lame.tdir/edns_lame.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_lame.tdir/edns_lame.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_lame.tdir/edns_lame.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_lame.tdir/edns_lame.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_lame.tdir/edns_lame.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_lame.tpkg delete external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ancil.tpkg delete external/bsd/unbound/dist/testdata/fwd_bogus.tdir/fwd_bogus.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/fwd_bogus.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/fwd_bogus.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/fwd_bogus.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/fwd_bogus.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/fwd_bogus.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/unbound_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/unbound_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/unbound_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/unbound_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_bogus.tpkg delete external/bsd/unbound/dist/testdata/fwd_capsid.tdir/fwd_capsid.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid.tdir/fwd_capsid.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid.tdir/fwd_capsid.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid.tdir/fwd_capsid.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid.tdir/fwd_capsid.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid.tdir/fwd_capsid.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid.tpkg delete external/bsd/unbound/dist/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_fallback.tpkg delete external/bsd/unbound/dist/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.testns2: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_strip.tpkg delete external/bsd/unbound/dist/testdata/fwd_capsid_white.tdir/fwd_capsid_white.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_white.tdir/fwd_capsid_white.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_white.tdir/fwd_capsid_white.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_white.tdir/fwd_capsid_white.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_white.tdir/fwd_capsid_white.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_white.tdir/fwd_capsid_white.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_white.tdir/fwd_capsid_white.testns2: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_capsid_white.tpkg delete external/bsd/unbound/dist/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.good: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_compress_c00c.tpkg delete external/bsd/unbound/dist/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_bksec.tpkg delete external/bsd/unbound/dist/testdata/fwd_edns_probe.tdir/fwd_edns_probe.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_probe.tdir/fwd_edns_probe.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_probe.tdir/fwd_edns_probe.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_probe.tdir/fwd_edns_probe.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_probe.tdir/fwd_edns_probe.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_probe.tdir/fwd_edns_probe.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_edns_probe.tpkg delete external/bsd/unbound/dist/testdata/fwd_malformed.tdir/fwd_malformed.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_malformed.tdir/fwd_malformed.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_malformed.tdir/fwd_malformed.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_malformed.tdir/fwd_malformed.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_malformed.tdir/fwd_malformed.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_malformed.tdir/fwd_malformed.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_no_edns.tdir/fwd_no_edns.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_no_edns.tdir/fwd_no_edns.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_no_edns.tdir/fwd_no_edns.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_no_edns.tdir/fwd_no_edns.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_no_edns.tdir/fwd_no_edns.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_no_edns.tdir/fwd_no_edns.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_no_edns.tpkg delete external/bsd/unbound/dist/testdata/fwd_oneport.tdir/fwd_oneport.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_oneport.tdir/fwd_oneport.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_oneport.tdir/fwd_oneport.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_oneport.tdir/fwd_oneport.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_oneport.tdir/fwd_oneport.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_oneport.tdir/fwd_oneport.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_oneport.tpkg delete external/bsd/unbound/dist/testdata/fwd_tcp.tdir/fwd_tcp.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp.tdir/fwd_tcp.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp.tdir/fwd_tcp.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp.tdir/fwd_tcp.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp.tdir/fwd_tcp.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp.tdir/fwd_tcp.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp.tpkg delete external/bsd/unbound/dist/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc.tpkg delete external/bsd/unbound/dist/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc6.tdir/fwd_tcp_tc6.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_tcp_tc6.tpkg delete external/bsd/unbound/dist/testdata/fwd_three.tdir/fwd_three.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three.tdir/fwd_three.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three.tdir/fwd_three.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three.tdir/fwd_three.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three.tdir/fwd_three.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three.tdir/fwd_three.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three.tpkg delete external/bsd/unbound/dist/testdata/fwd_three_service.tdir/fwd_three_service.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three_service.tdir/fwd_three_service.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three_service.tdir/fwd_three_service.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three_service.tdir/fwd_three_service.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three_service.tdir/fwd_three_service.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three_service.tdir/fwd_three_service.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_three_service.tpkg delete external/bsd/unbound/dist/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_ttlexpire.tpkg delete external/bsd/unbound/dist/testdata/fwd_udp.tdir/fwd_udp.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp.tdir/fwd_udp.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp.tdir/fwd_udp.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp.tdir/fwd_udp.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp.tdir/fwd_udp.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp.tdir/fwd_udp.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp.tpkg delete external/bsd/unbound/dist/testdata/fwd_udptmout.tdir/fwd_udptmout.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udptmout.tdir/fwd_udptmout.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udptmout.tdir/fwd_udptmout.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udptmout.tdir/fwd_udptmout.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udptmout.tdir/fwd_udptmout.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udptmout.tdir/fwd_udptmout.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udptmout.tpkg delete external/bsd/unbound/dist/testdata/fwd_waitudp.tdir/fwd_waitudp.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_waitudp.tdir/fwd_waitudp.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_waitudp.tdir/fwd_waitudp.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_waitudp.tdir/fwd_waitudp.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_waitudp.tdir/fwd_waitudp.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_waitudp.tdir/fwd_waitudp.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_waitudp.tpkg delete external/bsd/unbound/dist/testdata/fwd_zero.tdir/fwd_zero.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_zero.tdir/fwd_zero.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_zero.tdir/fwd_zero.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_zero.tdir/fwd_zero.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_zero.tdir/fwd_zero.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_zero.tdir/fwd_zero.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_zero.tpkg delete external/bsd/unbound/dist/testdata/fwddlv_parse.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/hostsfileosx.tdir/hostsfileosx.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/hostsfileosx.tdir/hostsfileosx.hosts: up to 1.1.1.1 external/bsd/unbound/dist/testdata/hostsfileosx.tdir/hostsfileosx.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/hostsfileosx.tdir/hostsfileosx.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/hostsfileosx.tdir/hostsfileosx.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/hostsfileosx.tdir/hostsfileosx.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/hostsfileosx.tpkg delete external/bsd/unbound/dist/testdata/ipsecmod_bogus_ipseckey.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ipsecmod_enabled.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ipsecmod_hook.sh: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ipsecmod_ignore_bogus_ipseckey.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ipsecmod_max_ttl.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ipsecmod_strict.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/ipsecmod_whitelist.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_class_any.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_dname_insec.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_dname_yx.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_dnsseclame_bug.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_dnsseclame_ds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_dnsseclame_ds_ok.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_dnsseclame_ta.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_dnsseclame_ta_ok.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_emptydp.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_emptydp_for_glue.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_primenoglue.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_resolve_minimised.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_resolve_minimised_nx.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_resolve_minimised_refused.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_resolve_minimised_timeout.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_scrub_dname_rev.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_scrub_dname_sec.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_stub_leak.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_acl_override.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_acl_taglist.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_acl_taglist_action.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_cname.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_ds.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nodefault.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/local_nodefault.tdir/local_nodefault.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nodefault.tdir/local_nodefault.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nodefault.tdir/local_nodefault.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nodefault.tdir/local_nodefault.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nodefault.tdir/local_nodefault.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nodefault.tdir/local_nodefault.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nodefault.tpkg delete external/bsd/unbound/dist/testdata/local_norec.tdir/local_norec.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_norec.tdir/local_norec.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_norec.tdir/local_norec.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_norec.tdir/local_norec.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_norec.tdir/local_norec.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_norec.tdir/local_norec.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_norec.tpkg delete external/bsd/unbound/dist/testdata/local_nosnoop.tdir/local_nosnoop.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nosnoop.tdir/local_nosnoop.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nosnoop.tdir/local_nosnoop.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nosnoop.tdir/local_nosnoop.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nosnoop.tdir/local_nosnoop.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nosnoop.tdir/local_nosnoop.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/local_nosnoop.tpkg delete external/bsd/unbound/dist/testdata/net_signed_servfail.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/nomem_cnametopos.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/nss_compile.tdir/nss_compile.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/nss_compile.tdir/nss_compile.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/nss_compile.tpkg delete external/bsd/unbound/dist/testdata/pylib.tdir/pylib.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.lookup.py: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.py: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pylib.tpkg delete external/bsd/unbound/dist/testdata/pymod.tdir/pymod.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.py: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod.tpkg delete external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.py: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/pymod_thread.tpkg delete external/bsd/unbound/dist/testdata/remote-threaded.tdir/bad_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/bad_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/bad_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/bad_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/remote-threaded.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/remote-threaded.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/remote-threaded.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/remote-threaded.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/remote-threaded.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/remote-threaded.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/unbound_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/unbound_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/unbound_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tdir/unbound_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/remote-threaded.tpkg delete external/bsd/unbound/dist/testdata/root_anchor.tdir/root_anchor.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_anchor.tdir/root_anchor.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_anchor.tpkg delete external/bsd/unbound/dist/testdata/root_hints.tdir/root_hints.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_hints.tdir/root_hints.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_hints.tpkg delete external/bsd/unbound/dist/testdata/speed_cache.tdir/makeqs.c: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_cache.tdir/makeqs.sh: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_cache.tdir/speed_cache.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_cache.tdir/speed_cache.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_cache.tdir/speed_cache.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_cache.tdir/speed_cache.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_cache.tdir/speed_cache.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_cache.tdir/speed_cache.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_cache.tpkg delete external/bsd/unbound/dist/testdata/speed_local.tdir/speed_local.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_local.tdir/speed_local.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_local.tdir/speed_local.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_local.tdir/speed_local.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_local.tdir/speed_local.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_local.tdir/speed_local.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/speed_local.tpkg delete external/bsd/unbound/dist/testdata/stat_timer.tdir/stat_timer.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_timer.tdir/stat_timer.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_timer.tdir/stat_timer.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_timer.tdir/stat_timer.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_timer.tdir/stat_timer.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_timer.tdir/stat_timer.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_timer.tpkg delete external/bsd/unbound/dist/testdata/stop_nxdomain.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/stop_nxdomain_minimised.rpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.clie.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.serv.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/unbound_control.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/unbound_control.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/unbound_server.key: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tdir/unbound_server.pem: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_ssl.tpkg delete external/bsd/unbound/dist/testdata/stream_tcp.tdir/stream_tcp.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_tcp.tdir/stream_tcp.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_tcp.tdir/stream_tcp.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_tcp.tdir/stream_tcp.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_tcp.tdir/stream_tcp.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_tcp.tdir/stream_tcp.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stream_tcp.tpkg delete external/bsd/unbound/dist/testdata/stub_udp.tdir/stub_udp.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp.tdir/stub_udp.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp.tdir/stub_udp.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp.tdir/stub_udp.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp.tdir/stub_udp.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp.tdir/stub_udp.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp.tpkg delete external/bsd/unbound/dist/testdata/stub_udp6.tdir/stub_udp6.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp6.tdir/stub_udp6.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp6.tdir/stub_udp6.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp6.tdir/stub_udp6.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp6.tdir/stub_udp6.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp6.tdir/stub_udp6.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp6.tpkg delete external/bsd/unbound/dist/testdata/subnet_cached.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_derived.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_format_ip4.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_max_source.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_not_whitelisted.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_val_positive.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_val_positive_client.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_without_validator.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_sigpipe.tdir/tcp_sigpipe.conf: up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_sigpipe.tdir/tcp_sigpipe.dsc: up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_sigpipe.tdir/tcp_sigpipe.post: up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_sigpipe.tdir/tcp_sigpipe.pre: up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_sigpipe.tdir/tcp_sigpipe.test: up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_sigpipe.tdir/tcp_sigpipe.testns: up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_sigpipe.tpkg delete external/bsd/unbound/dist/testdata/test_ldnsrr.5: up to 1.1.1.2 external/bsd/unbound/dist/testdata/test_ldnsrr.c5: up to 1.1.1.2 external/bsd/unbound/dist/testdata/test_sigs.ed25519: up to 1.1.1.1 external/bsd/unbound/dist/testdata/val_adbit.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_adcopy.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_anchor_nx.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_anchor_nx_nosig.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ans_dsent.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ans_nx.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_any.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_any_cname.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_any_dname.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cname_loop1.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cname_loop2.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cname_loop3.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnameinsectopos.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnamenx_dblnsec.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnamenx_rcodenx.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnameqtype.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametocloser.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametocloser_nosig.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametocnamewctoposwc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametodname.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametodnametocnametopos.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametoinsecure.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametonodata.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametonodata_nonsec.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametonsec.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametonx.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametooptin.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametooptout.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametopos.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametoposnowc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnametoposwc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnamewctonodata.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnamewctonx.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_cnamewctoposwc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_deleg_nons.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_dnametoolong.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_dnametopos.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_dnametoposwc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_dnamewc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ds_afterprime.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ds_cname.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ds_cnamesub.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ds_gost.crpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ds_gost_downgrade.crpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ds_sha2.crpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ds_sha2_downgrade.crpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ds_sha2_lenient.crpl: up to 1.1.1.1 external/bsd/unbound/dist/testdata/val_dsnsec.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_entds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_faildnskey.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_faildnskey_ok.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_fwdds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_keyprefetch.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_keyprefetch_verify.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_mal_wc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_negcache_ds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_negcache_dssoa.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_noadwhennodo.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodata.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodata_ent.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodata_entnx.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodata_entwc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodata_failsig.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodata_hasdata.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodata_zonecut.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodatawc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodatawc_badce.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodatawc_nodeny.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nodatawc_one.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nokeyprime.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b1_nameerror.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b1_nameerror_noce.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b1_nameerror_nonc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b1_nameerror_nowc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b21_nodataent.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b21_nodataent_wr.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b2_nodata.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b2_nodata_nons.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b3_optout.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b3_optout_negcache.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b3_optout_noce.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b3_optout_nonc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b4_wild.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b4_wild_wr.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b5_wcnodata.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b5_wcnodata_noce.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b5_wcnodata_nonc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_b5_wcnodata_nowc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_cname_ds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_cname_par.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_cname_sub.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_cnametocnamewctoposwc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_entnodata_optout.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_entnodata_optout_badopt.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_entnodata_optout_match.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_iter_high.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_nodatawccname.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_nods.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_nods_badopt.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_nods_badsig.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_nods_negcache.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_nods_soa.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_optout_ad.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_optout_cache.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_wcany.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nsec3_wcany_nodeny.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nx.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nx_nodeny.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nx_nowc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nx_nsec3_collision.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nx_nsec3_params.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_nx_overreach.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_pos_truncns.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_positive.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_positive_nosigs.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_positive_wc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_positive_wc_nodeny.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_qds_badanc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_qds_oneanc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_qds_twoanc.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_refer_unsignadd.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_referd.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_referglue.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_rrsig.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_secds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_secds_nosig.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_spurious_ns.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_stub_noroot.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_stubds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ta_algo_dnskey.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ta_algo_dnskey_dp.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ta_algo_missing.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_ta_algo_missing_dp.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_twocname.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_unalgo_anchor.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_unalgo_dlv.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_unalgo_ds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_unsec_cname.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_unsecds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_unsecds_negcache.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_unsecds_qtypeds.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/val_wild_pos.rpl: up to 1.1.1.2 external/bsd/unbound/dist/testdata/views.rpl: up to 1.1.1.1 external/bsd/unbound/dist/util/alloc.c: up to 1.1.1.2 external/bsd/unbound/dist/util/alloc.h: up to 1.1.1.2 external/bsd/unbound/dist/util/config_file.c: up to 1.1.1.2 external/bsd/unbound/dist/util/config_file.h: up to 1.1.1.2 external/bsd/unbound/dist/util/configlexer.c: up to 1.1.1.2 external/bsd/unbound/dist/util/configlexer.lex: up to 1.1.1.2 external/bsd/unbound/dist/util/configparser.c: up to 1.1.1.2 external/bsd/unbound/dist/util/configparser.h: up to 1.1.1.2 external/bsd/unbound/dist/util/configparser.y: up to 1.1.1.2 external/bsd/unbound/dist/util/data/dname.c: up to 1.1.1.2 external/bsd/unbound/dist/util/data/dname.h: up to 1.1.1.2 external/bsd/unbound/dist/util/data/msgencode.c: up to 1.1.1.2 external/bsd/unbound/dist/util/data/msgparse.c: up to 1.1.1.2 external/bsd/unbound/dist/util/data/msgparse.h: up to 1.1.1.2 external/bsd/unbound/dist/util/data/msgreply.c: up to 1.1.1.2 external/bsd/unbound/dist/util/data/msgreply.h: up to 1.1.1.2 external/bsd/unbound/dist/util/data/packed_rrset.c: up to 1.1.1.2 external/bsd/unbound/dist/util/data/packed_rrset.h: up to 1.1.1.2 external/bsd/unbound/dist/util/fptr_wlist.c: up to 1.1.1.2 external/bsd/unbound/dist/util/fptr_wlist.h: up to 1.1.1.2 external/bsd/unbound/dist/util/iana_ports.inc: up to 1.1.1.2 external/bsd/unbound/dist/util/locks.c: up to 1.1.1.2 external/bsd/unbound/dist/util/locks.h: up to 1.1.1.2 external/bsd/unbound/dist/util/log.c: up to 1.1.1.2 external/bsd/unbound/dist/util/mini_event.c: up to 1.1.1.2 external/bsd/unbound/dist/util/mini_event.h: up to 1.1.1.2 external/bsd/unbound/dist/util/module.c: up to 1.1.1.2 external/bsd/unbound/dist/util/module.h: up to 1.1.1.2 external/bsd/unbound/dist/util/net_help.c: up to 1.1.1.2 external/bsd/unbound/dist/util/net_help.h: up to 1.1.1.2 external/bsd/unbound/dist/util/netevent.c: up to 1.1.1.2 external/bsd/unbound/dist/util/netevent.h: up to 1.1.1.2 external/bsd/unbound/dist/util/rbtree.c: up to 1.1.1.2 external/bsd/unbound/dist/util/rbtree.h: up to 1.1.1.2 external/bsd/unbound/dist/util/shm_side/shm_main.c: up to 1.1.1.1 external/bsd/unbound/dist/util/shm_side/shm_main.h: up to 1.1.1.1 external/bsd/unbound/dist/util/storage/dnstree.c: up to 1.1.1.2 external/bsd/unbound/dist/util/storage/dnstree.h: up to 1.1.1.2 external/bsd/unbound/dist/util/storage/lookup3.c: up to 1.1.1.2 external/bsd/unbound/dist/util/storage/lruhash.c: up to 1.1.1.2 external/bsd/unbound/dist/util/storage/lruhash.h: up to 1.1.1.2 external/bsd/unbound/dist/util/storage/slabhash.c: up to 1.1.1.2 external/bsd/unbound/dist/util/storage/slabhash.h: up to 1.1.1.2 external/bsd/unbound/dist/util/timehist.c: up to 1.1.1.2 external/bsd/unbound/dist/util/timehist.h: up to 1.1.1.2 external/bsd/unbound/dist/util/tube.c: up to 1.1.1.2 external/bsd/unbound/dist/util/tube.h: up to 1.1.1.2 external/bsd/unbound/dist/util/ub_event.c: up to 1.1.1.2 external/bsd/unbound/dist/util/ub_event.h: up to 1.1.1.2 external/bsd/unbound/dist/util/ub_event_pluggable.c: up to 1.1.1.2 external/bsd/unbound/dist/util/winsock_event.c: up to 1.1.1.2 external/bsd/unbound/dist/util/winsock_event.h: up to 1.1.1.2 external/bsd/unbound/dist/validator/autotrust.c: up to 1.1.1.2 external/bsd/unbound/dist/validator/autotrust.h: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_anchor.c: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_anchor.h: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_neg.c: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_neg.h: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_nsec.c: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_nsec.h: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_nsec3.c: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_nsec3.h: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_secalgo.c: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_sigcrypt.c: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_sigcrypt.h: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_utils.c: up to 1.1.1.2 external/bsd/unbound/dist/validator/val_utils.h: up to 1.1.1.2 external/bsd/unbound/dist/validator/validator.c: up to 1.1.1.2 external/bsd/unbound/dist/validator/validator.h: up to 1.1.1.2 external/bsd/unbound/dist/winrc/setup.nsi: up to 1.1.1.2 external/bsd/unbound/dist/winrc/unbound-control-setup.cmd: up to 1.1.1.2 external/bsd/unbound/dist/winrc/w_inst.c: up to 1.1.1.2 external/bsd/unbound/dist/winrc/win_svc.c: up to 1.1.1.2 external/bsd/unbound/etc/rc.d/unbound: up to 1.2 external/bsd/unbound/include/config-1.0.h: up to 1.2 external/bsd/unbound/include/config-1.1.h: up to 1.2 external/bsd/unbound/include/config.h: up to 1.4 external/bsd/unbound/include/dnscrypt/dnscrypt_config.h: up to 1.1 external/bsd/unbound/lib/libunbound/Makefile: up to 1.3 external/bsd/unbound/lib/libunbound/shlib_version: up to 1.2 external/bsd/unbound/sbin/Makefile.inc: up to 1.4 share/mk/bsd.own.mk: patch Update unbound to 1.6.8. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Jan 19, 2018" "NLnet Labs" "unbound 1.6.8" d19 1 a19 2 The file format has attributes and values. Some attributes have attributes inside them. d25 1 a25 1 The utility d33 1 a33 1 $ unbound \-c /etc/unbound/unbound.conf d65 2 a66 2 There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute is followed by its containing attributes, or a value. d74 2 a75 3 if the directory where the daemon is started equals its chroot/working directory or is specified before the include statement with directory: dir. Wildcards can be used to include multiple files, see \fIglob\fR(7). d82 1 a82 1 The verbosity number, level 0 means no verbosity, only errors. Level 1 d84 3 a86 3 information. Level 3 gives query level information, output per query. Level 4 gives algorithm level information. Level 5 logs client identification for cache misses. Default is level 1. d92 1 a92 1 are only printed if replies were sent during the statistics interval, d101 1 a101 1 If enabled, extended statistics are printed from \fIunbound\-control\fR(8). d114 1 a114 1 Can be given multiple times to work on several interfaces. If none are d125 1 a125 1 Detect source interface on UDP queries and copy them to replies. This d129 1 a129 1 .B outgoing\-interface: \fI d131 3 a133 3 queries to authoritative servers and receive their replies. Can be given multiple times to work on several interfaces. If none are given the default (all) is used. You can specify the same interfaces in d137 1 a137 1 lines, the interfaces are then used for both purposes. Outgoing queries are a138 16 .IP If an IPv6 netblock is specified instead of an individual IPv6 address, outgoing UDP queries will use a randomised source address taken from the netblock to counter spoofing. Requires the IPv6 netblock to be routed to the host running unbound, and requires OS support for unprivileged non-local binds (currently only supported on Linux). Several netblocks may be specified with multiple .B outgoing\-interface: options, but do not specify both an individual IPv6 address and an IPv6 netblock, or the randomisation will be compromised. Consider combining with .B prefer\-ip6: yes to increase the likelihood of IPv6 nameservers being selected for queries. On Linux you need these two commands to be able to use the freebind socket option to receive traffic for the ip6 netblock: ip \-6 addr add mynetblock/64 dev lo && ip \-6 route add local mynetblock/64 dev lo d141 2 a142 2 Number of ports to open. This number of file descriptors can be opened per thread. Must be at least 1. Default depends on compile options. Larger d144 1 a144 1 very large value is best, use libevent to make this possible. d149 1 a149 1 spoofing attempts. Make sure these ports are not needed by other daemons. d153 4 a156 4 The \fBoutgoing\-port\-permit\fR and \fBoutgoing\-port\-avoid\fR statements are processed in the line order of the config file, adding the permitted ports and subtracting the avoided ports from the set of allowed ports. The processing starts with the non IANA allocated ports above 1024 in the set d160 1 a160 1 Do not permit unbound to open this port or range of ports for use to send d182 1 a182 1 then a value of 1472 can fix it. Setting to 512 bypasses even the most d190 1 a190 1 Suggested values are 512 to 4096. Default is 4096. d196 1 a196 1 for DNS data, such as for huge resource records, will result in a SERVFAIL d206 1 a206 1 Must be set to a power of 2. Setting (close) to the number of cpus is a d218 1 a218 1 results in one roundtrip to the authority servers. If too many queries d220 2 a221 2 the other 50% are replaced with the new incoming query if they have already spent more than their allowed time. This protects against denial of d223 1 a223 1 The effect is that the qps for long-lasting queries is about d284 1 a284 1 interface or IP address is down. Exists only on Linux, where the similar d294 1 a294 1 Must be set to a power of 2. d297 3 a299 3 Time to live maximum for RRsets and messages in the cache. Default is 86400 seconds (1 day). If the maximum kicks in, responses to clients still get decrementing TTLs based on the original (larger) values. d309 1 a309 1 higher values, especially more than an hour or so, can lead to trouble as d317 1 a317 1 Time to live for entries in the host cache. The host cache contains d321 2 a322 2 Number of slabs in the infrastructure cache. Slabs reduce lock contention by threads. Must be set to a power of 2. a331 4 .B define\-tag: \fI<"list of tags"> Define the tags that can be used with local\-zone and access\-control. Enclose the list between quotes ("") and put spaces between tags. .TP a341 4 .B prefer\-ip6: \fI If enabled, prefer IPv6 transport for sending DNS queries to internet nameservers. Default is no. .TP d350 1 a350 1 to queries. Value lower than common MSS on Ethernet a367 5 .B udp\-upstream\-without\-downstream: \fI Enable udp upstream even if do-udp is no. Default is no, and this does not change anything. Useful for TLS service providers, that want no udp downstream but use udp to fetch data upstream. .TP d371 1 a371 2 TCP wireformat. The other server must support this (see \fBssl\-service\-key\fR). a390 4 .B use\-systemd: \fI Enable or disable systemd socket activation. Default is no. .TP d393 1 a393 2 a daemon. Set the value to \fIno\fR when unbound runs as systemd service. Default is yes. d396 2 a397 2 The netblock is given as an IP4 or IP6 address with /size appended for a classless network block. The action can be \fIdeny\fR, \fIrefuse\fR, d403 1 a403 1 The action \fIrefuse\fR stops queries too, but sends a DNS rcode REFUSED d406 2 a407 2 The action \fIallow\fR gives access to clients from that netblock. It gives only access for recursion clients (which is d410 1 a410 1 The \fIallow\fR action does allow nonrecursive queries to access the d412 3 a414 3 the unbound server recursive lookup algorithm, and static data is served in the reply. This supports normal operations where nonrecursive queries are made for the authoritative data. For nonrecursive queries any replies d417 2 a418 2 The action \fIallow_snoop\fR gives nonrecursive access too. This give both recursive and non recursive access. The name \fIallow_snoop\fR refers d420 2 a421 2 the cache contents (for malicious acts). However, nonrecursive queries can also be a valuable debugging tool (when you want to examine the cache d425 2 a426 2 The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS protocol is not designed to handle dropped packets due to policy, and a434 20 .B access\-control\-tag: \fI <"list of tags"> Assign tags to access-control elements. Clients using this access control element use localzones that are tagged with one of these tags. Tags must be defined in \fIdefine\-tags\fR. Enclose list of tags in quotes ("") and put spaces between tags. If access\-control\-tag is configured for a netblock that does not have an access\-control, an access\-control element with action \fIallow\fR is configured for this netblock. .TP .B access\-control\-tag\-action: \fI Set action for particular tag for given access control element. If you have multiple tag values, the tag used to lookup the action is the first tag match between access\-control\-tag and local\-zone\-tag where "first" comes from the order of the define-tag values. .TP .B access\-control\-tag\-data: \fI <"resource record string"> Set redirect data for particular tag for given access control element. .TP .B access\-control\-view: \fI Set view for given access control element. .TP d438 2 a439 2 chroot has been performed the now defunct portion of the config file path is removed to be able to reread the config after a reload. d450 1 a450 1 to chroot and dropping permissions. This allows the pidfile to be d456 1 a456 1 If given a chroot is done to the given directory. The default is d461 1 a461 1 "@@UNBOUND_USERNAME@@". If you give username: "" no user change is performed. d465 1 a465 1 If you change the port number in the config file, and that new port number a471 2 If you give a server: directory: dir before include: file statements then those includes can be relative to the working directory. d475 1 a475 1 The logfile is appended to, in the following format: d477 1 a477 1 [seconds since 1970] unbound[pid:tid]: type: message. d480 1 a480 1 The logfile is reopened (for append) when the config file is reread, on d484 2 a485 2 Sets unbound to send log messages to the syslogd, using \fIsyslog\fR(3). a489 7 .B log\-identity: \fI If "" is given (default), then the name of the executable, usually "unbound" is used to report to the log. Enter a string to override it with that, which is useful on systems that run more than one instance of unbound, with different configurations, so that the logs can be easily distinguished against. .TP a500 7 .B log\-replies: \fI Prints one line per reply to the log, with the log timestamp and IP address, name, type, class, return code, time to resolve, from cache and response size. Default is no. Note that it takes time to print these lines which makes the server (significantly) slower. Odd (nonprintable) characters in names are printed as '?'. .TP d502 1 a502 1 The process id is written to the file. Default is "@@UNBOUND_PIDFILE@@". d505 1 a505 1 kill \-HUP `cat @@UNBOUND_PIDFILE@@` d509 1 a509 1 kill \-TERM `cat @@UNBOUND_PIDFILE@@` d515 1 a515 1 for the IN class. The file has the format of zone files, with root a532 3 .B hide\-trustanchor: \fI If enabled trustanchor.unbound queries are refused. .TP d536 1 a536 1 dependency depth. d539 1 a539 1 that unbound will pursue in answering a query. d542 1 a542 1 that many targets opportunistically. d546 1 a546 1 closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour d551 1 a551 1 it is legal protocol wise to send these, and unbound tries to give very d565 5 a569 5 (or the DNSKEY data fails to validate), then the zone is made insecure, this behaves like there is no trust anchor. You could turn this off if you are sometimes behind an intrusive firewall (of some sort) that removes DNSSEC data from packets, or a zone changes from signed to unsigned to badly signed often. If turned off you run the risk of a d573 1 a573 2 From RFC 8020 (with title "NXDOMAIN: There Really Is Nothing Underneath"), returns nxdomain to queries for a name d580 1 a580 1 The nxdomain must be secure, this means nsec3 with optout is insufficient. d586 1 a586 1 NS sets and the nameserver addresses that are encountered on the referral d603 3 a605 3 This perturbs the lowercase and uppercase of query names sent to authority servers and checks if the reply still has the correct casing. Disabled by default. d616 3 a618 10 Only sent minimum required labels of the QNAME and set QTYPE to NS when possible. Best effort approach; full QNAME and original QTYPE will be sent when upstream replies with a RCODE other than NOERROR, except when receiving NXDOMAIN from a DNSSEC signed zone. Default is off. .TP .B qname\-minimisation\-strict: \fI QNAME minimisation in strict mode. Do not fall-back to sending full QNAME to potentially broken nameservers. A lot of domains will not be resolvable when this option in enabled. Only use if you know what you are doing. This option only has effect when qname-minimisation is enabled. Default is off. d641 1 a641 1 Give multiple times to allow multiple domain names to contain private d652 1 a652 1 Do not query the given IP address. Can be IP4 or IP6. Append /num to d711 1 a711 2 necessary to deal with filesystem full events), it must also be inside the chroot (if that is used). d718 1 a718 1 "" around it. A TTL can be specified for ease of cut and paste, but is ignored. d724 1 a724 1 but has a different file format. Format is BIND\-9 style format, a728 3 .B trust\-anchor\-signaling: \fI Send RFC8145 key tag query after trust anchor priming. Default is on. .TP d736 3 a738 3 would be slow. The DLV configured is used as a root trusted DLV, this means that it is a lookaside for the root. Default is "", or no dlv anchor file. DLV is going to be decommissioned. Please do not use it any more. d750 1 a750 1 trust anchors for the domain they override this setting (and the domain d754 1 a754 1 lookups does not affect an (unsigned) internal domain. A DS record d760 1 a760 1 and expiration dates, instead of the current date. Do not set this unless d790 1 a790 1 to protect the users that rely on this validator for authentication from d805 2 a806 2 reply is not withheld from the client with SERVFAIL as usual. The client receives the bogus data. For messages that are found to be secure the AD bit d808 1 a808 1 The default value is "no". a817 5 .B serve\-expired: \fI If enabled, unbound attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish. The actual resolution answer ends up in the cache later on. Default is "no". .TP d823 1 a823 1 be in ascending order and have at least one entry. If you set it to d858 1 a858 1 Must be set to a power of 2. Setting (close) to the number of cpus is a a885 1 always_transparent, always_refuse, always_nxdomain, d908 1 a908 1 \h'5'\fItransparent\fR d916 1 a916 1 \h'5'\fItypetransparent\fR d923 1 a923 1 \h'5'\fIredirect\fR d929 2 a930 2 to the end user, with local\-zone: "example.com." redirect and d935 6 a940 6 \h'5'\fIinform\fR The query is answered normally, same as transparent. The client IP address (@@portnumber) is printed to the logfile. The log message is: timestamp, unbound-pid, info: zonename inform IP@@port queryname type class. This option can be used for normal resolution, but machines looking up infected names are logged, eg. to run antivirus on them. d942 1 a942 1 \h'5'\fIinform_deny\fR d946 1 a946 10 \h'5'\fIalways_transparent\fR Like transparent, but ignores local data and resolves normally. .TP 10 \h'5'\fIalways_refuse\fR Like refuse, but ignores local data and refuses the query. .TP 10 \h'5'\fIalways_nxdomain\fR Like static, but ignores local data and returns nxdomain for the query. .TP 10 \h'5'\fInodefault\fR d948 2 a949 2 also turn off default contents for the zone. The 'nodefault' option has no other effect than turning off default contents for the d953 7 a959 7 The default zones are localhost, reverse 127.0.0.1 and ::1, the onion, test, invalid and the AS112 zones. The AS112 zones are reverse DNS zones for private use and reserved IP addresses for which the servers on the internet cannot provide correct answers. They are configured by default to give nxdomain (no reverse information) answers. The defaults can be turned off by specifying your own local\-zone of that name, or using the 'nodefault' type. Below is a list of the default zone contents. d961 1 a961 1 \h'5'\fIlocalhost\fR d965 1 a965 1 local\-zone: "localhost." redirect d967 1 a967 1 local\-data: "localhost. 10800 IN d973 1 a973 1 \h'5'\fIreverse IPv4 loopback\fR d978 1 a978 1 local\-data: "127.in\-addr.arpa. 10800 IN d980 1 a980 1 local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN d984 1 a984 1 \h'5'\fIreverse IPv6 loopback\fR d990 1 a990 1 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN d993 1 a993 1 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN d996 1 a996 1 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN d1000 1 a1000 1 \h'5'\fIonion (RFC 7686)\fR d1005 1 a1005 1 local\-data: "onion. 10800 IN d1009 2 a1010 20 \h'5'\fItest (RFC 7686)\fR Default content: .nf local\-zone: "test." static local\-data: "test. 10800 IN NS localhost." local\-data: "test. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" .fi .TP 10 \h'5'\fIinvalid (RFC 7686)\fR Default content: .nf local\-zone: "invalid." static local\-data: "invalid. 10800 IN NS localhost." local\-data: "invalid. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" .fi .TP 10 \h'5'\fIreverse RFC1918 local use zones\fR Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to d1012 1 a1012 1 The \fBlocal\-zone:\fR is set static and as \fBlocal\-data:\fR SOA and NS d1015 2 a1016 2 \h'5'\fIreverse RFC3330 IP4 this, link\-local, testnet and broadcast\fR Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa, d1022 1 a1022 1 Reverse data for zone d1047 1 a1047 1 The query has to match exactly unless you configure the local\-zone as d1050 2 a1051 2 a local\-zone, a transparent local\-zone is configured. For record types such as TXT, use single quotes, as in a1062 12 .B local\-zone\-tag: \fI <"list of tags"> Assign tags to localzones. Tagged localzones will only be applied when the used access-control element has a matching tag. Tags must be defined in \fIdefine\-tags\fR. Enclose list of tags in quotes ("") and put spaces between tags. .TP 5 .B local\-zone\-override: \fI Override the localzone type for queries from addresses matching netblock. Use this localzone type, regardless the type configured for the local-zone (both tagged and untagged) and regardless the type configured using access\-control\-tag\-action. .TP 5 d1095 1 a1095 1 .B ratelimit\-for\-domain: \fI a1098 1 A value of 0 will disable ratelimiting for that domain. d1100 1 a1100 1 .B ratelimit\-below\-domain: \fI a1106 29 A value of 0 will disable ratelimiting for domain names that end in this name. .TP 5 .B ip\-ratelimit: \fI Enable global ratelimiting of queries accepted per ip address. If 0, the default, it is disabled. This option is experimental at this time. The ratelimit is in queries per second that are allowed. More queries are completely dropped and will not receive a reply, SERVFAIL or otherwise. IP ratelimiting happens before looking in the cache. This may be useful for mitigating amplification attacks. .TP 5 .B ip\-ratelimit\-size: \fI Give the size of the data structure in which the current ongoing rates are kept track in. Default 4m. In bytes or use m(mega), k(kilo), g(giga). The ip ratelimit structure is small, so this data structure likely does not need to be large. .TP 5 .B ip\-ratelimit\-slabs: \fI Give power of 2 number of slabs, this is used to reduce lock contention in the ip ratelimit tracking data structure. Close to the number of cpus is a fairly good setting. .TP 5 .B ip\-ratelimit\-factor: \fI Set the amount of queries to rate limit when the limit is exceeded. If set to 0, all queries are dropped for addresses where the limit is exceeded. If set to another value, 1 in that number is allowed through to complete. Default is 10, allowing 1/10 traffic to flow normally. This can make ordinary queries complete (if repeatedly queried for), and enter the cache, whilst also mitigating the traffic flow by the factor given. d1174 3 a1176 3 This is useful for company\-local data or private zones. Setup an authoritative server on a different host (or different port). Enter a config entry for unbound with d1178 3 a1180 3 . The unbound resolver can then access the data, without referring to the public internet for it. d1182 1 a1182 1 This setup allows DNSSEC signed zones to be served by that d1184 5 a1188 5 can be put in config, so that unbound can validate the data and set the AD bit on replies for the private zone (authoritative servers do not set the AD bit). This setup makes unbound capable of answering queries for the private zone, and can even set the AD bit ('authentic'), but the AA ('authoritative') bit is not set on these replies. d1207 2 a1208 2 This option is by default off. If enabled it performs NS set priming, which is similar to root hints, where it starts using the list of nameservers a1216 4 .TP .B stub\-ssl\-upstream: \fI Enabled or disable whether the queries to this stub use SSL for transport. Default is no. a1246 38 .TP .B forward\-ssl\-upstream: \fI Enabled or disable whether the queries to this forwarder use SSL for transport. Default is no. .SS "View Options" .LP There may be multiple .B view: clauses. Each with a \fBname:\fR and zero or more \fBlocal\-zone\fR and \fBlocal\-data\fR elements. View can be mapped to requests by specifying the view name in an \fBaccess\-control\-view\fR element. Options from matching views will override global options. Global options will be used if no matching view is found, or when the matching view does not have the option specified. .TP .B name: \fI Name of the view. Must be unique. This name is used in access\-control\-view elements. .TP .B local\-zone: \fI View specific local\-zone elements. Has the same types and behaviour as the global local\-zone elements. When there is at least one local\-zone specified and view\-first is no, the default local-zones will be added to this view. Defaults can be disabled using the nodefault type. When view\-first is yes or when a view does not have a local\-zone, the global local\-zone will be used including it's default zones. .TP .B local\-data: \fI"" View specific local\-data elements. Has the same behaviour as the global local\-data elements. .TP .B local\-data\-ptr: \fI"IPaddr name" View specific local\-data\-ptr elements. Has the same behaviour as the global local\-data\-ptr elements. .TP .B view\-first: \fI If enabled, it attempts to use the global local\-zone and local\-data if there is no match in the view specific options. The default is no. a1255 6 .LP If the \fBchroot:\fR option is enabled, you should make sure Python's library directory structure is bind mounted in the new root environment, see \fImount\fR(8). Also the \fBpython\-script:\fR path should be specified as an absolute path relative to the new root, or as a relative path to the working directory. d1258 1 a1258 1 The script file to load. a1271 199 .SS "DNSCrypt Options" .LP The .B dnscrypt: clause gives the settings of the dnscrypt channel. While those options are available, they are only meaningful if unbound was compiled with \fB\-\-enable\-dnscrypt\fR. Currently certificate and secret/public keys cannot be generated by unbound. You can use dnscrypt-wrapper to generate those: https://github.com/cofyc/\ dnscrypt-wrapper/blob/master/README.md#usage .TP .B dnscrypt\-enable: \fI\fR Whether or not the \fBdnscrypt\fR config should be enabled. You may define configuration but not activate it. The default is no. .TP .B dnscrypt\-port: \fI On which port should \fBdnscrypt\fR should be activated. Note that you should have a matching \fBinterface\fR option defined in the \fBserver\fR section for this port. .TP .B dnscrypt\-provider: \fI\fR The provider name to use to distribute certificates. This is of the form: \fB2.dnscrypt-cert.example.com.\fR. The name \fIMUST\fR end with a dot. .TP .B dnscrypt\-secret\-key: \fI\fR Path to the time limited secret key file. This option may be specified multiple times. .TP .B dnscrypt\-provider\-cert: \fI\fR Path to the certificate related to the \fBdnscrypt\-secret\-key\fRs. This option may be specified multiple times. .TP .B dnscrypt\-shared\-secret\-cache\-size: \fI Give the size of the data structure in which the shared secret keys are kept in. Default 4m. In bytes or use m(mega), k(kilo), g(giga). The shared secret cache is used when a same client is making multiple queries using the same public key. It saves a substantial amount of CPU. .TP .B dnscrypt\-shared\-secret\-cache\-slabs: \fI Give power of 2 number of slabs, this is used to reduce lock contention in the dnscrypt shared secrets cache. Close to the number of cpus is a fairly good setting. .TP .B dnscrypt\-nonce\-cache\-size: \fI Give the size of the data structure in which the client nonces are kept in. Default 4m. In bytes or use m(mega), k(kilo), g(giga). The nonce cache is used to prevent dnscrypt message replaying. Client nonce should be unique for any pair of client pk/server sk. .TP .B dnscrypt\-nonce\-cache\-slabs: \fI Give power of 2 number of slabs, this is used to reduce lock contention in the dnscrypt nonce cache. Close to the number of cpus is a fairly good setting. .SS "EDNS Client Subnet Module Options" .LP The ECS module must be configured in the \fBmodule\-config:\fR "subnetcache validator iterator" directive and be compiled into the daemon to be enabled. These settings go in the \fBserver:\fR section. .LP If the destination address is whitelisted with Unbound will add the EDNS0 option to the query containing the relevant part of the client's address. When an answer contains the ECS option the response and the option are placed in a specialized cache. If the authority indicated no support, the response is stored in the regular cache. .LP Additionally, when a client includes the option in its queries, Unbound will forward the option to the authority if present in the whitelist, or \fBclient\-subnet\-always\-forward\fR is set to yes. In this case the lookup in the regular cache is skipped. .LP The maximum size of the ECS cache is controlled by 'msg-cache-size' in the configuration file. On top of that, for each query only 100 different subnets are allowed to be stored for each address family. Exceeding that number, older entries will be purged from cache. .TP .B send\-client\-subnet: \fI\fR Send client source address to this authority. Append /num to indicate a classless delegation netblock, for example like 10.2.3.4/24 or 2001::11/64. Can be given multiple times. Authorities not listed will not receive edns-subnet information, unless domain in query is specified in \fBclient\-subnet\-zone\fR. .TP .B client\-subnet\-zone: \fI\fR Send client source address in queries for this domain and its subdomains. Can be given multiple times. Zones not listed will not receive edns-subnet information, unless hosted by authority specified in \fBsend\-client\-subnet\fR. .TP .B client\-subnet\-always\-forward: \fI\fR Specify whether the ECS whitelist check (configured using \fBsend\-client\-subnet\fR) is applied for all queries, even if the triggering query contains an ECS record, or only for queries for which the ECS record is generated using the querier address (and therefore did not contain ECS data in the client query). If enabled, the whitelist check is skipped when the client query contains an ECS record. Default is no. .TP .B max\-client\-subnet\-ipv6: \fI\fR Specifies the maximum prefix length of the client source address we are willing to expose to third parties for IPv6. Defaults to 56. .TP .B max\-client\-subnet\-ipv4: \fI\fR Specifies the maximum prefix length of the client source address we are willing to expose to third parties for IPv4. Defaults to 24. .SS "Opportunistic IPsec Support Module Options" .LP The IPsec module must be configured in the \fBmodule\-config:\fR "ipsecmod validator iterator" directive and be compiled into the daemon to be enabled. These settings go in the \fBserver:\fR section. .LP When unbound receives an A/AAAA query that is not in the cache and finds a valid answer, it will withhold returning the answer and instead will generate an IPSECKEY subquery for the same domain name. If an answer was found, unbound will call an external hook passing the following arguments: .TP 10 \h'5'\fIQNAME\fR Domain name of the A/AAAA and IPSECKEY query. In string format. .TP 10 \h'5'\fIIPSECKEY TTL\fR TTL of the IPSECKEY RRset. .TP 10 \h'5'\fIA/AAAA\fR String of space separated IP addresses present in the A/AAAA RRset. The IP addresses are in string format. .TP 10 \h'5'\fIIPSECKEY\fR String of space separated IPSECKEY RDATA present in the IPSECKEY RRset. The IPSECKEY RDATA are in DNS presentation format. .LP The A/AAAA answer is then cached and returned to the client. If the external hook was called the TTL changes to ensure it doesn't surpass \fBipsecmod-max-ttl\fR. .LP The same procedure is also followed when \fBprefetch:\fR is used, but the A/AAAA answer is given to the client before the hook is called. \fBipsecmod-max-ttl\fR ensures that the A/AAAA answer given from cache is still relevant for opportunistic IPsec. .TP .B ipsecmod-enabled: \fI\fR Specifies whether the IPsec module is enabled or not. The IPsec module still needs to be defined in the \fBmodule\-config:\fR directive. This option facilitates turning on/off the module without restarting/reloading unbound. Defaults to yes. .TP .B ipsecmod\-hook: \fI\fR Specifies the external hook that unbound will call with \fIsystem\fR(3). The file can be specified as an absolute/relative path. The file needs the proper permissions to be able to be executed by the same user that runs unbound. It must be present when the IPsec module is defined in the \fBmodule\-config:\fR directive. .TP .B ipsecmod-strict: \fI\fR If enabled unbound requires the external hook to return a success value of 0. Failing to do so unbound will reply with SERVFAIL. The A/AAAA answer will also not be cached. Defaults to no. .TP .B ipsecmod\-max-ttl: \fI\fR Time to live maximum for A/AAAA cached records after calling the external hook. Defaults to 3600. .TP .B ipsecmod-ignore-bogus: \fI\fR Specifies the behaviour of unbound when the IPSECKEY answer is bogus. If set to yes, the hook will be called and the A/AAAA answer will be returned to the client. If set to no, the hook will not be called and the answer to the A/AAAA query will be SERVFAIL. Mainly used for testing. Defaults to no. .TP .B ipsecmod\-whitelist: \fI\fR Whitelist the domain so that the module logic will be executed. Can be given multiple times, for different domains. If the option is not specified, all domains are treated as being whitelisted (default). .SS "Cache DB Module Options" .LP The Cache DB module must be configured in the \fBmodule\-config:\fR "validator cachedb iterator" directive and be compiled into the daemon with \fB\-\-enable\-cachedb\fR. If this module is enabled and configured, the specified backend database works as a second level cache: When Unbound cannot find an answer to a query in its built-in in-memory cache, it consults the specified backend. If it finds a valid answer in the backend, Unbound uses it to respond to the query without performing iterative DNS resolution. If Unbound cannot even find an answer in the backend, it resolves the query as usual, and stores the answer in the backend. The .B cachedb: clause gives custom settings of the cache DB module. .TP .B backend: \fI\fR Specify the backend database name. Currently, only the in-memory "testframe" backend is supported. As the name suggests this backend is not of any practical use. This option defaults to "testframe". .TP .B secret-seed: \fI<"secret string">\fR Specify a seed to calculate a hash value from query information. This value will be used as the key of the corresponding answer for the backend database and can be customized if the hash should not be predictable operationally. If the backend database is shared by multiple Unbound instances, all instances must use the same secret seed. This option defaults to "default". d1279 1 a1279 1 which on BSD\-32bit tops out at 30\-40 Mb after heavy usage. d1320 2 a1321 2 unbound log file. default is to log to \fIsyslog\fR(3). d1323 1 a1323 1 \fIunbound\fR(8), d1326 1 a1326 1 .B Unbound @ 1.1.1.2 log @Unbound 1.6.8 Download: unbound-1.6.8.tar.gz SHA1 checksum: 492737be9647c26ee39d4d198f2755062803b412 SHA256 checksum: e3b428e33f56a45417107448418865fe08d58e0e7fea199b855515f60884dd49 PGP signature: unbound-1.6.8.tar.gz.asc Date: 19 Jan, 2018 Bug Fixes Fix for CVE-2017-15105: vulnerability in the processing of wildcard synthesized NSEC records. Older versions Unbound 1.6.7 Download: unbound-1.6.7.tar.gz SHA1 checksum: 098f8acfc3e9d1cab54f07863e61eabbb67c80dc SHA256 checksum: 4e7bd43d827004c6d51bef73adf941798e4588bdb40de5e79d89034d69751c9f PGP signature: unbound-1.6.7.tar.gz.asc Date: 10 Oct, 2017 Features Set trust-anchor-signaling default to yes #1440: [dnscrypt] client nonce cache. #1435: Allow UDP to be disabled separately upstream and downstream. Bug Fixes Fix that looping modules always stop the query, and don't pass control. Fix unbound-host to report error for DNSSEC state of failed lookups. Spelling fixes, from Josh Soref. Fix #1400: allowing use of global cache on ECS-forwarding unless always-forward. use a cachedb answer even if it's "expired" when serve-expired is yes (patch from Jinmei Tatuya). trigger refetching of the answer in that case (this will bypass cachedb lookup) allow storing a 0-TTL answer from cachedb in the in-memory message cache when serve-expired is yes Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff. Log name of looping module Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch (by Danilo G. Baio). Fix param unused warning for windows exportsymbol compile. Use RCODE from A query on DNS64 synthesized answer. Fix trust-anchor-signaling works in libunbound. Fix spelling in unbound-control man page. Unbound 1.6.6 Download: unbound-1.6.6.tar.gz SHA1 checksum: d205c03a402f5d900d5bad3d036849a12804a49e SHA256 checksum: 972b14dc33093e672652a7b2b5f159bab2198b0fe9c9e1c5707e1895d4d4b390 PGP signature: unbound-1.6.6.tar.gz.asc Date: 18 Sep, 2017 Features unbound-control dump_infra prints port number for address if not 53. Fix #1344: RFC6761-reserved domains: test. and invalid. Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor). With the -p option unbound does not create a pidfile. Added stats for queries that have been ratelimited by domain recursion. Patch to show DNSCrypt status in help output, from Carsten Strotmann. Fix #1407: Add ECS options check to unbound-checkconf. Fix #1415: [dnscrypt] shared secret cache, patch from Manu Bretelle. Bug Fixes fixup of dnscrypt_cert_chacha test (from Manu Bretelle). First fix for zero b64 and hex text zone format in sldns. Better fixup of dnscrypt_cert_chacha test for different escapes. Fix that infra cache host hash does not change after reconfig. Fix python example0 return module wait instead of error for pass. enhancement for hardened-tls for DNS over TLS. Removed duplicated security settings. Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned on. Fix #1331: libunbound segfault in threaded mode when context is deleted. Fix pythonmod link line option flag. Fix openssl 1.1.0 load of ssl error strings from ssl init. Fix 1332: Bump verbosity of failed chown'ing of the control socket. Redirect all localhost names to localhost address for RFC6761. Fix #1350: make cachedb backend configurable (from JINMEI Tatuya). Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg. upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02), config.sub(2016-09-05). annotate case statement fallthrough for gcc 7.1.1. flex output from flex 2.6.1. snprintf of thread number does not warn about truncated string. squelch TCP fast open error on FreeBSD when kernel has it disabled, unless verbosity is high. remove warning from windows compile. Fix compile with libnettle Fix DSA configure switch (--disable dsa) for libnettle and libnss. Fix #1365: Add Ed25519 support using libnettle. Fix #1394: mix of serve-expired and response-ip could cause a crash. Remove unused iter_env member (ip6arpa_dname) Do not reset rrset.bogus stats when called using stats_noreset. Do not add rrset_bogus and query ratelimiting stats per thread, these module stats are global. Fix #1397: Recursive DS lookups for AS112 zones names should recurse. Fix #1398: make cachedb secret configurable. Remove spaces from Makefile. Fix issue on macOX 10.10 where TCP fast open is detected but not implemented causing TCP to fail. The fix allows fallback to regular TCP in this case and is also more robust for cases where connectx() fails for some reason. Fix #1402: squelch invalid argument error for fd_set_block on windows. Fix to reclaim tcp handler when it is closed due to dnscrypt buffer allocation failure. Fix #1415: patch to free dnscrypt environment on reload. iana portlist update Small fixes for the shared secret cache patch. Fix WKS records on kvm autobuild host, with default protobyname entries for udp and tcp. Fix #1414: fix segfault on parse failure and log_replies. zero qinfo in handle_request, this zeroes local_alias and also the qname member. new keys and certs for dnscrypt tests. fixup WKS test on buildhost without servicebyname. updated contrib/fastrpz.patch to apply with configparser changes. Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs. Fix #1424: cachedb:testframe is not thread safe. Fix #1417: [dnscrypt] shared secret cache counters, and works when dnscrypt is not enabled. And cache size configuration option. Fix #1418: [ip ratelimit] initialize slabhash using ip-ratelimit-slabs. Recommend 1472 buffer size in unbound.conf Fix #1412: QNAME minimisation strict mode not honored Fix #1434: Fix windows openssl 1.1.0 linking. Add dns64 for client-subnet in unbound-checkconf. Unbound 1.6.5 Download: unbound-1.6.5.tar.gz SHA1 checksum: ecb260b94d139d84fae2bff80f9701f53a329e26 SHA256 checksum: e297aa1229015f25bf24e4923cb1dadf1f29b84f82a353205006421f82cc104e PGP signature: unbound-1.6.5.tar.gz.asc Date: 21 Aug, 2017 Bug Fixes Fix install of trust anchor when two anchors are present, makes both valid. Checks hash of DS but not signature of new key. This fixes the root.key file if created when unbound is installed between sep11 and oct11 2017. Unbound 1.6.4 Download: unbound-1.6.4.tar.gz SHA1 checksum: 836ecc48518b9159f600a738c276423ef1f95021 SHA256 checksum: df0a88816ec31ccb8284c9eb132e1166fbf6d9cde71fbc4b8cd08a91ee777fed PGP signature: unbound-1.6.4.tar.gz.asc Date: 27 Jun, 2017 Features Implemented trust anchor signaling using key tag query. unbound-checkconf -o allows query of dnstap config variables. Also unbound-control get_option. Also for dnscrypt. unbound.h exports the shm stats structures. They use type long long and no ifdefs, and ub_ before the typenames. Implemented opportunistic IPsec support module (ipsecmod). Added redirect-bogus.patch to contrib directory. Support for the ED25519 algorithm with openssl (from openssl 1.1.1). renumbering B-Root's IPv6 address to 2001:500:200::b. Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher. Fix #1277: disable domain ratelimit by setting value to 0. Added fastrpz patch to contrib Bug Fixes Added ECS unit test (from Manu Bretelle). ECS documentation fix (from Manu Bretelle). Fix #1252: more indentation inconsistencies. Fix #1253: unused variable in edns-subnet/addrtree.c:getbit(). Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle). iana portlist update Based on #1257: check parse limit before t increment in sldns RR string parse routine. Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start. and fix that 64bit getting installed in C:\Program Files (x86). Fix #1259: "--disable-ecdsa" argument overwritten by "#ifdef SHA256_DIGEST_LENGTH@@daemon/remote.c". iana portlist update Added test for leak of stub information. Fix sldns wire2str printout of RR type CAA tags. Fix sldns int16_data parse. Fix sldns parse and printout of TSIG RRs. sldns SMIMEA and AVC definitions, same as getdns definitions. Fix tcp-mss failure printout text. Set SO_REUSEADDR on outgoing tcp connections to fix the bind before connect limited tcp connections. With the option tcp connections can share the same source port (for different destinations). Add 'c' to getopt() in testbound. Adjust servfail by iterator to not store in cache when serve-expired is enabled, to avoid overwriting useful information there. Fix queries for nameservers under a stub leaking to the internet. document trust-anchor-signaling in example config file. updated configure, dependencies and flex output. better module memory lookup, fix of unbound-control shm names for module memory printout of statistics. Fix type AVC sldns rrdef. Some whitespace fixup. Fix #1265: contrib/unbound.service contains hardcoded path. Fix #1265 to use /bin/kill. Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs, and compatibility with BoringSSL. Fix #1268: SIGSEGV after log_reopen. exec_prefix is by default equal to prefix. printout localzone for duplicate local-zone warnings. Fix assertion for low buffer size and big edns payload when worker overrides udpsize. Support for openssl EVP_DigestVerify. Fix #1269: inconsistent use of built-in local zones with views. Add defaults for new local-zone trees added to views using unbound-control. Fix #1273: cachedb.c doesn't compile with -Wextra. If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write. Also use global local-zones when there is a matching view that does not have any local-zone specified. Fix fastopen EPIPE fallthrough to perform connect. Fix #1274: automatically trim chroot path from dnscrypt key/cert paths (from Manu Bretelle). Fix #1275: cached data in cachedb is never used. Fix that unbound-control can set val_clean_additional and val_permissive_mode. Add dnscrypt XChaCha20 tests. Detect chacha for dnscrypt at configure time. dnscrypt unit tests with chacha. Added domain name based ECS whitelist. Fix #1278: Incomplete wildcard proof. Fix #1279: Memory leak on reload when python module is enabled. Fix #1280: Unbound fails assert when response from authoritative contains malformed qname. When 0x20 caps-for-id is enabled, when assertions are not enabled the malformed qname is handled correctly. More fixes in depth for buffer checks in 0x20 qname checks. Fix stub zone queries leaking to the internet for harden-referral-path ns checks. Fix query for refetch_glue of stub leaking to internet. Fix #1301: memory leak in respip and tests. Free callback in edns-subnetmod on exit and restart. Fix memory leak in sldns_buffer_new_frm_data. Fix memory leak in dnscrypt config read. Fix dnscrypt chacha cert support ifdefs. Fix dnscrypt chacha cert unit test escapes in grep. Fix to unlock view in view test. Fix warning in pythonmod under clang compiler. Fix lintian typo. Fix #1316: heap read buffer overflow in parse_edns_options. Unbound 1.6.3 Download: unbound-1.6.3.tar.gz SHA1 checksum: 4477627c31e8728058565f3bae3a12a1544d8a9c SHA256 checksum: 4c7e655c1d0d2d133fdeb81bc1ab3aa5c155700f66c9f5fb53fa6a5c3ea9845f PGP signature: unbound-1.6.3.tar.gz.asc Date: 13 Jun, 2017 Bug Fixes Fix #1280: Unbound fails assert when response from authoritative contains malformed qname. When 0x20 caps-for-id is enabled, when assertions are not enabled the malformed qname is handled correctly. Unbound 1.6.2 Download: unbound-1.6.2.tar.gz SHA1 checksum: de370b1ac8e260db9c4c1504453752713dd8818f SHA256 checksum: 1a323d72c32180b7141c9e6ebf199fc68a0208dfebad4640cd2c4c27235e3b9c PGP signature: unbound-1.6.2.tar.gz.asc Date: 24 Apr, 2017 Features Add trustanchor.unbound CH TXT that gets a response with a number of TXT RRs with a string like "example.com. 2345 1234" with the trust anchors and their keytags. Patch for view functionality for local-data-ptr from Björn Ketelaars. Response actions based on IP address from Jinmei Tatuya (Infoblox). Patch from Luiz Fernando Softov for Stats Shared Memory. unbound-control stats_shm command prints stats using shared memory, which uses less cpu. --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and DS records. NSEC3 is not disabled. #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then enabled in the config file from Manu Bretelle. Merge EDNS Client subnet implementation from feature branch into main branch, using new EDNS processing framework. harden-algo-downgrade: no also makes unbound more lenient about digest algorithms in DS records. Bug Fixes sldns has ED25519 and ED448 algorithm number and name for display. sldns updated for vfixed and buffer resize indication from getdns. iana portlist update Fix #1224: Fix that defaults should not fall back to "Program Files (x86) if Unbound is 64bit by default on windows. Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to redirect. make depend, autoconf, doxygen and lint fixed up. include sys/time.h for new shm code on NetBSD. Fix #1227: Fix that Unbound control allows weak ciphersuits. Fix #1226: provide official 32bit binary for windows. For #1227: if we have sha256, set the cipher list to have no known vulns. Fix testpkts.c, check if DO bit is set, not only if there is an OPT record. Fix #1229: Systemd service sandboxing in contrib/unbound.service. Fix #1230: swig version 2.0.1 is required for pythonmod, with 1.3.40 it crashes when running repeatly unbound-control reload. fix enum conversion warnings fake-sha1 test option; print warning if used. To make unit tests. unbound-control list local zone and data commands listed in the help output. Fix #1234: shortening DNAME loop produces duplicate DNAME records in ANSWER section. testbound understands Deckard MATCH rcode question answer commands. Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead of YXDOMAIN + query loop, reported by Petr Spacek. Fix that SHM is not inited if not enabled. Fix that looped DNAMEs do not cause unbound to spend effort. trustanchor tags are sorted. reusable routine to fetch taglist. Fix #1237 - Wrong resolving in chain, for norec queries that get SERVFAIL returned. make depend, autoconf, remove warnings about statement before var. lru_demote and lruhash_insert_or_retrieve functions for getdns. fixup for lruhash (whitespace and header file comment). dnscrypt tests. Fix doxygen for dnscrypt files. Fix #1238: segmentation fault when adding through the remote interface a per-view local zone to a view with no previous (configured) local zones. Fix #1229: Systemd service sandboxing, options in wrong sections. Fix #1239: configure fails to find python distutils if python prints warning. Fix to prevent non-referal query from being cached as referal when the no_cache_store flag was set. Remove (now unused) event2 include from dnscrypt code. Fix #1217: Add metrics to unbound-control interface showing crypted, cert request, plaintext and malformed queries (from Manu Bretelle). Do not add current time twice to TTL before ECS cache store. Do not touch rrset cache after ECS cache message generation. Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode. Fix #1244: document that use of chroot requires trust anchor file to be under chroot. Small fixup for documentation. Fix respip for braces when locks arent used. Fix pythonmod for cb changes. Generalise inplace callback (de)registration (de)register inplace callbacks for module id No unbound-control set_option for ECS options Deprecated client-subnet-opcode config option Introduced client-subnet-always-forward config option Changed max-client-subnet-ipv6 default to 56 (as in RFC) Removed extern ECS config options module_restart_next now calls clear on all following modules Also create ECS module qstate on module_event_pass event remove malloc from inplace_cb_register Unlock view in respip unit test Some whitespace fixup. Remove ECS option after REFUSED answer. Fix small memory leak in edns_opt_copy_alloc. Respip dereference after NULL check. Zero initialize addrtree allocation. Use correct identifier for SHM destroy. Display ECS module memory usage. Fix #1247: unbound does not shorten source prefix length when forwarding ECS. Properly check for allocation failure in local_data_find_tag_datas. Fix #1249: unbound doesn't return FORMERR to bogus ECS. Set SHM ECS memory usage to 0 when module not loaded. subnet mem value is available in shm, also when not enabled, to make the struct easier to memmap by other applications, independent of the configuration of unbound. Fix #1250: inconsistent indentation in services/listen_dnsport.c. Unbound 1.6.1 Download: unbound-1.6.1.tar.gz SHA1 checksum: 41369fcfd37844b02b7293b37ec78e69f0db34c7 SHA256 checksum: 42df63f743c0fe8424aeafcf003ad4b880b46c14149d696057313f5c1ef51400 PGP signature: unbound-1.6.1.tar.gz.asc Date: 21 Feb, 2017 Features configure --enable-systemd and lets unbound use systemd sockets if you enable use-systemd: yes in unbound.conf. Also there are contrib/unbound.socket and contrib/unbound.service: systemd files for unbound, install them in /usr/lib/systemd/system. Contributed by Sami Kerola and Pavel Odintsov. [bugzilla: 1187 ] Source IP rate limiting, patch from Larissa Feng. [bugzilla: 1184 ] Log DNS replies. This includes the same logging information that DNS queries and response code and response size, patch from Larissa Feng. Include root trust anchor id 20326 in unbound-anchor. 64bit is default for windows builds. Bug Fixes [bugzilla: 1176 ] Fix stack size too small for Alpine Linux. Fix unbound-control and ipv6 only. [bugzilla: 1182 ] Fix Resource leak (socket), at startup. [bugzilla: 1178 ] Fix attempt to fix setup error at end, pop result values at end of install. iana portlist update Fix inet_ntop and inet_pton warnings in windows compile. [bugzilla: 1191 ] Fix remove comment about view deletion. [bugzilla: 1188 ] Fix unresolved symbol 'fake_dsa' in libunbound.so when built with Nettle [bugzilla: 1190 ] Fix to not echo back EDNS options in local-zone error response. [bugzilla: 1194 ] Fix if cross build fails when $host isn't `uname` for getentropy. Fix reload chdir failure when also chrooted to that directory. Fix to return formerr for queries for meta-types, to avoid packet amplification if this meta-type is sent on to upstream. [bugzilla: 1201 ] Fix missing unlock in answer_from_cache error condition. [bugzilla: 1202 ] Fix code comment that packed_rrset_data is not always 'packed'. Fix to also block meta types 128 through to 248 with formerr. [bugzilla: 1206 ] Fix that some view-related commands are missing from 'unbound-control -h' Fix to rename ub_callback_t to ub_callback_type, because POSIX reserves _t typedefs. Fix to rename internally used types from _t to _type, because _t type names are reserved by POSIX. Increase MAX_MODULE to 16. [bugzilla: 1211 ] Fix can't enable interface-automatic if no IPv6 with more helpful error message. fix root_anchor test for updated icannbundle.pem lower certificates. Fix compile on solaris of the fix to use $host detect. Fix for type name change and fix warning on windows compile. Fix pythonmod for typedef changes. Fix dnstap for warning of set but not used. Fix autoconf of systemd check for lack of pkg-config. Unbound 1.6.0 Download: unbound-1.6.0.tar.gz SHA1 checksum: 9b7606b016b447dc837efc108cee94f3fecf4ede SHA256 checksum: 6b7db874e6debda742fee8869d722e5a17faf1086e93c911b8564532aeeffab7 PGP signature: unbound-1.6.0.tar.gz.asc Date: 15 Dec, 2016 Features Added generic EDNS code for registering known EDNS option codes, bypassing the cache response stage and uniquifying mesh states. Four EDNS option lists were added to module_qstate (module_qstate.edns_opts_*) to store EDNS options from/to front/back side. Added two flags to module_qstate (no_cache_lookup, no_cache_store) that control the modules' cache interactions. Added code for registering inplace callback functions. The registered functions can be called just before replying with local data or Chaos, replying from cache, replying with SERVFAIL, replying with a resolved query, sending a query to a nameserver. The functions can inspect the available data and maybe change response/query related data (i.e. append EDNS options). Updated Python module for the above. Updated Python documentation. Added views functionality. Added qname-minimisation-strict config option. Patch that resolves CNAMEs entered in local-data conf statements that point to data on the internet, from Jinmei Tatuya (Infoblox). serve-expired config option: serve expired responses with TTL 0. .gitattributes line for githubs code language display. log-identity: config option to set sys log identity, patch from "Robin H. Johnson" (robbat2@@gentoo.org). Added stub-ssl-upstream and forward-ssl-upstream options. Added local-zones and local-data bulk addition and removal functionality in unbound-control (local_zones, local_zones_remove, local_datas and local_datas_remove). Bug Fixes Fix #836: unbound could echo back EDNS options in an error response. Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX. Fix #839: Memory grows unexpectedly with large RPZ files. Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile. Fix #841: big local-zone's make it consume large amounts of memory. Fix dnstap relaying "random" messages instead of resolver/forwarder responses, from Nikolay Edigaryev. Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav. Fix #1117: spelling errors, from Robert Edmonds. iana portlist update. fix memoryleak logfile when in debug mode. Re-fix #839 from view commit overwrite. Fixup const void cast warning. Removed patch comments from acllist.c and msgencode.c Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf, from Jinmei Tatuya (Infoblox). Fix #1125: unbound could reuse an answer packet incorrectly for clients with different EDNS parameters, from Jinmei Tatuya. Fix #1118: libunbound.pc sets strange Libs, Libs.private values. Added Requires line to libunbound.pc Fix #1130: whitespace in example.conf.in more consistent. suppress compile warning in lex files. init lzt variable, for older gcc compiler warnings. fix --enable-dsa to work, instead of copying ecdsa enable. Fix DNSSEC validation of query type ANY with DNAME answers. Fixup query_info local_alias init. Ported tests for local_cname unit test to testbound framework. g.root-servers.net has AAAA address. Fix #1134: unbound-control set_option -- val-override-date: -1 works immediately to ignore datetime, or back to 0 to enable it again. The -- is to ignore the '-1' as an option flag. Patch for server.num.zero_ttl stats for count of expired replies, from Pavel Odintsov. Fix failure to build on arm64 with no sbrk. Set OpenSSL security level to 0 when using aNULL ciphers. configure detects ssl security level API function in the autoconf manner. Every function on its own, so that other libraries (eg. LibreSSL) can develop their API without hindrance. Fix #1154: segfault when reading config with duplicate zones. Note that for harden-below-nxdomain the nxdomain must be secure, this means nsec3 with optout is insufficient. Fix #1155: test status code of unbound-control in 04-checkconf, not the status code from the tee command. Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing Underneath" for the harden-below-nxdomain option. patch from Dag-Erling Smorgrav that removes code that relies on sbrk(). Make access-control-tag-data RDATA absolute. This makes the RDATA origin consistent between local-data and access-control-tag-data. Fix NSEC ENT wildcard check. Matching wildcard does not have to be a subdomain of the NSEC owner. QNAME minimisation uses QTYPE=A, therefore always check cache for this type in harden-below-nxdomain functionality. Added unit test for QNAME minimisation + harden below nxdomain synergy. Fix that with openssl 1.1 control-use-cert: no uses less cpu, by using no encryption over the unix socket. hyphen as minus fix, by Andreas Schulze Fix #1170: document that 'inform' local-zone uses local-data. Fix #1173: differ local-zone type deny from unset tag_actions element. Add DSA support for OpenSSL 1.1.0 Fix remote control without cert for LibreSSL Fix downcast warnings from visual studio in sldns code. Unbound 1.5.10 Download: unbound-1.5.10.tar.gz SHA1 checksum: 6102849c400db3a4195b1f16df8f312568a6ec57 SHA256 checksum: a39b8b4fcca2a2b35a2daa53fe35150cc3f09038dc9acede09c912fc248a9486 PGP signature: unbound-1.5.10.tar.gz.asc Date: 27 Sep, 2016 Features Create a pkg-config file for libunbound in contrib. TCP Fast open patch from Sara Dickinson. Finegrained localzone control with define-tag, access-control-tag, access-control-tag-action, access-control-tag-data, local-zone-tag, and local-zone-override. And added types always_transparent, always_refuse, always_nxdomain with that. If more than half of tcp connections are in use, a shorter timeout is used (200 msec, vs 2 minutes) to pressure tcp for new connects. [bugzilla: 787 ] Fix #787: outgoing-interface netblock/64 ipv6 option to use linux freebind to use 64bits of entropy for every query with random local part. For #787: prefer-ip6 option for unbound.conf prefers to send upstream queries to ipv6 servers. Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e. keep debug symbols in windows build. Bug Fixes [bugzilla: 778 ] Fix unbound 1.5.9: -h segfault (null deref). Fix unbound-anchor.exe file location defaults to Program Files with (x86) appended. Fix to not ignore return value of chown() in daemon startup. Better help text from -h (from Ray Griffith). [bugzilla: 773 ] Fix Non-standard Python location build failure with pyunbound. Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures. Revert fix for NetworkService account on windows due to breakage it causes. Fix that windows install will not overwrite existing service.conf file (and ignore gui config choices if it exists). And delete service.conf.shipped on uninstall. In unbound.conf directory: dir immediately changes to that directory, so that include: file below that is relative to that directory. With chroot, make the directory an absolute path inside chroot. do not delete service.conf on windows uninstall. document directory immediate fix and allow EXECUTABLE syntax in it on windows. Fix directory: fix for unbound-checkconf, it restores cwd. Use QTYPE=A for QNAME minimisation. Keep track of number of time-outs when performing QNAME minimisation. Stop minimising when number of time-outs for a QNAME/QTYPE pair is more than three. [bugzilla: 775 ] Fix unbound-host and unbound-anchor crash on windows, ignore null delete for wsaevent. Fix spelling in freebind option man page text. Fix windows link of ssl with crypt32. [bugzilla: 779 ] Fix Union casting is non-portable. [bugzilla: 780 ] Fix MAP_ANON not defined in HP-UX 11.31. [bugzilla: 781 ] Fix prealloc() is an HP-UX system library call. Decrease dp attempts at each QNAME minimisation iteration [bugzilla: 784 ] Fix Build configure assumess that having getpwnam means there is endpwent function available. Updated repository with newer flex and bison output. Fix static compile on windows missing gdi32. Fix dynamic link of anchor-update.exe on windows. Fix detect of mingw for MXE package build. Fixes for 64bit windows compile. [bugzilla: 788 ] Fix for nettle 3.0: Failed to build with Nettle >= 3.0 and --with-libunbound-only --with-nettle. Fixed unbound.doxygen for 1.8.11. [bugzilla: 798 ] Fix Client-side TCP fast open fails (Linux). [bugzilla: 801 ] Fix missing error condition handling in daemon_create_workers(). [bugzilla: 802 ] Fix workaround for function parameters that are "unused" without log_assert. [bugzilla: 803 ] Fix confusing (and incorrect) code comment in daemon_cleanup(). [bugzilla: 806 ] Fix wrong comment removed. use sendmsg instead of sendto for TFO. [bugzilla: 807 ] Fix workaround for possible some "unused" function parameters in test code, from Jinmei Tatuya. Note that OPENPGPKEY type is RFC 7929. [bugzilla: 804 ] Fix #804: unbound stops responding after outage. Fixes queries that attempt to wait for an empty list of subqueries. Fix for #804: lower num_target_queries for iterator also for failed lookups. [bugzilla: 820 ] Fix set sldns_str2wire_rr_buf() dual meaning len parameter in each iteration in find_tag_datas(). [bugzilla: 777 ] Fix OpenSSL 1.1.0 compatibility, patch from Sebastian A. Siewior. RFC 7958 is now out, updated docs for unbound-anchor. Fix for compile without warnings with openssl 1.1.0. [bugzilla: 826 ] Fix refuse_non_local could result in a broken response. iana portlist update. Fix compile with openssl 1.1.0 with api=1.1.0. [bugzilla: 829 ] Fix doc of sldns_wire2str_rdata_buf() return value has an off-by-one typo, from Jinmei Tatuya (Infoblox). Fix incomplete prototypes reported by Dag-Erling Smørgrav. [bugzilla: 828 ] Fix missing type in access-control-tag-action redirect results in NXDOMAIN. Take configured minimum TTL into consideration when reducing TTL to original TTL from RRSIG. [bugzilla: 831 ] Fix workaround for spurious fread_chk warning against petal.c Silenced flex-generated sign-unsigned warning print with gcc diagnostic pragma. Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len. fix potential memory leak in daemon/remote.c and nullpointer dereference in validator/autotrust. [bugzilla: 883 ] Fix error for duplicate local zone entry. [bugzilla: 835 ] Fix --disable-dsa with nettle verify. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Jan 19, 2018" "NLnet Labs" "unbound 1.6.8" d19 1 a19 2 The file format has attributes and values. Some attributes have attributes inside them. d25 1 a25 1 The utility d33 1 a33 1 $ unbound \-c /etc/unbound/unbound.conf d65 2 a66 2 There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute is followed by its containing attributes, or a value. d74 2 a75 3 if the directory where the daemon is started equals its chroot/working directory or is specified before the include statement with directory: dir. Wildcards can be used to include multiple files, see \fIglob\fR(7). d82 1 a82 1 The verbosity number, level 0 means no verbosity, only errors. Level 1 d84 3 a86 3 information. Level 3 gives query level information, output per query. Level 4 gives algorithm level information. Level 5 logs client identification for cache misses. Default is level 1. d92 1 a92 1 are only printed if replies were sent during the statistics interval, d101 1 a101 1 If enabled, extended statistics are printed from \fIunbound\-control\fR(8). d114 1 a114 1 Can be given multiple times to work on several interfaces. If none are d125 1 a125 1 Detect source interface on UDP queries and copy them to replies. This d129 1 a129 1 .B outgoing\-interface: \fI d131 3 a133 3 queries to authoritative servers and receive their replies. Can be given multiple times to work on several interfaces. If none are given the default (all) is used. You can specify the same interfaces in d137 1 a137 1 lines, the interfaces are then used for both purposes. Outgoing queries are a138 16 .IP If an IPv6 netblock is specified instead of an individual IPv6 address, outgoing UDP queries will use a randomised source address taken from the netblock to counter spoofing. Requires the IPv6 netblock to be routed to the host running unbound, and requires OS support for unprivileged non-local binds (currently only supported on Linux). Several netblocks may be specified with multiple .B outgoing\-interface: options, but do not specify both an individual IPv6 address and an IPv6 netblock, or the randomisation will be compromised. Consider combining with .B prefer\-ip6: yes to increase the likelihood of IPv6 nameservers being selected for queries. On Linux you need these two commands to be able to use the freebind socket option to receive traffic for the ip6 netblock: ip \-6 addr add mynetblock/64 dev lo && ip \-6 route add local mynetblock/64 dev lo d141 2 a142 2 Number of ports to open. This number of file descriptors can be opened per thread. Must be at least 1. Default depends on compile options. Larger d144 1 a144 1 very large value is best, use libevent to make this possible. d149 1 a149 1 spoofing attempts. Make sure these ports are not needed by other daemons. d153 4 a156 4 The \fBoutgoing\-port\-permit\fR and \fBoutgoing\-port\-avoid\fR statements are processed in the line order of the config file, adding the permitted ports and subtracting the avoided ports from the set of allowed ports. The processing starts with the non IANA allocated ports above 1024 in the set d160 1 a160 1 Do not permit unbound to open this port or range of ports for use to send d182 1 a182 1 then a value of 1472 can fix it. Setting to 512 bypasses even the most d190 1 a190 1 Suggested values are 512 to 4096. Default is 4096. d196 1 a196 1 for DNS data, such as for huge resource records, will result in a SERVFAIL d206 1 a206 1 Must be set to a power of 2. Setting (close) to the number of cpus is a d218 1 a218 1 results in one roundtrip to the authority servers. If too many queries d220 2 a221 2 the other 50% are replaced with the new incoming query if they have already spent more than their allowed time. This protects against denial of d223 1 a223 1 The effect is that the qps for long-lasting queries is about d284 1 a284 1 interface or IP address is down. Exists only on Linux, where the similar d294 1 a294 1 Must be set to a power of 2. d297 3 a299 3 Time to live maximum for RRsets and messages in the cache. Default is 86400 seconds (1 day). If the maximum kicks in, responses to clients still get decrementing TTLs based on the original (larger) values. d309 1 a309 1 higher values, especially more than an hour or so, can lead to trouble as d317 1 a317 1 Time to live for entries in the host cache. The host cache contains d321 2 a322 2 Number of slabs in the infrastructure cache. Slabs reduce lock contention by threads. Must be set to a power of 2. a331 4 .B define\-tag: \fI<"list of tags"> Define the tags that can be used with local\-zone and access\-control. Enclose the list between quotes ("") and put spaces between tags. .TP a341 4 .B prefer\-ip6: \fI If enabled, prefer IPv6 transport for sending DNS queries to internet nameservers. Default is no. .TP d350 1 a350 1 to queries. Value lower than common MSS on Ethernet a367 5 .B udp\-upstream\-without\-downstream: \fI Enable udp upstream even if do-udp is no. Default is no, and this does not change anything. Useful for TLS service providers, that want no udp downstream but use udp to fetch data upstream. .TP d371 1 a371 2 TCP wireformat. The other server must support this (see \fBssl\-service\-key\fR). a390 4 .B use\-systemd: \fI Enable or disable systemd socket activation. Default is no. .TP d393 1 a393 2 a daemon. Set the value to \fIno\fR when unbound runs as systemd service. Default is yes. d396 2 a397 2 The netblock is given as an IP4 or IP6 address with /size appended for a classless network block. The action can be \fIdeny\fR, \fIrefuse\fR, d403 1 a403 1 The action \fIrefuse\fR stops queries too, but sends a DNS rcode REFUSED d406 2 a407 2 The action \fIallow\fR gives access to clients from that netblock. It gives only access for recursion clients (which is d410 1 a410 1 The \fIallow\fR action does allow nonrecursive queries to access the d412 3 a414 3 the unbound server recursive lookup algorithm, and static data is served in the reply. This supports normal operations where nonrecursive queries are made for the authoritative data. For nonrecursive queries any replies d417 2 a418 2 The action \fIallow_snoop\fR gives nonrecursive access too. This give both recursive and non recursive access. The name \fIallow_snoop\fR refers d420 2 a421 2 the cache contents (for malicious acts). However, nonrecursive queries can also be a valuable debugging tool (when you want to examine the cache d425 2 a426 2 The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS protocol is not designed to handle dropped packets due to policy, and a434 20 .B access\-control\-tag: \fI <"list of tags"> Assign tags to access-control elements. Clients using this access control element use localzones that are tagged with one of these tags. Tags must be defined in \fIdefine\-tags\fR. Enclose list of tags in quotes ("") and put spaces between tags. If access\-control\-tag is configured for a netblock that does not have an access\-control, an access\-control element with action \fIallow\fR is configured for this netblock. .TP .B access\-control\-tag\-action: \fI Set action for particular tag for given access control element. If you have multiple tag values, the tag used to lookup the action is the first tag match between access\-control\-tag and local\-zone\-tag where "first" comes from the order of the define-tag values. .TP .B access\-control\-tag\-data: \fI <"resource record string"> Set redirect data for particular tag for given access control element. .TP .B access\-control\-view: \fI Set view for given access control element. .TP d438 2 a439 2 chroot has been performed the now defunct portion of the config file path is removed to be able to reread the config after a reload. d450 1 a450 1 to chroot and dropping permissions. This allows the pidfile to be d456 1 a456 1 If given a chroot is done to the given directory. The default is d461 1 a461 1 "@@UNBOUND_USERNAME@@". If you give username: "" no user change is performed. d465 1 a465 1 If you change the port number in the config file, and that new port number a471 2 If you give a server: directory: dir before include: file statements then those includes can be relative to the working directory. d475 1 a475 1 The logfile is appended to, in the following format: d477 1 a477 1 [seconds since 1970] unbound[pid:tid]: type: message. d480 1 a480 1 The logfile is reopened (for append) when the config file is reread, on d484 2 a485 2 Sets unbound to send log messages to the syslogd, using \fIsyslog\fR(3). a489 7 .B log\-identity: \fI If "" is given (default), then the name of the executable, usually "unbound" is used to report to the log. Enter a string to override it with that, which is useful on systems that run more than one instance of unbound, with different configurations, so that the logs can be easily distinguished against. .TP a500 7 .B log\-replies: \fI Prints one line per reply to the log, with the log timestamp and IP address, name, type, class, return code, time to resolve, from cache and response size. Default is no. Note that it takes time to print these lines which makes the server (significantly) slower. Odd (nonprintable) characters in names are printed as '?'. .TP d502 1 a502 1 The process id is written to the file. Default is "@@UNBOUND_PIDFILE@@". d505 1 a505 1 kill \-HUP `cat @@UNBOUND_PIDFILE@@` d509 1 a509 1 kill \-TERM `cat @@UNBOUND_PIDFILE@@` d515 1 a515 1 for the IN class. The file has the format of zone files, with root a532 3 .B hide\-trustanchor: \fI If enabled trustanchor.unbound queries are refused. .TP d536 1 a536 1 dependency depth. d539 1 a539 1 that unbound will pursue in answering a query. d542 1 a542 1 that many targets opportunistically. d546 1 a546 1 closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour d551 1 a551 1 it is legal protocol wise to send these, and unbound tries to give very d565 5 a569 5 (or the DNSKEY data fails to validate), then the zone is made insecure, this behaves like there is no trust anchor. You could turn this off if you are sometimes behind an intrusive firewall (of some sort) that removes DNSSEC data from packets, or a zone changes from signed to unsigned to badly signed often. If turned off you run the risk of a d573 1 a573 2 From RFC 8020 (with title "NXDOMAIN: There Really Is Nothing Underneath"), returns nxdomain to queries for a name d580 1 a580 1 The nxdomain must be secure, this means nsec3 with optout is insufficient. d586 1 a586 1 NS sets and the nameserver addresses that are encountered on the referral d603 3 a605 3 This perturbs the lowercase and uppercase of query names sent to authority servers and checks if the reply still has the correct casing. Disabled by default. d616 3 a618 10 Only sent minimum required labels of the QNAME and set QTYPE to NS when possible. Best effort approach; full QNAME and original QTYPE will be sent when upstream replies with a RCODE other than NOERROR, except when receiving NXDOMAIN from a DNSSEC signed zone. Default is off. .TP .B qname\-minimisation\-strict: \fI QNAME minimisation in strict mode. Do not fall-back to sending full QNAME to potentially broken nameservers. A lot of domains will not be resolvable when this option in enabled. Only use if you know what you are doing. This option only has effect when qname-minimisation is enabled. Default is off. d641 1 a641 1 Give multiple times to allow multiple domain names to contain private d652 1 a652 1 Do not query the given IP address. Can be IP4 or IP6. Append /num to d711 1 a711 2 necessary to deal with filesystem full events), it must also be inside the chroot (if that is used). d718 1 a718 1 "" around it. A TTL can be specified for ease of cut and paste, but is ignored. d724 1 a724 1 but has a different file format. Format is BIND\-9 style format, a728 3 .B trust\-anchor\-signaling: \fI Send RFC8145 key tag query after trust anchor priming. Default is on. .TP d736 3 a738 3 would be slow. The DLV configured is used as a root trusted DLV, this means that it is a lookaside for the root. Default is "", or no dlv anchor file. DLV is going to be decommissioned. Please do not use it any more. d750 1 a750 1 trust anchors for the domain they override this setting (and the domain d754 1 a754 1 lookups does not affect an (unsigned) internal domain. A DS record d760 1 a760 1 and expiration dates, instead of the current date. Do not set this unless d790 1 a790 1 to protect the users that rely on this validator for authentication from d805 2 a806 2 reply is not withheld from the client with SERVFAIL as usual. The client receives the bogus data. For messages that are found to be secure the AD bit d808 1 a808 1 The default value is "no". a817 5 .B serve\-expired: \fI If enabled, unbound attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish. The actual resolution answer ends up in the cache later on. Default is "no". .TP d823 1 a823 1 be in ascending order and have at least one entry. If you set it to d858 1 a858 1 Must be set to a power of 2. Setting (close) to the number of cpus is a a885 1 always_transparent, always_refuse, always_nxdomain, d908 1 a908 1 \h'5'\fItransparent\fR d916 1 a916 1 \h'5'\fItypetransparent\fR d923 1 a923 1 \h'5'\fIredirect\fR d929 2 a930 2 to the end user, with local\-zone: "example.com." redirect and d935 6 a940 6 \h'5'\fIinform\fR The query is answered normally, same as transparent. The client IP address (@@portnumber) is printed to the logfile. The log message is: timestamp, unbound-pid, info: zonename inform IP@@port queryname type class. This option can be used for normal resolution, but machines looking up infected names are logged, eg. to run antivirus on them. d942 1 a942 1 \h'5'\fIinform_deny\fR d946 1 a946 10 \h'5'\fIalways_transparent\fR Like transparent, but ignores local data and resolves normally. .TP 10 \h'5'\fIalways_refuse\fR Like refuse, but ignores local data and refuses the query. .TP 10 \h'5'\fIalways_nxdomain\fR Like static, but ignores local data and returns nxdomain for the query. .TP 10 \h'5'\fInodefault\fR d948 2 a949 2 also turn off default contents for the zone. The 'nodefault' option has no other effect than turning off default contents for the d953 7 a959 7 The default zones are localhost, reverse 127.0.0.1 and ::1, the onion, test, invalid and the AS112 zones. The AS112 zones are reverse DNS zones for private use and reserved IP addresses for which the servers on the internet cannot provide correct answers. They are configured by default to give nxdomain (no reverse information) answers. The defaults can be turned off by specifying your own local\-zone of that name, or using the 'nodefault' type. Below is a list of the default zone contents. d961 1 a961 1 \h'5'\fIlocalhost\fR d965 1 a965 1 local\-zone: "localhost." redirect d967 1 a967 1 local\-data: "localhost. 10800 IN d973 1 a973 1 \h'5'\fIreverse IPv4 loopback\fR d978 1 a978 1 local\-data: "127.in\-addr.arpa. 10800 IN d980 1 a980 1 local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN d984 1 a984 1 \h'5'\fIreverse IPv6 loopback\fR d990 1 a990 1 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN d993 1 a993 1 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN d996 1 a996 1 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN d1000 1 a1000 1 \h'5'\fIonion (RFC 7686)\fR d1005 1 a1005 1 local\-data: "onion. 10800 IN d1009 2 a1010 20 \h'5'\fItest (RFC 7686)\fR Default content: .nf local\-zone: "test." static local\-data: "test. 10800 IN NS localhost." local\-data: "test. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" .fi .TP 10 \h'5'\fIinvalid (RFC 7686)\fR Default content: .nf local\-zone: "invalid." static local\-data: "invalid. 10800 IN NS localhost." local\-data: "invalid. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" .fi .TP 10 \h'5'\fIreverse RFC1918 local use zones\fR Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to d1012 1 a1012 1 The \fBlocal\-zone:\fR is set static and as \fBlocal\-data:\fR SOA and NS d1015 2 a1016 2 \h'5'\fIreverse RFC3330 IP4 this, link\-local, testnet and broadcast\fR Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa, d1022 1 a1022 1 Reverse data for zone d1047 1 a1047 1 The query has to match exactly unless you configure the local\-zone as d1050 2 a1051 2 a local\-zone, a transparent local\-zone is configured. For record types such as TXT, use single quotes, as in a1062 12 .B local\-zone\-tag: \fI <"list of tags"> Assign tags to localzones. Tagged localzones will only be applied when the used access-control element has a matching tag. Tags must be defined in \fIdefine\-tags\fR. Enclose list of tags in quotes ("") and put spaces between tags. .TP 5 .B local\-zone\-override: \fI Override the localzone type for queries from addresses matching netblock. Use this localzone type, regardless the type configured for the local-zone (both tagged and untagged) and regardless the type configured using access\-control\-tag\-action. .TP 5 d1095 1 a1095 1 .B ratelimit\-for\-domain: \fI a1098 1 A value of 0 will disable ratelimiting for that domain. d1100 1 a1100 1 .B ratelimit\-below\-domain: \fI a1106 29 A value of 0 will disable ratelimiting for domain names that end in this name. .TP 5 .B ip\-ratelimit: \fI Enable global ratelimiting of queries accepted per ip address. If 0, the default, it is disabled. This option is experimental at this time. The ratelimit is in queries per second that are allowed. More queries are completely dropped and will not receive a reply, SERVFAIL or otherwise. IP ratelimiting happens before looking in the cache. This may be useful for mitigating amplification attacks. .TP 5 .B ip\-ratelimit\-size: \fI Give the size of the data structure in which the current ongoing rates are kept track in. Default 4m. In bytes or use m(mega), k(kilo), g(giga). The ip ratelimit structure is small, so this data structure likely does not need to be large. .TP 5 .B ip\-ratelimit\-slabs: \fI Give power of 2 number of slabs, this is used to reduce lock contention in the ip ratelimit tracking data structure. Close to the number of cpus is a fairly good setting. .TP 5 .B ip\-ratelimit\-factor: \fI Set the amount of queries to rate limit when the limit is exceeded. If set to 0, all queries are dropped for addresses where the limit is exceeded. If set to another value, 1 in that number is allowed through to complete. Default is 10, allowing 1/10 traffic to flow normally. This can make ordinary queries complete (if repeatedly queried for), and enter the cache, whilst also mitigating the traffic flow by the factor given. d1174 3 a1176 3 This is useful for company\-local data or private zones. Setup an authoritative server on a different host (or different port). Enter a config entry for unbound with d1178 3 a1180 3 . The unbound resolver can then access the data, without referring to the public internet for it. d1182 1 a1182 1 This setup allows DNSSEC signed zones to be served by that d1184 5 a1188 5 can be put in config, so that unbound can validate the data and set the AD bit on replies for the private zone (authoritative servers do not set the AD bit). This setup makes unbound capable of answering queries for the private zone, and can even set the AD bit ('authentic'), but the AA ('authoritative') bit is not set on these replies. d1207 2 a1208 2 This option is by default off. If enabled it performs NS set priming, which is similar to root hints, where it starts using the list of nameservers a1216 4 .TP .B stub\-ssl\-upstream: \fI Enabled or disable whether the queries to this stub use SSL for transport. Default is no. a1246 38 .TP .B forward\-ssl\-upstream: \fI Enabled or disable whether the queries to this forwarder use SSL for transport. Default is no. .SS "View Options" .LP There may be multiple .B view: clauses. Each with a \fBname:\fR and zero or more \fBlocal\-zone\fR and \fBlocal\-data\fR elements. View can be mapped to requests by specifying the view name in an \fBaccess\-control\-view\fR element. Options from matching views will override global options. Global options will be used if no matching view is found, or when the matching view does not have the option specified. .TP .B name: \fI Name of the view. Must be unique. This name is used in access\-control\-view elements. .TP .B local\-zone: \fI View specific local\-zone elements. Has the same types and behaviour as the global local\-zone elements. When there is at least one local\-zone specified and view\-first is no, the default local-zones will be added to this view. Defaults can be disabled using the nodefault type. When view\-first is yes or when a view does not have a local\-zone, the global local\-zone will be used including it's default zones. .TP .B local\-data: \fI"" View specific local\-data elements. Has the same behaviour as the global local\-data elements. .TP .B local\-data\-ptr: \fI"IPaddr name" View specific local\-data\-ptr elements. Has the same behaviour as the global local\-data\-ptr elements. .TP .B view\-first: \fI If enabled, it attempts to use the global local\-zone and local\-data if there is no match in the view specific options. The default is no. a1255 6 .LP If the \fBchroot:\fR option is enabled, you should make sure Python's library directory structure is bind mounted in the new root environment, see \fImount\fR(8). Also the \fBpython\-script:\fR path should be specified as an absolute path relative to the new root, or as a relative path to the working directory. d1258 1 a1258 1 The script file to load. a1271 199 .SS "DNSCrypt Options" .LP The .B dnscrypt: clause gives the settings of the dnscrypt channel. While those options are available, they are only meaningful if unbound was compiled with \fB\-\-enable\-dnscrypt\fR. Currently certificate and secret/public keys cannot be generated by unbound. You can use dnscrypt-wrapper to generate those: https://github.com/cofyc/\ dnscrypt-wrapper/blob/master/README.md#usage .TP .B dnscrypt\-enable: \fI\fR Whether or not the \fBdnscrypt\fR config should be enabled. You may define configuration but not activate it. The default is no. .TP .B dnscrypt\-port: \fI On which port should \fBdnscrypt\fR should be activated. Note that you should have a matching \fBinterface\fR option defined in the \fBserver\fR section for this port. .TP .B dnscrypt\-provider: \fI\fR The provider name to use to distribute certificates. This is of the form: \fB2.dnscrypt-cert.example.com.\fR. The name \fIMUST\fR end with a dot. .TP .B dnscrypt\-secret\-key: \fI\fR Path to the time limited secret key file. This option may be specified multiple times. .TP .B dnscrypt\-provider\-cert: \fI\fR Path to the certificate related to the \fBdnscrypt\-secret\-key\fRs. This option may be specified multiple times. .TP .B dnscrypt\-shared\-secret\-cache\-size: \fI Give the size of the data structure in which the shared secret keys are kept in. Default 4m. In bytes or use m(mega), k(kilo), g(giga). The shared secret cache is used when a same client is making multiple queries using the same public key. It saves a substantial amount of CPU. .TP .B dnscrypt\-shared\-secret\-cache\-slabs: \fI Give power of 2 number of slabs, this is used to reduce lock contention in the dnscrypt shared secrets cache. Close to the number of cpus is a fairly good setting. .TP .B dnscrypt\-nonce\-cache\-size: \fI Give the size of the data structure in which the client nonces are kept in. Default 4m. In bytes or use m(mega), k(kilo), g(giga). The nonce cache is used to prevent dnscrypt message replaying. Client nonce should be unique for any pair of client pk/server sk. .TP .B dnscrypt\-nonce\-cache\-slabs: \fI Give power of 2 number of slabs, this is used to reduce lock contention in the dnscrypt nonce cache. Close to the number of cpus is a fairly good setting. .SS "EDNS Client Subnet Module Options" .LP The ECS module must be configured in the \fBmodule\-config:\fR "subnetcache validator iterator" directive and be compiled into the daemon to be enabled. These settings go in the \fBserver:\fR section. .LP If the destination address is whitelisted with Unbound will add the EDNS0 option to the query containing the relevant part of the client's address. When an answer contains the ECS option the response and the option are placed in a specialized cache. If the authority indicated no support, the response is stored in the regular cache. .LP Additionally, when a client includes the option in its queries, Unbound will forward the option to the authority if present in the whitelist, or \fBclient\-subnet\-always\-forward\fR is set to yes. In this case the lookup in the regular cache is skipped. .LP The maximum size of the ECS cache is controlled by 'msg-cache-size' in the configuration file. On top of that, for each query only 100 different subnets are allowed to be stored for each address family. Exceeding that number, older entries will be purged from cache. .TP .B send\-client\-subnet: \fI\fR Send client source address to this authority. Append /num to indicate a classless delegation netblock, for example like 10.2.3.4/24 or 2001::11/64. Can be given multiple times. Authorities not listed will not receive edns-subnet information, unless domain in query is specified in \fBclient\-subnet\-zone\fR. .TP .B client\-subnet\-zone: \fI\fR Send client source address in queries for this domain and its subdomains. Can be given multiple times. Zones not listed will not receive edns-subnet information, unless hosted by authority specified in \fBsend\-client\-subnet\fR. .TP .B client\-subnet\-always\-forward: \fI\fR Specify whether the ECS whitelist check (configured using \fBsend\-client\-subnet\fR) is applied for all queries, even if the triggering query contains an ECS record, or only for queries for which the ECS record is generated using the querier address (and therefore did not contain ECS data in the client query). If enabled, the whitelist check is skipped when the client query contains an ECS record. Default is no. .TP .B max\-client\-subnet\-ipv6: \fI\fR Specifies the maximum prefix length of the client source address we are willing to expose to third parties for IPv6. Defaults to 56. .TP .B max\-client\-subnet\-ipv4: \fI\fR Specifies the maximum prefix length of the client source address we are willing to expose to third parties for IPv4. Defaults to 24. .SS "Opportunistic IPsec Support Module Options" .LP The IPsec module must be configured in the \fBmodule\-config:\fR "ipsecmod validator iterator" directive and be compiled into the daemon to be enabled. These settings go in the \fBserver:\fR section. .LP When unbound receives an A/AAAA query that is not in the cache and finds a valid answer, it will withhold returning the answer and instead will generate an IPSECKEY subquery for the same domain name. If an answer was found, unbound will call an external hook passing the following arguments: .TP 10 \h'5'\fIQNAME\fR Domain name of the A/AAAA and IPSECKEY query. In string format. .TP 10 \h'5'\fIIPSECKEY TTL\fR TTL of the IPSECKEY RRset. .TP 10 \h'5'\fIA/AAAA\fR String of space separated IP addresses present in the A/AAAA RRset. The IP addresses are in string format. .TP 10 \h'5'\fIIPSECKEY\fR String of space separated IPSECKEY RDATA present in the IPSECKEY RRset. The IPSECKEY RDATA are in DNS presentation format. .LP The A/AAAA answer is then cached and returned to the client. If the external hook was called the TTL changes to ensure it doesn't surpass \fBipsecmod-max-ttl\fR. .LP The same procedure is also followed when \fBprefetch:\fR is used, but the A/AAAA answer is given to the client before the hook is called. \fBipsecmod-max-ttl\fR ensures that the A/AAAA answer given from cache is still relevant for opportunistic IPsec. .TP .B ipsecmod-enabled: \fI\fR Specifies whether the IPsec module is enabled or not. The IPsec module still needs to be defined in the \fBmodule\-config:\fR directive. This option facilitates turning on/off the module without restarting/reloading unbound. Defaults to yes. .TP .B ipsecmod\-hook: \fI\fR Specifies the external hook that unbound will call with \fIsystem\fR(3). The file can be specified as an absolute/relative path. The file needs the proper permissions to be able to be executed by the same user that runs unbound. It must be present when the IPsec module is defined in the \fBmodule\-config:\fR directive. .TP .B ipsecmod-strict: \fI\fR If enabled unbound requires the external hook to return a success value of 0. Failing to do so unbound will reply with SERVFAIL. The A/AAAA answer will also not be cached. Defaults to no. .TP .B ipsecmod\-max-ttl: \fI\fR Time to live maximum for A/AAAA cached records after calling the external hook. Defaults to 3600. .TP .B ipsecmod-ignore-bogus: \fI\fR Specifies the behaviour of unbound when the IPSECKEY answer is bogus. If set to yes, the hook will be called and the A/AAAA answer will be returned to the client. If set to no, the hook will not be called and the answer to the A/AAAA query will be SERVFAIL. Mainly used for testing. Defaults to no. .TP .B ipsecmod\-whitelist: \fI\fR Whitelist the domain so that the module logic will be executed. Can be given multiple times, for different domains. If the option is not specified, all domains are treated as being whitelisted (default). .SS "Cache DB Module Options" .LP The Cache DB module must be configured in the \fBmodule\-config:\fR "validator cachedb iterator" directive and be compiled into the daemon with \fB\-\-enable\-cachedb\fR. If this module is enabled and configured, the specified backend database works as a second level cache: When Unbound cannot find an answer to a query in its built-in in-memory cache, it consults the specified backend. If it finds a valid answer in the backend, Unbound uses it to respond to the query without performing iterative DNS resolution. If Unbound cannot even find an answer in the backend, it resolves the query as usual, and stores the answer in the backend. The .B cachedb: clause gives custom settings of the cache DB module. .TP .B backend: \fI\fR Specify the backend database name. Currently, only the in-memory "testframe" backend is supported. As the name suggests this backend is not of any practical use. This option defaults to "testframe". .TP .B secret-seed: \fI<"secret string">\fR Specify a seed to calculate a hash value from query information. This value will be used as the key of the corresponding answer for the backend database and can be customized if the hash should not be predictable operationally. If the backend database is shared by multiple Unbound instances, all instances must use the same secret seed. This option defaults to "default". d1279 1 a1279 1 which on BSD\-32bit tops out at 30\-40 Mb after heavy usage. d1320 2 a1321 2 unbound log file. default is to log to \fIsyslog\fR(3). d1323 1 a1323 1 \fIunbound\fR(8), d1326 1 a1326 1 .B Unbound @ 1.1.1.2.4.1 log @Sync with HEAD @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Mar 12, 2019" "NLnet Labs" "unbound 1.9.1" d124 1 a124 1 Same as interface: (for ease of compatibility with nsd.conf). a209 10 .B stream\-wait\-size: \fI Number of bytes size maximum to use for waiting stream buffers. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). As TCP and TLS streams queue up multiple results, the amount of memory used for these buffers does not exceed this number, otherwise the responses are dropped. This manages the total memory usage of the server (under heavy use), the number of requests that can be queued up per connection is also limited, with further requests waiting in TCP buffers. .TP a255 6 .B unknown\-server\-time\-limit: \fI The wait time in msec for waiting for an unknown server to reply. Increase this if you are behind a slow satellite link, to eg. 1128. That would then avoid re\-querying every initial query because it times out. Default is 376 msec. .TP d281 3 a283 3 distribute incoming queries to threads more evenly. Default is yes. On Linux it is supported in kernels >= 3.9. On other systems, FreeBSD, OSX it may also work. You can enable it (on any platform and kernel), d291 1 a291 1 non\-local interfaces. For example for non\-existent IP addresses that d296 1 a296 2 permissions on some systems. The option uses IP_BINDANY on FreeBSD systems and SO_BINDANY on OpenBSD systems. d316 3 a318 1 86400 seconds (1 day). When the TTL expires, the cache item has expired. d320 1 a320 1 trust (very large) TTL values. Downstream clients also see the lower TTL. a332 1 This applies to nxdomain and nodata answers. a389 31 .B tcp-idle-timeout: \fI\fR The period Unbound will wait for a query on a TCP connection. If this timeout expires Unbound closes the connection. This option defaults to 30000 milliseconds. When the number of free incoming TCP buffers falls below 50% of the total number configured, the option value used is progressively reduced, first to 1% of the configured value, then to 0.2% of the configured value if the number of free buffers falls below 35% of the total number configured, and finally to 0 if the number of free buffers falls below 20% of the total number configured. A minimum timeout of 200 milliseconds is observed regardless of the option value used. .TP .B edns-tcp-keepalive: \fI\fR Enable or disable EDNS TCP Keepalive. Default is no. .TP .B edns-tcp-keepalive-timeout: \fI\fR The period Unbound will wait for a query on a TCP connection when EDNS TCP Keepalive is active. If this timeout expires Unbound closes the connection. If the client supports the EDNS TCP Keepalive option, Unbound sends the timeout value to the client to encourage it to close the connection before the server times out. This option defaults to 120000 milliseconds. When the number of free incoming TCP buffers falls below 50% of the total number configured, the advertised timeout is progressively reduced to 1% of the configured value, then to 0.2% of the configured value if the number of free buffers falls below 35% of the total number configured, and finally to 0 if the number of free buffers falls below 20% of the total number configured. A minimum actual timeout of 200 milliseconds is observed regardless of the advertised timeout. .TP d399 3 a401 3 .B tls\-upstream: \fI Enabled or disable whether the upstream queries use TLS only for transport. Default is no. Useful in tunneling scenarios. The TLS contains plain DNS in d403 1 a403 5 \fBtls\-service\-key\fR). If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert to load CA certs, otherwise the connections cannot be authenticated. This option enables TLS for all of them, but if you do not set this you can configure TLS specifically for some forward zones with forward\-tls\-upstream. And also with stub\-tls\-upstream. d405 9 a413 3 .B ssl\-upstream: \fI Alternate syntax for \fBtls\-upstream\fR. If both are present in the config file the last is used. d415 2 a416 16 .B tls\-service\-key: \fI If enabled, the server provides TLS service on the TCP ports marked implicitly or explicitly for TLS service with tls\-port. The file must contain the private key for the TLS session, the public certificate is in the tls\-service\-pem file and it must also be specified if tls\-service\-key is specified. The default is "", turned off. Enabling or disabling this service requires a restart (a reload is not enough), because the key is read while root permissions are held and before chroot (if any). The ports enabled implicitly or explicitly via \fBtls\-port:\fR do not provide normal DNS TCP service. .TP .B ssl\-service\-key: \fI Alternate syntax for \fBtls\-service\-key\fR. .TP .B tls\-service\-pem: \fI The public key certificate pem file for the tls service. Default is "", a418 7 .B ssl\-service\-pem: \fI Alternate syntax for \fBtls\-service\-pem\fR. .TP .B tls\-port: \fI The port number on which to provide TCP TLS service, default 853, only interfaces configured with that port number as @@number get the TLS service. .TP d420 2 a421 42 Alternate syntax for \fBtls\-port\fR. .TP .B tls\-cert\-bundle: \fI If null or "", no file is used. Set it to the certificate bundle file, for example "/etc/pki/tls/certs/ca\-bundle.crt". These certificates are used for authenticating connections made to outside peers. For example auth\-zone urls, and also DNS over TLS connections. .TP .B ssl\-cert\-bundle: \fI Alternate syntax for \fBtls\-cert\-bundle\fR. .TP .B tls\-win\-cert: \fI Add the system certificates to the cert bundle certificates for authentication. If no cert bundle, it uses only these certificates. Default is no. On windows this option uses the certificates from the cert store. Use the tls\-cert\-bundle option on other systems. .TP .B tls\-additional\-port: \fI List portnumbers as tls\-additional\-port, and when interfaces are defined, eg. with the @@port suffix, as this port number, they provide dns over TLS service. Can list multiple, each on a new statement. .TP .B tls-session-ticket-keys: \fI If not "", lists files with 80 bytes of random contents that are used to perform TLS session resumption for clients using the unbound server. These files contain the secret key for the TLS session tickets. First key use to encrypt and decrypt TLS session tickets. Other keys use to decrypt only. With this you can roll over to new keys, by generating a new first file and allowing decrypt of the old file by listing it after the first file for some time, after the wait clients are not using the old key any more and the old key can be removed. One way to create the file is dd if=/dev/random bs=1 count=80 of=ticket.dat The first 16 bytes should be different from the old one if you create a second key, that is the name used to identify the key. Then there is 32 bytes random data for an AES key and then 32 bytes random data for the HMAC key. .TP .B tls\-ciphers: \fI Set the list of ciphers to allow when serving TLS. Use "" for defaults, and that is the default. .TP .B tls\-ciphersuites: \fI Set the list of ciphersuites to allow when serving TLS. This is for newer TLS 1.3 connections. Use "" for defaults, and that is the default. a431 5 .B tcp\-connection\-limit: \fI Allow up to \fIlimit\fR simultaneous TCP connections from the given netblock. When at the limit, further connections are accepted but closed immediately. This option is experimental at this time. .TP d435 1 a435 2 \fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or \fIrefuse_non_local\fR. a436 1 The order of the access\-control statements therefore does not matter. a453 9 The \fIallow_setrd\fR action ignores the recursion desired (RD) bit and treats all requests as if the recursion desired bit is set. Note that this behavior violates RFC 1034 which states that a name server should never perform recursive service unless asked via the RD bit since this interferes with trouble shooting of name servers and their databases. This prohibited behavior may be useful if another DNS server must forward requests for specific zones to a resolver DNS server, but only supports stub domains and sends queries to the resolver DNS server with the RD bit cleared. .IP d513 2 a514 3 If given a chroot is done to the given directory. By default chroot is enabled and the default is "@@UNBOUND_CHROOT_DIR@@". If you give "" no chroot is performed. a573 15 .B log\-tag\-queryreply: \fI Prints the word 'query' and 'reply' with log\-queries and log\-replies. This makes filtering logs easier. The default is off (for backwards compatibility). .TP .B log\-local\-actions: \fI Print log lines to inform about local zone actions. These lines are like the local\-zone type inform prints out, but they are also printed for the other types of local zones. .TP .B log\-servfail: \fI Print log lines that say why queries return SERVFAIL to clients. This is separate from the verbosity debug logs, much smaller, and printed at the error level, not the info level of debug info from verbosity. .TP d656 1 a656 1 have DNSSEC. Default is on. d665 1 a665 1 Default no, because it burdens the authority servers, and it is d693 1 a693 1 Only sent minimum required labels of the QNAME and set QTYPE to A when d696 1 a696 1 NXDOMAIN from a DNSSEC signed zone. Default is yes. a703 6 .B aggressive\-nsec: \fI Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN and other denials, using information from previous NXDOMAINs answers. Default is no. It helps to reduce the query rate towards targets that get a very high nonexistent name lookup rate. .TP d751 1 a751 1 .B prefetch\-key: \fI d756 1 a756 7 .B deny\-any: \fI If yes, deny queries of type ANY with an empty response. Default is no. If disabled, unbound responds with a short list of resource records if some can be found in the cache and makes the upstream type ANY query if there are none. .TP .B rrset\-roundrobin: \fI d764 1 a764 1 This may cause a slight speedup. The default is yes, even though the DNS d766 1 a766 3 be of use and save roundtrips for clients. Because they are not used, and the saved roundtrips are easier saved with prefetch, whilst this is faster. a781 6 The default is "validator iterator". When the server is built with EDNS client subnet support the default is "subnetcache validator iterator". Most modules that need to be listed here have to be listed at the beginning of the line. The cachedb module has to be listed just before the iterator. The python module can be listed in different places, it then processes the output of the module it is just before. a816 3 .B root\-key\-sentinel: \fI Root key trust anchor sentinel. Default is on. .TP a910 11 .B serve\-expired\-ttl: \fI Limit serving of expired responses to configured seconds after expiration. 0 disables the limit. This option only applies when \fBserve\-expired\fR is enabled. The default is 0. .TP .B serve\-expired\-ttl\-reset: \fI Set the TTL of expired records to the \fBserve\-expired\-ttl\fR value after a failed attempt to retrieve the record from upstream. This makes sure that the expired records will be served as long as there are queries for it. Default is "no". .TP d959 1 a959 1 .B unblock\-lan\-zones: \fI d970 1 a970 1 .B insecure\-lan\-zones: \fI d979 1 a979 1 inform_redirect, always_transparent, always_refuse, always_nxdomain, noview, a1039 4 \h'5'\fIinform_redirect\fR The query is redirected, like 'redirect', and logged, like 'inform'. Ie. answer queries with fixed data and also log the machines that ask. .TP 10 a1048 7 \h'5'\fInoview\fR Breaks out of that view and moves towards the global local zones for answer to the query. If the view first is no, it'll resolve normally. If view first is enabled, it'll break perform that step and check the global answers. For when the view has view specific overrides but some zone has to be answered from global local zone contents. .TP 10 d1112 1 a1112 1 \h'5'\fItest (RFC 2606)\fR d1121 1 a1121 1 \h'5'\fIinvalid (RFC 2606)\fR d1188 1 a1188 2 tags. When there are multiple tags it checks if the intersection of the list of tags for the query and local\-zone\-tag is non-empty. a1269 15 .TP 5 .B fast\-server\-permil: \fI Specify how many times out of 1000 to pick from the set of fastest servers. 0 turns the feature off. A value of 900 would pick from the fastest servers 90 percent of the time, and would perform normal exploration of random servers for the remaining time. When prefetch is enabled (or serve\-expired), such prefetches are not sped up, because there is no one waiting for it, and it presents a good moment to perform server exploration. The \fBfast\-server\-num\fR option can be used to specify the size of the fastest servers set. The default for fast\-server\-permil is 0. .TP 5 .B fast\-server\-num: \fI Set the number of servers that should be used for fast server selection. Only use the fastest specified number of servers with the fast\-server\-permil option, that turns this on or off. The default is to use the fastest 3 servers. d1276 1 a1276 1 to setup TLSv1 security for the connection. The a1291 8 .IP If you set it to an absolute path, a local socket is used. The local socket does not use the certificates and keys, so those files need not be present. To restrict access, unbound sets permissions on the file to the user and group that is configured, the access bits are set to allow the group members to access the control socket file. Put users that need to access the socket in the that group. To restrict access further, create a directory to put the control socket in and restrict access to that directory. d1300 5 a1304 3 For localhost control-interface you can disable the use of TLS by setting this option to "no", default is "yes". For local sockets, TLS is disabled and the value of this option is ignored. d1370 1 a1370 1 This option is by default no. If enabled it performs NS set priming, d1381 2 a1382 2 .B stub\-tls\-upstream: \fI Enabled or disable whether the queries to this stub use TLS for transport. a1383 7 .TP .B stub\-ssl\-upstream: \fI Alternate syntax for \fBstub\-tls\-upstream\fR. .TP .B stub\-no\-cache: \fI Default is no. If enabled, data inside the stub is not cached. This is useful when you want immediate changes to be visible. a1394 3 CNAMEs are chased by unbound itself, asking the remote server for every name in the indirection chain, to protect the local cache from illegal indirect referenced items. a1407 7 If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. .IP At high verbosity it logs the TLS certificate, with TLS enabled. If you leave out the '#' and auth name from the forward\-addr, any name is accepted. The cert must also match a CA from the tls\-cert\-bundle. d1410 4 a1413 3 If a forwarded query is met with a SERVFAIL error, and this option is enabled, unbound will fall back to normal recursive resolution for this query as if no query forwarding had been specified. The default is "no". d1415 2 a1416 2 .B forward\-tls\-upstream: \fI Enabled or disable whether the queries to this forwarder use TLS for transport. a1417 85 If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert to load CA certs, otherwise the connections cannot be authenticated. .TP .B forward\-ssl\-upstream: \fI Alternate syntax for \fBforward\-tls\-upstream\fR. .TP .B forward\-no\-cache: \fI Default is no. If enabled, data inside the forward is not cached. This is useful when you want immediate changes to be visible. .SS "Authority Zone Options" .LP Authority zones are configured with \fBauth\-zone:\fR, and each one must have a \fBname:\fR. There can be multiple ones, by listing multiple auth\-zone clauses, each with a different name, pertaining to that part of the namespace. The authority zone with the name closest to the name looked up is used. Authority zones are processed after \fBlocal\-zones\fR and before cache (\fBfor\-downstream:\fR \fIyes\fR), and when used in this manner make unbound respond like an authority server. Authority zones are also processed after cache, just before going to the network to fetch information for recursion (\fBfor\-upstream:\fR \fIyes\fR), and when used in this manner provide a local copy of an authority server that speeds up lookups of that data. .LP Authority zones can be read from zonefile. And can be kept updated via AXFR and IXFR. After update the zonefile is rewritten. The update mechanism uses the SOA timer values and performs SOA UDP queries to detect zone changes. .LP If the update fetch fails, the timers in the SOA record are used to time another fetch attempt. Until the SOA expiry timer is reached. Then the zone is expired. When a zone is expired, queries are SERVFAIL, and any new serial number is accepted from the master (even if older), and if fallback is enabled, the fallback activates to fetch from the upstream instead of the SERVFAIL. .TP .B name: \fI Name of the authority zone. .TP .B master: \fI Where to download a copy of the zone from, with AXFR and IXFR. Multiple masters can be specified. They are all tried if one fails. .TP .B url: \fI Where to download a zonefile for the zone. With http or https. An example for the url is "http://www.example.com/example.org.zone". Multiple url statements can be given, they are tried in turn. If only urls are given the SOA refresh timer is used to wait for making new downloads. If also masters are listed, the masters are first probed with UDP SOA queries to see if the SOA serial number has changed, reducing the number of downloads. If none of the urls work, the masters are tried with IXFR and AXFR. For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used to authenticate the connection. .TP .B allow\-notify: \fI With allow\-notify you can specify additional sources of notifies. When notified, the server attempts to first probe and then zone transfer. If the notify is from a master, it first attempts that master. Otherwise other masters are attempted. If there are no masters, but only urls, the file is downloaded when notified. The masters from master: statements are allowed notify by default. .TP .B fallback\-enabled: \fI Default no. If enabled, unbound falls back to querying the internet as a resolver for this zone when lookups fail. For example for DNSSEC validation failures. .TP .B for\-downstream: \fI Default yes. If enabled, unbound serves authority responses to downstream clients for this zone. This option makes unbound behave, for the queries with names in this zone, like one of the authority servers for that zone. Turn it off if you want unbound to provide recursion for the zone but have a local copy of zone data. If for\-downstream is no and for\-upstream is yes, then unbound will DNSSEC validate the contents of the zone before serving the zone contents to clients and store validation results in the cache. .TP .B for\-upstream: \fI Default yes. If enabled, unbound fetches data from this data collection for answering recursion queries. Instead of sending queries over the internet to the authority servers for this zone, it'll fetch the data directly from the zone data. Turn it on when you want unbound to provide recursion for downstream clients, and use the zone data as a local copy to speed up lookups. .TP .B zonefile: \fI The filename where the zone is stored. If not given then no zonefile is used. If the file does not exist or is empty, unbound will attempt to fetch zone data (eg. from the master servers). d1423 1 a1423 3 \fBlocal\-data\fR elements. Views can also contain view\-first, response\-ip, response\-ip\-data and local\-data\-ptr elements. View can be mapped to requests by specifying the a1482 6 .TP .B dns64\-ignore\-aaaa: \fI\fR List domain for which the AAAA records are ignored and the A record is used by dns64 processing instead. Can be entered multiple times, list a new domain for which it applies, one per line. Applies also to names underneath the name given. a1515 13 .B dnscrypt\-provider\-cert\-rotated: \fI\fR Path to a certificate that we should be able to serve existing connection from but do not want to advertise over \fBdnscrypt\-provider\fR's TXT record certs distribution. A typical use case is when rotating certificates, existing clients may still use the client magic from the old cert in their queries until they fetch and update the new cert. Likewise, it would allow one to prime the new cert/key without distributing the new cert yet, this can be useful when using a network of servers using anycast and on which the configuration may not get updated at the exact same time. By priming the cert, the servers can handle both old and new certs traffic while distributing only one. This option may be specified multiple times. .TP a1584 18 .TP .B min\-client\-subnet\-ipv6: \fI\fR Specifies the minimum prefix length of the IPv6 source mask we are willing to accept in queries. Shorter source masks result in REFUSED answers. Source mask of 0 is always accepted. Default is 0. .TP .B min\-client\-subnet\-ipv4: \fI\fR Specifies the minimum prefix length of the IPv4 source mask we are willing to accept in queries. Shorter source masks result in REFUSED answers. Source mask of 0 is always accepted. Default is 0. .TP .B max\-ecs\-tree\-size\-ipv4: \fI\fR Specifies the maximum number of subnets ECS answers kept in the ECS radix tree. This number applies for each qname/qclass/qtype tuple. Defaults to 100. .TP .B max\-ecs\-tree\-size\-ipv6: \fI\fR Specifies the maximum number of subnets ECS answers kept in the ECS radix tree. This number applies for each qname/qclass/qtype tuple. Defaults to 100. a1663 26 .P If Unbound was built with \fB\-\-with\-libhiredis\fR on a system that has installed the hiredis C client library of Redis, then the "redis" backend can be used. This backend communicates with the specified Redis server over a TCP connection to store and retrieve cache data. It can be used as a persistent and/or shared cache backend. It should be noted that Unbound never removes data stored in the Redis server, even if some data have expired in terms of DNS TTL or the Redis server has cached too much data; if necessary the Redis server must be configured to limit the cache size, preferably with some kind of least-recently-used eviction policy. This backend uses synchronous communication with the Redis server based on the assumption that the communication is stable and sufficiently fast. The thread waiting for a response from the Redis server cannot handle other DNS queries. Although the backend has the ability to reconnect to the server when the connection is closed unexpectedly and there is a configurable timeout in case the server is overly slow or hangs up, these cases are assumed to be very rare. If connection close or timeout happens too often, Unbound will be effectively unusable with this backend. It's the administrator's responsibility to make the assumption hold. .P d1670 3 a1672 4 The default database is the in-memory backend named "testframe", which, as the name suggests, is not of any practical use. Depending on the build-time configuration, "redis" backend may also be used as described above. a1681 22 .P The following .B cachedb otions are specific to the redis backend. .TP .B redis-server-host: \fI\fR The IP (either v6 or v4) address or domain name of the Redis server. In general an IP address should be specified as otherwise Unbound will have to resolve the name of the server every time it establishes a connection to the server. This option defaults to "127.0.0.1". .TP .B redis-server-port: \fI\fR The TCP port number of the Redis server. This option defaults to 6379. .TP .B redis-timeout: \fI\fR The period until when Unbound waits for a response from the Redis sever. If this timeout expires Unbound closes the connection, treats it as if the Redis server does not have the requested data, and will try to re-establish a new connection later. This option defaults to 100 milliseconds. @ 1.1.1.2.4.2 log @Merge changes from current as of 20200406 @ text @d1 1 a1 1 .TH "unbound.conf" "5" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6" d53 1 a53 1 # mount \-\-bind \-n /dev/urandom /etc/unbound/dev/urandom a302 2 At extreme load it could be better to turn it off to distribute the queries evenly, reported for Linux systems (4.4.x). d630 1 a630 3 /var/run/unbound.pid and the chroot to be /var/unbound, for example. Note that Unbound is not able to remove the pidfile after termination when it is located outside of the chroot directory. d632 1 a632 1 Additionally, unbound may need to access /dev/urandom (for entropy) d774 1 a774 1 Will trust glue only if it is within the servers authority. Default is yes. d784 1 a784 1 downgrade attack that disables security for a zone. Default is yes. d794 1 a794 1 have DNSSEC. Default is yes. d831 1 a831 1 Only send minimum required labels of the QNAME and set QTYPE to A when d948 1 a948 1 The probes are run several times per month, thus the machine must be online d973 1 a973 1 Send RFC8145 key tag query after trust anchor priming. Default is yes. d976 1 a976 1 Root key trust anchor sentinel. Default is yes. a1677 1 With the "ip#name" notation a AXFR over TLS can be used. d1768 1 a1768 2 (usually first, or between the validator and iterator). Multiple instances of the python module are supported by adding the word "python" more than once. d1777 1 a1777 2 The script file to load. Repeat this option for every python module instance added to the \fBmodule\-config:\fR option. @ 1.1.1.2.2.1 log @Sync with HEAD Resolve a couple of conflicts (result of the uimin/uimax changes) @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Jun 21, 2018" "NLnet Labs" "unbound 1.7.3" d291 1 a291 1 non\-local interfaces. For example for non\-existent IP addresses that d296 1 a296 2 permissions on some systems. The option uses IP_BINDANY on FreeBSD systems and SO_BINDANY on OpenBSD systems. a332 1 This applies to nxdomain and nodata answers. d399 3 a401 3 .B tls\-upstream: \fI Enabled or disable whether the upstream queries use TLS only for transport. Default is no. Useful in tunneling scenarios. The TLS contains plain DNS in d403 1 a403 7 \fBtls\-service\-key\fR). If you enable this, also configure a tls\-cert\-bundle or use tls\-win\cert to load CA certs, otherwise the connections cannot be authenticated. .TP .B ssl\-upstream: \fI Alternate syntax for \fBtls\-upstream\fR. If both are present in the config file the last is used. d405 4 a408 4 .B tls\-service\-key: \fI If enabled, the server provider TLS service on its TCP sockets. The clients have to use tls\-upstream: yes. The file is the private key for the TLS session. The public certificate is in the tls\-service\-pem file. Default d415 2 a416 5 .B ssl\-service\-key: \fI Alternate syntax for \fBtls\-service\-key\fR. .TP .B tls\-service\-pem: \fI The public key certificate pem file for the tls service. Default is "", a418 7 .B ssl\-service\-pem: \fI Alternate syntax for \fBtls\-service\-pem\fR. .TP .B tls\-port: \fI The port number on which to provide TCP TLS service, default 853, only interfaces configured with that port number as @@number get the TLS service. .TP d420 2 a421 21 Alternate syntax for \fBtls\-port\fR. .TP .B tls\-cert\-bundle: \fI If null or "", no file is used. Set it to the certificate bundle file, for example "/etc/pki/tls/certs/ca\-bundle.crt". These certificates are used for authenticating connections made to outside peers. For example auth\-zone urls, and also DNS over TLS connections. .TP .B ssl\-cert\-bundle: \fI Alternate syntax for \fBtls\-cert\-bundle\fR. .TP .B tls\-win\-cert: \fI Add the system certificates to the cert bundle certificates for authentication. If no cert bundle, it uses only these certificates. Default is no. On windows this option uses the certificates from the cert store. Use the tls\-cert\-bundle option on other systems. .TP .B tls\-additional\-port: \fI List portnumbers as tls\-additional\-port, and when interfaces are defined, eg. with the @@port suffix, as this port number, they provide dns over TLS service. Can list multiple, each on a new statement. d435 1 a435 2 \fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or \fIrefuse_non_local\fR. a453 9 The \fIallow_setrd\fR action ignores the recursion desired (RD) bit and treats all requests as if the recursion desired bit is set. Note that this behavior violates RFC 1034 which states that a name server should never perform recursive service unless asked via the RD bit since this interferes with trouble shooting of name servers and their databases. This prohibited behavior may be useful if another DNS server must forward requests for specific zones to a resolver DNS server, but only supports stub domains and sends queries to the resolver DNS server with the RD bit cleared. .IP d665 1 a665 1 Default no, because it burdens the authority servers, and it is d693 1 a693 1 Only sent minimum required labels of the QNAME and set QTYPE to A when d696 1 a696 1 NXDOMAIN from a DNSSEC signed zone. Default is yes. a703 6 .B aggressive\-nsec: \fI Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN and other denials, using information from previous NXDOMAINs answers. Default is no. It helps to reduce the query rate towards targets that get a very high nonexistent name lookup rate. .TP a816 3 .B root\-key\-sentinel: \fI Root key trust anchor sentinel. Default is on. .TP d979 1 a979 1 always_transparent, always_refuse, always_nxdomain, noview, a1048 7 \h'5'\fInoview\fR Breaks out of that view and moves towards the global local zones for answer to the query. If the view first is no, it'll resolve normally. If view first is enabled, it'll break perform that step and check the global answers. For when the view has view specific overrides but some zone has to be answered from global local zone contents. .TP 10 d1112 1 a1112 1 \h'5'\fItest (RFC 2606)\fR d1121 1 a1121 1 \h'5'\fIinvalid (RFC 2606)\fR a1269 17 .TP 5 .B low\-rtt: \fI Set the time in millisecond that is considere a low ping time for fast server selection with the low\-rtt\-permil option, that turns this on or off. The default is 45 msec, a number from IPv6 quick response documents. .TP 5 .B low\-rtt\-permil: \fI Specify how many times out of 1000 to pick the fast server from the low rtt band. 0 turns the feature off. A value of 900 would pick the fast server when such fast servers are available 90 percent of the time, and the remaining time perform normal exploration of random servers. When prefetch is enabled (or serve\-expired), such prefetches are not sped up, because there is no one waiting for it, and it presents a good moment to perform server exploration. The low\-rtt option can be used to specify which servers are picked for fast server selection, servers with a ping roundtrip time below that value are considered. The default for low\-rtt\-permil is 0. d1276 1 a1276 1 to setup TLSv1 security for the connection. The a1291 8 .IP If you set it to an absolute path, a local socket is used. The local socket does not use the certificates and keys, so those files need not be present. To restrict access, unbound sets permissions on the file to the user and group that is configured, the access bits are set to allow the group members to access the control socket file. Put users that need to access the socket in the that group. To restrict access further, create a directory to put the control socket in and restrict access to that directory. d1300 5 a1304 3 For localhost control-interface you can disable the use of TLS by setting this option to "no", default is "yes". For local sockets, TLS is disabled and the value of this option is ignored. d1370 1 a1370 1 This option is by default no. If enabled it performs NS set priming, d1381 2 a1382 2 .B stub\-tls\-upstream: \fI Enabled or disable whether the queries to this stub use TLS for transport. a1383 3 .TP .B stub\-ssl\-upstream: \fI Alternate syntax for \fBstub\-tls\-upstream\fR. a1394 3 CNAMEs are chased by unbound itself, asking the remote server for every name in the indirection chain, to protect the local cache from illegal indirect referenced items. a1407 7 If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. .IP At high verbosity it logs the TLS certificate, with TLS enabled. If you leave out the '#' and auth name from the forward\-addr, any name is accepted. The cert must also match a CA from the tls\-cert\-bundle. d1415 2 a1416 2 .B forward\-tls\-upstream: \fI Enabled or disable whether the queries to this forwarder use TLS for transport. a1417 74 If you enable this, also configure a tls\-cert\-bundle or use tls\-win\cert to load CA certs, otherwise the connections cannot be authenticated. .TP .B forward\-ssl\-upstream: \fI Alternate syntax for \fBforward\-tls\-upstream\fR. .SS "Authority Zone Options" .LP Authority zones are configured with \fBauth\-zone:\fR, and each one must have a \fBname:\fR. There can be multiple ones, by listing multiple auth\-zone clauses, each with a different name, pertaining to that part of the namespace. The authority zone with the name closest to the name looked up is used. Authority zones are processed after \fBlocal\-zones\fR and before cache (\fBfor\-downstream:\fR \fIyes\fR), and when used in this manner make unbound respond like an authority server. Authority zones are also processed after cache, just before going to the network to fetch information for recursion (\fBfor\-upstream:\fR \fIyes\fR), and when used in this manner provide a local copy of an authority server that speeds up lookups of that data. .LP Authority zones can be read from zonefile. And can be kept updated via AXFR and IXFR. After update the zonefile is rewritten. The update mechanism uses the SOA timer values and performs SOA UDP queries to detect zone changes. .TP .B name: \fI Name of the authority zone. .TP .B master: \fI Where to download a copy of the zone from, with AXFR and IXFR. Multiple masters can be specified. They are all tried if one fails. .TP .B url: \fI Where to download a zonefile for the zone. With http or https. An example for the url is "http://www.example.com/example.org.zone". Multiple url statements can be given, they are tried in turn. If only urls are given the SOA refresh timer is used to wait for making new downloads. If also masters are listed, the masters are first probed with UDP SOA queries to see if the SOA serial number has changed, reducing the number of downloads. If none of the urls work, the masters are tried with IXFR and AXFR. For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used to authenticate the connection. .TP .B allow\-notify: \fI With allow\-notify you can specify additional sources of notifies. When notified, the server attempts to first probe and then zone transfer. If the notify is from a master, it first attempts that master. Otherwise other masters are attempted. If there are no masters, but only urls, the file is downloaded when notified. The masters from master: statements are allowed notify by default. .TP .B fallback\-enabled: \fI Default no. If enabled, unbound falls back to querying the internet as a resolver for this zone when lookups fail. For example for DNSSEC validation failures. .TP .B for\-downstream: \fI Default yes. If enabled, unbound serves authority responses to downstream clients for this zone. This option makes unbound behave, for the queries with names in this zone, like one of the authority servers for that zone. Turn it off if you want unbound to provide recursion for the zone but have a local copy of zone data. If for\-downstream is no and for\-upstream is yes, then unbound will DNSSEC validate the contents of the zone before serving the zone contents to clients and store validation results in the cache. .TP .B for\-upstream: \fI Default yes. If enabled, unbound fetches data from this data collection for answering recursion queries. Instead of sending queries over the internet to the authority servers for this zone, it'll fetch the data directly from the zone data. Turn it on when you want unbound to provide recursion for downstream clients, and use the zone data as a local copy to speed up lookups. .TP .B zonefile: \fI The filename where the zone is stored. If not given then no zonefile is used. If the file does not exist or is empty, unbound will attempt to fetch zone data (eg. from the master servers). a1515 13 .B dnscrypt\-provider\-cert\-rotated: \fI\fR Path to a certificate that we should be able to serve existing connection from but do not want to advertise over \fBdnscrypt\-provider\fR's TXT record certs distribution. A typical use case is when rotating certificates, existing clients may still use the client magic from the old cert in their queries until they fetch and update the new cert. Likewise, it would allow one to prime the new cert/key without distributing the new cert yet, this can be useful when using a network of servers using anycast and on which the configuration may not get updated at the exact same time. By priming the cert, the servers can handle both old and new certs traffic while distributing only one. This option may be specified multiple times. .TP a1663 26 .P If Unbound was built with \fB\-\-with\-libhiredis\fR on a system that has installed the hiredis C client library of Redis, then the "redis" backend can be used. This backend communicates with the specified Redis server over a TCP connection to store and retrieve cache data. It can be used as a persistent and/or shared cache backend. It should be noted that Unbound never removes data stored in the Redis server, even if some data have expired in terms of DNS TTL or the Redis server has cached too much data; if necessary the Redis server must be configured to limit the cache size, preferably with some kind of least-recently-used eviction policy. This backend uses synchronous communication with the Redis server based on the assumption that the communication is stable and sufficiently fast. The thread waiting for a response from the Redis server cannot handle other DNS queries. Although the backend has the ability to reconnect to the server when the connection is closed unexpectedly and there is a configurable timeout in case the server is overly slow or hangs up, these cases are assumed to be very rare. If connection close or timeout happens too often, Unbound will be effectively unusable with this backend. It's the administrator's responsibility to make the assumption hold. .P d1670 3 a1672 4 The default database is the in-memory backend named "testframe", which, as the name suggests, is not of any practical use. Depending on the build-time configuration, "redis" backend may also be used as described above. a1681 22 .P The following .B cachedb otions are specific to the redis backend. .TP .B redis-server-host: \fI\fR The IP (either v6 or v4) address or domain name of the Redis server. In general an IP address should be specified as otherwise Unbound will have to resolve the name of the server every time it establishes a connection to the server. This option defaults to "127.0.0.1". .TP .B redis-server-port: \fI\fR The TCP port number of the Redis server. This option defaults to 6379. .TP .B redis-timeout: \fI\fR The period until when Unbound waits for a response from the Redis sever. If this timeout expires Unbound closes the connection, treats it as if the Redis server does not have the requested data, and will try to re-establish a new connection later. This option defaults to 100 milliseconds. @ 1.1.1.3 log @Import unbound-1.7.3 19 June 2018: Wouter - Fix for unbound-control on Windows and set TCP socket parameters more closely. - Fix windows unbound-control no cert bad file descriptor error. 18 June 2018: Wouter - Fix that control-use-cert: no works for 127.0.0.1 to disable certs. - Fix unbound-checkconf for control-use-cert. 15 June 2018: Wouter - tag for 1.7.3rc1. 14 June 2018: Wouter - #4103: Fix that auth-zone does not insist on SOA record first in file for url downloads. - Fix that first control-interface determines if TLS is used. Warn when IP address interfaces are used without TLS. - Fix nettle compile. 12 June 2018: Ralph - Don't count CNAME response types received during qname minimisation as query restart. 12 June 2018: Wouter - #4102 for NSD, but for Unbound. Named unix pipes do not use certificate and key files, access can be restricted with file and directory permissions. The option control-use-cert is no longer used, and ignored if found in unbound.conf. - Rename tls-additional-ports to tls-additional-port, because every line adds one port. - Fix buffer size warning in unit test. - remade dependencies in the Makefile. 6 June 2018: Wouter - Patch to fix openwrt for mac os build darwin detection in configure. 5 June 2018: Wouter - Fix crash if ratelimit taken into use with unbound-control instead of with unbound.conf. 4 June 2018: Wouter - Fix deadlock caused by incoming notify for auth-zone. - tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018, trunk is 1.7.3 in development from this point. - #4100: Fix stub reprime when it becomes useless. 1 June 2018: Wouter - Rename additional-tls-port to tls-additional-ports. The older name is accepted for backwards compatibility. 30 May 2018: Wouter - Patch from Syzdek: Add ability to ignore RD bit and treat all requests as if the RD bit is set. 29 May 2018: Wouter - in compat/arc4random call getentropy_urandom when getentropy fails with ENOSYS. - Fix that fallback for windows port. 28 May 2018: Wouter - Fix windows tcp and tls spin on events. - Add routine from getdns to add windows cert store to the SSL_CTX. - tls-win-cert option that adds the system certificate store for authenticating DNS-over-TLS connections. It can be used instead of the tls-cert-bundle option, or with it to add certificates. 25 May 2018: Wouter - For TCP and TLS connections that don't establish, perform address update in infra cache, so future selections can exclude them. - Fix that tcp sticky events are removed for closed fd on windows. - Fix close events for tcp only. 24 May 2018: Wouter - Fix that libunbound can do DNS-over-TLS, when configured. - Fix that windows unbound service can use DNS-over-TLS. - unbound-host initializes ssl (for potential DNS-over-TLS usage inside libunbound), when ssl upstream or a cert-bundle is configured. 23 May 2018: Wouter - Use accept4 to speed up incoming TCP (and TLS) connections, available on Linux, FreeBSD and OpenBSD. 17 May 2018: Ralph - Qname minimisation default changed to yes. 15 May 2018: Wouter - Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand. 11 May 2018: Wouter - Fix contrib/libunbound.pc for libssl libcrypto references, from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914 7 May 2018: Wouter - Fix windows to not have sticky TLS events for TCP. - Fix read of DNS over TLS length and data in one read call. - Fix mesh state assertion failure due to callback removal. 3 May 2018: Wouter - Fix that configure --with-libhiredis also turns on cachedb. - Fix gcc 8 buffer warning in testcode. - Fix function type cast warning in libunbound context callback type. 2 May 2018: Wouter - Fix fail to reject dead peers in forward-zone, with ssl-upstream. 1 May 2018: Wouter - Fix that unbound-control reload frees the rrset keys and returns the memory pages to the system. 30 April 2018: Wouter - Fix spelling error in man page and note defaults as no instead of off. 26 April 2018: Wouter - Fix for crash in daemon_cleanup with dnstap during reload, from Saksham Manchanda. - Also that for dnscrypt. - tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk is from here 1.7.2 in development. 25 April 2018: Ralph - Fix memory leak when caching wildcard records for aggressive NSEC use 24 April 2018: Wouter - Fix contrib/fastrpz.patch for this release. - Fix auth https for libev. 24 April 2018: Ralph - Added root-key-sentinel support 23 April 2018: Wouter - makedist uses bz2 for expat code, instead of tar.gz. - Fix #4092: libunbound: use-caps-for-id lacks colon in config_set_option. - auth zone http download stores exact copy of downloaded file, including comments in the file. - Fix sldns parse failure for CDS alternate delete syntax empty hex. - Attempt for auth zone fix; add of callback in mesh gets from callback does not skip callback of result. - Fix cname classification with qname minimisation enabled. - list_auth_zones unbound-control command. 20 April 2018: Wouter - man page documentation for dns-over-tls forward-addr '#' notation. - removed free from failed parse case. - Fix #4091: Fix that reload of auth-zone does not merge the zonefile with the previous contents. - Delete auth zone when removed from config. 19 April 2018: Wouter - Can set tls authentication with forward-addr: IP#tls.auth.name And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem". such as forward-addr: 9.9.9.9@@853#dns.quad9.net or 1.1.1.1@@853#cloudflare-dns.com - Fix #658: unbound using TLS in a forwarding configuration does not verify the server's certificate (RFC 8310 support). - For addr with #authname and no @@port notation, the default is 853. 18 April 2018: Wouter - Fix auth-zone retry timer to be on schedule with retry timeout, with backoff. Also time a refresh at the zone expiry. 17 April 2018: Wouter - auth zone notify work. - allow-notify: config statement for auth-zones. - unit test for allow-notify 16 April 2018: Wouter - Fix auth zone target lookup iterator. - auth zone notify with prefix - auth zone notify work. 13 April 2018: Wouter - Fix for max include depth for authzones. - Fix memory free on fail for $INCLUDE in authzone. - Fix that an internal error to look up the wrong rr type for auth zone gets stopped, before trying to send there. - auth zone notify work. 10 April 2018: Ralph - num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN statistics counters. 10 April 2018: Wouter - documentation for low-rtt and low-rtt-pct. - auth zone notify work. 9 April 2018: Wouter - Fix that flush_zone sets prefetch ttl expired, so that with serve-expired enabled it'll start prefetching those entries. - num.query.authzone.up and num.query.authzone.down statistics counters. - Fix downstream auth zone, only fallback when auth zone fails to answer and fallback is enabled. - Accept both option names with and without colon for get_option and set_option. - low-rtt and low-rtt-pct in unbound.conf enable the server selection of fast servers for some percentage of the time. 5 April 2018: Wouter - Combine write of tcp length and tcp query for dns over tls. - nitpick fixes in example.conf. - Fix above stub queries for type NS and useless delegation point. - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3 tls_choose_sigalg routine does not allow the ciphers for the pipe, so use TLSv1.2. - ED448 support. 3 April 2018: Wouter - Fix #4043: make test fails due to v6 presentation issue in macOS. - Fix unable to resolve after new WLAN connection, due to auth-zone failing with a forwarder set. Now, auth-zone is only used for answers (not referrals) when a forwarder is set. 29 March 2018: Ralph - Check "result" in dup_all(), by Florian Obser. 23 March 2018: Ralph - Fix unbound-control get_option aggressive-nsec 21 March 2018: Ralph - Do not use cached NSEC records to generate negative answers for domains under DNSSEC Negative Trust Anchors. 19 March 2018: Wouter - iana port update. 16 March 2018: Wouter - corrected a minor typo in the changelog. - move htobe64/be64toh portability code to cachedb.c. 15 March 2018: Wouter - Add --with-libhiredis, unbound support for a new cachedb backend that uses a Redis server as the storage. This implementation depends on the hiredis client library (https://redislabs.com/lp/hiredis/). And unbound should be built with both --enable-cachedb and --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h should exist). Patch from Jinmei Tatuya (Infoblox). - Fix #3817: core dump happens in libunbound delete, when queued servfail hits deleted message queue. - Create additional tls service interfaces by opening them on other portnumbers and listing the portnumbers as additional-tls-port: nr. 13 March 2018: Wouter - Fix typo in documentation. - Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually flushed with serve-expired on. 12 March 2018: Wouter - Added documentation for aggressive-nsec: yes. - tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk now has 1.7.1 in development. - Fix #3727: Protocol name is TLS, options have been renamed but documentation is not consistent. - Check IXFR start serial. 9 March 2018: Wouter - Fix #3598: Fix swig build issue on rhel6 based system. configure --disable-swig-version-check stops the swig version check. 8 March 2018: Wouter - tag 1.7.0rc2. 7 March 2018: Wouter - Fixed contrib/fastrpz.patch, even though this already applied cleanly for me, now also for others. - patch to log creates keytag queries, from A. Schulze. - patch suggested by Debian lintian: allow to -> allow one to, from A. Schulze. - Attempt to remove warning about trailing whitespace. 6 March 2018: Wouter - Reverted fix for #3512, this may not be the best way forward; although it could be changed at a later time, to stay similar to other implementations. - svn trunk contains 1.7.0, this is the number for the next release. - Fix for windows compile. - tag 1.7.0rc1. 5 March 2018: Wouter - Fix to check define of DSA for when openssl is without deprecated. - iana port update. - Fix #3582: Squelch address already in use log when reuseaddr option causes same port to be used twice for tcp connections. 27 February 2018: Wouter - Fixup contrib/fastrpz.patch so that it applies. - Fix compile without threads, and remove unused variable. - Fix compile with staticexe and python module. - Fix nettle compile. 22 February 2018: Ralph - Save wildcard RRset from answer with original owner for use in aggressive NSEC. 21 February 2018: Wouter - Fix #3512: unbound incorrectly reports SERVFAIL for CAA query when there is a CNAME loop. - Fix validation for CNAME loops. When it detects a cname loop, by finding the cname, cname in the existing list, it returns the partial result with the validation result up to then. - more robust cachedump rrset routine. 19 February 2018: Wouter - Fix #3505: Documentation for default local zones references wrong RFC. - Fix #3494: local-zone noview can be used to break out of the view to the global local zone contents, for queries for that zone. - Fix for more maintainable code in localzone. 16 February 2018: Wouter - Fixes for clang static analyzer, the missing ; in edns-subnet/addrtree.c after the assert made clang analyzer produce a failure to analyze it. 13 February 2018: Ralph - Aggressive NSEC tests 13 February 2018: Wouter - tls-cert-bundle option in unbound.conf enables TLS authentication. - iana port update. 12 February 2018: Wouter - Unit test for auth zone https url download. 12 February 2018: Ralph - Added tests with wildcard expanded NSEC records (CVE-2017-15105 test) - Processed aggressive NSEC code review remarks Wouter 8 February 2018: Ralph - Aggressive use of NSEC implementation. Use cached NSEC records to generate NXDOMAIN, NODATA and positive wildcard answers. 8 February 2018: Wouter - iana port update. - auth zone url config. 5 February 2018: Wouter - Fix #3451: dnstap not building when you have a separate build dir. And removed protoc warning, set dnstap.proto syntax to proto2. - auth-zone provides a way to configure RFC7706 from unbound.conf, eg. with auth-zone: name: "." for-downstream: no for-upstream: yes fallback-enabled: yes and masters or a zonefile with data. 2 February 2018: Wouter - Fix unfreed locks in log and arc4random at exit of unbound. - unit test with valgrind - Fix lock race condition in dns cache dname synthesis. - lock subnet new item before insertion to please checklocks, no modification of critical regions outside of lock region. 1 February 2018: Wouter - fix unaligned structure making a false positive in checklock unitialised memory. 29 January 2018: Ralph - Use NSEC with longest ce to prove wildcard absence. - Only use *.ce to prove wildcard absence, no longer names. 25 January 2018: Wouter - ltrace.conf file for libunbound in contrib. 23 January 2018: Wouter - Fix that unbound-checkconf -f flag works with auto-trust-anchor-file for startup scripts to get the full pathname(s) of anchor file(s). - Print fatal errors about remote control setup before log init, so that it is printed to console. 22 January 2018: Wouter - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is also recognized and means the same. Also for tls-port, tls-service-key, tls-service-pem, stub-tls-upstream and forward-tls-upstream. - Fix #3397: Fix that cachedb could return a partial CNAME chain. - Fix #3397: Fix that when the cache contains an unsigned DNAME in the middle of a cname chain, a result without the DNAME could be returned. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Jun 21, 2018" "NLnet Labs" "unbound 1.7.3" d291 1 a291 1 non\-local interfaces. For example for non\-existent IP addresses that d296 1 a296 2 permissions on some systems. The option uses IP_BINDANY on FreeBSD systems and SO_BINDANY on OpenBSD systems. a332 1 This applies to nxdomain and nodata answers. d399 3 a401 3 .B tls\-upstream: \fI Enabled or disable whether the upstream queries use TLS only for transport. Default is no. Useful in tunneling scenarios. The TLS contains plain DNS in d403 1 a403 7 \fBtls\-service\-key\fR). If you enable this, also configure a tls\-cert\-bundle or use tls\-win\cert to load CA certs, otherwise the connections cannot be authenticated. .TP .B ssl\-upstream: \fI Alternate syntax for \fBtls\-upstream\fR. If both are present in the config file the last is used. d405 4 a408 4 .B tls\-service\-key: \fI If enabled, the server provider TLS service on its TCP sockets. The clients have to use tls\-upstream: yes. The file is the private key for the TLS session. The public certificate is in the tls\-service\-pem file. Default d415 2 a416 5 .B ssl\-service\-key: \fI Alternate syntax for \fBtls\-service\-key\fR. .TP .B tls\-service\-pem: \fI The public key certificate pem file for the tls service. Default is "", a418 7 .B ssl\-service\-pem: \fI Alternate syntax for \fBtls\-service\-pem\fR. .TP .B tls\-port: \fI The port number on which to provide TCP TLS service, default 853, only interfaces configured with that port number as @@number get the TLS service. .TP d420 2 a421 21 Alternate syntax for \fBtls\-port\fR. .TP .B tls\-cert\-bundle: \fI If null or "", no file is used. Set it to the certificate bundle file, for example "/etc/pki/tls/certs/ca\-bundle.crt". These certificates are used for authenticating connections made to outside peers. For example auth\-zone urls, and also DNS over TLS connections. .TP .B ssl\-cert\-bundle: \fI Alternate syntax for \fBtls\-cert\-bundle\fR. .TP .B tls\-win\-cert: \fI Add the system certificates to the cert bundle certificates for authentication. If no cert bundle, it uses only these certificates. Default is no. On windows this option uses the certificates from the cert store. Use the tls\-cert\-bundle option on other systems. .TP .B tls\-additional\-port: \fI List portnumbers as tls\-additional\-port, and when interfaces are defined, eg. with the @@port suffix, as this port number, they provide dns over TLS service. Can list multiple, each on a new statement. d435 1 a435 2 \fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or \fIrefuse_non_local\fR. a453 9 The \fIallow_setrd\fR action ignores the recursion desired (RD) bit and treats all requests as if the recursion desired bit is set. Note that this behavior violates RFC 1034 which states that a name server should never perform recursive service unless asked via the RD bit since this interferes with trouble shooting of name servers and their databases. This prohibited behavior may be useful if another DNS server must forward requests for specific zones to a resolver DNS server, but only supports stub domains and sends queries to the resolver DNS server with the RD bit cleared. .IP d665 1 a665 1 Default no, because it burdens the authority servers, and it is d693 1 a693 1 Only sent minimum required labels of the QNAME and set QTYPE to A when d696 1 a696 1 NXDOMAIN from a DNSSEC signed zone. Default is yes. a703 6 .B aggressive\-nsec: \fI Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN and other denials, using information from previous NXDOMAINs answers. Default is no. It helps to reduce the query rate towards targets that get a very high nonexistent name lookup rate. .TP a816 3 .B root\-key\-sentinel: \fI Root key trust anchor sentinel. Default is on. .TP d979 1 a979 1 always_transparent, always_refuse, always_nxdomain, noview, a1048 7 \h'5'\fInoview\fR Breaks out of that view and moves towards the global local zones for answer to the query. If the view first is no, it'll resolve normally. If view first is enabled, it'll break perform that step and check the global answers. For when the view has view specific overrides but some zone has to be answered from global local zone contents. .TP 10 d1112 1 a1112 1 \h'5'\fItest (RFC 2606)\fR d1121 1 a1121 1 \h'5'\fIinvalid (RFC 2606)\fR a1269 17 .TP 5 .B low\-rtt: \fI Set the time in millisecond that is considere a low ping time for fast server selection with the low\-rtt\-permil option, that turns this on or off. The default is 45 msec, a number from IPv6 quick response documents. .TP 5 .B low\-rtt\-permil: \fI Specify how many times out of 1000 to pick the fast server from the low rtt band. 0 turns the feature off. A value of 900 would pick the fast server when such fast servers are available 90 percent of the time, and the remaining time perform normal exploration of random servers. When prefetch is enabled (or serve\-expired), such prefetches are not sped up, because there is no one waiting for it, and it presents a good moment to perform server exploration. The low\-rtt option can be used to specify which servers are picked for fast server selection, servers with a ping roundtrip time below that value are considered. The default for low\-rtt\-permil is 0. d1276 1 a1276 1 to setup TLSv1 security for the connection. The a1291 8 .IP If you set it to an absolute path, a local socket is used. The local socket does not use the certificates and keys, so those files need not be present. To restrict access, unbound sets permissions on the file to the user and group that is configured, the access bits are set to allow the group members to access the control socket file. Put users that need to access the socket in the that group. To restrict access further, create a directory to put the control socket in and restrict access to that directory. d1300 5 a1304 3 For localhost control-interface you can disable the use of TLS by setting this option to "no", default is "yes". For local sockets, TLS is disabled and the value of this option is ignored. d1370 1 a1370 1 This option is by default no. If enabled it performs NS set priming, d1381 2 a1382 2 .B stub\-tls\-upstream: \fI Enabled or disable whether the queries to this stub use TLS for transport. a1383 3 .TP .B stub\-ssl\-upstream: \fI Alternate syntax for \fBstub\-tls\-upstream\fR. a1394 3 CNAMEs are chased by unbound itself, asking the remote server for every name in the indirection chain, to protect the local cache from illegal indirect referenced items. a1407 7 If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. .IP At high verbosity it logs the TLS certificate, with TLS enabled. If you leave out the '#' and auth name from the forward\-addr, any name is accepted. The cert must also match a CA from the tls\-cert\-bundle. d1415 2 a1416 2 .B forward\-tls\-upstream: \fI Enabled or disable whether the queries to this forwarder use TLS for transport. a1417 74 If you enable this, also configure a tls\-cert\-bundle or use tls\-win\cert to load CA certs, otherwise the connections cannot be authenticated. .TP .B forward\-ssl\-upstream: \fI Alternate syntax for \fBforward\-tls\-upstream\fR. .SS "Authority Zone Options" .LP Authority zones are configured with \fBauth\-zone:\fR, and each one must have a \fBname:\fR. There can be multiple ones, by listing multiple auth\-zone clauses, each with a different name, pertaining to that part of the namespace. The authority zone with the name closest to the name looked up is used. Authority zones are processed after \fBlocal\-zones\fR and before cache (\fBfor\-downstream:\fR \fIyes\fR), and when used in this manner make unbound respond like an authority server. Authority zones are also processed after cache, just before going to the network to fetch information for recursion (\fBfor\-upstream:\fR \fIyes\fR), and when used in this manner provide a local copy of an authority server that speeds up lookups of that data. .LP Authority zones can be read from zonefile. And can be kept updated via AXFR and IXFR. After update the zonefile is rewritten. The update mechanism uses the SOA timer values and performs SOA UDP queries to detect zone changes. .TP .B name: \fI Name of the authority zone. .TP .B master: \fI Where to download a copy of the zone from, with AXFR and IXFR. Multiple masters can be specified. They are all tried if one fails. .TP .B url: \fI Where to download a zonefile for the zone. With http or https. An example for the url is "http://www.example.com/example.org.zone". Multiple url statements can be given, they are tried in turn. If only urls are given the SOA refresh timer is used to wait for making new downloads. If also masters are listed, the masters are first probed with UDP SOA queries to see if the SOA serial number has changed, reducing the number of downloads. If none of the urls work, the masters are tried with IXFR and AXFR. For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used to authenticate the connection. .TP .B allow\-notify: \fI With allow\-notify you can specify additional sources of notifies. When notified, the server attempts to first probe and then zone transfer. If the notify is from a master, it first attempts that master. Otherwise other masters are attempted. If there are no masters, but only urls, the file is downloaded when notified. The masters from master: statements are allowed notify by default. .TP .B fallback\-enabled: \fI Default no. If enabled, unbound falls back to querying the internet as a resolver for this zone when lookups fail. For example for DNSSEC validation failures. .TP .B for\-downstream: \fI Default yes. If enabled, unbound serves authority responses to downstream clients for this zone. This option makes unbound behave, for the queries with names in this zone, like one of the authority servers for that zone. Turn it off if you want unbound to provide recursion for the zone but have a local copy of zone data. If for\-downstream is no and for\-upstream is yes, then unbound will DNSSEC validate the contents of the zone before serving the zone contents to clients and store validation results in the cache. .TP .B for\-upstream: \fI Default yes. If enabled, unbound fetches data from this data collection for answering recursion queries. Instead of sending queries over the internet to the authority servers for this zone, it'll fetch the data directly from the zone data. Turn it on when you want unbound to provide recursion for downstream clients, and use the zone data as a local copy to speed up lookups. .TP .B zonefile: \fI The filename where the zone is stored. If not given then no zonefile is used. If the file does not exist or is empty, unbound will attempt to fetch zone data (eg. from the master servers). a1515 13 .B dnscrypt\-provider\-cert\-rotated: \fI\fR Path to a certificate that we should be able to serve existing connection from but do not want to advertise over \fBdnscrypt\-provider\fR's TXT record certs distribution. A typical use case is when rotating certificates, existing clients may still use the client magic from the old cert in their queries until they fetch and update the new cert. Likewise, it would allow one to prime the new cert/key without distributing the new cert yet, this can be useful when using a network of servers using anycast and on which the configuration may not get updated at the exact same time. By priming the cert, the servers can handle both old and new certs traffic while distributing only one. This option may be specified multiple times. .TP a1663 26 .P If Unbound was built with \fB\-\-with\-libhiredis\fR on a system that has installed the hiredis C client library of Redis, then the "redis" backend can be used. This backend communicates with the specified Redis server over a TCP connection to store and retrieve cache data. It can be used as a persistent and/or shared cache backend. It should be noted that Unbound never removes data stored in the Redis server, even if some data have expired in terms of DNS TTL or the Redis server has cached too much data; if necessary the Redis server must be configured to limit the cache size, preferably with some kind of least-recently-used eviction policy. This backend uses synchronous communication with the Redis server based on the assumption that the communication is stable and sufficiently fast. The thread waiting for a response from the Redis server cannot handle other DNS queries. Although the backend has the ability to reconnect to the server when the connection is closed unexpectedly and there is a configurable timeout in case the server is overly slow or hangs up, these cases are assumed to be very rare. If connection close or timeout happens too often, Unbound will be effectively unusable with this backend. It's the administrator's responsibility to make the assumption hold. .P d1670 3 a1672 4 The default database is the in-memory backend named "testframe", which, as the name suggests, is not of any practical use. Depending on the build-time configuration, "redis" backend may also be used as described above. a1681 22 .P The following .B cachedb otions are specific to the redis backend. .TP .B redis-server-host: \fI\fR The IP (either v6 or v4) address or domain name of the Redis server. In general an IP address should be specified as otherwise Unbound will have to resolve the name of the server every time it establishes a connection to the server. This option defaults to "127.0.0.1". .TP .B redis-server-port: \fI\fR The TCP port number of the Redis server. This option defaults to 6379. .TP .B redis-timeout: \fI\fR The period until when Unbound waits for a response from the Redis sever. If this timeout expires Unbound closes the connection, treats it as if the Redis server does not have the requested data, and will try to re-establish a new connection later. This option defaults to 100 milliseconds. @ 1.1.1.4 log @Import 1.9.1: 1 March 2019: Wouter - output forwarder log in ssl_req_order test. 28 February 2019: Wouter - Remove memory leak on pythonmod python2 script file init. - Remove swig gcc8 python function cast warnings, they are ignored. - Print correct module that failed when module-config is wrong. 27 February 2019: Wouter - Fix #4229: Unbound man pages lack information, about access-control order and local zone tags, and elements in views. - Fix #14: contrib/unbound.init: Fix wrong comparison judgment before copying. - Fix for python module on Windows, fix fopen. 25 February 2019: Wouter - Fix #4227: pair event del and add for libevent for tcp_req_info. 21 February 2019: Wouter - Fix the error for unknown module in module-config is understandable, and explains it was not compiled in and where to see the list. - In example.conf explain where to put cachedb module in module-config. - In man page and example config explain that most modules have to be listed at the start of module-config. 20 February 2019: Wouter - Fix pythonmod include and sockaddr_un ifdefs for compile on Windows, and for libunbound. 18 February 2019: Wouter - Print query name with ip_ratelimit exceeded log lines. - Spaces instead of tabs in that log message. - Print query name and IP address when domain rate limit exceeded. 14 February 2019: Wouter - Fix capsforid canonical sort qsort callback. 11 February 2019: Wouter - Note default for module-config in man page. - Fix recursion lame test for qname minimisation asked queries, that were not present in the set of prepared answers. - Fix #13: Remove left-over requirements on OpenSSL >= 1.1.0 for cert name matching, from man page. - make depend, with newer gcc, nicer layout. 7 February 2019: Wouter - Fix #4206: OpenSSL 1.0.2 hostname verification for FreeBSD 11.2. - Fix that qname minimisation does not skip a label when missing nameserver targets need to be fetched. - Fix #4225: clients seem to erroneously receive no answer with DNS-over-TLS and qname-minimisation. 4 February 2019: Wouter - Fix that log-replies prints the correct name for local-alias names, for names that have a CNAME in local-data configuration. It logs the original query name, not the target of the CNAME. - Add local-zone type inform_redirect, which logs like type inform, and redirects like type redirect. - Perform canonical sort for 0x20 capsforid compare of replies, this sorts rrsets in the authority and additional section before comparison, so that out of order rrsets do not cause failure. 31 January 2019: Wouter - Set ub_ctx_set_tls call signature in ltrace config file for libunbound in contrib/libunbound.so.conf. - improve documentation for tls-service-key and forward-first. - #10: fixed pkg-config operations, PKG_PROG_PKG_CONFIG moved out of conditional section, fixes systemd builds, from Enrico Scholz. - #9: For openssl 1.0.2 use the CRYPTO_THREADID locking callbacks, still supports the set_id_callback previous API. And for 1.1.0 no locking callbacks are needed. - #8: Fix OpenSSL without ENGINE support compilation. - Wipe TLS session key data from memory on exit. 30 January 2019: Ralph - Fix case in which query timeout can result in marking delegation as edns_lame_known. 29 January 2019: Wouter - Fix spelling of tls-ciphers in example.conf.in. - Fix #4224: auth_xfr_notify.rpl test broken due to typo - Fix locking for libunbound context setup with broken port config. 28 January 2019: Wouter - ub_ctx_set_tls call for libunbound that enables DoT for the machines set with ub_ctx_set_fwd. Patch from Florian Obser. - Set build system for added call in the libunbound API. - List example config for root zone copy locally hosted with auth-zone as suggested from draft-ietf-dnsop-7706-bis-02. But with updated B root address. - set version to 1.9.0 for release. And this was released with the spelling for tls-ciphers fix as 1.9.0 on Feb 5. Trunk has 1.9.1 in development. 25 January 2019: Wouter - Fix that tcp for auth zone and outgoing does not remove and then gets the ssl read again applied to the deleted commpoint. - updated contrib/fastrpz.patch to cleanly diff. - no lock when threads disabled in tcp request buffer count. - remove compile warnings from libnettle compile. - output of newer lex 2.6.1 and bison 3.0.5. 24 January 2019: Wouter - Newer aclocal and libtoolize used for generating configure scripts, aclocal 1.16.1 and libtoolize 2.4.6. - Fix unit test for python 3.7 new keyword 'async'. - clang analysis fixes, assert arc4random buffer in init, no check for already checked delegation pointer in iterator, in testcode check for NULL packet matches, in perf do not copy from NULL start list when growing capacity. Adjust host and file only when present in test header read to please checker. In testcode for unknown macro operand give zero result. Initialise the passed argv array in test code. In test code add EDNS data segment copy only when nonempty. - Patch from Florian Obser fixes some compiler warnings: include mini_event.h to have a prototype for mini_ev_cmp include edns.h to have a prototype for apply_edns_options sldns_wire2str_edns_keepalive_print is only called in the wire2str, module declare it static to get rid of compiler warning: no previous prototype for function infra_find_ip_ratedata() is only called in the infra module, declare it static to get rid of compiler warning: no previous prototype for function do not shadow local variable buf in authzone auth_chunks_delete and az_nsec3_findnode are only called in the authzone module, declare them static to get rid of compiler warning: no previous prototype for function... copy_rrset() is only called in the respip module, declare it static to get rid of compiler warning: no previous prototype for function 'copy_rrset' no need for another variable "r"; gets rid of compiler warning: declaration shadows a local variable in libunbound.c no need for another variable "ns"; gets rid of compiler warning: declaration shadows a local variable in iterator.c - Moved includes and make depend. 23 January 2019: Wouter - Patch from Manabu Sonoda with tls-ciphers and tls-ciphersuites options for unbound.conf. - Fixes for the patch, and man page entry. - Fix configure to detect SSL_CTX_set_ciphersuites, for better library compatibility when compiling. - Patch for TLS session resumption from Manabu Sonoda, enable with tls-session-ticket-keys in unbound.conf. - Fixes for patch (includes, declarations, warnings). Free at end and keep config options in order read from file to keep the first one as the first one. - Fix for IXFR fallback to reset counter when IXFR does not timeout. 22 January 2019: Wouter - Fix space calculation for tcp req buffer size. - Doc for stream-wait-size and unit test. - unbound-control stats has mem.streamwait that counts TCP and TLS waiting result buffers. - Fix for #4219: secondaries not updated after serial change, unbound falls back to AXFR after IXFR gives several timeout failures. - Fix that auth zone after IXFR fallback tries the same master. 21 January 2019: Wouter - Fix tcp idle timeout test, for difference in the tcp reply code. - Unit test for tcp request reorder and timeouts. - Unit tests for ssl out of order processing. - Fix that multiple dns fragments can be carried in one TLS frame. - Add stream-wait-size: 4m config option to limit the maximum memory used by waiting tcp and tls stream replies. This avoids a denial of service where these replies use up all of the memory. 17 January 2019: Wouter - For caps-for-id fallback, use the whitelist to avoid timeout starting a fallback sequence for it. - increase mesh max activation count for capsforid long fetches. 16 January 2019: Ralph - Get ready for the DNS flag day: remove EDNS lame procedure, do not re-query without EDNS after timeout. 15 January 2019: Wouter - In the out of order processing, reset byte count for (potential) partial read. - Review fixes in out of order processing. 14 January 2019: Wouter - streamtcp option -a send queries consecutively and prints answers as they arrive. - Fix for out of order processing administration quit cleanup. - unit test for tcp out of order processing. 11 January 2019: Wouter - Initial commit for out-of-order processing for TCP and TLS. 9 January 2019: Wouter - Log query name for looping module errors. 8 January 2019: Wouter - Fix syntax in comment of local alias processing. - Fix NSEC3 record that is returned in wildcard replies from auth-zone zones with NSEC3 and wildcards. 7 January 2019: Wouter - On FreeBSD warn if systcl settings do not allow server TCP FASTOPEN, and server tcp fastopen is enabled at compile time. - Document interaction between the tls-upstream option in the server section and forward-tls-upstream option in the forward-zone sections. - Add contrib/unbound-fuzzme.patch from Jacob Hoffman-Andrews, the patch adds a program used for fuzzing. 12 December 2018: Wouter - Fix for crash in dns64 module if response is null. 10 December 2018: Wouter - Fix config parser memory leaks. - ip-ratelimit-factor of 1 allows all traffic through, instead of the previous blocking everything. - Fix for FreeBSD port make with dnscrypt and dnstap enabled. - Fix #4206: support openssl 1.0.2 for TLS hostname verification, alongside the 1.1.0 and later support that is already there. - Fixup openssl 1.0.2 compile 6 December 2018: Wouter - Fix dns64 allocation in wrong region for returned internal queries. 3 December 2018: Wouter - Fix icon, no ragged edges and nicer resolutions available, for eg. Win 7 and Windows 10 display. - cache-max-ttl also defines upperbound of initial TTL in response. 30 November 2018: Wouter - Patch for typo in unbound.conf man page. - log-tag-queryreply: yes in unbound.conf tags the log-queries and log-replies in the log file for easier log filter maintenance. 29 November 2018: Wouter - iana portlist updated. - Fix chroot auth-zone fix to remove chroot prefix. - tag for 1.8.2rc1, which became 1.8.2 on 4 dec 2018, with icon updated. Trunk contains 1.8.3 in development. Which became 1.8.3 on 11 december with only the dns64 fix of 6 dec. Trunk then became 1.8.4 in development. - Fix that unbound-checkconf does not complains if the config file is not placed inside the chroot. - Refuse to start with no ports. - Remove clang analysis warnings. 28 November 2018: Wouter - Fix leak in chroot fix for auth-zone. - Fix clang analysis for outside directory build test. 27 November 2018: Wouter - Fix DNS64 to not store intermediate results in cache, this avoids other threads from picking up the wrong data. The module restores the previous no_cache_store setting when the the module is finished. - Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work. - New and better fix for Fix #4193: Fix that prefetch failure does not overwrite valid cache entry with SERVFAIL. - auth-zone give SERVFAIL when expired, fallback activates when expired, and this is documented in the man page. - stat count SERVFAIL downstream auth-zone queries for expired zones. - Put new logos into windows installer. - Fix windows compile for new rrset roundrobin fix. - Update contrib fastrpz patch for latest release. 26 November 2018: Wouter - Fix to not set GLOB_NOSORT so the unbound.conf include: files are sorted and in a predictable order. - Fix #4193: Fix that prefetch failure does not overwrite valid cache entry with SERVFAIL. - Add unbound-control view_local_datas command, like local_datas. - Fix that unbound-control can send file for view_local_datas. 22 November 2018: Wouter - With ./configure --with-pyunbound --with-pythonmodule PYTHON_VERSION=3.6 or with 2.7 unbound can compile and unit tests succeed for the python module. - pythonmod logs the python error and traceback on failure. - ignore debug python module for test in doxygen output. - review fixes for python module. - Fix #4209: Crash in libunbound when called from getdns. - auth zone zonefiles can be in a chroot, the chroot directory components are removed before use. - Fix that empty zonefile means the zonefile is not set and not used. - make depend. 21 November 2018: Wouter - Scrub NS records from NODATA responses as well. 20 November 2018: Wouter - Scrub NS records from NXDOMAIN responses to stop fragmentation poisoning of the cache. - Add patch from Jan Vcelak for pythonmod, add sockaddr_storage getters, add support for query callbacks, allow raw address access via comm_reply and update API documentation. - Removed compile warnings in pythonmod sockaddr routines. 19 November 2018: Wouter - Support SO_REUSEPORT_LB in FreeBSD 12 with the so-reuseport: yes option in unbound.conf. 6 November 2018: Ralph - Bugfix min-client-subnet-ipv6 25 October 2018: Ralph - Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options. 25 October 2018: Wouter - Fix #4191: NXDOMAIN vs SERVFAIL during dns64 PTR query. - Fix #4190: Please create a "ANY" deny option, adds the option deny-any: yes in unbound.conf. This responds with an empty message to queries of type ANY. - Fix #4141: More randomness to rrset-roundrobin. - Fix #4132: Openness/closeness of RANGE intervals in rpl files. - Fix #4126: RTT_band too low on VSAT links with 600+ms latency, adds the option unknown-server-time-limit to unbound.conf that can be increased to avoid the problem. - remade makefile dependencies. - Fix #4152: Logs shows wrong time when using log-time-ascii: yes. 24 October 2018: Ralph - Add markdel function to ECS slabhash. - Limit ECS scope returned to client to the scope used for caching. - Make lint like previous #4154 fix. 22 October 2018: Wouter - Fix #4192: unbound-control-setup generates keys not readable by group. - check that the dnstap socket file can be opened and exists, print error if not. - Fix #4154: make ECS_MAX_TREESIZE configurable, with the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options. 22 October 2018: Ralph - Change fast-server-num default to 3. 8 October 2018: Ralph - Add fast-server-permil and fast-server-num options. - Deprecate low-rtt and low-rtt-permil options. 8 October 2018: Wouter - Squelch log of failed to tcp initiate after TCP Fastopen failure. 5 October 2018: Wouter - Squelch EADDRNOTAVAIL errors when the interface goes away, this omits 'can't assign requested address' errors unless verbosity is set to a high value. - Set default for so-reuseport to no for FreeBSD. It is enabled by default for Linux and DragonFlyBSD. The setting can be configured in unbound.conf to override the default. - iana port update. 2 October 2018: Wouter - updated contrib/fastrpz.patch to apply for this version - dnscrypt.c removed sizeof to get array bounds. - Fix testlock code to set noreturn on error routine. - Remove unused variable from contrib fastrpz/rpz.c and remove unused diagnostic pragmas that themselves generate warnings - clang analyze test is used only when assertions are enabled. 1 October 2018: Wouter - tag for release 1.8.1rc1. Became release 1.8.1 on 8 oct, with fastrpz.patch fix included. Trunk has 1.8.2 in development. 27 September 2018: Wouter - Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, fixes qname minimisation with a forwarder when connectivity has issues from rejecting responses. 25 September 2018: Wouter - Perform TLS SNI indication of the host that is being contacted for DNS over TLS service. It sets the configured tls auth name. This is useful for hosts that apart from the DNS over TLS services also provide other (web) services. - Fix #4149: Add SSL cleanup for tcp timeout. 17 September 2018: Wouter - Fix compile on Mac for unbound, provide explicit_bzero when libc does not have it. - Fix unbound for openssl in FIPS mode, it uses the digests with the EVP call contexts. - Fix that with harden-below-nxdomain and qname minisation enabled some iterator states for nonresponsive domains can get into a state where they waited for an empty list. - Stop UDP to TCP failover after timeouts that causes the ping count to be reset by the TCP time measurement (that exists for TLS), because that causes the UDP part to not be measured as timeout. - Fix #4156: Fix systemd service manager state change notification. 13 September 2018: Wouter - Fix seed for random backup code to use explicit zero when wiped. - exit log routine is annotated as noreturn function. - free memory leaks in config strlist and str2list insert functions. - do not move unused argv variable after getopt. - Remove unused if clause in testcode. - in testcode, free async ids, initialise array, and check for null pointer during test of the test. And use exit for return to note irregular program stop. - Free memory leak in config strlist append. - make sure nsec3 comparison salt is initialized. - unit test has clang analysis. - remove unused variable assignment from iterator scrub routine. - check for null in delegation point during iterator refetch in forward zone. - neater pointer cast in libunbound context quit routine. - initialize statistics totals for printout. - in authzone check that node exists before adding rrset. - in unbound-anchor, use readwrite memory BIO. - assertion in autotrust that packed rrset is formed correctly. - Fix memory leak when message parse fails partway through copy. - remove unused udpsize assignment in message encode. - nicer bio free code in unbound-anchor. - annotate exit functions with noreturn in unbound-control. 11 September 2018: Wouter - Fixed unused return value warnings in contrib/fastrpz.patch for asprintf. - Fix to squelch respip warning in unit test, it is printed at higher verbosity settings. - Fix spelling errors. - Fix initialisation in remote.c 10 September 2018: Wouter - 1.8.1 in svn trunk. (changes from 4,5,.. sep apply). - iana port update. 5 September 2018: Wouter - Fix spelling error in header, from getdns commit by Andreas Gelmini. 4 September 2018: Ralph - More explicitly mention the type of ratelimit when applying ip-ratelimit. 4 September 2018: Wouter - Tag for 1.8.0rc1 release, became 1.8.0 release on 10 Sep 2018. 31 August 2018: Wouter - Disable minimal-responses in subnet unit tests. 30 August 2018: Wouter - Fix that a local-zone with a local-zone-type that is transparent in a view with view-first, makes queries check for answers from the local-zones defined outside of views. 28 August 2018: Ralph - Disable minimal-responses in ipsecmod unit tests. - Added serve-expired-ttl and serve-expired-ttl-reset options. 27 August 2018: Wouter - Set defaults to yes for a number of options to increase speed and resilience of the server. The so-reuseport, harden-below-nxdomain, and minimal-responses options are enabled by default. They used to be disabled by default, waiting to make sure they worked. They are enabled by default now, and can be disabled explicitly by setting them to "no" in the unbound.conf config file. The reuseport and minimal options increases speed of the server, and should be otherwise harmless. The harden-below-nxdomain option works well together with the recently default enabled qname minimisation, this causes more fetches to use information from the cache. - next release is called 1.8.0. - Fix lintflags for lint on FreeBSD. 22 August 2018: George - #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This gives access to reply information for the client's communication point when the callback is called before the mesh state (modules). Changes to C and Python's inplace_callback signatures were also necessary. 21 August 2018: Wouter - log-local-actions: yes option for unbound.conf that logs all the local zone actions, a patch from Saksham Manchanda (Secure64). - #4146: num.query.subnet and num.query.subnet_cache counters. - Fix only misc failure from log-servfail when val-log-level is not enabled. 17 August 2018: Ralph - Fix classification for QTYPE=CNAME queries when QNAME minimisation is enabled. 17 August 2018: Wouter - Set libunbound to increase current, because the libunbound change to the event callback function signature. That needs programs, that use it, to recompile against the new header definition. - print servfail info to log as error. - added more servfail printout statements, to the iterator. - log-servfail: yes prints log lines that say why queries are returning SERVFAIL to clients. 16 August 2018: Wouter - Fix warning on compile without threads. - Fix contrib/fastrpz.patch. 15 August 2018: Wouter - Fix segfault in auth-zone read and reorder of RRSIGs. 14 August 2018: Wouter - Fix that printout of error for cycle targets is a verbosity 4 printout and does not wrongly print it is a memory error. - Upgraded crosscompile script to include libunbound DLL in the zipfile. 10 August 2018: Wouter - Fix #4144: dns64 module caches wrong (negative) information. 9 August 2018: Wouter - unbound-checkconf checks if modules exist and prints if they are not compiled in the name of the wrong module. - document --enable-subnet in doc/README. - Patch for stub-no-cache and forward-no-cache options that disable caching for the contents of that stub or forward, for when you want immediate changes visible, from Bjoern A. Zeeb. 7 August 2018: Ralph - Make capsforid fallback QNAME minimisation aware. 7 August 2018: Wouter - Fix #4142: unbound.service.in: improvements and fixes. Add unit dependency ordering (based on systemd-resolved). Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings about missing privileges during startup). Add 'AF_INET6' to 'RestrictAddressFamilies' (without it IPV6 can't work). From Guido Shanahan. - Patch to implement tcp-connection-limit from Jim Hague (Sinodun). This limits the number of simultaneous TCP client connections from a nominated netblock. - make depend, yacc, lex, doc, headers. And log the limit exceeded message only on high verbosity, so as to not spam the logs when it is busy. 6 August 2018: Wouter - Fix for #4136: Fix to unconditionally call destroy in daemon.c. 3 August 2018: George - Expose if a query (or a subquery) was ratelimited (not src IP ratelimiting) to libunbound under 'ub_result.was_ratelimited'. This also introduces a change to 'ub_event_callback_type' in libunbound/unbound-event.h. - Tidy pylib tests. 3 August 2018: Wouter - Revert previous change for #4136: because it introduces build problems. - New fix for #4136: This one ignores lex without without yylex_destroy. 1 August 2018: Wouter - Fix to remove systemd sockaddr function check, that is not always present. Make socket activation more lenient. But not different when socket activation is not used. - iana port list update. 31 July 2018: Wouter - Patches from Jim Hague (Sinodun) for EDNS KeepAlive. - Sort out test runs when the build directory isn't the project root directory. - Add config tcp-idle-timeout (default 30s). This applies to client connections only; the timeout on TCP connections upstream is unaffected. - Error if EDNS Keepalive received over UDP. - Add edns-tcp-keepalive and edns-tcp-keepalive timeout options and implement option in client responses. - Correct and expand manual page entries for keepalive and idle timeout. - Implement progressive backoff of TCP idle/keepalive timeout. - Fix 'make depend' to work when build dir is not project root. - Add delay parameter to streamtcp, -d secs. To be used when testing idle timeout. - From Wouter: make depend, the dependencies in the patches did not apply cleanly. Also remade yacc and lex. - Fix mesh.c incompatible pointer pass. - Please doxygen so it passes. - Fix #4139: Fix unbound-host leaks memory on ANY. 30 July 2018: Wouter - Fix #4136: insufficiency from mismatch of FLEX capability between released tarball and build host. 27 July 2018: Wouter - Fix man page, say that chroot is enabled by default. 26 July 2018: Wouter - Fix #4135: 64-bit Windows Installer Creates Entries Under The Wrong Registry Key, reported by Brian White. 23 July 2018: Wouter - Fix use-systemd readiness signalling, only when use-systemd is yes and not in signal handler. 20 July 2018: Wouter - Fix #4130: print text describing -dd and unbound-checkconf on config file read error at startup, the errors may have been moved away by the startup process. - Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared. 19 July 2018: Wouter - Fix #4129 unbound-control error message with wrong cert permissions is too cryptic. 17 July 2018: Wouter - Fix #4127 unbound -h does not list -p help. - Print error if SSL name verification configured but not available in the ssl library. - Fix that ratelimit and ip-ratelimit are applied after reload of changed config file. - Resize ratelimit and ip-ratelimit caches if changed on reload. 16 July 2018: Wouter - Fix qname minimisation NXDOMAIN validation lookup failures causing error_supers assertion fails. - Squelch can't bind socket errors with Permission denied unless verbosity is 4 or higher, for UDP outgoing sockets. 12 July 2018: Wouter - Fix to improve systemd socket activation code file descriptor assignment. - Fix for 4126 that the #define for UNKNOWN_SERVER_NICENESS can be more easily changed to adjust default rtt assumptions. 10 July 2018: Wouter - Note in documentation that the cert name match code needs OpenSSL 1.1.0 or later to be enabled. 6 July 2018: Wouter - Fix documentation ambiguity for tls-win-cert in tls-upstream and forward-tls-upstream docs. - iana port update. - Note RFC8162 support. SMIMEA record type can be read in by the zone record parser. - Fix round robin for failed addresses with prefer-ip6: yes 4 July 2018: Wouter - Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass if DNSSEC is not enabled. New option -R allows fallback from resolv.conf to direct queries. 3 July 2018: Wouter - Better documentation for unblock-lan-zones and insecure-lan-zones config statements. - Fix permission denied printed for auth zone probe random port nrs. 2 July 2018: Wouter - Fix checking for libhiredis printout in configure output. - Fix typo on man page in ip-address description. - Update libunbound/python/examples/dnssec_test.py example code to also set the 20326 trust anchor for the root in the example code. 29 June 2018: Wouter - dns64-ignore-aaaa: config option to list domain names for which the existing AAAA is ignored and dns64 processing is used on the A record. 28 June 2018: Wouter - num.queries.tls counter for queries over TLS. - log port number with err_addr logs. 27 June 2018: Wouter - #4109: Fix that package config depends on python unconditionally. - Patch, do not export python from pkg-config, from Petr Menšík. 26 June 2018: Wouter - Partial fix for permission denied on IPv6 address on FreeBSD. - Fix that auth-zone master reply with current SOA serial does not stop scan of masters for an updated zone. - Fix that auth-zone does not start the wait timer without checking if the wait timer has already been started. 21 June 2018: Wouter - #4108: systemd reload hang fix. - Fix usage printout for unbound-host, hostname has to be last argument on BSDs and Windows. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Mar 12, 2019" "NLnet Labs" "unbound 1.9.1" d124 1 a124 1 Same as interface: (for ease of compatibility with nsd.conf). a209 10 .B stream\-wait\-size: \fI Number of bytes size maximum to use for waiting stream buffers. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). As TCP and TLS streams queue up multiple results, the amount of memory used for these buffers does not exceed this number, otherwise the responses are dropped. This manages the total memory usage of the server (under heavy use), the number of requests that can be queued up per connection is also limited, with further requests waiting in TCP buffers. .TP a255 6 .B unknown\-server\-time\-limit: \fI The wait time in msec for waiting for an unknown server to reply. Increase this if you are behind a slow satellite link, to eg. 1128. That would then avoid re\-querying every initial query because it times out. Default is 376 msec. .TP d281 3 a283 3 distribute incoming queries to threads more evenly. Default is yes. On Linux it is supported in kernels >= 3.9. On other systems, FreeBSD, OSX it may also work. You can enable it (on any platform and kernel), d317 3 a319 1 86400 seconds (1 day). When the TTL expires, the cache item has expired. d321 1 a321 1 trust (very large) TTL values. Downstream clients also see the lower TTL. a391 31 .B tcp-idle-timeout: \fI\fR The period Unbound will wait for a query on a TCP connection. If this timeout expires Unbound closes the connection. This option defaults to 30000 milliseconds. When the number of free incoming TCP buffers falls below 50% of the total number configured, the option value used is progressively reduced, first to 1% of the configured value, then to 0.2% of the configured value if the number of free buffers falls below 35% of the total number configured, and finally to 0 if the number of free buffers falls below 20% of the total number configured. A minimum timeout of 200 milliseconds is observed regardless of the option value used. .TP .B edns-tcp-keepalive: \fI\fR Enable or disable EDNS TCP Keepalive. Default is no. .TP .B edns-tcp-keepalive-timeout: \fI\fR The period Unbound will wait for a query on a TCP connection when EDNS TCP Keepalive is active. If this timeout expires Unbound closes the connection. If the client supports the EDNS TCP Keepalive option, Unbound sends the timeout value to the client to encourage it to close the connection before the server times out. This option defaults to 120000 milliseconds. When the number of free incoming TCP buffers falls below 50% of the total number configured, the advertised timeout is progressively reduced to 1% of the configured value, then to 0.2% of the configured value if the number of free buffers falls below 35% of the total number configured, and finally to 0 if the number of free buffers falls below 20% of the total number configured. A minimum actual timeout of 200 milliseconds is observed regardless of the advertised timeout. .TP d406 1 a406 1 If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert to a407 2 This option enables TLS for all of them, but if you do not set this you can configure TLS specifically for some forward zones with forward\-tls\-upstream. And also with stub\-tls\-upstream. d414 8 a421 9 If enabled, the server provides TLS service on the TCP ports marked implicitly or explicitly for TLS service with tls\-port. The file must contain the private key for the TLS session, the public certificate is in the tls\-service\-pem file and it must also be specified if tls\-service\-key is specified. The default is "", turned off. Enabling or disabling this service requires a restart (a reload is not enough), because the key is read while root permissions are held and before chroot (if any). The ports enabled implicitly or explicitly via \fBtls\-port:\fR do not provide normal DNS TCP service. a459 21 .B tls-session-ticket-keys: \fI If not "", lists files with 80 bytes of random contents that are used to perform TLS session resumption for clients using the unbound server. These files contain the secret key for the TLS session tickets. First key use to encrypt and decrypt TLS session tickets. Other keys use to decrypt only. With this you can roll over to new keys, by generating a new first file and allowing decrypt of the old file by listing it after the first file for some time, after the wait clients are not using the old key any more and the old key can be removed. One way to create the file is dd if=/dev/random bs=1 count=80 of=ticket.dat The first 16 bytes should be different from the old one if you create a second key, that is the name used to identify the key. Then there is 32 bytes random data for an AES key and then 32 bytes random data for the HMAC key. .TP .B tls\-ciphers: \fI Set the list of ciphers to allow when serving TLS. Use "" for defaults, and that is the default. .TP .B tls\-ciphersuites: \fI Set the list of ciphersuites to allow when serving TLS. This is for newer TLS 1.3 connections. Use "" for defaults, and that is the default. .TP a468 5 .B tcp\-connection\-limit: \fI Allow up to \fIlimit\fR simultaneous TCP connections from the given netblock. When at the limit, further connections are accepted but closed immediately. This option is experimental at this time. .TP a474 1 The order of the access\-control statements therefore does not matter. d560 2 a561 3 If given a chroot is done to the given directory. By default chroot is enabled and the default is "@@UNBOUND_CHROOT_DIR@@". If you give "" no chroot is performed. a620 15 .B log\-tag\-queryreply: \fI Prints the word 'query' and 'reply' with log\-queries and log\-replies. This makes filtering logs easier. The default is off (for backwards compatibility). .TP .B log\-local\-actions: \fI Print log lines to inform about local zone actions. These lines are like the local\-zone type inform prints out, but they are also printed for the other types of local zones. .TP .B log\-servfail: \fI Print log lines that say why queries return SERVFAIL to clients. This is separate from the verbosity debug logs, much smaller, and printed at the error level, not the info level of debug info from verbosity. .TP d703 1 a703 1 have DNSSEC. Default is on. d804 1 a804 1 .B prefetch\-key: \fI d809 1 a809 7 .B deny\-any: \fI If yes, deny queries of type ANY with an empty response. Default is no. If disabled, unbound responds with a short list of resource records if some can be found in the cache and makes the upstream type ANY query if there are none. .TP .B rrset\-roundrobin: \fI d817 1 a817 1 This may cause a slight speedup. The default is yes, even though the DNS d819 1 a819 3 be of use and save roundtrips for clients. Because they are not used, and the saved roundtrips are easier saved with prefetch, whilst this is faster. a834 6 The default is "validator iterator". When the server is built with EDNS client subnet support the default is "subnetcache validator iterator". Most modules that need to be listed here have to be listed at the beginning of the line. The cachedb module has to be listed just before the iterator. The python module can be listed in different places, it then processes the output of the module it is just before. a966 11 .B serve\-expired\-ttl: \fI Limit serving of expired responses to configured seconds after expiration. 0 disables the limit. This option only applies when \fBserve\-expired\fR is enabled. The default is 0. .TP .B serve\-expired\-ttl\-reset: \fI Set the TTL of expired records to the \fBserve\-expired\-ttl\fR value after a failed attempt to retrieve the record from upstream. This makes sure that the expired records will be served as long as there are queries for it. Default is "no". .TP d1015 1 a1015 1 .B unblock\-lan\-zones: \fI d1026 1 a1026 1 .B insecure\-lan\-zones: \fI d1035 1 a1035 1 inform_redirect, always_transparent, always_refuse, always_nxdomain, noview, a1095 4 \h'5'\fIinform_redirect\fR The query is redirected, like 'redirect', and logged, like 'inform'. Ie. answer queries with fixed data and also log the machines that ask. .TP 10 d1251 1 a1251 2 tags. When there are multiple tags it checks if the intersection of the list of tags for the query and local\-zone\-tag is non-empty. d1334 16 a1349 14 .B fast\-server\-permil: \fI Specify how many times out of 1000 to pick from the set of fastest servers. 0 turns the feature off. A value of 900 would pick from the fastest servers 90 percent of the time, and would perform normal exploration of random servers for the remaining time. When prefetch is enabled (or serve\-expired), such prefetches are not sped up, because there is no one waiting for it, and it presents a good moment to perform server exploration. The \fBfast\-server\-num\fR option can be used to specify the size of the fastest servers set. The default for fast\-server\-permil is 0. .TP 5 .B fast\-server\-num: \fI Set the number of servers that should be used for fast server selection. Only use the fastest specified number of servers with the fast\-server\-permil option, that turns this on or off. The default is to use the fastest 3 servers. a1472 4 .TP .B stub\-no\-cache: \fI Default is no. If enabled, data inside the stub is not cached. This is useful when you want immediate changes to be visible. d1509 4 a1512 3 If a forwarded query is met with a SERVFAIL error, and this option is enabled, unbound will fall back to normal recursive resolution for this query as if no query forwarding had been specified. The default is "no". d1517 1 a1517 1 If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert to a1521 4 .TP .B forward\-no\-cache: \fI Default is no. If enabled, data inside the forward is not cached. This is useful when you want immediate changes to be visible. a1537 7 .LP If the update fetch fails, the timers in the SOA record are used to time another fetch attempt. Until the SOA expiry timer is reached. Then the zone is expired. When a zone is expired, queries are SERVFAIL, and any new serial number is accepted from the master (even if older), and if fallback is enabled, the fallback activates to fetch from the upstream instead of the SERVFAIL. d1596 1 a1596 3 \fBlocal\-data\fR elements. Views can also contain view\-first, response\-ip, response\-ip\-data and local\-data\-ptr elements. View can be mapped to requests by specifying the a1655 6 .TP .B dns64\-ignore\-aaaa: \fI\fR List domain for which the AAAA records are ignored and the A record is used by dns64 processing instead. Can be entered multiple times, list a new domain for which it applies, one per line. Applies also to names underneath the name given. a1770 18 .TP .B min\-client\-subnet\-ipv6: \fI\fR Specifies the minimum prefix length of the IPv6 source mask we are willing to accept in queries. Shorter source masks result in REFUSED answers. Source mask of 0 is always accepted. Default is 0. .TP .B min\-client\-subnet\-ipv4: \fI\fR Specifies the minimum prefix length of the IPv4 source mask we are willing to accept in queries. Shorter source masks result in REFUSED answers. Source mask of 0 is always accepted. Default is 0. .TP .B max\-ecs\-tree\-size\-ipv4: \fI\fR Specifies the maximum number of subnets ECS answers kept in the ECS radix tree. This number applies for each qname/qclass/qtype tuple. Defaults to 100. .TP .B max\-ecs\-tree\-size\-ipv6: \fI\fR Specifies the maximum number of subnets ECS answers kept in the ECS radix tree. This number applies for each qname/qclass/qtype tuple. Defaults to 100. @ 1.1.1.4.2.1 log @Pull up the following, requested by christos in ticket #604: external/bsd/unbound/dist/ipset/ipset.c up to 1.1.1.1 external/bsd/unbound/dist/ipset/ipset.h up to 1.1.1.1 external/bsd/unbound/dist/compat/getentropy_freebsd.c up to 1.1.1.1 external/bsd/unbound/dist/contrib/drop-tld.diff up to 1.1.1.1 external/bsd/unbound/dist/contrib/unbound-fuzzers.tar.bz2 up to 1.1.1.1 external/bsd/unbound/dist/doc/README.ipset.md up to 1.1.1.1 external/bsd/unbound/dist/pythonmod/examples/avahi-resolver.py up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_nsec3_ent.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_minimal.rpl up to 1.1.1.1 external/bsd/unbound/dist/.travis.yml up to 1.1.1.1 external/bsd/unbound/dist/README.md up to 1.1.1.1 external/bsd/unbound/dist/.gitattributes delete external/bsd/unbound/dist/.gitignore delete external/bsd/unbound/dist/Makefile.in up to 1.1.1.5 external/bsd/unbound/dist/aclocal.m4 up to 1.1.1.4 external/bsd/unbound/dist/config.guess up to 1.4 external/bsd/unbound/dist/config.h.in up to 1.1.1.5 external/bsd/unbound/dist/config.sub up to 1.4 external/bsd/unbound/dist/configure up to 1.1.1.5 external/bsd/unbound/dist/configure.ac up to 1.1.1.5 external/bsd/unbound/dist/install-sh up to 1.1.1.3 external/bsd/unbound/dist/cachedb/cachedb.c up to 1.1.1.5 external/bsd/unbound/dist/compat/getentropy_linux.c up to 1.1.1.3 external/bsd/unbound/dist/compat/getentropy_osx.c up to 1.1.1.2 external/bsd/unbound/dist/compat/getentropy_solaris.c up to 1.1.1.2 external/bsd/unbound/dist/compat/getentropy_win.c up to 1.1.1.2 external/bsd/unbound/dist/compat/malloc.c up to 1.1.1.2 external/bsd/unbound/dist/compat/sha512.c up to 1.1.1.3 external/bsd/unbound/dist/compat/snprintf.c up to 1.1.1.2 external/bsd/unbound/dist/contrib/README up to 1.1.1.5 external/bsd/unbound/dist/contrib/create_unbound_ad_servers.sh up to 1.1.1.2 external/bsd/unbound/dist/contrib/fastrpz.patch up to 1.1.1.4 external/bsd/unbound/dist/contrib/unbound.init up to 1.1.1.3 external/bsd/unbound/dist/contrib/unbound.init_fedora up to 1.1.1.2 external/bsd/unbound/dist/contrib/unbound.service.in up to 1.1.1.3 external/bsd/unbound/dist/daemon/daemon.c up to 1.1.1.5 external/bsd/unbound/dist/daemon/remote.c up to 1.1.1.5 external/bsd/unbound/dist/daemon/stats.c up to 1.1.1.5 external/bsd/unbound/dist/daemon/unbound.c up to 1.1.1.5 external/bsd/unbound/dist/daemon/worker.c up to 1.1.1.5 external/bsd/unbound/dist/dns64/dns64.c up to 1.1.1.4 external/bsd/unbound/dist/dnscrypt/dnscrypt.c up to 1.1.1.4 external/bsd/unbound/dist/doc/Changelog up to 1.1.1.5 external/bsd/unbound/dist/doc/README up to 1.1.1.5 external/bsd/unbound/dist/doc/TODO up to 1.1.1.2 external/bsd/unbound/dist/doc/example.conf.in up to 1.1.1.5 external/bsd/unbound/dist/doc/libunbound.3.in up to 1.1.1.5 external/bsd/unbound/dist/doc/unbound-anchor.8.in up to 1.1.1.5 external/bsd/unbound/dist/doc/unbound-checkconf.8.in up to 1.1.1.5 external/bsd/unbound/dist/doc/unbound-control.8.in up to 1.1.1.5 external/bsd/unbound/dist/doc/unbound-host.1.in up to 1.1.1.5 external/bsd/unbound/dist/doc/unbound.8.in up to 1.1.1.5 external/bsd/unbound/dist/doc/unbound.conf.5.in up to 1.1.1.5 external/bsd/unbound/dist/doc/unbound.doxygen up to 1.1.1.4 external/bsd/unbound/dist/edns-subnet/subnetmod.c up to 1.1.1.4 external/bsd/unbound/dist/ipsecmod/ipsecmod.c up to 1.1.1.3 external/bsd/unbound/dist/iterator/iter_scrub.c up to 1.1.1.5 external/bsd/unbound/dist/iterator/iter_utils.c up to 1.1.1.5 external/bsd/unbound/dist/iterator/iter_utils.h up to 1.1.1.5 external/bsd/unbound/dist/iterator/iterator.c up to 1.1.1.5 external/bsd/unbound/dist/libunbound/context.c up to 1.1.1.5 external/bsd/unbound/dist/libunbound/context.h up to 1.1.1.4 external/bsd/unbound/dist/libunbound/libunbound.c up to 1.1.1.5 external/bsd/unbound/dist/libunbound/libworker.c up to 1.1.1.5 external/bsd/unbound/dist/libunbound/python/libunbound.i up to 1.1.1.3 external/bsd/unbound/dist/pythonmod/interface.i up to 1.1.1.5 external/bsd/unbound/dist/pythonmod/pythonmod.c up to 1.1.1.4 external/bsd/unbound/dist/pythonmod/doc/examples/example0-1.py up to 1.1.1.3 external/bsd/unbound/dist/pythonmod/doc/examples/example0.rst up to 1.1.1.3 external/bsd/unbound/dist/pythonmod/examples/calc.py up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/examples/edns.py up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/examples/inplace_callbacks.py up to 1.1.1.3 external/bsd/unbound/dist/respip/respip.c up to 1.1.1.3 external/bsd/unbound/dist/services/authzone.c up to 1.1.1.4 external/bsd/unbound/dist/services/authzone.h up to 1.1.1.4 external/bsd/unbound/dist/services/listen_dnsport.c up to 1.1.1.5 external/bsd/unbound/dist/services/localzone.c up to 1.1.1.5 external/bsd/unbound/dist/services/mesh.c up to 1.1.1.5 external/bsd/unbound/dist/services/modstack.c up to 1.1.1.4 external/bsd/unbound/dist/services/outside_network.c up to 1.1.1.5 external/bsd/unbound/dist/services/outside_network.h up to 1.1.1.5 external/bsd/unbound/dist/services/cache/dns.c up to 1.1.1.5 external/bsd/unbound/dist/sldns/parse.c up to 1.1.1.3 external/bsd/unbound/dist/sldns/rrdef.c up to 1.1.1.4 external/bsd/unbound/dist/sldns/sbuffer.c up to 1.1.1.3 external/bsd/unbound/dist/sldns/sbuffer.h up to 1.1.1.4 external/bsd/unbound/dist/sldns/str2wire.c up to 1.1.1.4 external/bsd/unbound/dist/sldns/wire2str.c up to 1.1.1.5 external/bsd/unbound/dist/sldns/wire2str.h up to 1.1.1.4 external/bsd/unbound/dist/smallapp/unbound-anchor.c up to 1.1.1.4 external/bsd/unbound/dist/smallapp/unbound-checkconf.c up to 1.1.1.5 external/bsd/unbound/dist/smallapp/unbound-control.c up to 1.1.1.5 external/bsd/unbound/dist/smallapp/unbound-host.c up to 1.1.1.5 external/bsd/unbound/dist/testcode/asynclook.c up to 1.1.1.5 external/bsd/unbound/dist/testcode/delayer.c up to 1.1.1.3 external/bsd/unbound/dist/testcode/fake_event.c up to 1.1.1.5 external/bsd/unbound/dist/testcode/memstats.c up to 1.1.1.3 external/bsd/unbound/dist/testcode/mini_tdir.sh up to 1.1.1.2 external/bsd/unbound/dist/testcode/perf.c up to 1.1.1.4 external/bsd/unbound/dist/testcode/petal.c up to 1.1.1.4 external/bsd/unbound/dist/testcode/streamtcp.c up to 1.1.1.5 external/bsd/unbound/dist/testcode/testbound.c up to 1.1.1.5 external/bsd/unbound/dist/testcode/testpkts.c up to 1.1.1.5 external/bsd/unbound/dist/testcode/unitmain.c up to 1.1.1.5 external/bsd/unbound/dist/testcode/unitmsgparse.c up to 1.1.1.3 external/bsd/unbound/dist/testcode/unitregional.c up to 1.1.1.2 external/bsd/unbound/dist/testdata/auth_nsec3_wild.rpl up to 1.1.1.2 external/bsd/unbound/dist/util/alloc.c up to 1.1.1.4 external/bsd/unbound/dist/util/config_file.c up to 1.1.1.5 external/bsd/unbound/dist/util/config_file.h up to 1.1.1.5 external/bsd/unbound/dist/util/configlexer.c up to 1.1.1.5 external/bsd/unbound/dist/util/configlexer.lex up to 1.1.1.5 external/bsd/unbound/dist/util/configparser.c up to 1.1.1.5 external/bsd/unbound/dist/util/configparser.h up to 1.1.1.5 external/bsd/unbound/dist/util/configparser.y up to 1.1.1.5 external/bsd/unbound/dist/util/fptr_wlist.c up to 1.1.1.5 external/bsd/unbound/dist/util/iana_ports.inc up to 1.1.1.5 external/bsd/unbound/dist/util/log.c up to 1.1.1.5 external/bsd/unbound/dist/util/mini_event.c up to 1.3 external/bsd/unbound/dist/util/net_help.c up to 1.1.1.5 external/bsd/unbound/dist/util/net_help.h up to 1.1.1.5 external/bsd/unbound/dist/util/netevent.c up to 1.3 external/bsd/unbound/dist/util/random.c up to 1.1.1.2 external/bsd/unbound/dist/util/random.h up to 1.1.1.2 external/bsd/unbound/dist/util/regional.c up to 1.1.1.2 external/bsd/unbound/dist/util/ub_event.c up to 1.1.1.4 external/bsd/unbound/dist/util/ub_event_pluggable.c up to 1.1.1.3 external/bsd/unbound/dist/util/winsock_event.c up to 1.1.1.3 external/bsd/unbound/dist/util/data/dname.c up to 1.1.1.4 external/bsd/unbound/dist/util/data/msgencode.c up to 1.1.1.4 external/bsd/unbound/dist/util/data/msgencode.h up to 1.1.1.2 external/bsd/unbound/dist/util/data/msgparse.c up to 1.1.1.4 external/bsd/unbound/dist/util/data/msgreply.c up to 1.1.1.5 external/bsd/unbound/dist/util/data/msgreply.h up to 1.1.1.5 external/bsd/unbound/dist/util/shm_side/shm_main.c up to 1.1.1.2 external/bsd/unbound/dist/util/storage/lookup3.c up to 1.1.1.3 external/bsd/unbound/dist/validator/autotrust.c up to 1.1.1.4 external/bsd/unbound/dist/validator/val_anchor.c up to 1.1.1.4 external/bsd/unbound/dist/validator/val_secalgo.c up to 1.1.1.5 external/bsd/unbound/dist/validator/val_sigcrypt.c up to 1.1.1.4 external/bsd/unbound/dist/validator/validator.c up to 1.1.1.5 external/bsd/unbound/include/config.h up to 1.7 doc/3RDPARTY (manually edited) Import unbound 1.9.6: 6 December 2019: Wouter - Fix ipsecmod compile. - Fix Makefile.in for ipset module compile, from Adi Prasaja. 5 December 2019: Wouter - unbound-fuzzers.tar.bz2: three programs for fuzzing, that are 1:1 replacements for unbound-fuzzme.c that gets created after applying the contrib/unbound-fuzzme.patch. They are contributed by Eric Sesterhenn from X41 D-Sec. - tag for 1.9.6rc1. 4 December 2019: Wouter - Fix lock type for memory purify log lock deletion. - Fix testbound for alloccheck runs, memory purify and lock checks. - update contrib/fastrpz.patch to apply more cleanly. - Fix Make Test Fails when Configured With --enable-alloc-nonregional, reported by X41 D-Sec. 3 December 2019: Wouter - Merge pull request #124 from rmetrich: Changed log lock from 'quick' to 'basic' because this is an I/O lock. - Fix text around serial arithmatic used for RRSIG times to refer to correct RFC number. - Fix Assert Causing DoS in synth_cname(), reported by X41 D-Sec. - Fix similar code in auth_zone synth cname to add the extra checks. - Fix Assert Causing DoS in dname_pkt_copy(), reported by X41 D-Sec. - Fix OOB Read in sldns_wire2str_dname_scan(), reported by X41 D-Sec. - Fix Out of Bounds Write in sldns_str2wire_str_buf(), reported by X41 D-Sec. - Fix Out of Bounds Write in sldns_b64_pton(), fixed by check in sldns_str2wire_int16_data_buf(), reported by X41 D-Sec. - Fix Insufficient Handling of Compressed Names in dname_pkt_copy(), reported by X41 D-Sec. - Fix Out of Bound Write Compressed Names in rdata_copy(), reported by X41 D-Sec. - Fix Hang in sldns_wire2str_pkt_scan(), reported by X41 D-Sec. This further lowers the max to 256. - Fix snprintf() supports the n-specifier, reported by X41 D-Sec. - Fix Bad Indentation, in dnscrypt.c, reported by X41 D-Sec. - Fix Client NONCE Generation used for Server NONCE, reported by X41 D-Sec. - Fix compile error in dnscrypt. - Fix _vfixed not Used, removed from sbuffer code, reported by X41 D-Sec. - Fix Hardcoded Constant, reported by X41 D-Sec. - make depend 2 December 2019: Wouter - Merge pull request #122 from he32: In tcp_callback_writer(), don't disable time-out when changing to read. 22 November 2019: George - Fix compiler warnings. 22 November 2019: Wouter - Fix dname loop maximum, reported by Eric Sesterhenn from X41 D-Sec. - Add make distclean that removes everything configure produced, and make maintainer-clean that removes bison and flex output. 20 November 2019: Wouter - Fix Out of Bounds Read in rrinternal_get_owner(), reported by X41 D-Sec. - Fix Race Condition in autr_tp_create(), reported by X41 D-Sec. - Fix Shared Memory World Writeable, reported by X41 D-Sec. - Adjust unbound-control to make stats_shm a read only operation. - Fix Weak Entropy Used For Nettle, reported by X41 D-Sec. - Fix Randomness Error not Handled Properly, reported by X41 D-Sec. - Fix Out-of-Bounds Read in dname_valid(), reported by X41 D-Sec. - Fix Config Injection in create_unbound_ad_servers.sh, reported by X41 D-Sec. - Fix Local Memory Leak in cachedb_init(), reported by X41 D-Sec. - Fix Integer Underflow in Regional Allocator, reported by X41 D-Sec. - Upgrade compat/getentropy_linux.c to version 1.46 from OpenBSD. - Synchronize compat/getentropy_win.c with version 1.5 from OpenBSD, no changes but makes the file, comments, identical. - Upgrade compat/getentropy_solaris.c to version 1.13 from OpenBSD. - Upgrade compat/getentropy_osx.c to version 1.12 from OpenBSD. - Changes to compat/getentropy files for, no link to openssl if using nettle, and hence config.h for HAVE_NETTLE variable. compat definition of MAP_ANON, for older systems. ifdef stdint.h inclusion for older systems. ifdef sha2.h inclusion for older systems. - Fixed Compat Code Diverging from Upstream, reported by X41 D-Sec. - Fix compile with --enable-alloc-checks, reported by X41 D-Sec. - Fix Terminating Quotes not Written, reported by X41 D-Sec. - Fix Useless memset() in validator, reported by X41 D-Sec. - Fix Unrequired Checks, reported by X41 D-Sec. - Fix Enum Name not Used, reported by X41 D-Sec. - Fix NULL Pointer Dereference via Control Port, reported by X41 D-Sec. - Fix Bad Randomness in Seed, reported by X41 D-Sec. - Fix python examples/calc.py for eval, reported by X41 D-Sec. - Fix comments for doxygen in dns64. 19 November 2019: Wouter - Fix CVE-2019-18934, shell execution in ipsecmod. - 1.9.5 is 1.9.4 with bugfix, trunk is 1.9.6 in development. - Fix authzone printout buffer length check. - Fixes to please lint checks. - Fix Integer Overflow in Regional Allocator, reported by X41 D-Sec. - Fix Unchecked NULL Pointer in dns64_inform_super() and ipsecmod_new(), reported by X41 D-Sec. - Fix Out-of-bounds Read in rr_comment_dnskey(), reported by X41 D-Sec. - Fix Integer Overflows in Size Calculations, reported by X41 D-Sec. - Fix Integer Overflow to Buffer Overflow in sldns_str2wire_dname_buf_origin(), reported by X41 D-Sec. - Fix Out of Bounds Read in sldns_str2wire_dname(), reported by X41 D-Sec. - Fix Out of Bounds Write in sldns_bget_token_par(), reported by X41 D-Sec. 18 November 2019: Wouter - In unbound-host use separate variable for get_option to please code checkers. - update to bison output of 3.4.1 in code repository. - Provide a prototype for compat malloc to remove compile warning. - Portable grep usage for reuseport configure test. - Check return type of HMAC_Init_ex for openssl 0.9.8. - gitignore .source tempfile used for compatible make. 13 November 2019: Wouter - iana portlist updated. - contrib/fastrpz.patch updated to apply for current code. - fixes for splint cleanliness, long vs int in SSL set_mode. 11 November 2019: Wouter - Fix #109: check number of arguments for stdin-pipes in unbound-control and fail if too many arguments. - Merge #102 from jrtc27: Add getentropy emulation for FreeBSD. 24 October 2019: Wouter - Fix #99: Memory leak in ub_ctx (event_base will never be freed). 23 October 2019: George - Add new configure option `--enable-fully-static` to enable full static build if requested; in relation to #91. 23 October 2019: Wouter - Merge #97: manpage: Add missing word on unbound.conf, from Erethon. 22 October 2019: Wouter - drop-tld.diff: adds option drop-tld: yesno that drops 2 label queries, to stop random floods. Apply with patch -p1 < contrib/drop-tld.diff and compile. From Saksham Manchanda (Secure64). Please note that we think this will drop DNSKEY and DS lookups for tlds and hence break DNSSEC lookups for downstream clients. 7 October 2019: Wouter - Add doxygen comments to unbound-anchor source address code, in #86. 3 October 2019: Wouter - Merge #90 from vcunat: fix build with nettle-3.5. - Merge 1.9.4 release with fix for vulnerability CVE-2019-16866. - Continue with development of 1.9.5. - Merge #86 from psquarejho: Added -b source address option to smallapp/unbound-anchor.c, from Lukas Wunner. 26 September 2019: Wouter - Merge #87 from hardfalcon: Fix contrib/unbound.service.in, Drop CAP_KILL, use + prefix for ExecReload= instead. 25 September 2019: Wouter - The unbound.conf includes are sorted ascending, for include statements with a '*' from glob. 23 September 2019: Wouter - Merge #85 for #84 from sam-lunt: Add kill capability to systemd service file to fix that systemctl reload fails. 20 September 2019: Wouter - Merge #82 from hardfalcon: Downgrade CAP_NET_ADMIN to CAP_NET_RAW in unbound.service. - Merge #81 from Maryse47: Consistently use /dev/urandom instead of /dev/random in scripts and docs. - Merge #83 from Maryse47: contrib/unbound.service.in: do not fork into the background. 19 September 2019: Wouter - Fix #78: Memory leak in outside_network.c. - Merge pull request #76 from Maryse47: Improvements and fixes for systemd unbound.service. - oss-fuzz badge on README.md. - Fix fix for #78 to also free service callback struct. - Fix for oss-fuzz build warning. - Fix wrong response ttl for prepended short CNAME ttls, this would create a wrong zero_ttl response count with serve-expired enabled. - Merge #80 from stasic: Improve wording in man page. 11 September 2019: Wouter - Use explicit bzero for wiping clear buffer of hash in cachedb, reported by Eric Sesterhenn from X41 D-Sec. 9 September 2019: Wouter - Fix #72: configure --with-syslog-facility=LOCAL0-7 with default LOG_DAEMON (as before) can set the syslog facility that the server uses to log messages. 4 September 2019: Wouter - Fix #71: fix openssl error squelch commit compilation error. 3 September 2019: Wouter - squelch DNS over TLS errors 'ssl handshake failed crypto error' on low verbosity, they show on verbosity 3 (query details), because there is a high volume and the operator cannot do anything for the remote failure. Specifically filters the high volume errors. 2 September 2019: Wouter - ipset module #28: log that an address is added, when verbosity high. - ipset: refactor long routine into three smaller ones. - updated Makefile dependencies. 23 August 2019: Wouter - Fix contrib/fastrpz.patch asprintf return value checks. 22 August 2019: Wouter - Fix that pkg-config is setup before --enable-systemd needs it. - 1.9.3rc2 release candidate tag. And this became the 1.9.3 release. Master is 1.9.4 in development. 21 August 2019: Wouter - Fix log_dns_msg to log irrespective of minimal responses config. 19 August 2019: Ralph - Document limitation of pidfile removal outside of chroot directory. 16 August 2019: Wouter - Fix unittest valgrind false positive uninitialised value report, where if gcc 9.1.1 uses -O2 (but not -O1) then valgrind 3.15.0 issues an uninitialised value for the token buffer at the str2wire.c rrinternal_get_owner() strcmp with the '@@' value. Rewritten to use straight character comparisons removes the false positive. Also valgrinds --expensive-definedness-checks=yes can stop this false positive. - Please doxygen's parser for "@@" occurrence in doxygen comment. - Fixup contrib/fastrpz.patch - Remove warning about unknown cast-function-type warning pragma. 15 August 2019: Wouter - iana portlist updated. - Fix autotrust temp file uniqueness windows compile. - avoid warning about upcast on 32bit systems for autotrust. - escape commandline contents for -V. - Fix character buffer size in ub_ctx_hosts. - 1.9.3rc1 release candidate tag. - Option -V prints if TCP fastopen is available. 14 August 2019: George - Fix #59, when compiled with systemd support check that we can properly communicate with systemd through the `NOTIFY_SOCKET`. 14 August 2019: Wouter - Generate configlexer with newer flex. - Fix warning for unused variable for compilation without systemd. 12 August 2019: George - Introduce `-V` option to print the version number and build options. Previously reported build options like linked libs and linked modules are now moved from `-h` to `-V` as well for consistency. - PACKAGE_BUGREPORT now also includes link to GitHub issues. 1 August 2019: Wouter - For #52 #53, second context does not close logfile override. - Fix #52 #53, fix for example fail program. - Fix to return after failed auth zone http chunk write. - Fix to remove unused test for task_probe existance. - Fix to timeval_add for remaining second in microseconds. - Check repinfo in worker_handle_request, if null, drop it. 29 July 2019: Wouter - Add verbose log message when auth zone file is written, at level 4. - Add hex print of trust anchor pointer to trust anchor file temp name to make it unique, for libunbound created multiple contexts. 23 July 2019: Wouter - Fix question section mismatch in local zone redirect. 19 July 2019: Wouter - Fix #49: Set no renegotiation on the SSL context to stop client session renegotiation. 12 July 2019: Wouter - Fix #48: Unbound returns additional records on NODATA response, if minimal-responses is enabled, also the additional for negative responses is removed. 9 July 2019: Ralph - Fix in respip addrtree selection. Absence of addr_tree_init_parents() call made it impossible to go up the tree when the matching netmask is too specific. 5 July 2019: Ralph - Fix for possible assertion failure when answering respip CNAME from cache. 25 June 2019: Wouter - For #45, check that 127.0.0.1 and ::1 are not used in unbound.conf when do-not-query-localhost is turned on, or at default on, unbound-checkconf prints a warning if it is found in forward-addr or stub-addr statements. 24 June 2019: Wouter - Fix memleak in unit test, reported from the clang 8.0 static analyzer. 18 June 2019: Wouter - PR #28: IPSet module, by Kevin Chou. Created a module to support the ipset that could add the domain's ip to a list easily. Needs libmnl, and --enable-ipset and config it, doc/README.ipset.md. - Fix to omit RRSIGs from addition to the ipset. - Fix to make unbound-control with ipset, remove unused variable, use unsigned type because of comparison, and assign null instead of compare with it. Remade lex and yacc output. - make depend - Added documentation to the ipset files (for doxygen output). - Merge PR #6: Python module: support multiple instances - Merge PR #5: Python module: define constant MODULE_RESTART_NEXT - Merge PR #4: Python module: assign something useful to the per-query data store 'qdata' - Fix python dict reference and double free in config. 17 June 2019: Wouter - Master contains version 1.9.3 in development. - Fix #39: In libunbound, leftover logfile is close()d unpredictably. - Fix for #24: Fix abort due to scan of auth zone masters using old address from previous scan. 12 June 2019: Wouter - Fix another spoolbuf storage code point, in prefetch. - 1.9.2rc3 release candidate tag. Which became the 1.9.2 release on 17 June 2019. 11 June 2019: Wouter - Fix that fixes the Fix that spoolbuf is not used to store tcp pipelined response between mesh send and callback end, this fixes error cases that did not use the correct spoolbuf. - 1.9.2rc2 release candidate tag. 6 June 2019: Wouter - 1.9.2rc1 release candidate tag. 4 June 2019: Wouter - iana portlist updated. 29 May 2019: Wouter - Fix to guard _OPENBSD_SOURCE from redefinition. 28 May 2019: Wouter - Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD. - gitignore config.h.in~. 27 May 2019: Wouter - Fix double file close in tcp pipelined response code. 24 May 2019: Wouter - Fix that spoolbuf is not used to store tcp pipelined response between mesh send and callback end. 20 May 2019: Wouter - Note that so-reuseport at extreme load is better turned off, otherwise queries are not distributed evenly, on Linux 4.4.x. 16 May 2019: Wouter - Fix #31: swig 4.0 and python module. 13 May 2019: Wouter - Squelch log messages from tcp send about connection reset by peer. They can be enabled with verbosity at higher values for diagnosing network connectivity issues. - Attempt to fix malformed tcp response. 9 May 2019: Wouter - Revert fix for oss-fuzz, error is in that build script that unconditionally includes .o files detected by configure, also when the machine architecture uses different LIBOBJS files. 8 May 2019: Wouter - Attempt to fix build failure in oss-fuzz because of reallocarray. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14648. Does not omit compile flags from commandline. 7 May 2019: Wouter - Fix edns-subnet locks, in error cases the lock was not unlocked. - Fix doxygen output error on readme markdown vignettes. 6 May 2019: Wouter - Fix #29: Solaris 11.3 and missing symbols be64toh, htobe64. - Fix #30: AddressSanitizer finding in lookup3.c. This sets the hash function to use a slower but better auditable code that does not read beyond array boundaries. This makes code better security checkable, and is better for security. It is fixed to be slower, but not read outside of the array. 2 May 2019: Wouter - contrib/fastrpz.patch updated for code changes, and with git diff. - Fix .gitignore, add pythonmod and dnstap generated files. And unit test generated files, and generated doc files. 1 May 2019: Wouter - Update makedist for git. - Nicer travis output for clang analysis. - PR #16: XoT support, AXFR over TLS, turn it on with master: # in unbound.conf. This uses TLS to download the AXFR (or IXFR). 25 April 2019: Wouter - Fix wrong query name in local zone redirect answers with a CNAME, the copy of the local alias is in unpacked form. 18 April 2019: Ralph - Scrub RRs from answer section when reusing NXDOMAIN message for subdomain answers. - For harden-below-nxdomain: do not consider a name to be non-exitent when message contains a CNAME record. 18 April 2019: Wouter - travis build file. 16 April 2019: Wouter - Better braces in if statement in TCP fastopen code. - iana portlist updated. 15 April 2019: Wouter - Fix tls write event for read state change to re-call SSL_write and not resume the TLS handshake. 11 April 2019: George - Update python documentation for init_standard(). - Typos. 11 April 2019: Wouter - Fix that auth zone uses correct network type for sockets for SOA serial probes. This fixes that probes fail because earlier probe addresses are unreachable. - Fix that auth zone fails over to next master for timeout in tcp. - Squelch SSL read and write connection reset by peer and broken pipe messages. Verbosity 2 and higher enables them. 8 April 2019: Wouter - Fix to use event_assign with libevent for thread-safety. - verbose information about auth zone lookup process, also lookup start, timeout and fail. - Fix #17: Add python module example from Jan Janak, that is a plugin for the Unbound DNS resolver to resolve DNS records in multicast DNS [RFC 6762] via Avahi. The plugin communicates with Avahi via DBus. The comment section at the beginning of the file contains detailed documentation. - Fix to wipe ssl ticket keys from memory with explicit_bzero, if available. 5 April 2019: Wouter - Fix to reinit event structure for accepted TCP (and TLS) sockets. 4 April 2019: Wouter - Fix spelling error in log output for event method. 3 April 2019: Wouter - Move goto label in answer_from_cache to the end of the function where it is more visible. - Fix auth-zone NSEC3 response for wildcard nodata answers, include the closest encloser in the answer. 2 April 2019: Wouter - Fix auth-zone NSEC3 response for empty nonterminals with exact match nsec3 records. - Fix for out of bounds integers, thanks to OSTIF audit. It is in allocation debug code. - Fix for auth zone nsec3 ent fix for wildcard nodata. 25 March 2019: Wouter - Fix that tls-session-ticket-keys: "" on its own in unbound.conf disables the tls session ticker key calls into the OpenSSL API. - Fix crash if tls-servic-pem not filled in when necessary. 21 March 2019: Wouter - Fix #4240: Fix whitespace cleanup in example.conf. 19 March 2019: Wouter - add type CAA to libpyunbound (accessing libunbound from python). 18 March 2019: Wouter - Add log message, at verbosity 4, that says the query is encrypted with TLS, if that is enabled for the query. - Fix #4239: set NOTIMPL when deny-any is enabled, for RFC8482. 7 March 2019: Wouter - Fix for #4233: guard use of NDEBUG, so that it can be passed in CFLAGS into configure. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6" d53 1 a53 1 # mount \-\-bind \-n /dev/urandom /etc/unbound/dev/urandom a302 2 At extreme load it could be better to turn it off to distribute the queries evenly, reported for Linux systems (4.4.x). d630 1 a630 3 /var/run/unbound.pid and the chroot to be /var/unbound, for example. Note that Unbound is not able to remove the pidfile after termination when it is located outside of the chroot directory. d632 1 a632 1 Additionally, unbound may need to access /dev/urandom (for entropy) d774 1 a774 1 Will trust glue only if it is within the servers authority. Default is yes. d784 1 a784 1 downgrade attack that disables security for a zone. Default is yes. d794 1 a794 1 have DNSSEC. Default is yes. d831 1 a831 1 Only send minimum required labels of the QNAME and set QTYPE to A when d948 1 a948 1 The probes are run several times per month, thus the machine must be online d973 1 a973 1 Send RFC8145 key tag query after trust anchor priming. Default is yes. d976 1 a976 1 Root key trust anchor sentinel. Default is yes. a1677 1 With the "ip#name" notation a AXFR over TLS can be used. d1768 1 a1768 2 (usually first, or between the validator and iterator). Multiple instances of the python module are supported by adding the word "python" more than once. d1777 1 a1777 2 The script file to load. Repeat this option for every python module instance added to the \fBmodule\-config:\fR option. @ 1.1.1.4.2.2 log @Pull up the following, requested by christos in ticket #1803: external/bsd/nsd/dist/compat/cpuset.c up to 1.1.1.1 external/bsd/nsd/dist/compat/cpuset.h up to 1.1.1.2 external/bsd/nsd/dist/compat/setproctitle.c up to 1.1.1.1 external/bsd/nsd/dist/compat/explicit_bzero.c up to 1.1.1.1 external/bsd/nsd/dist/doc/NSD-VERIFY-MODS up to 1.1.1.1 external/bsd/nsd/dist/util/proxy_protocol.c up to 1.1.1.1 external/bsd/nsd/dist/util/proxy_protocol.h up to 1.1.1.1 external/bsd/nsd/dist/contrib/patch_for_s6_startup_and_other_service_supervisors.diff up to 1.1.1.1 external/bsd/nsd/dist/contrib/autocomplete_nsd-control.bash up to 1.1.1.1 external/bsd/nsd/dist/bitset.c up to 1.1.1.1 external/bsd/nsd/dist/README.md up to 1.1.1.4 external/bsd/nsd/dist/aclocal.m4 up to 1.1.1.1 external/bsd/nsd/dist/bitset.h up to 1.1.1.2 external/bsd/nsd/dist/popen3.c up to 1.1.1.2 external/bsd/nsd/dist/popen3.h up to 1.1.1.3 external/bsd/nsd/dist/ixfr.c up to 1.1.1.2 external/bsd/nsd/dist/ixfr.h up to 1.1.1.2 external/bsd/nsd/dist/ixfrcreate.c up to 1.1.1.2 external/bsd/nsd/dist/ixfrcreate.h up to 1.1.1.2 external/bsd/nsd/dist/siphash.c up to 1.1.1.1 external/bsd/nsd/dist/verify.c up to 1.1.1.2 external/bsd/nsd/dist/verify.h up to 1.1.1.2 external/bsd/nsd/dist/SECURITY.md up to 1.1.1.1 external/bsd/nsd/dist/configyyrename.h delete external/bsd/nsd/dist/udbradtree.c delete external/bsd/nsd/dist/udbradtree.h delete external/bsd/nsd/dist/udbzone.c delete external/bsd/nsd/dist/udbzone.h delete external/bsd/nsd/dist/contrib/nsd.service delete external/bsd/nsd/dist/contrib/nsd.socket delete external/bsd/nsd/Makefile.inc up to 1.8 external/bsd/nsd/dist/Makefile.in up to 1.1.1.9 external/bsd/nsd/dist/acx_nlnetlabs.m4 up to 1.1.1.4 external/bsd/nsd/dist/answer.c up to 1.1.1.2 external/bsd/nsd/dist/answer.h up to 1.1.1.2 external/bsd/nsd/dist/axfr.c up to 1.1.1.5 external/bsd/nsd/dist/axfr.h up to 1.1.1.3 external/bsd/nsd/dist/buffer.h up to 1.1.1.2 external/bsd/nsd/dist/config.guess up to 1.2 external/bsd/nsd/dist/config.h.in up to 1.1.1.9 external/bsd/nsd/dist/configlexer.c up to 1.9 external/bsd/nsd/dist/configlexer.lex up to 1.1.1.8 external/bsd/nsd/dist/configparser.c up to 1.9 external/bsd/nsd/dist/configparser.h up to 1.9 external/bsd/nsd/dist/configparser.y up to 1.1.1.8 external/bsd/nsd/dist/configure up to 1.3 external/bsd/nsd/dist/configure.ac up to 1.6 external/bsd/nsd/dist/dbaccess.c up to 1.1.1.6 external/bsd/nsd/dist/dbcreate.c up to 1.1.1.6 external/bsd/nsd/dist/difffile.c up to 1.1.1.8 external/bsd/nsd/dist/difffile.h up to 1.1.1.4 external/bsd/nsd/dist/dname.c up to 1.1.1.3 external/bsd/nsd/dist/dname.h up to 1.1.1.2 external/bsd/nsd/dist/dns.c up to 1.1.1.6 external/bsd/nsd/dist/dns.h up to 1.1.1.6 external/bsd/nsd/dist/edns.c up to 1.1.1.4 external/bsd/nsd/dist/edns.h up to 1.1.1.3 external/bsd/nsd/dist/ipc.c up to 1.1.1.8 external/bsd/nsd/dist/iterated_hash.c up to 1.1.1.2 external/bsd/nsd/dist/lookup3.c up to 1.1.1.3 external/bsd/nsd/dist/mini_event.c up to 1.1.1.4 external/bsd/nsd/dist/mini_event.h up to 1.1.1.4 external/bsd/nsd/dist/namedb.c up to 1.1.1.6 external/bsd/nsd/dist/namedb.h up to 1.1.1.5 external/bsd/nsd/dist/netio.h up to 1.1.1.2 external/bsd/nsd/dist/nsd-checkconf.8.in up to 1.1.1.9 external/bsd/nsd/dist/nsd-checkconf.c up to 1.1.1.8 external/bsd/nsd/dist/nsd-checkzone.8.in up to 1.1.1.9 external/bsd/nsd/dist/nsd-checkzone.c up to 1.1.1.6 external/bsd/nsd/dist/nsd-control-setup.sh.in up to 1.1.1.4 external/bsd/nsd/dist/nsd-control.8.in up to 1.1.1.9 external/bsd/nsd/dist/nsd-control.c up to 1.1.1.9 external/bsd/nsd/dist/nsd-mem.c up to 1.1.1.5 external/bsd/nsd/dist/nsd.8.in up to 1.1.1.9 external/bsd/nsd/dist/nsd.c up to 1.1.1.9 external/bsd/nsd/dist/nsd.conf.5.in up to 1.1.1.9 external/bsd/nsd/dist/nsd.conf.sample.in up to 1.1.1.8 external/bsd/nsd/dist/nsd.h up to 1.1.1.8 external/bsd/nsd/dist/nsec3.c up to 1.1.1.7 external/bsd/nsd/dist/nsec3.h up to 1.1.1.4 external/bsd/nsd/dist/options.c up to 1.5 external/bsd/nsd/dist/options.h up to 1.1.1.9 external/bsd/nsd/dist/packet.c up to 1.1.1.3 external/bsd/nsd/dist/packet.h up to 1.1.1.5 external/bsd/nsd/dist/query.c up to 1.1.1.8 external/bsd/nsd/dist/query.h up to 1.1.1.5 external/bsd/nsd/dist/radtree.c up to 1.1.1.5 external/bsd/nsd/dist/rbtree.h up to 1.1.1.3 external/bsd/nsd/dist/rdata.c up to 1.1.1.4 external/bsd/nsd/dist/rdata.h up to 1.1.1.3 external/bsd/nsd/dist/region-allocator.c up to 1.1.1.4 external/bsd/nsd/dist/region-allocator.h up to 1.1.1.2 external/bsd/nsd/dist/remote.c up to 1.1.1.9 external/bsd/nsd/dist/remote.h up to 1.1.1.4 external/bsd/nsd/dist/rrl.c up to 1.1.1.4 external/bsd/nsd/dist/rrl.h up to 1.1.1.3 external/bsd/nsd/dist/server.c up to 1.8 external/bsd/nsd/dist/tsig-openssl.c up to 1.1.1.3 external/bsd/nsd/dist/tsig-openssl.h up to 1.1.1.3 external/bsd/nsd/dist/tsig.c up to 1.1.1.5 external/bsd/nsd/dist/tsig.h up to 1.1.1.2 external/bsd/nsd/dist/udb.c up to 1.1.1.5 external/bsd/nsd/dist/udb.h up to 1.1.1.5 external/bsd/nsd/dist/util.c up to 1.1.1.6 external/bsd/nsd/dist/util.h up to 1.8 external/bsd/nsd/dist/xfr-inspect.c up to 1.1.1.3 external/bsd/nsd/dist/xfrd-disk.c up to 1.1.1.6 external/bsd/nsd/dist/xfrd-notify.c up to 1.1.1.3 external/bsd/nsd/dist/xfrd-tcp.c up to 1.1.1.6 external/bsd/nsd/dist/xfrd-tcp.h up to 1.1.1.3 external/bsd/nsd/dist/xfrd.c up to 1.1.1.8 external/bsd/nsd/dist/xfrd.h up to 1.1.1.5 external/bsd/nsd/dist/zlexer.c up to 1.8 external/bsd/nsd/dist/zlexer.lex up to 1.1.1.6 external/bsd/nsd/dist/zonec.c up to 1.1.1.7 external/bsd/nsd/dist/zonec.h up to 1.1.1.6 external/bsd/nsd/dist/zparser.c up to 1.8 external/bsd/nsd/dist/zparser.h up to 1.6 external/bsd/nsd/dist/zparser.y up to 1.1.1.7 external/bsd/nsd/dist/compat/b64_pton.c up to 1.1.1.2 external/bsd/nsd/dist/compat/fake-rfc2553.h up to 1.1.1.2 external/bsd/nsd/dist/contrib/README up to 1.1.1.4 external/bsd/nsd/dist/contrib/nsd_munin_ up to 1.1.1.2 external/bsd/nsd/dist/dnstap/dnstap.c up to 1.1.1.4 external/bsd/nsd/dist/dnstap/dnstap.h up to 1.1.1.3 external/bsd/nsd/dist/dnstap/dnstap.m4 up to 1.1.1.2 external/bsd/nsd/dist/dnstap/dnstap_collector.c up to 1.1.1.3 external/bsd/nsd/dist/dnstap/dnstap_collector.h up to 1.1.1.2 external/bsd/nsd/dist/doc/CREDITS up to 1.1.1.3 external/bsd/nsd/dist/doc/ChangeLog up to 1.1.1.9 external/bsd/nsd/dist/doc/README up to 1.3 external/bsd/nsd/dist/doc/README.svn up to 1.1.1.2 external/bsd/nsd/dist/doc/RELNOTES up to 1.1.1.9 external/bsd/nsd/dist/doc/REQUIREMENTS up to 1.2 external/bsd/nsd/include/config.h up to 1.12 external/bsd/nsd/lib/libnsd/Makefile up to 1.6 external/bsd/nsd/sbin/nsd/Makefile up to 1.2 external/bsd/nsd/sbin/nsd-checkzone/Makefile up to 1.2 external/bsd/nsd/sbin/nsd-control/Makefile up to 1.2 external/bsd/unbound/dist/contrib/ios/15-ios.conf up to 1.1.1.1 external/bsd/unbound/dist/contrib/ios/install_expat.sh up to 1.1.1.1 external/bsd/unbound/dist/contrib/ios/install_openssl.sh up to 1.1.1.1 external/bsd/unbound/dist/contrib/ios/install_tools.sh up to 1.1.1.2 external/bsd/unbound/dist/contrib/ios/openssl.patch up to 1.1.1.1 external/bsd/unbound/dist/contrib/ios/setenv_ios.sh up to 1.1.1.1 external/bsd/unbound/dist/contrib/android/15-android.conf up to 1.1.1.1 external/bsd/unbound/dist/contrib/android/install_expat.sh up to 1.1.1.1 external/bsd/unbound/dist/contrib/android/install_ndk.sh up to 1.1.1.1 external/bsd/unbound/dist/contrib/android/install_openssl.sh up to 1.1.1.1 external/bsd/unbound/dist/contrib/android/install_tools.sh up to 1.1.1.1 external/bsd/unbound/dist/contrib/android/setenv_android.sh up to 1.1.1.1 external/bsd/unbound/dist/contrib/drop2rpz up to 1.1.1.2 external/bsd/unbound/dist/contrib/metrics.awk up to 1.1.1.2 external/bsd/unbound/dist/contrib/unbound_portable.service.in up to 1.1.1.1 external/bsd/unbound/dist/contrib/unbound_smf23.tar.gz up to 1.1.1.1 external/bsd/unbound/dist/contrib/Dockerfile.tests up to 1.1.1.2 external/bsd/unbound/dist/contrib/unbound.init_yocto up to 1.1.1.1 external/bsd/unbound/dist/dnstap/dnstap_fstrm.c up to 1.1.1.1 external/bsd/unbound/dist/dnstap/dnstap_fstrm.h up to 1.1.1.1 external/bsd/unbound/dist/dnstap/dtstream.c up to 1.1.1.3 external/bsd/unbound/dist/dnstap/dtstream.h up to 1.1.1.1 external/bsd/unbound/dist/dnstap/unbound-dnstap-socket.c up to 1.1.1.3 external/bsd/unbound/dist/services/rpz.c up to 1.1.1.3 external/bsd/unbound/dist/services/rpz.h up to 1.1.1.3 external/bsd/unbound/dist/testcode/dohclient.c up to 1.1.1.3 external/bsd/unbound/dist/testcode/readzone.c up to 1.1.1.1 external/bsd/unbound/dist/testcode/unittcpreuse.c up to 1.1.1.2 external/bsd/unbound/dist/testcode/unitzonemd.c up to 1.1.1.1 external/bsd/unbound/dist/testdata/00-lint.tdir/00-lint.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap.tdir/dnstap.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap.tdir/dnstap.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap.tdir/dnstap.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap.tdir/dnstap.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap.tdir/dnstap.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap.tdir/dnstap.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_client_string.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_client_string_opcode.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/nsid_ascii.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/nsid_hex.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/nsid_not_set.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_axfr.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_ixfr.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/rpz_qname.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/rpz_qname_override.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_respip.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/rpz_respip_override.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/serve_expired_client_timeout.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/serve_expired_ttl.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/dnstap_tcp.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/dnstap_tcp.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/dnstap_tcp.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/dnstap_tcp.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/dnstap_tcp.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/dnstap_tcp.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.dscp up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.include-toplevel.1 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.include-toplevel.2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.include-toplevel.3 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.include-toplevel.4 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.include-toplevel.5 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.include-toplevel.6 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/good.min up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.include-toplevel.7 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/good.include-toplevel up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.include.withclauses.1 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.include.withclauses.2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.include.withclauses.3 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.include.withoutclauses.1 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.include.withoutclauses.2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.include.withoutclauses.3 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.includetop.withclauses.1 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.includetop.withclauses.2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.includetop.withclauses.3 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.includetop.withoutclauses.1 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.includetop.withoutclauses.2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.includetop.withoutclauses.3 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.withclauses.1 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.withclauses.2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.withclauses.3 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.withoutclauses.1 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.withoutclauses.2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.withoutclauses.3 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.withsomeclauses.1 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.withsomeclauses.2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/include.withsomeclauses.3 up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.proxy-and-dnscrypt up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.proxy-and-https up to 1.1.1.1 external/bsd/unbound/dist/testdata/07-confroot.tdir/07-confroot.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/conf.bad_credentials up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/conf.spoofed_credentials up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/dnskey-failures.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/dnssec-failures.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/make-broken-zone.sh up to 1.1.1.2 external/bsd/unbound/dist/testdata/ede.tdir/bogus/nsec-failures.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/rrsig-failures.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/dnskey-failures.test.signed up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/dnssec-failures.test.signed up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/nsec-failures.test.signed up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/rrsig-failures.test.signed up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/trust-anchors up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/ede-auth.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/ede.conf up to 1.1.1.2 external/bsd/unbound/dist/testdata/ede.tdir/ede.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/ede.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/ede.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/ede.tdir/ede.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/dnstap_tls.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/dnstap_tls.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/dnstap_tls.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/dnstap_tls.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/dnstap_tls.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/dnstap_tls.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_reply_ttl.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/nss_compile.tdir/nss_compile.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_anchor.tdir/root_anchor.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_hints.tdir/root_hints.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/clang-analysis.tdir/clang-analysis.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_cached_ede.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_ttl_client_timeout.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_zerottl.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/serve_original_ttl.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/dnstap_reconnect.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/dnstap_reconnect.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/dnstap_reconnect.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/dnstap_reconnect.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/dnstap_reconnect.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/dnstap_reconnect.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/dnstap_tls_badcert.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/dnstap_tls_badcert.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/dnstap_tls_badcert.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/dnstap_tls_badcert.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/dnstap_tls_badcert.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/dnstap_tls_badcert.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/dnstap_tls_badname.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/dnstap_tls_badname.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/dnstap_tls_badname.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/dnstap_tls_badname.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/dnstap_tls_badname.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/dnstap_tls_badname.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/dnstap_tls_clientauth.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/dnstap_tls_clientauth.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/dnstap_tls_clientauth.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/dnstap_tls_clientauth.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/dnstap_tls_clientauth.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/dnstap_tls_clientauth.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/dnstap_tls_peername.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/dnstap_tls_peername.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/dnstap_tls_peername.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/dnstap_tls_peername.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/dnstap_tls_peername.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/dnstap_tls_peername.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream.tdir/doh_downstream.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream.tdir/doh_downstream.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream.tdir/doh_downstream.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream.tdir/doh_downstream.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream.tdir/doh_downstream.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream.tdir/doh_downstream.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/doh_downstream_buffer_size.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/doh_downstream_buffer_size.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/doh_downstream_buffer_size.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/doh_downstream_buffer_size.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/doh_downstream_buffer_size.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/doh_downstream_endpoint.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/doh_downstream_endpoint.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/doh_downstream_endpoint.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/doh_downstream_endpoint.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/doh_downstream_endpoint.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/doh_downstream_notls.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/doh_downstream_notls.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/doh_downstream_notls.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/doh_downstream_notls.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/doh_downstream_notls.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/doh_downstream_notls.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/doh_downstream_post.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/doh_downstream_post.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/doh_downstream_post.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/doh_downstream_post.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/doh_downstream_post.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/doh_downstream_post.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dynlibmod.tdir/dynlibmod.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/dynlibmod.tdir/dynlibmod.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/dynlibmod.tdir/dynlibmod.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dynlibmod.tdir/dynlibmod.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dynlibmod.tdir/dynlibmod.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dynlibmod.tdir/dynlibmod.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/dynlibmod.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dynlibmod.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/dynlibmod.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/dynlibmod.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/padding.tdir/padding.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/padding.tdir/padding.conf2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/padding.tdir/padding.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/padding.tdir/padding.msgsizes up to 1.1.1.1 external/bsd/unbound/dist/testdata/padding.tdir/padding.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/padding.tdir/padding.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/padding.tdir/padding.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/padding.tdir/padding.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/padding.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/padding.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/padding.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/padding.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.conf up to 1.1.1.2 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.test up to 1.1.1.3 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.testexpiredns up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.testns up to 1.1.1.2 external/bsd/unbound/dist/testdata/stat_values.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values_cachedb.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values_downstream_cookies.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_reuse.tdir/tcp_reuse.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_reuse.tdir/tcp_reuse.conf2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_reuse.tdir/tcp_reuse.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_reuse.tdir/tcp_reuse.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_reuse.tdir/tcp_reuse.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/tcp_reuse.tdir/tcp_reuse.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/tls_reuse.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/tls_reuse.conf2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/tls_reuse.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/tls_reuse.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/tls_reuse.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/tls_reuse.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/tls_reuse.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_anchor.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_anchor_fail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_chain.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_chain_fail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_file.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_file_fail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_file_unknown.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_cached_zone.tdir/blanks.example.com.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_cached_zone.tdir/blanks_cached_zone.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_cached_zone.tdir/blanks_cached_zone.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_cached_zone.tdir/blanks_cached_zone.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_cached_zone.tdir/blanks_cached_zone.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_cached_zone.tdir/blanks_cached_zone.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_insecure.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_insecure_absent.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_insecure_absent_reject.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_insecure_fail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_nokey.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_permissive_mode.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_xfr.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_xfr_anchor.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_xfr_anchor_fail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_xfr_chain.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_xfr_chain_fail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_xfr_chain_keyinxfr.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/auth_zonemd_xfr_fail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede_acl_refused.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_ignore_empty.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede_localzone_dname_expansion.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_attached_once_per_upstream.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_error_retries.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_cname_minimise.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_dp_ip6useless.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_ghost_sub.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_ghost_timewindow.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_nxns_cached.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_nxns_fallback.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_nxns_parentside.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/nsid_bogus.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/rpz_clientip.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_nsdname.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.conf up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.testns up to 1.1.1.2 external/bsd/unbound/dist/testdata/rpz_nsip.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_passthru.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_qname_tcponly.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_respip_tcponly.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_rootwc.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_signal_nxdomain_ra.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_client_timeout_no_prefetch.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_prefetch.crpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/subnet_prezero.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example1.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example10.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example11.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example12.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example13.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example14.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.test.scenario up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.testns2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example15.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example16.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example17.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example2.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example3.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example4.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example5.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example6.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example7.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example8.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example9.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example_a1.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example_a2.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example_a3.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example_a4.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd.example_a5.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_https.tdir/127.0.0.1/blanks.example.com.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_https.tdir/blanks_https.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_https.tdir/blanks_https.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_https.tdir/blanks_https.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_https.tdir/blanks_https.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_https.tdir/blanks_https.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_https.tdir/petal.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/blanks_https.tdir/petal.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_cached_ede.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_servfail_cname.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp_with_tcp_upstream.tdir/fwd_udp_with_tcp_upstream.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp_with_tcp_upstream.tdir/fwd_udp_with_tcp_upstream.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp_with_tcp_upstream.tdir/fwd_udp_with_tcp_upstream.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp_with_tcp_upstream.tdir/fwd_udp_with_tcp_upstream.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp_with_tcp_upstream.tdir/fwd_udp_with_tcp_upstream.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/fwd_udp_with_tcp_upstream.tdir/fwd_udp_with_tcp_upstream.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/127.0.0.1/example.com.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/http_user_agent.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/http_user_agent.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/http_user_agent.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/http_user_agent.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/http_user_agent.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/petal.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/petal.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/http_user_agent.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/ratelimit.tdir/ratelimit.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/ratelimit.tdir/ratelimit.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/ratelimit.tdir/ratelimit.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/ratelimit.tdir/ratelimit.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/ratelimit.tdir/ratelimit.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/ratelimit.tdir/ratelimit.testns up to 1.1.1.2 external/bsd/unbound/dist/testdata/ratelimit.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/ratelimit.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/ratelimit.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/ratelimit.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp_with_tcp_upstream.tdir/stub_udp_with_tcp_upstream.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp_with_tcp_upstream.tdir/stub_udp_with_tcp_upstream.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp_with_tcp_upstream.tdir/stub_udp_with_tcp_upstream.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp_with_tcp_upstream.tdir/stub_udp_with_tcp_upstream.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp_with_tcp_upstream.tdir/stub_udp_with_tcp_upstream.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_udp_with_tcp_upstream.tdir/stub_udp_with_tcp_upstream.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/svcb.tdir/crypto.cloudflare.com.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.failure-cases-01 up to 1.1.1.2 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.failure-cases-02 up to 1.1.1.1 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.failure-cases-03 up to 1.1.1.1 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.failure-cases-04 up to 1.1.1.1 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.success-cases.zone up to 1.1.1.2 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.success-cases.zone.cmp up to 1.1.1.2 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.test-vectors-pf.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.test-vectors-wf.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd_reload.tdir/zonemd_reload.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd_reload.tdir/zonemd_reload.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd_reload.tdir/zonemd_reload.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd_reload.tdir/zonemd_reload.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd_reload.tdir/zonemd_reload.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd_reload.tdir/zonemd_reload.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/zonemd_reload.tdir/zonemd_reload.zone up to 1.1.1.1 external/bsd/unbound/dist/testdata/disable_edns_do.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede_cache_snoop_not_auth.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_downstream_cookies.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_auth_tc.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_cname_minimise_nx.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_failreply.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_scopezero.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_nat64.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_nat64_prefix.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_nat64_prefix48.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_scrub_rr_length.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_cached_cname.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_0ttl_nodata.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_0ttl_nxdomain.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_0ttl_servfail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_cached_servfail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_cached_servfail_refresh.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_client_timeout_servfail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_cached_servfail.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_global_prefetch.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_global_prefetch_always_forward.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_global_prefetch_expired.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_global_prefetch_with_client_ecs.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/val_any_negcache.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/val_scrub_rr_length.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.servfail.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.test.scenario up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.testns up to 1.1.1.1 external/bsd/unbound/dist/util/proxy_protocol.c up to 1.1.1.1 external/bsd/unbound/dist/util/proxy_protocol.h up to 1.1.1.1 external/bsd/unbound/dist/util/rfc_1982.c up to 1.1.1.1 external/bsd/unbound/dist/util/rfc_1982.h up to 1.1.1.1 external/bsd/unbound/dist/util/siphash.c up to 1.1.1.1 external/bsd/unbound/dist/util/siphash.h up to 1.1.1.1 external/bsd/unbound/dist/util/timeval_func.c up to 1.1.1.1 external/bsd/unbound/dist/util/timeval_func.h up to 1.1.1.1 external/bsd/unbound/dist/SECURITY.md up to 1.1.1.1 external/bsd/unbound/dist/README-Travis.md up to 1.1.1.2 external/bsd/unbound/dist/dynlibmod/examples/helloworld.c up to 1.1.1.1 external/bsd/unbound/dist/dynlibmod/dynlibmod.c up to 1.1.1.2 external/bsd/unbound/dist/dynlibmod/dynlibmod.h up to 1.1.1.1 external/bsd/unbound/dist/contrib/unbound_smf22.tar.gz delete external/bsd/unbound/dist/testcode/mini_tpkg.sh delete external/bsd/unbound/dist/testdata/dlv_anchor.rpl delete external/bsd/unbound/dist/testdata/dlv_ask_higher.rpl delete external/bsd/unbound/dist/testdata/dlv_below_ta.rpl delete external/bsd/unbound/dist/testdata/dlv_delegation.rpl delete external/bsd/unbound/dist/testdata/dlv_ds_lookup.rpl delete external/bsd/unbound/dist/testdata/dlv_insecure.rpl delete external/bsd/unbound/dist/testdata/dlv_insecure_negcache.rpl delete external/bsd/unbound/dist/testdata/dlv_keyretry.rpl delete external/bsd/unbound/dist/testdata/dlv_negnx.rpl delete external/bsd/unbound/dist/testdata/dlv_optout.rpl delete external/bsd/unbound/dist/testdata/dlv_remove.rpl delete external/bsd/unbound/dist/testdata/dlv_remove_empty.rpl delete external/bsd/unbound/dist/testdata/dlv_remove_nodel.rpl delete external/bsd/unbound/dist/testdata/dlv_remove_pos.rpl delete external/bsd/unbound/dist/testdata/dlv_unused.rpl delete external/bsd/unbound/dist/testdata/domain_insec_dlv.rpl delete external/bsd/unbound/dist/testdata/fwddlv_parse.rpl delete external/bsd/unbound/dist/testdata/val_unalgo_dlv.rpl delete external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/precheck.sh delete external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/precheck.sh delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/1.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/1.key delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/2.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/1_chacha.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/1_salsa.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/2.key delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/2_chacha.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/2_salsa.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.conf delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.dsc delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.post delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.pre delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.test delete external/bsd/unbound/dist/testdata/dnscrypt_queries.tdir/dnscrypt_queries.testns delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/precheck.sh delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/1.key delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/2.key delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/1_chacha.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/1_salsa.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/2_chacha.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/2_salsa.cert delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.conf delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.dsc delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.post delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.pre delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.test delete external/bsd/unbound/dist/testdata/dnscrypt_queries_chacha.tdir/dnscrypt_queries_chacha.testns delete external/bsd/unbound/dist/.travis.yml delete external/bsd/unbound/Makefile.inc up to 1.5 external/bsd/unbound/dist/Makefile.in up to 1.1.1.8 external/bsd/unbound/dist/README.md up to 1.1.1.4 external/bsd/unbound/dist/aclocal.m4 up to 1.1.1.5 external/bsd/unbound/dist/acx_nlnetlabs.m4 up to 1.1.1.5 external/bsd/unbound/dist/acx_python.m4 up to 1.1.1.5 external/bsd/unbound/dist/config.guess up to 1.8 external/bsd/unbound/dist/config.h.in up to 1.1.1.8 external/bsd/unbound/dist/config.sub up to 1.7 external/bsd/unbound/dist/configure up to 1.1.1.8 external/bsd/unbound/dist/configure.ac up to 1.1.1.8 external/bsd/unbound/dist/install-sh up to 1.1.1.4 external/bsd/unbound/dist/cachedb/cachedb.c up to 1.1.1.8 external/bsd/unbound/dist/cachedb/cachedb.h up to 1.1.1.3 external/bsd/unbound/dist/cachedb/redis.c up to 1.1.1.3 external/bsd/unbound/dist/compat/arc4random.c up to 1.1.1.5 external/bsd/unbound/dist/compat/ctime_r.c up to 1.1.1.3 external/bsd/unbound/dist/compat/getentropy_solaris.c up to 1.1.1.4 external/bsd/unbound/dist/contrib/README up to 1.1.1.7 external/bsd/unbound/dist/contrib/aaaa-filter-iterator.patch up to 1.1.1.5 external/bsd/unbound/dist/contrib/fastrpz.patch up to 1.1.1.5 external/bsd/unbound/dist/contrib/libunbound.pc.in up to 1.1.1.4 external/bsd/unbound/dist/contrib/unbound.service.in up to 1.1.1.6 external/bsd/unbound/dist/contrib/unbound.spec up to 1.1.1.2 external/bsd/unbound/dist/contrib/unbound_munin_ up to 1.1.1.4 external/bsd/unbound/dist/daemon/acl_list.c up to 1.1.1.6 external/bsd/unbound/dist/daemon/acl_list.h up to 1.1.1.5 external/bsd/unbound/dist/daemon/cachedump.c up to 1.1.1.6 external/bsd/unbound/dist/daemon/daemon.c up to 1.1.1.8 external/bsd/unbound/dist/daemon/daemon.h up to 1.1.1.5 external/bsd/unbound/dist/daemon/remote.c up to 1.1.1.8 external/bsd/unbound/dist/daemon/remote.h up to 1.1.1.4 external/bsd/unbound/dist/daemon/stats.c up to 1.1.1.8 external/bsd/unbound/dist/daemon/stats.h up to 1.1.1.3 external/bsd/unbound/dist/daemon/unbound.c up to 1.1.1.7 external/bsd/unbound/dist/daemon/worker.c up to 1.1.1.8 external/bsd/unbound/dist/daemon/worker.h up to 1.1.1.3 external/bsd/unbound/dist/dns64/dns64.c up to 1.1.1.7 external/bsd/unbound/dist/dnscrypt/dnscrypt.c up to 1.1.1.5 external/bsd/unbound/dist/dnscrypt/dnscrypt.h up to 1.1.1.3 external/bsd/unbound/dist/dnscrypt/dnscrypt.m4 up to 1.1.1.3 external/bsd/unbound/dist/dnstap/dnstap.c up to 1.1.1.6 external/bsd/unbound/dist/dnstap/dnstap.h up to 1.1.1.4 external/bsd/unbound/dist/dnstap/dnstap.m4 up to 1.1.1.3 external/bsd/unbound/dist/doc/Changelog up to 1.1.1.8 external/bsd/unbound/dist/doc/FEATURES up to 1.1.1.2 external/bsd/unbound/dist/doc/README up to 1.1.1.8 external/bsd/unbound/dist/doc/README.DNS64 up to 1.1.1.2 external/bsd/unbound/dist/doc/README.tests up to 1.1.1.2 external/bsd/unbound/dist/doc/TODO up to 1.1.1.3 external/bsd/unbound/dist/doc/example.conf.in up to 1.1.1.8 external/bsd/unbound/dist/doc/libunbound.3.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound-anchor.8.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound-checkconf.8.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound-control.8.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound-host.1.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound.8.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound.conf.5.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound.doxygen up to 1.1.1.6 external/bsd/unbound/dist/edns-subnet/addrtree.c up to 1.1.1.4 external/bsd/unbound/dist/edns-subnet/addrtree.h up to 1.1.1.3 external/bsd/unbound/dist/edns-subnet/edns-subnet.h up to 1.1.1.2 external/bsd/unbound/dist/edns-subnet/subnetmod.c up to 1.1.1.7 external/bsd/unbound/dist/edns-subnet/subnetmod.h up to 1.1.1.5 external/bsd/unbound/dist/ipsecmod/ipsecmod.c up to 1.1.1.4 external/bsd/unbound/dist/ipsecmod/ipsecmod.h up to 1.1.1.2 external/bsd/unbound/dist/ipset/ipset.c up to 1.1.1.3 external/bsd/unbound/dist/iterator/iter_delegpt.c up to 1.1.1.6 external/bsd/unbound/dist/iterator/iter_delegpt.h up to 1.1.1.7 external/bsd/unbound/dist/iterator/iter_fwd.c up to 1.1.1.5 external/bsd/unbound/dist/iterator/iter_hints.c up to 1.1.1.6 external/bsd/unbound/dist/iterator/iter_priv.c up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_resptype.c up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_resptype.h up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_scrub.c up to 1.1.1.8 external/bsd/unbound/dist/iterator/iter_scrub.h up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_utils.c up to 1.1.1.8 external/bsd/unbound/dist/iterator/iter_utils.h up to 1.1.1.7 external/bsd/unbound/dist/iterator/iterator.c up to 1.1.1.8 external/bsd/unbound/dist/iterator/iterator.h up to 1.1.1.7 external/bsd/unbound/dist/libunbound/context.c up to 1.1.1.8 external/bsd/unbound/dist/libunbound/context.h up to 1.1.1.6 external/bsd/unbound/dist/libunbound/libunbound.c up to 1.1.1.8 external/bsd/unbound/dist/libunbound/libworker.c up to 1.1.1.8 external/bsd/unbound/dist/libunbound/unbound-event.h up to 1.1.1.5 external/bsd/unbound/dist/libunbound/unbound.h up to 1.5 external/bsd/unbound/dist/libunbound/worker.h up to 1.1.1.5 external/bsd/unbound/dist/libunbound/python/libunbound.i up to 1.1.1.5 external/bsd/unbound/dist/libunbound/python/doc/examples/example4.rst up to 1.1.1.3 external/bsd/unbound/dist/pythonmod/interface.i up to 1.1.1.8 external/bsd/unbound/dist/pythonmod/pythonmod.c up to 1.1.1.6 external/bsd/unbound/dist/pythonmod/pythonmod.h up to 1.1.1.5 external/bsd/unbound/dist/pythonmod/pythonmod_utils.c up to 1.1.1.5 external/bsd/unbound/dist/pythonmod/pythonmod_utils.h up to 1.1.1.3 external/bsd/unbound/dist/pythonmod/ubmodule-msg.py up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/ubmodule-tst.py up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/usecase.rst up to 1.1.1.3 external/bsd/unbound/dist/pythonmod/doc/examples/example0-1.py up to 1.1.1.4 external/bsd/unbound/dist/pythonmod/doc/examples/example0.rst up to 1.1.1.4 external/bsd/unbound/dist/pythonmod/doc/examples/example5.rst up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/examples/example6.rst up to 1.1.1.3 external/bsd/unbound/dist/pythonmod/doc/modules/config.rst up to 1.1.1.3 external/bsd/unbound/dist/pythonmod/doc/modules/env.rst up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/modules/functions.rst up to 1.1.1.5 external/bsd/unbound/dist/pythonmod/doc/modules/struct.rst up to 1.1.1.4 external/bsd/unbound/dist/pythonmod/examples/avahi-resolver.py up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/examples/edns.py up to 1.1.1.4 external/bsd/unbound/dist/pythonmod/examples/inplace_callbacks.py up to 1.1.1.6 external/bsd/unbound/dist/pythonmod/examples/log.py up to 1.1.1.2 external/bsd/unbound/dist/respip/respip.c up to 1.1.1.6 external/bsd/unbound/dist/respip/respip.h up to 1.1.1.4 external/bsd/unbound/dist/services/authzone.c up to 1.3 external/bsd/unbound/dist/services/authzone.h up to 1.1.1.6 external/bsd/unbound/dist/services/listen_dnsport.c up to 1.1.1.8 external/bsd/unbound/dist/services/listen_dnsport.h up to 1.1.1.6 external/bsd/unbound/dist/services/localzone.c up to 1.1.1.8 external/bsd/unbound/dist/services/localzone.h up to 1.1.1.7 external/bsd/unbound/dist/services/mesh.c up to 1.1.1.8 external/bsd/unbound/dist/services/mesh.h up to 1.1.1.6 external/bsd/unbound/dist/services/modstack.c up to 1.1.1.7 external/bsd/unbound/dist/services/outbound_list.h up to 1.1.1.2 external/bsd/unbound/dist/services/outside_network.c up to 1.1.1.8 external/bsd/unbound/dist/services/outside_network.h up to 1.1.1.8 external/bsd/unbound/dist/services/view.c up to 1.1.1.3 external/bsd/unbound/dist/services/cache/dns.c up to 1.1.1.8 external/bsd/unbound/dist/services/cache/dns.h up to 1.1.1.7 external/bsd/unbound/dist/services/cache/infra.c up to 1.1.1.7 external/bsd/unbound/dist/services/cache/infra.h up to 1.1.1.6 external/bsd/unbound/dist/services/cache/rrset.c up to 1.1.1.5 external/bsd/unbound/dist/services/cache/rrset.h up to 1.1.1.4 external/bsd/unbound/dist/sldns/keyraw.c up to 1.1.1.4 external/bsd/unbound/dist/sldns/keyraw.h up to 1.1.1.4 external/bsd/unbound/dist/sldns/parse.c up to 1.1.1.5 external/bsd/unbound/dist/sldns/parse.h up to 1.1.1.3 external/bsd/unbound/dist/sldns/parseutil.c up to 1.1.1.4 external/bsd/unbound/dist/sldns/parseutil.h up to 1.1.1.4 external/bsd/unbound/dist/sldns/pkthdr.h up to 1.1.1.2 external/bsd/unbound/dist/sldns/rrdef.c up to 1.1.1.6 external/bsd/unbound/dist/sldns/rrdef.h up to 1.1.1.6 external/bsd/unbound/dist/sldns/sbuffer.h up to 1.1.1.5 external/bsd/unbound/dist/sldns/str2wire.c up to 1.1.1.7 external/bsd/unbound/dist/sldns/str2wire.h up to 1.1.1.5 external/bsd/unbound/dist/sldns/wire2str.c up to 1.1.1.7 external/bsd/unbound/dist/sldns/wire2str.h up to 1.1.1.6 external/bsd/unbound/dist/smallapp/unbound-anchor.c up to 1.1.1.7 external/bsd/unbound/dist/smallapp/unbound-checkconf.c up to 1.1.1.8 external/bsd/unbound/dist/smallapp/unbound-control-setup.sh.in up to 1.1.1.3 external/bsd/unbound/dist/smallapp/unbound-control.c up to 1.1.1.8 external/bsd/unbound/dist/smallapp/unbound-host.c up to 1.1.1.7 external/bsd/unbound/dist/smallapp/worker_cb.c up to 1.1.1.6 external/bsd/unbound/dist/testcode/asynclook.c up to 1.1.1.6 external/bsd/unbound/dist/testcode/delayer.c up to 1.1.1.6 external/bsd/unbound/dist/testcode/do-tests.sh up to 1.1.1.5 external/bsd/unbound/dist/testcode/fake_event.c up to 1.1.1.8 external/bsd/unbound/dist/testcode/lock_verify.c up to 1.1.1.4 external/bsd/unbound/dist/testcode/mini_tdir.sh up to 1.1.1.4 external/bsd/unbound/dist/testcode/perf.c up to 1.1.1.7 external/bsd/unbound/dist/testcode/petal.c up to 1.1.1.6 external/bsd/unbound/dist/testcode/replay.c up to 1.1.1.6 external/bsd/unbound/dist/testcode/replay.h up to 1.1.1.6 external/bsd/unbound/dist/testcode/run_vm.sh up to 1.1.1.3 external/bsd/unbound/dist/testcode/streamtcp.1 up to 1.1.1.3 external/bsd/unbound/dist/testcode/streamtcp.c up to 1.1.1.8 external/bsd/unbound/dist/testcode/testbound.c up to 1.1.1.7 external/bsd/unbound/dist/testcode/testpkts.c up to 1.1.1.8 external/bsd/unbound/dist/testcode/testpkts.h up to 1.1.1.5 external/bsd/unbound/dist/testcode/unitauth.c up to 1.1.1.5 external/bsd/unbound/dist/testcode/unitdname.c up to 1.1.1.2 external/bsd/unbound/dist/testcode/unitecs.c up to 1.1.1.3 external/bsd/unbound/dist/testcode/unitldns.c up to 1.1.1.4 external/bsd/unbound/dist/testcode/unitlruhash.c up to 1.1.1.3 external/bsd/unbound/dist/testcode/unitmain.c up to 1.1.1.8 external/bsd/unbound/dist/testcode/unitmain.h up to 1.1.1.3 external/bsd/unbound/dist/testcode/unitmsgparse.c up to 1.1.1.4 external/bsd/unbound/dist/testcode/unitverify.c up to 1.1.1.6 external/bsd/unbound/dist/testdata/auth_xfr_host.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/auth_xfr_ixfrmismatch.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/auth_zonefile_dnssec.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/auth_zonefile_dnssec_fail.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/auth_zonefile_down.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/autotrust_10key.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/autotrust_init_fail.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/autotrust_init_failsig.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/autotrust_probefail.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/autotrust_probefailsig.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/autotrust_revtp.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/autotrust_revtp_read.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/autotrust_revtp_use.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/black_data.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/black_ds_entry.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/black_key_entry.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/black_prime.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/black_prime_entry.rpl up to 1.1.1.6 external/bsd/unbound/dist/testdata/common.sh up to 1.1.1.4 external/bsd/unbound/dist/testdata/dns64_lookup.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/edns_keepalive.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/fetch_glue.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/fetch_glue_cname.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/fwd.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_0ttlservfail.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_any.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_error.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_timeout.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_dnsseclame_bug.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_dnsseclame_ds.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_dnsseclame_ta.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_donotq127.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/iter_emptydp.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/iter_emptydp_for_glue.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/iter_lame_aaaa.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_lame_noaa.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_lame_nosoa.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/iter_lamescrub.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/iter_ns_badip.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_pcnamech.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/iter_pcnamechrec.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/iter_prefetch_change.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/iter_primenoglue.rpl up to 1.1.1.6 external/bsd/unbound/dist/testdata/iter_privaddr.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_ranoaa_lame.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_reclame_one.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_reclame_two.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_recurse.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_scrub_dname_rev.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/iter_scrub_dname_sec.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/iter_scrub_ns.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_scrub_ns_fwd.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_scrub_ns_side.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_stublastresort.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/localdata.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/root_key_sentinel.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/rrset_updated.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/subnet_cached.crpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/subnet_derived.crpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/subnet_format_ip4.crpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/subnet_not_whitelisted.crpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/subnet_val_positive.crpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/subnet_val_positive_client.crpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/subnet_without_validator.crpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/test_ldnsrr.5 up to 1.1.1.3 external/bsd/unbound/dist/testdata/test_ldnsrr.c5 up to 1.1.1.3 external/bsd/unbound/dist/testdata/ttl_msg.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_any.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_any_dname.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_cnametocloser_nosig.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_cnametocnamewctoposwc.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_cnametoinsecure.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_cnametonodata_nonsec.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_cnametooptout.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_cnametoposnowc.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_deleg_nons.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_dnamewc.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_ds_cname.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_faildnskey.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_faildnskey_ok.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_keyprefetch_verify.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nodata_failsig.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nodata_failwc.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_nokeyprime.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b1_nameerror_nowc.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nsec3_b2_nodata_nons.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b3_optout.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nsec3_b3_optout_negcache.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nsec3_b3_optout_noce.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b3_optout_nonc.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b4_wild.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b4_wild_wr.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b5_wcnodata.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b5_wcnodata_noce.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b5_wcnodata_nonc.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b5_wcnodata_nowc.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_cnametocnamewctoposwc.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_entnodata_optout_badopt.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_nods_badsig.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nsec3_optout_cache.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_nsec3_wcany.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nx_failwc.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_nx_nsec3_collision.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nx_overreach.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_positive_nosigs.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_refer_unsignadd.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_referglue.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_secds_nosig.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_stub_noroot.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_ta_algo_missing.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_twocname.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/00-lint.tdir/00-lint.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/01-doc.tdir/01-doc.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/03-testbound.tdir/03-testbound.test up to 1.1.1.3 external/bsd/unbound/dist/testdata/04-checkconf.tdir/04-checkconf.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.badfwd up to 1.1.1.2 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.user up to 1.1.1.2 external/bsd/unbound/dist/testdata/04-checkconf.tdir/good.all up to 1.1.1.2 external/bsd/unbound/dist/testdata/07-confroot.tdir/07-confroot.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/07-confroot.tdir/07-confroot.test up to 1.1.1.3 external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.conf up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/bad_control.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/bad_control.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/bad_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/bad_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/unbound_control.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/unbound_control.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/unbound_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/unbound_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/test_cert.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound-control-setup up to 1.1.1.3 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound_control.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound_control.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/10-unbound-anchor.tdir/keys/unbound_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/auth_https.tdir/auth_https.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/clang-analysis.tdir/clang-analysis.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/clang-analysis.tdir/clang-analysis.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/unbound_control.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/unbound_control.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/unbound_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/ctrl_itr.tdir/unbound_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/unbound_control.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/unbound_control.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/unbound_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/ctrl_pipe.tdir/unbound_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.post up to 1.1.1.3 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/unbound_control.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/unbound_control.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/unbound_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_bogus.tdir/unbound_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.conf up to 1.1.1.3 external/bsd/unbound/dist/testdata/fwd_oneport.tdir/fwd_oneport.conf up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_zero.tdir/fwd_zero.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/nss_compile.tdir/nss_compile.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/nss_compile.tdir/nss_compile.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.lookup.conf up to 1.1.1.2 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.lookup.py up to 1.1.1.3 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.post up to 1.1.1.3 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.pre up to 1.1.1.3 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.test up to 1.1.1.4 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.testns up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.py up to 1.1.1.3 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.py up to 1.1.1.3 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/remote-threaded.tdir/remote-threaded.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/remote-threaded.tdir/unbound_control.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/remote-threaded.tdir/unbound_control.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/remote-threaded.tdir/unbound_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/remote-threaded.tdir/unbound_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/root_anchor.tdir/root_anchor.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/root_anchor.tdir/root_anchor.test up to 1.1.1.3 external/bsd/unbound/dist/testdata/root_hints.tdir/root_hints.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/root_hints.tdir/root_hints.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/speed_local.tdir/speed_local.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ssl_req_order.tdir/ssl_req_order.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ssl_req_order.tdir/unbound_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/ssl_req_order.tdir/unbound_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/ssl_req_timeout.tdir/ssl_req_timeout.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ssl_req_timeout.tdir/unbound_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/ssl_req_timeout.tdir/unbound_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.clie.conf up to 1.1.1.3 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.serv.conf up to 1.1.1.4 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.test up to 1.1.1.3 external/bsd/unbound/dist/testdata/stream_ssl.tdir/unbound_control.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/stream_ssl.tdir/unbound_control.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/stream_ssl.tdir/unbound_server.key up to 1.1.1.2 external/bsd/unbound/dist/testdata/stream_ssl.tdir/unbound_server.pem up to 1.1.1.2 external/bsd/unbound/dist/testdata/tcp_req_size.tdir/tcp_req_size.test up to 1.1.1.2 external/bsd/unbound/dist/util/config_file.c up to 1.1.1.8 external/bsd/unbound/dist/util/config_file.h up to 1.1.1.8 external/bsd/unbound/dist/util/configlexer.c up to 1.1.1.8 external/bsd/unbound/dist/util/configlexer.lex up to 1.1.1.8 external/bsd/unbound/dist/util/configparser.c up to 1.1.1.8 external/bsd/unbound/dist/util/configparser.h up to 1.1.1.8 external/bsd/unbound/dist/util/configparser.y up to 1.1.1.8 external/bsd/unbound/dist/util/configyyrename.h up to 1.1.1.2 external/bsd/unbound/dist/util/edns.c up to 1.1.1.4 external/bsd/unbound/dist/util/edns.h up to 1.1.1.4 external/bsd/unbound/dist/util/fptr_wlist.c up to 1.1.1.8 external/bsd/unbound/dist/util/fptr_wlist.h up to 1.1.1.5 external/bsd/unbound/dist/util/iana_ports.inc up to 1.1.1.8 external/bsd/unbound/dist/util/log.c up to 1.1.1.7 external/bsd/unbound/dist/util/log.h up to 1.1.1.4 external/bsd/unbound/dist/util/mini_event.c up to 1.5 external/bsd/unbound/dist/util/mini_event.h up to 1.1.1.3 external/bsd/unbound/dist/util/module.c up to 1.1.1.5 external/bsd/unbound/dist/util/module.h up to 1.1.1.7 external/bsd/unbound/dist/util/net_help.c up to 1.1.1.8 external/bsd/unbound/dist/util/net_help.h up to 1.1.1.8 external/bsd/unbound/dist/util/netevent.c up to 1.6 external/bsd/unbound/dist/util/netevent.h up to 1.1.1.7 external/bsd/unbound/dist/util/random.c up to 1.1.1.3 external/bsd/unbound/dist/util/regional.c up to 1.1.1.5 external/bsd/unbound/dist/util/regional.h up to 1.1.1.2 external/bsd/unbound/dist/util/rtt.c up to 1.1.1.3 external/bsd/unbound/dist/util/rtt.h up to 1.1.1.2 external/bsd/unbound/dist/util/timehist.c up to 1.1.1.3 external/bsd/unbound/dist/util/tube.c up to 1.1.1.5 external/bsd/unbound/dist/util/tube.h up to 1.1.1.3 external/bsd/unbound/dist/util/ub_event.c up to 1.1.1.6 external/bsd/unbound/dist/util/ub_event_pluggable.c up to 1.1.1.4 external/bsd/unbound/dist/util/data/dname.c up to 1.1.1.5 external/bsd/unbound/dist/util/data/dname.h up to 1.1.1.5 external/bsd/unbound/dist/util/data/msgencode.c up to 1.1.1.7 external/bsd/unbound/dist/util/data/msgencode.h up to 1.1.1.3 external/bsd/unbound/dist/util/data/msgparse.c up to 1.1.1.7 external/bsd/unbound/dist/util/data/msgparse.h up to 1.1.1.6 external/bsd/unbound/dist/util/data/msgreply.c up to 1.1.1.8 external/bsd/unbound/dist/util/data/msgreply.h up to 1.1.1.8 external/bsd/unbound/dist/util/data/packed_rrset.c up to 1.1.1.4 external/bsd/unbound/dist/util/data/packed_rrset.h up to 1.1.1.5 external/bsd/unbound/dist/util/shm_side/shm_main.c up to 1.1.1.4 external/bsd/unbound/dist/util/storage/dnstree.c up to 1.1.1.4 external/bsd/unbound/dist/util/storage/dnstree.h up to 1.1.1.4 external/bsd/unbound/dist/util/storage/lookup3.c up to 1.1.1.4 external/bsd/unbound/dist/util/storage/lruhash.c up to 1.1.1.4 external/bsd/unbound/dist/util/storage/lruhash.h up to 1.1.1.3 external/bsd/unbound/dist/util/storage/slabhash.c up to 1.1.1.4 external/bsd/unbound/dist/util/storage/slabhash.h up to 1.1.1.4 external/bsd/unbound/dist/validator/autotrust.c up to 1.1.1.7 external/bsd/unbound/dist/validator/val_anchor.c up to 1.1.1.7 external/bsd/unbound/dist/validator/val_anchor.h up to 1.1.1.5 external/bsd/unbound/dist/validator/val_kcache.c up to 1.1.1.4 external/bsd/unbound/dist/validator/val_kcache.h up to 1.1.1.2 external/bsd/unbound/dist/validator/val_kentry.c up to 1.1.1.3 external/bsd/unbound/dist/validator/val_kentry.h up to 1.1.1.3 external/bsd/unbound/dist/validator/val_neg.c up to 1.1.1.6 external/bsd/unbound/dist/validator/val_neg.h up to 1.1.1.4 external/bsd/unbound/dist/validator/val_nsec.c up to 1.1.1.6 external/bsd/unbound/dist/validator/val_nsec.h up to 1.1.1.4 external/bsd/unbound/dist/validator/val_nsec3.c up to 1.1.1.5 external/bsd/unbound/dist/validator/val_nsec3.h up to 1.1.1.4 external/bsd/unbound/dist/validator/val_secalgo.c up to 1.1.1.7 external/bsd/unbound/dist/validator/val_secalgo.h up to 1.1.1.2 external/bsd/unbound/dist/validator/val_sigcrypt.c up to 1.1.1.7 external/bsd/unbound/dist/validator/val_sigcrypt.h up to 1.1.1.4 external/bsd/unbound/dist/validator/val_utils.c up to 1.1.1.5 external/bsd/unbound/dist/validator/val_utils.h up to 1.1.1.5 external/bsd/unbound/dist/validator/validator.c up to 1.1.1.8 external/bsd/unbound/dist/validator/validator.h up to 1.1.1.6 external/bsd/unbound/include/config.h up to 1.12 external/bsd/unbound/lib/libunbound/Makefile up to 1.9 external/bsd/unbound/lib/libunbound/shlib_version up to 1.6 external/bsd/wpa/dist/hostapd/README-MULTI-AP up to 1.1.1.1 external/bsd/wpa/dist/src/ap/airtime_policy.c up to 1.1.1.1 external/bsd/wpa/dist/src/ap/airtime_policy.h up to 1.1.1.1 external/bsd/wpa/dist/src/ap/wpa_auth_kay.c up to 1.1.1.1 external/bsd/wpa/dist/src/ap/wpa_auth_kay.h up to 1.1.1.1 external/bsd/wpa/dist/src/common/dragonfly.c up to 1.1.1.1 external/bsd/wpa/dist/src/common/dragonfly.h up to 1.1.1.1 external/bsd/wpa/dist/src/common/ocv.c up to 1.1.1.1 external/bsd/wpa/dist/src/common/ocv.h up to 1.1.1.1 external/bsd/wpa/dist/src/crypto/sha512.c up to 1.1.1.1 external/bsd/wpa/dist/src/eap_common/eap_teap_common.c up to 1.1.1.1 external/bsd/wpa/dist/src/eap_common/eap_teap_common.h up to 1.1.1.1 external/bsd/wpa/dist/src/eap_peer/eap_teap.c up to 1.1.1.1 external/bsd/wpa/dist/src/eap_peer/eap_teap_pac.c up to 1.1.1.1 external/bsd/wpa/dist/src/eap_peer/eap_teap_pac.h up to 1.1.1.1 external/bsd/wpa/dist/src/eap_server/eap_server_teap.c up to 1.1.1.1 external/bsd/wpa/dist/wpa_supplicant/README-DPP up to 1.1.1.1 external/bsd/wpa/dist/src/crypto/.gitignore delete external/bsd/wpa/dist/src/drivers/.gitignore delete external/bsd/wpa/dist/src/radius/.gitignore delete external/bsd/wpa/dist/src/tls/.gitignore delete external/bsd/wpa/dist/src/utils/.gitignore delete external/bsd/wpa/dist/wpa_supplicant/.gitignore delete external/bsd/wpa/dist/wpa_supplicant/doc/docbook/.gitignore delete external/bsd/wpa/dist/wpa_supplicant/dbus/.gitignore delete external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_old.c delete external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_old.h delete external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_old_handlers.c delete external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_old_handlers.h delete external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_old_handlers_wps.c delete external/bsd/wpa/dist/wpa_supplicant/dbus/fi.epitest.hostap.WPASupplicant.service.in delete external/bsd/wpa/dist/wpa_supplicant/examples/wpas-test.py delete external/bsd/wpa/dist/wpa_supplicant/wpa_gui-qt4/.gitignore delete external/bsd/wpa/dist/wpa_supplicant/wpa_gui-qt4/lang/.gitignore delete external/bsd/wpa/bin/hostapd/Makefile up to 1.17 external/bsd/wpa/bin/wpa_passphrase/Makefile up to 1.6 external/bsd/wpa/bin/wpa_supplicant/Makefile up to 1.11 external/bsd/wpa/bin/wpa_supplicant/wpa_supplicant.8 up to 1.10 external/bsd/wpa/dist/CONTRIBUTIONS up to 1.1.1.5 external/bsd/wpa/dist/COPYING up to 1.1.1.6 external/bsd/wpa/dist/README up to 1.1.1.8 external/bsd/wpa/dist/hostapd/Android.mk up to 1.1.1.7 external/bsd/wpa/dist/hostapd/ChangeLog up to 1.1.1.10 external/bsd/wpa/dist/hostapd/Makefile up to 1.1.1.9 external/bsd/wpa/dist/hostapd/README up to 1.1.1.8 external/bsd/wpa/dist/hostapd/android.config up to 1.1.1.6 external/bsd/wpa/dist/hostapd/config_file.c up to 1.1.1.8 external/bsd/wpa/dist/hostapd/ctrl_iface.c up to 1.1.1.9 external/bsd/wpa/dist/hostapd/defconfig up to 1.1.1.8 external/bsd/wpa/dist/hostapd/eap_register.c up to 1.1.1.5 external/bsd/wpa/dist/hostapd/hostapd.conf up to 1.1.1.9 external/bsd/wpa/dist/hostapd/hostapd.wpa_psk up to 1.1.1.2 external/bsd/wpa/dist/hostapd/hostapd_cli.c up to 1.11 external/bsd/wpa/dist/hostapd/main.c up to 1.6 external/bsd/wpa/dist/hostapd/wps-ap-nfc.py up to 1.1.1.2 external/bsd/wpa/dist/hs20/client/Makefile up to 1.1.1.3 external/bsd/wpa/dist/hs20/client/est.c up to 1.1.1.4 external/bsd/wpa/dist/hs20/client/osu_client.c up to 1.1.1.5 external/bsd/wpa/dist/src/lib.rules up to 1.1.1.3 external/bsd/wpa/dist/src/ap/Makefile up to 1.1.1.5 external/bsd/wpa/dist/src/ap/accounting.c up to 1.1.1.7 external/bsd/wpa/dist/src/ap/acs.c up to 1.1.1.5 external/bsd/wpa/dist/src/ap/ap_config.c up to 1.1.1.9 external/bsd/wpa/dist/src/ap/ap_config.h up to 1.1.1.8 external/bsd/wpa/dist/src/ap/ap_drv_ops.c up to 1.6 external/bsd/wpa/dist/src/ap/ap_drv_ops.h up to 1.1.1.8 external/bsd/wpa/dist/src/ap/authsrv.c up to 1.1.1.8 external/bsd/wpa/dist/src/ap/beacon.c up to 1.1.1.9 external/bsd/wpa/dist/src/ap/ctrl_iface_ap.c up to 1.1.1.8 external/bsd/wpa/dist/src/ap/dfs.c up to 1.1.1.5 external/bsd/wpa/dist/src/ap/dhcp_snoop.c up to 1.1.1.4 external/bsd/wpa/dist/src/ap/dpp_hostapd.c up to 1.1.1.2 external/bsd/wpa/dist/src/ap/dpp_hostapd.h up to 1.1.1.2 external/bsd/wpa/dist/src/ap/drv_callbacks.c up to 1.6 external/bsd/wpa/dist/src/ap/eap_user_db.c up to 1.1.1.5 external/bsd/wpa/dist/src/ap/fils_hlp.c up to 1.1.1.2 external/bsd/wpa/dist/src/ap/gas_serv.c up to 1.1.1.6 external/bsd/wpa/dist/src/ap/gas_serv.h up to 1.1.1.5 external/bsd/wpa/dist/src/ap/hostapd.c up to 1.5 external/bsd/wpa/dist/src/ap/hostapd.h up to 1.5 external/bsd/wpa/dist/src/ap/hs20.c up to 1.1.1.4 external/bsd/wpa/dist/src/ap/hw_features.c up to 1.1.1.8 external/bsd/wpa/dist/src/ap/ieee802_11.c up to 1.5 external/bsd/wpa/dist/src/ap/ieee802_11.h up to 1.1.1.9 external/bsd/wpa/dist/src/ap/ieee802_11_auth.c up to 1.1.1.7 external/bsd/wpa/dist/src/ap/ieee802_11_he.c up to 1.1.1.2 external/bsd/wpa/dist/src/ap/ieee802_11_shared.c up to 1.1.1.7 external/bsd/wpa/dist/src/ap/ieee802_11_vht.c up to 1.1.1.6 external/bsd/wpa/dist/src/ap/ieee802_1x.c up to 1.1.1.9 external/bsd/wpa/dist/src/ap/ieee802_1x.h up to 1.1.1.6 external/bsd/wpa/dist/src/ap/neighbor_db.c up to 1.1.1.3 external/bsd/wpa/dist/src/ap/neighbor_db.h up to 1.1.1.3 external/bsd/wpa/dist/src/ap/rrm.c up to 1.1.1.3 external/bsd/wpa/dist/src/ap/sta_info.c up to 1.1.1.8 external/bsd/wpa/dist/src/ap/sta_info.h up to 1.1.1.8 external/bsd/wpa/dist/src/ap/vlan_full.c up to 1.1.1.2 external/bsd/wpa/dist/src/ap/vlan_init.c up to 1.1.1.8 external/bsd/wpa/dist/src/ap/wmm.c up to 1.4 external/bsd/wpa/dist/src/ap/wnm_ap.c up to 1.1.1.6 external/bsd/wpa/dist/src/ap/wpa_auth.c up to 1.12 external/bsd/wpa/dist/src/ap/wpa_auth.h up to 1.4 external/bsd/wpa/dist/src/ap/wpa_auth_ft.c up to 1.4 external/bsd/wpa/dist/src/ap/wpa_auth_glue.c up to 1.1.1.9 external/bsd/wpa/dist/src/ap/wpa_auth_i.h up to 1.4 external/bsd/wpa/dist/src/ap/wpa_auth_ie.c up to 1.1.1.8 external/bsd/wpa/dist/src/ap/wpa_auth_ie.h up to 1.1.1.5 external/bsd/wpa/dist/src/ap/wps_hostapd.c up to 1.1.1.9 external/bsd/wpa/dist/src/common/common_module_tests.c up to 1.1.1.4 external/bsd/wpa/dist/src/common/defs.h up to 1.1.1.8 external/bsd/wpa/dist/src/common/dpp.c up to 1.2 external/bsd/wpa/dist/src/common/dpp.h up to 1.1.1.2 external/bsd/wpa/dist/src/common/hw_features_common.c up to 1.1.1.4 external/bsd/wpa/dist/src/common/hw_features_common.h up to 1.1.1.4 external/bsd/wpa/dist/src/common/ieee802_11_common.c up to 1.1.1.8 external/bsd/wpa/dist/src/common/ieee802_11_common.h up to 1.1.1.8 external/bsd/wpa/dist/src/common/ieee802_11_defs.h up to 1.1.1.8 external/bsd/wpa/dist/src/common/linux_bridge.h up to 1.1.1.2 external/bsd/wpa/dist/src/common/qca-vendor.h up to 1.1.1.5 external/bsd/wpa/dist/src/common/sae.c up to 1.10 external/bsd/wpa/dist/src/common/sae.h up to 1.1.1.5 external/bsd/wpa/dist/src/common/version.h up to 1.1.1.10 external/bsd/wpa/dist/src/common/wpa_common.c up to 1.1.1.8 external/bsd/wpa/dist/src/common/wpa_common.h up to 1.5 external/bsd/wpa/dist/src/common/wpa_ctrl.c up to 1.1.1.7 external/bsd/wpa/dist/src/common/wpa_ctrl.h up to 1.1.1.9 external/bsd/wpa/dist/src/crypto/Makefile up to 1.1.1.8 external/bsd/wpa/dist/src/crypto/aes-internal-enc.c up to 1.1.1.4 external/bsd/wpa/dist/src/crypto/aes_i.h up to 1.1.1.3 external/bsd/wpa/dist/src/crypto/crypto.h up to 1.1.1.6 external/bsd/wpa/dist/src/crypto/crypto_gnutls.c up to 1.1.1.4 external/bsd/wpa/dist/src/crypto/crypto_internal-modexp.c up to 1.1.1.4 external/bsd/wpa/dist/src/crypto/crypto_internal.c up to 1.1.1.5 external/bsd/wpa/dist/src/crypto/crypto_libtomcrypt.c up to 1.1.1.4 external/bsd/wpa/dist/src/crypto/crypto_linux.c up to 1.1.1.2 external/bsd/wpa/dist/src/crypto/crypto_nettle.c up to 1.1.1.2 external/bsd/wpa/dist/src/crypto/crypto_openssl.c up to 1.5 external/bsd/wpa/dist/src/crypto/crypto_wolfssl.c up to 1.1.1.2 external/bsd/wpa/dist/src/crypto/dh_groups.c up to 1.1.1.8 external/bsd/wpa/dist/src/crypto/md4-internal.c up to 1.1.1.4 external/bsd/wpa/dist/src/crypto/random.c up to 1.1.1.6 external/bsd/wpa/dist/src/crypto/sha1-internal.c up to 1.1.1.6 external/bsd/wpa/dist/src/crypto/sha1-prf.c up to 1.1.1.3 external/bsd/wpa/dist/src/crypto/sha1-tlsprf.c up to 1.1.1.4 external/bsd/wpa/dist/src/crypto/sha1-tprf.c up to 1.1.1.4 external/bsd/wpa/dist/src/crypto/sha1.c up to 1.1.1.4 external/bsd/wpa/dist/src/crypto/sha256-kdf.c up to 1.1.1.4 external/bsd/wpa/dist/src/crypto/sha256-prf.c up to 1.1.1.5 external/bsd/wpa/dist/src/crypto/sha256-tlsprf.c up to 1.1.1.2 external/bsd/wpa/dist/src/crypto/sha256.h up to 1.1.1.6 external/bsd/wpa/dist/src/crypto/sha384-kdf.c up to 1.1.1.2 external/bsd/wpa/dist/src/crypto/sha384-prf.c up to 1.1.1.3 external/bsd/wpa/dist/src/crypto/sha512-internal.c up to 1.1.1.2 external/bsd/wpa/dist/src/crypto/sha512-kdf.c up to 1.1.1.2 external/bsd/wpa/dist/src/crypto/sha512-prf.c up to 1.1.1.2 external/bsd/wpa/dist/src/crypto/tls.h up to 1.1.1.8 external/bsd/wpa/dist/src/crypto/tls_gnutls.c up to 1.1.1.8 external/bsd/wpa/dist/src/crypto/tls_internal.c up to 1.1.1.8 external/bsd/wpa/dist/src/crypto/tls_none.c up to 1.1.1.7 external/bsd/wpa/dist/src/crypto/tls_openssl.c up to 1.1.1.9 external/bsd/wpa/dist/src/crypto/tls_wolfssl.c up to 1.1.1.2 external/bsd/wpa/dist/src/drivers/driver.h up to 1.5 external/bsd/wpa/dist/src/drivers/driver_atheros.c up to 1.1.1.9 external/bsd/wpa/dist/src/drivers/driver_bsd.c up to 1.39 external/bsd/wpa/dist/src/drivers/driver_common.c up to 1.1.1.7 external/bsd/wpa/dist/src/drivers/driver_hostap.c up to 1.1.1.7 external/bsd/wpa/dist/src/drivers/driver_macsec_linux.c up to 1.1.1.2 external/bsd/wpa/dist/src/drivers/driver_macsec_qca.c up to 1.1.1.5 external/bsd/wpa/dist/src/drivers/driver_ndis.c up to 1.1.1.7 external/bsd/wpa/dist/src/drivers/driver_nl80211.c up to 1.1.1.9 external/bsd/wpa/dist/src/drivers/driver_nl80211.h up to 1.1.1.4 external/bsd/wpa/dist/src/drivers/driver_nl80211_capa.c up to 1.1.1.4 external/bsd/wpa/dist/src/drivers/driver_nl80211_event.c up to 1.1.1.4 external/bsd/wpa/dist/src/drivers/driver_nl80211_scan.c up to 1.1.1.4 external/bsd/wpa/dist/src/drivers/driver_openbsd.c up to 1.1.1.2 external/bsd/wpa/dist/src/drivers/driver_privsep.c up to 1.1.1.6 external/bsd/wpa/dist/src/drivers/driver_roboswitch.c up to 1.1.1.7 external/bsd/wpa/dist/src/drivers/driver_wext.c up to 1.1.1.8 external/bsd/wpa/dist/src/drivers/drivers.mak up to 1.1.1.8 external/bsd/wpa/dist/src/drivers/drivers.mk up to 1.1.1.7 external/bsd/wpa/dist/src/drivers/linux_ioctl.c up to 1.1.1.6 external/bsd/wpa/dist/src/drivers/nl80211_copy.h up to 1.1.1.8 external/bsd/wpa/dist/src/eap_common/eap_defs.h up to 1.1.1.7 external/bsd/wpa/dist/src/eap_common/eap_eke_common.c up to 1.1.1.4 external/bsd/wpa/dist/src/eap_common/eap_pwd_common.c up to 1.6 external/bsd/wpa/dist/src/eap_common/eap_pwd_common.h up to 1.3 external/bsd/wpa/dist/src/eap_common/eap_sake_common.c up to 1.1.1.4 external/bsd/wpa/dist/src/eap_common/eap_sake_common.h up to 1.1.1.3 external/bsd/wpa/dist/src/eap_common/eap_sim_common.c up to 1.1.1.6 external/bsd/wpa/dist/src/eap_common/eap_sim_common.h up to 1.1.1.4 external/bsd/wpa/dist/src/eap_peer/eap.c up to 1.1.1.9 external/bsd/wpa/dist/src/eap_peer/eap.h up to 1.1.1.8 external/bsd/wpa/dist/src/eap_peer/eap_aka.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_peer/eap_config.h up to 1.2 external/bsd/wpa/dist/src/eap_peer/eap_eke.c up to 1.1.1.4 external/bsd/wpa/dist/src/eap_peer/eap_fast.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_peer/eap_leap.c up to 1.1.1.7 external/bsd/wpa/dist/src/eap_peer/eap_methods.h up to 1.1.1.6 external/bsd/wpa/dist/src/eap_peer/eap_mschapv2.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_peer/eap_peap.c up to 1.2 external/bsd/wpa/dist/src/eap_peer/eap_pwd.c up to 1.9 external/bsd/wpa/dist/src/eap_peer/eap_sake.c up to 1.1.1.7 external/bsd/wpa/dist/src/eap_peer/eap_sim.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_peer/eap_tls.c up to 1.1.1.6 external/bsd/wpa/dist/src/eap_peer/eap_tls_common.c up to 1.2 external/bsd/wpa/dist/src/eap_peer/eap_tls_common.h up to 1.2 external/bsd/wpa/dist/src/eap_peer/eap_ttls.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_peer/eap_wsc.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_server/eap.h up to 1.1.1.8 external/bsd/wpa/dist/src/eap_server/eap_i.h up to 1.1.1.8 external/bsd/wpa/dist/src/eap_server/eap_methods.h up to 1.1.1.6 external/bsd/wpa/dist/src/eap_server/eap_server.c up to 1.5 external/bsd/wpa/dist/src/eap_server/eap_server_aka.c up to 1.1.1.9 external/bsd/wpa/dist/src/eap_server/eap_server_gpsk.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_server/eap_server_mschapv2.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_server/eap_server_pax.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_server/eap_server_peap.c up to 1.1.1.7 external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c up to 1.9 external/bsd/wpa/dist/src/eap_server/eap_server_sake.c up to 1.1.1.8 external/bsd/wpa/dist/src/eap_server/eap_server_sim.c up to 1.1.1.9 external/bsd/wpa/dist/src/eap_server/eap_server_tls.c up to 1.1.1.7 external/bsd/wpa/dist/src/eap_server/eap_server_tls_common.c up to 1.9 external/bsd/wpa/dist/src/eap_server/eap_server_ttls.c up to 1.1.1.9 external/bsd/wpa/dist/src/eap_server/eap_tls_common.h up to 1.1.1.7 external/bsd/wpa/dist/src/eapol_auth/eapol_auth_sm.c up to 1.1.1.8 external/bsd/wpa/dist/src/eapol_auth/eapol_auth_sm.h up to 1.1.1.8 external/bsd/wpa/dist/src/eapol_supp/eapol_supp_sm.c up to 1.1.1.9 external/bsd/wpa/dist/src/eapol_supp/eapol_supp_sm.h up to 1.1.1.7 external/bsd/wpa/dist/src/fst/fst.h up to 1.1.1.2 external/bsd/wpa/dist/src/p2p/p2p.c up to 1.5 external/bsd/wpa/dist/src/p2p/p2p.h up to 1.1.1.7 external/bsd/wpa/dist/src/p2p/p2p_build.c up to 1.1.1.6 external/bsd/wpa/dist/src/p2p/p2p_go_neg.c up to 1.1.1.8 external/bsd/wpa/dist/src/p2p/p2p_group.c up to 1.1.1.7 external/bsd/wpa/dist/src/p2p/p2p_i.h up to 1.1.1.8 external/bsd/wpa/dist/src/p2p/p2p_invitation.c up to 1.1.1.7 external/bsd/wpa/dist/src/p2p/p2p_utils.c up to 1.1.1.6 external/bsd/wpa/dist/src/pae/ieee802_1x_cp.c up to 1.1.1.4 external/bsd/wpa/dist/src/pae/ieee802_1x_cp.h up to 1.1.1.3 external/bsd/wpa/dist/src/pae/ieee802_1x_kay.c up to 1.1.1.5 external/bsd/wpa/dist/src/pae/ieee802_1x_kay.h up to 1.1.1.4 external/bsd/wpa/dist/src/pae/ieee802_1x_kay_i.h up to 1.1.1.4 external/bsd/wpa/dist/src/pae/ieee802_1x_key.c up to 1.1.1.2 external/bsd/wpa/dist/src/pae/ieee802_1x_key.h up to 1.1.1.2 external/bsd/wpa/dist/src/pae/ieee802_1x_secy_ops.c up to 1.1.1.4 external/bsd/wpa/dist/src/pae/ieee802_1x_secy_ops.h up to 1.1.1.4 external/bsd/wpa/dist/src/radius/radius_client.c up to 1.3 external/bsd/wpa/dist/src/radius/radius_server.c up to 1.1.1.8 external/bsd/wpa/dist/src/radius/radius_server.h up to 1.1.1.8 external/bsd/wpa/dist/src/rsn_supp/pmksa_cache.c up to 1.1.1.9 external/bsd/wpa/dist/src/rsn_supp/tdls.c up to 1.4 external/bsd/wpa/dist/src/rsn_supp/wpa.c up to 1.5 external/bsd/wpa/dist/src/rsn_supp/wpa.h up to 1.1.1.8 external/bsd/wpa/dist/src/rsn_supp/wpa_ft.c up to 1.4 external/bsd/wpa/dist/src/rsn_supp/wpa_i.h up to 1.4 external/bsd/wpa/dist/src/rsn_supp/wpa_ie.c up to 1.1.1.8 external/bsd/wpa/dist/src/rsn_supp/wpa_ie.h up to 1.1.1.7 external/bsd/wpa/dist/src/tls/asn1.c up to 1.1.1.5 external/bsd/wpa/dist/src/tls/bignum.c up to 1.1.1.3 external/bsd/wpa/dist/src/tls/libtommath.c up to 1.1.1.7 external/bsd/wpa/dist/src/tls/tlsv1_client.c up to 1.1.1.8 external/bsd/wpa/dist/src/tls/tlsv1_client.h up to 1.1.1.5 external/bsd/wpa/dist/src/tls/tlsv1_client_read.c up to 1.1.1.8 external/bsd/wpa/dist/src/tls/tlsv1_client_write.c up to 1.1.1.7 external/bsd/wpa/dist/src/tls/tlsv1_server.c up to 1.1.1.8 external/bsd/wpa/dist/src/tls/tlsv1_server.h up to 1.1.1.5 external/bsd/wpa/dist/src/tls/tlsv1_server_i.h up to 1.1.1.5 external/bsd/wpa/dist/src/tls/tlsv1_server_read.c up to 1.1.1.7 external/bsd/wpa/dist/src/tls/tlsv1_server_write.c up to 1.1.1.6 external/bsd/wpa/dist/src/tls/x509v3.c up to 1.1.1.9 external/bsd/wpa/dist/src/utils/Makefile up to 1.1.1.5 external/bsd/wpa/dist/src/utils/base64.c up to 1.1.1.6 external/bsd/wpa/dist/src/utils/browser.c up to 1.1.1.2 external/bsd/wpa/dist/src/utils/common.c up to 1.6 external/bsd/wpa/dist/src/utils/common.h up to 1.7 external/bsd/wpa/dist/src/utils/eloop.c up to 1.14 external/bsd/wpa/dist/src/utils/http_curl.c up to 1.1.1.5 external/bsd/wpa/dist/src/utils/json.c up to 1.1.1.2 external/bsd/wpa/dist/src/utils/list.h up to 1.1.1.5 external/bsd/wpa/dist/src/utils/os_internal.c up to 1.1.1.7 external/bsd/wpa/dist/src/utils/os_none.c up to 1.1.1.8 external/bsd/wpa/dist/src/utils/os_unix.c up to 1.6 external/bsd/wpa/dist/src/utils/trace.c up to 1.1.1.7 external/bsd/wpa/dist/src/utils/utils_module_tests.c up to 1.1.1.5 external/bsd/wpa/dist/src/utils/wpa_debug.c up to 1.1.1.8 external/bsd/wpa/dist/src/wps/wps.c up to 1.1.1.9 external/bsd/wpa/dist/src/wps/wps.h up to 1.1.1.8 external/bsd/wpa/dist/src/wps/wps_attr_build.c up to 1.1.1.7 external/bsd/wpa/dist/src/wps/wps_attr_parse.c up to 1.1.1.7 external/bsd/wpa/dist/src/wps/wps_attr_parse.h up to 1.1.1.4 external/bsd/wpa/dist/src/wps/wps_common.c up to 1.1.1.9 external/bsd/wpa/dist/src/wps/wps_defs.h up to 1.1.1.8 external/bsd/wpa/dist/src/wps/wps_dev_attr.c up to 1.1.1.5 external/bsd/wpa/dist/src/wps/wps_dev_attr.h up to 1.1.1.5 external/bsd/wpa/dist/src/wps/wps_enrollee.c up to 1.1.1.9 external/bsd/wpa/dist/src/wps/wps_er.c up to 1.1.1.8 external/bsd/wpa/dist/src/wps/wps_i.h up to 1.1.1.7 external/bsd/wpa/dist/src/wps/wps_registrar.c up to 1.1.1.10 external/bsd/wpa/dist/src/wps/wps_upnp.c up to 1.1.1.8 external/bsd/wpa/dist/src/wps/wps_validate.c up to 1.1.1.5 external/bsd/wpa/dist/wpa_supplicant/Android.mk up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/ChangeLog up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/Makefile up to 1.5 external/bsd/wpa/dist/wpa_supplicant/README up to 1.5 external/bsd/wpa/dist/wpa_supplicant/README-P2P up to 1.1.1.6 external/bsd/wpa/dist/wpa_supplicant/android.config up to 1.1.1.6 external/bsd/wpa/dist/wpa_supplicant/ap.c up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/ap.h up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/bss.c up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/bss.h up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/config.c up to 1.8 external/bsd/wpa/dist/wpa_supplicant/config.h up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/config_file.c up to 1.1.1.9 external/bsd/wpa/dist/wpa_supplicant/config_ssid.h up to 1.1.1.9 external/bsd/wpa/dist/wpa_supplicant/config_winreg.c up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/ctrl_iface.c up to 1.6 external/bsd/wpa/dist/wpa_supplicant/ctrl_iface_unix.c up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/defconfig up to 1.5 external/bsd/wpa/dist/wpa_supplicant/dpp_supplicant.c up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/dpp_supplicant.h up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/driver_i.h up to 1.4 external/bsd/wpa/dist/wpa_supplicant/eap_register.c up to 1.1.1.5 external/bsd/wpa/dist/wpa_supplicant/eapol_test.c up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/eapol_test.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/events.c up to 1.9 external/bsd/wpa/dist/wpa_supplicant/gas_query.c up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/gas_query.h up to 1.1.1.6 external/bsd/wpa/dist/wpa_supplicant/hs20_supplicant.c up to 1.1.1.6 external/bsd/wpa/dist/wpa_supplicant/hs20_supplicant.h up to 1.1.1.6 external/bsd/wpa/dist/wpa_supplicant/ibss_rsn.c up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/interworking.c up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/main.c up to 1.5 external/bsd/wpa/dist/wpa_supplicant/mbo.c up to 1.1.1.3 external/bsd/wpa/dist/wpa_supplicant/mesh.c up to 1.1.1.4 external/bsd/wpa/dist/wpa_supplicant/mesh_mpm.c up to 1.1.1.4 external/bsd/wpa/dist/wpa_supplicant/mesh_rsn.c up to 1.1.1.4 external/bsd/wpa/dist/wpa_supplicant/notify.c up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/notify.h up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/op_classes.c up to 1.3 external/bsd/wpa/dist/wpa_supplicant/p2p_supplicant.c up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/p2p_supplicant.h up to 1.1.1.6 external/bsd/wpa/dist/wpa_supplicant/preauth_test.c up to 1.1.1.6 external/bsd/wpa/dist/wpa_supplicant/rrm.c up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/scan.c up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/sme.c up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/sme.h up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/wmm_ac.c up to 1.1.1.3 external/bsd/wpa/dist/wpa_supplicant/wnm_sta.c up to 1.6 external/bsd/wpa/dist/wpa_supplicant/wpa_cli.c up to 1.11 external/bsd/wpa/dist/wpa_supplicant/wpa_supplicant.c up to 1.12 external/bsd/wpa/dist/wpa_supplicant/wpa_supplicant.conf up to 1.2 external/bsd/wpa/dist/wpa_supplicant/wpa_supplicant_i.h up to 1.6 external/bsd/wpa/dist/wpa_supplicant/wpas_glue.c up to 1.1.1.9 external/bsd/wpa/dist/wpa_supplicant/wpas_kay.c up to 1.1.1.4 external/bsd/wpa/dist/wpa_supplicant/wps_supplicant.c up to 1.1.1.9 external/bsd/wpa/dist/wpa_supplicant/wps_supplicant.h up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/dbus/Makefile up to 1.1.1.4 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus-wpa_supplicant.conf up to 1.1.1.3 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_common.c up to 1.1.1.5 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_new.c up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_new.h up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_new_handlers.c up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_new_handlers.h up to 1.1.1.9 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_new_handlers_p2p.c up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_new_handlers_p2p.h up to 1.1.1.6 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_new_handlers_wps.c up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/dbus/dbus_new_helpers.c up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/eapol_test.8 up to 1.1.1.5 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/eapol_test.sgml up to 1.1.1.5 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_background.8 up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_background.sgml up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_cli.8 up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_cli.sgml up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_gui.8 up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_gui.sgml up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_passphrase.8 up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_passphrase.sgml up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_priv.8 up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_priv.sgml up to 1.1.1.7 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_supplicant.8 up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_supplicant.conf.5 up to 1.1.1.10 external/bsd/wpa/dist/wpa_supplicant/doc/docbook/wpa_supplicant.sgml up to 1.1.1.8 external/bsd/wpa/dist/wpa_supplicant/examples/dbus-listen-preq.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/dpp-qrcode.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/p2p-nfc.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/wpas-dbus-new-getall.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/wpas-dbus-new-signals.py up to 1.1.1.3 external/bsd/wpa/dist/wpa_supplicant/examples/wpas-dbus-new-wps.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/wpas-dbus-new.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/wps-nfc.py up to 1.1.1.3 external/bsd/wpa/dist/wpa_supplicant/examples/p2p/p2p_connect.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/p2p/p2p_disconnect.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/p2p/p2p_find.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/p2p/p2p_flush.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/p2p/p2p_group_add.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/p2p/p2p_invite.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/p2p/p2p_listen.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/examples/p2p/p2p_stop_find.py up to 1.1.1.2 external/bsd/wpa/dist/wpa_supplicant/systemd/wpa_supplicant.service.in up to 1.1.1.3 external/bsd/wpa/dist/wpa_supplicant/utils/log2pcap.py up to 1.1.1.2 external/mpl/dhcp/dist/common/tests/domain_name_test.c up to 1.2 external/mpl/dhcp/dist/dhcpctl/cltest2.c up to 1.2 external/mpl/dhcp/dist/relay/tests/Atffile up to 1.1.1.1 external/mpl/dhcp/dist/relay/tests/Kyuafile up to 1.1.1.1 external/mpl/dhcp/dist/relay/tests/Makefile.am up to 1.1.1.1 external/mpl/dhcp/dist/relay/tests/Makefile.in up to 1.1.1.3 external/mpl/dhcp/dist/relay/tests/relay_unittests.c up to 1.4 external/mpl/dhcp/dist/CONTRIBUTING.md up to 1.1.1.2 external/mpl/dhcp/dist/keama/tests/badduid.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/README up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/example.conf up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/example.json up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/runall.sh up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/runone.sh up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/simple.conf up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/simple.json up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/test-a6.conf up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/test-a6.json up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/vmnet8.conf up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/samples/vmnet8.json up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badcasexsc.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badcasexsc.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badclass2.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badclass2.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/baddecl2array.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/baddecl2array.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/baddecl2record.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/baddecl2record.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/baddeclBt.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/baddeclBt.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/baddefaultxsc.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/baddefaultxsc.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/baddomain.notyet up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badduid.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/env up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badinclude.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badinclude.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badoption66.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badoption66.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badoptionD6.notyet up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badoptionDc4.notyet up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badoptionI4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badoptionI4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badoptiond4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badoptiond4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badstatusdir.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badstatusdir.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badsubclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/badsubclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/bintadx6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/bintadx6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/bootfilename4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/bootfilename4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/charcasedx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/checkall.sh up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/charcasedx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/checkone.sh up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/class4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/class4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/class4empty.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/class4empty.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/class6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/class6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/class6empty.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/class6empty.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/classbadmatch.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/classbadmatch.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/classbadmatchif.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/classbadmatchif.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/classinclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/classinclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/concatdx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/concatdx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/concatnulldx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/concatnulldx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/docsis4.dir up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/configdata4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/configdata4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/dbtimeformat4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/dbtimeformat4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/dbtimeformat6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/dbtimeformat6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/ddnsupdstyle6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/ddnsupdstyle6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/defaultexpr6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/defaultexpr6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/denyunknown6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/denyunknown6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/docsis6.dir up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duid2.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duid2.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duiden6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duiden6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidennoid.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidennoid.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidennonum.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidennonum.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidll6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidll6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidllbadtype.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidllbadtype.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidllhw6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidllhw6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidllnohw.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidllnohw.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidllt6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidllt6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltbadtype.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltbadtype.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltnohw.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltnohw.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltnotime.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltnotime.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltthw4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltthw4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltthw6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidlltthw6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidnoid.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/duidnoid.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/enableupdates6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/enableupdates6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/encodedx6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/encodedx6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/escapestring4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/escapestring4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/execstatement4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/execstatement4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/execstatement6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/execstatement6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/existsbx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/existsbx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/filename4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/filename4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/filenamedx4.notyet up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/fixedaddressinroot4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/fixedaddressinroot4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/fixedaddressinroot6.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/fixedaddressinroot6.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/fixedprefixinroot.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/fixedprefixinroot.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/fqdncompressed.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/fqdncompressed.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/gethostdx4.notyet up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/global4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/global4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/global6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/global6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupclass4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupclass4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupclass6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupclass6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupgroup4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupgroup4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/grouphost4.inn up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/grouphost4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupinclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupinclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupsubnet4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupsubnet4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupsubnet6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupsubnet6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupsubnetif.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/groupsubnetif.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hardware2dx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hardware2dx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hardwaredx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hardwaredx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hardwareinroot.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hardwareinroot.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/host6.notyet up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostidentifier4.inl up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostidentifier4.outl up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostnum.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostinclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostinclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostinhost.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostinhost.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostname4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostname4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostnum.errF up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostuid4.inn up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/hostuid4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/ifxsc4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/ifxsc4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/ipaddr6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/ipaddr6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/ipaddrhost4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/ipaddrhost4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/ipaddrs4.notyet4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/lifetime4.ind up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/lifetime4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/lifetime6.inD up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/lifetime6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/lifetimedef4.ind up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/lifetimedef4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/lifetimedef6.inD up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/lifetimedef6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/listarray.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/listarray.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/minimal4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/minimal4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/minimal6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/minimal6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/mixedarray.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/mixedarray.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/nestarray.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/nestarray.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/noauth4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/noauth4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/noauth6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/noauth6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/noclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/noclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/noinclude.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/noinclude.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/notbx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/nosubclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/nosubclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/nosuperclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/nosuperclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/notbx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/notnotbx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/notnotbx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/nxdomainnx6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/nxdomainnx6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/onxsc4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/onxsc4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optdatagrouppool4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optdatagrouppool4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondata4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondata4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondata6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondata6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondatapool4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondatapool4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondatapool6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondatapool6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondecl4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondecl4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondecl6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondecl6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondeclBat4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optiondeclBat4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionencap4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionencap4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionencap6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionencap6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionexpr4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionexpr4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionspace4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionspace4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionspace6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionspace6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionvendor4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionvendor4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionvendor6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/optionvendor6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/orphan4.inn up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/orphan4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/orphan6.inN up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/orphan6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/packetdx4.notyet up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/permitauth4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/permitauth4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/permitauth6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/permitauth6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/permitknown4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/permitknown4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pickdx6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pickdx6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pool4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pool4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pool42.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pool42.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pool6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pool6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pool6in4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/pool6in4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/poolinroot4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/poolinroot4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/poolinroot6.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/poolinroot6.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/preferred6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/preferred6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefix0.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefix0.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefix128.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefix128.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefix6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefix6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefix62.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefix62.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefixinroot6.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/prefixinroot6.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/qualifyingsuffix4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/qualifyingsuffix4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/qualifyingsuffix6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/qualifyingsuffix6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/range4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/range4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/range6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/range6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/range6in4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/range6in4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/rangeinroot4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/rangeinroot4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/rangeinroot6.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/rangeinroot6.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/reversedx6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/reversedx6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/runall.sh up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/runone.sh up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/share0.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/share0.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/share2if.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/share2if.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareempty.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareempty.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinhost.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinhost.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinshare.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinshare.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinsubnet4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinsubnet4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinsubnet6.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareinsubnet6.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/sharenoname.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/sharenoname.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareone4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareone4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareone6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/shareone6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/sharepools4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/sharepools4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/sharetwo4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/sharetwo4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/sharetwo6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/sharetwo6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/sname4.notyet up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/spawning6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/spawning6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclass4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclass4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclass6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclass6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclassbinsel4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclassbinsel4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclassbinsel6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclassbinsel6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclassguard4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclassguard4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclassguard6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subclassguard6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet42if.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet42if.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4auth.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4auth.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4badmask.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4badmask.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4inclass.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4inclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4inhost.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4inhost.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4nomask.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet4nomask.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet62if.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet62if.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6auth.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6auth.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6inclass.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6inclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6one.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6inhost.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6inhost.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6multi.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6multi.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6nolen.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6nolen.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6noslash.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6noslash.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnet6one.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnetinsubnet4.err4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnetinsubnet4.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnetinsubnet6.err6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/subnetinsubnet6.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/substringdx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/substringdx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/suffixdx4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/suffixdx4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/switchxsc4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/switchxsc4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/switchxsc6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/switchxsc6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/tautology.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/tautology.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/tautologyhexa.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/tautologyhexa.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/tautologysub.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/tautologysub.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/temporary6.in6 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/temporary6.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/textarray.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/textarray.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/unknownoption.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/unknownoption.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/unknownspace.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/unknownspace.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/userclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/userclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/vendorclass.err up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/vendorclass.msg up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/vendorspace4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/vendorspace4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/zone4.in4 up to 1.1.1.1 external/mpl/dhcp/dist/keama/tests/zone4.out up to 1.1.1.1 external/mpl/dhcp/dist/keama/ChangeLog.md up to 1.1.1.2 external/mpl/dhcp/dist/keama/Makefile.am up to 1.1.1.1 external/mpl/dhcp/dist/keama/Makefile.in up to 1.1.1.3 external/mpl/dhcp/dist/keama/README.md up to 1.1.1.1 external/mpl/dhcp/dist/keama/conflex.c up to 1.3 external/mpl/dhcp/dist/keama/confparse.c up to 1.3 external/mpl/dhcp/dist/keama/data.c up to 1.3 external/mpl/dhcp/dist/keama/data.h up to 1.3 external/mpl/dhcp/dist/keama/dhctoken.h up to 1.3 external/mpl/dhcp/dist/keama/doc.txt up to 1.1.1.1 external/mpl/dhcp/dist/keama/eval.c up to 1.3 external/mpl/dhcp/dist/keama/json.c up to 1.3 external/mpl/dhcp/dist/keama/keama.8 up to 1.3 external/mpl/dhcp/dist/keama/keama.c up to 1.3 external/mpl/dhcp/dist/keama/keama.h up to 1.3 external/mpl/dhcp/dist/keama/options.c up to 1.3 external/mpl/dhcp/dist/keama/parse.c up to 1.3 external/mpl/dhcp/dist/keama/print.c up to 1.3 external/mpl/dhcp/dist/keama/reduce.c up to 1.3 external/mpl/dhcp/bind/dist/lib/dns/dst_api.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/Kyuafile up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/acl.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/adb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/badcache.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/byaddr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/cache.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/callbacks.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/catz.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/client.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/clientinfo.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/compress.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/db.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dbiterator.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dbtable.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/diff.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dispatch.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dlz.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dns64.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dnsrps.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dnssec.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dnstap.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dnstap.proto up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ds.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tsig_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_internal.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_openssl.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_parse.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_parse.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_pkcs11.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dyndb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ecdb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ecs.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/fixedname.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/forward.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gen-unix.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gen-win32.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gen.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/geoip2.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gssapi_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gssapictx.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/hmac_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ipkeylist.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/iptable.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/journal.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/kasp.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/key.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/keydata.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/time.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/keymgr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/keytable.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/lib.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/log.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/lookup.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/mapapi up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/master.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/masterdump.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/message.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/name.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ncache.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/nsec.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/nsec3.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/nta.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/openssl_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/openssldh_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/opensslecdsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/openssleddsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/opensslrsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/order.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/peer.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/pkcs11.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/pkcs11ecdsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/pkcs11eddsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/pkcs11rsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/portlist.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/private.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rbt.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rbtdb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rbtdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rcode.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdatalist.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdatalist_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdataset.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdatasetiter.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdataslab.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/request.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/resolver.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rootns.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rpz.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rriterator.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rrl.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/sdb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/sdlz.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/soa.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ssu.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ssu_external.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/stats.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/timer.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tcpmsg.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tkey.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tsec.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tsig.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ttl.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/update.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/validator.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/version.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/view.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/xfrin.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zone.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/acl.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/adb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/badcache.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/bit.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/byaddr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/cache.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/callbacks.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/catz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/cert.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/client.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/clientinfo.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/compress.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/db.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dbiterator.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dbtable.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/diff.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dispatch.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dlz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dlz_dlopen.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dns64.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dnsrps.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dnssec.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dnstap.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ds.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dsdigest.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dyndb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ecdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ecs.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/edns.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/events.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/fixedname.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/forward.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/geoip.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ipkeylist.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/iptable.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/journal.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/kasp.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keydata.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keyflags.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keymgr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keytable.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keyvalues.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/lib.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/librpz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/lmdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/log.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/lookup.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/master.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/masterdump.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/message.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/name.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ncache.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/nsec.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/nsec3.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/nta.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/opcode.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/order.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/peer.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/portlist.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/private.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rbt.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rcode.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdata.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdataclass.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdatalist.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdataset.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdatasetiter.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdataslab.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdatatype.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/request.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/resolver.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rootns.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rpz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rriterator.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rrl.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/sdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/sdlz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/secalg.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/secproto.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/soa.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ssu.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/stats.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/tcpmsg.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/time.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/timer.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/tkey.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/tsec.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/tsig.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ttl.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/types.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/update.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/validator.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/version.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/view.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/xfrin.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/zone.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/zonekey.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/zoneverify.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/zt.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dst/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dst/dst.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dst/gssapi.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dst/result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zone_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zonekey.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zoneverify.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zt.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/any_255/tsig_250.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/any_255/tsig_250.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/rdatastructpre.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/rdatastructsuf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/ch_3/a_1.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/ch_3/a_1.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/afsdb_18.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/afsdb_18.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/amtrelay_260.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/amtrelay_260.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/avc_258.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/avc_258.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/caa_257.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/caa_257.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cdnskey_60.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cdnskey_60.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cds_59.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cds_59.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cert_37.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cert_37.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cname_5.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cname_5.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/csync_62.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/csync_62.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dlv_32769.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dlv_32769.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dname_39.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ds_43.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dname_39.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dnskey_48.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dnskey_48.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/doa_259.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/doa_259.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ds_43.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/eui48_108.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/eui48_108.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/eui64_109.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/eui64_109.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/gpos_27.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/gpos_27.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/hinfo_13.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/hinfo_13.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/hip_55.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/hip_55.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ipseckey_45.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ipseckey_45.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/isdn_20.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/isdn_20.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/key_25.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/key_25.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/keydata_65533.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/keydata_65533.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/l32_105.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/l32_105.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/l64_106.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/l64_106.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/loc_29.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/loc_29.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/lp_107.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/lp_107.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mb_7.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mb_7.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/md_3.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/md_3.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mf_4.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mf_4.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mg_8.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mg_8.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/minfo_14.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/minfo_14.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mr_9.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mr_9.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mx_15.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mx_15.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/naptr_35.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/naptr_35.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nid_104.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nid_104.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ninfo_56.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ninfo_56.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ns_2.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ns_2.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec3_50.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec3_50.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec3param_51.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec3param_51.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec_47.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec_47.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/null_10.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/null_10.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nxt_30.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nxt_30.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/openpgpkey_61.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/openpgpkey_61.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/opt_41.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/opt_41.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/proforma.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/proforma.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ptr_12.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ptr_12.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rkey_57.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rkey_57.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rp_17.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rp_17.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rrsig_46.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rrsig_46.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rt_21.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rt_21.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sig_24.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sig_24.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sink_40.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sink_40.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/smimea_53.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/smimea_53.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/soa_6.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/soa_6.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/spf_99.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/spf_99.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sshfp_44.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sshfp_44.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ta_32768.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ta_32768.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/talink_58.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/talink_58.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/tkey_249.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/tkey_249.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/tlsa_52.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/tlsa_52.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/txt_16.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/txt_16.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/uri_256.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/uri_256.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/x25_19.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/x25_19.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/zonemd_63.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/zonemd_63.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/hs_4/a_1.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/hs_4/a_1.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/a6_38.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/a6_38.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/a_1.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/a_1.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/aaaa_28.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/aaaa_28.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/apl_42.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/apl_42.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/atma_34.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/atma_34.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/dhcid_49.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/dhcid_49.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/eid_31.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/eid_31.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/https_65.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/https_65.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/kx_36.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/kx_36.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nimloc_32.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nimloc_32.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nsap-ptr_23.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nsap-ptr_23.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nsap_22.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nsap_22.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/px_26.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/px_26.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/srv_33.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/srv_33.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/svcb_64.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/svcb_64.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/wks_11.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/wks_11.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/context.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/dnsconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/netdb.h.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/platform.h.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/resconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/types.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/version.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/Kyuafile up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/context.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/dnsconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/gai_strerror.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/getaddrinfo.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/getnameinfo.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/resconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/version.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/aes.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/app.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/assertions.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/astack.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/atomic.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/backtrace.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/barrier.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/base32.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/base64.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/bind9.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/buffer.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/bufferlist.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/cmocka.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/commandline.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/counter.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/crc64.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/deprecated.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/endian.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/errno.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/error.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/event.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/eventclass.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/file.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/formatcheck.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/fsaccess.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/fuzz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/hash.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/heap.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/hex.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/hmac.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/ht.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/httpd.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/interfaceiter.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/iterated_hash.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/lang.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/lex.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/lfsr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/lib.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/likely.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/list.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/log.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/magic.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/managers.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/md.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/mem.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/meminfo.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/mutexblock.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/netaddr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/netmgr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/netscope.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/nonce.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/os.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/parseint.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/platform.h.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/pool.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/portset.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/print.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/quota.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/radix.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/random.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/ratelimiter.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/refcount.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/regex.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/region.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/resource.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/resultclass.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/rwlock.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/safe.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/serial.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/siphash.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/sockaddr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/socket.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/stats.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/stdio.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/strerr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/string.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/symtab.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/task.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/taskpool.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/timer.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/tm.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/types.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/url.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/utf8.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/util.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/version.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/constants.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/internal.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/pk11.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/site.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pkcs11/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pkcs11/pkcs11.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/Kyuafile up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/aes.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/app.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/assertions.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/astack.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/backtrace-emptytbl.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/backtrace.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/base32.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/base64.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/bind9.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/buffer.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/bufferlist.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/commandline.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/counter.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/crc64.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/entropy.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/entropy_private.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/error.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/event.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/fsaccess.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/hash.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/heap.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/hex.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/hmac.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/ht.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/httpd.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/iterated_hash.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/lex.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/lfsr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/lib.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/lib_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/log.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/managers.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/md.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/mem.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/mem_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/mutexblock.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netaddr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netscope.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/nonce.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/openssl_shim.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/openssl_shim.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/parseint.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pk11.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pk11_result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pool.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/portset.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/quota.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/radix.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/random.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/ratelimiter.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/regex.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/region.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/rwlock.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/safe.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/serial.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/siphash.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/sockaddr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/stats.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/string.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/symtab.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/task.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/task_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/taskpool.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/timer.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/timer_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/tls.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/tls_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/tm.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/trampoline.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/trampoline_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/url.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/utf8.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/version.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/xoshiro128starstar.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/netmgr-int.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/netmgr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/tcp.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/tcpdns.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/udp.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/uv-compat.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/uv-compat.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/uverr2result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/condition.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/mutex.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/once.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/thread.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/condition.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/mutex.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/thread.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/align.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/dir.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/net.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/netdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/offset.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/stat.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/stdatomic.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/stdtime.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/syslog.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/time.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/dir.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/errno.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/errno2result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/errno2result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/file.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/fsaccess.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/ifiter_getifaddrs.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/interfaceiter.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/meminfo.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/net.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/os.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/pk11_api.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/resource.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/socket.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/socket_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/stdio.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/stdtime.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/syslog.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/time.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/aclconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/cfg.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/dnsconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/grammar.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/kaspconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/log.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/namedconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/version.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/Kyuafile up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/aclconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/dnsconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/kaspconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/log.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/namedconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/parser.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/version.c up to 1.1 external/mpl/dhcp/bind/dist/version up to 1.1 external/mpl/dhcp/bind/Makefile up to 1.1 external/mpl/dhcp/bind/Makefile.inc up to 1.1 external/mpl/dhcp/bind/include/dns/enumclass.h up to 1.1 external/mpl/dhcp/bind/include/dns/code.h up to 1.1 external/mpl/dhcp/bind/include/dns/enumtype.h up to 1.1 external/mpl/dhcp/bind/include/dns/rdatastruct.h up to 1.1 external/mpl/dhcp/bind/include/irs/netdb.h up to 1.1 external/mpl/dhcp/bind/include/irs/platform.h up to 1.1 external/mpl/dhcp/bind/include/config.h up to 1.1 external/mpl/dhcp/bind/include/isc/atomic.h up to 1.1 external/mpl/dhcp/bind/include/isc/platform.h up to 1.1 external/mpl/dhcp/bind/include/isc/stdatomic.h up to 1.1 external/mpl/dhcp/bind/lib/libdns/Makefile up to 1.1 external/mpl/dhcp/bind/lib/Makefile up to 1.1 external/mpl/dhcp/bind/lib/Makefile.inc up to 1.1 external/mpl/dhcp/bind/lib/libirs/Makefile up to 1.1 external/mpl/dhcp/bind/lib/libisc/Makefile up to 1.1 external/mpl/dhcp/bind/lib/libisc/isc.map up to 1.1 external/mpl/dhcp/bind/lib/libisccfg/Makefile up to 1.1 external/mpl/dhcp/Makefile up to 1.2 external/mpl/dhcp/Makefile.inc up to 1.13 external/mpl/dhcp/dhcp2netbsd up to 1.3 external/mpl/dhcp/bin/relay/Makefile up to 1.3 external/mpl/dhcp/bin/server/Makefile up to 1.10 external/mpl/dhcp/dist/LICENSE up to 1.1.1.4 external/mpl/dhcp/dist/Makefile.am up to 1.1.1.2 external/mpl/dhcp/dist/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/README up to 1.1.1.4 external/mpl/dhcp/dist/RELNOTES up to 1.2 external/mpl/dhcp/dist/aclocal.m4 up to 1.1.1.4 external/mpl/dhcp/dist/config.guess up to 1.3 external/mpl/dhcp/dist/configure up to 1.1.1.4 external/mpl/dhcp/dist/configure.ac up to 1.1.1.4 external/mpl/dhcp/dist/configure.ac+lt up to 1.1.1.3 external/mpl/dhcp/dist/client/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/client/client_tables.c up to 1.3 external/mpl/dhcp/dist/client/clparse.c up to 1.4 external/mpl/dhcp/dist/client/dhc6.c up to 1.4 external/mpl/dhcp/dist/client/dhclient-script.8 up to 1.3 external/mpl/dhcp/dist/client/dhclient.8 up to 1.4 external/mpl/dhcp/dist/client/dhclient.c up to 1.5 external/mpl/dhcp/dist/client/dhclient.conf.5 up to 1.3 external/mpl/dhcp/dist/client/dhclient.leases.5 up to 1.3 external/mpl/dhcp/dist/client/scripts/linux up to 1.1.1.2 external/mpl/dhcp/dist/client/tests/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/client/tests/duid_unittest.c up to 1.3 external/mpl/dhcp/dist/common/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/common/alloc.c up to 1.3 external/mpl/dhcp/dist/common/bpf.c up to 1.5 external/mpl/dhcp/dist/common/comapi.c up to 1.3 external/mpl/dhcp/dist/common/conflex.c up to 1.3 external/mpl/dhcp/dist/common/ctrace.c up to 1.3 external/mpl/dhcp/dist/common/dhcp-eval.5 up to 1.3 external/mpl/dhcp/dist/common/dhcp-options.5 up to 1.4 external/mpl/dhcp/dist/common/dhcp4o6.c up to 1.3 external/mpl/dhcp/dist/common/discover.c up to 1.5 external/mpl/dhcp/dist/common/dispatch.c up to 1.5 external/mpl/dhcp/dist/common/dlpi.c up to 1.3 external/mpl/dhcp/dist/common/dns.c up to 1.5 external/mpl/dhcp/dist/common/ethernet.c up to 1.3 external/mpl/dhcp/dist/common/execute.c up to 1.4 external/mpl/dhcp/dist/common/fddi.c up to 1.3 external/mpl/dhcp/dist/common/icmp.c up to 1.3 external/mpl/dhcp/dist/common/inet.c up to 1.3 external/mpl/dhcp/dist/common/lpf.c up to 1.4 external/mpl/dhcp/dist/common/memory.c up to 1.3 external/mpl/dhcp/dist/common/nit.c up to 1.3 external/mpl/dhcp/dist/common/ns_name.c up to 1.4 external/mpl/dhcp/dist/common/options.c up to 1.7 external/mpl/dhcp/dist/common/packet.c up to 1.4 external/mpl/dhcp/dist/common/parse.c up to 1.5 external/mpl/dhcp/dist/common/print.c up to 1.3 external/mpl/dhcp/dist/common/raw.c up to 1.4 external/mpl/dhcp/dist/common/resolv.c up to 1.3 external/mpl/dhcp/dist/common/socket.c up to 1.5 external/mpl/dhcp/dist/common/tables.c up to 1.4 external/mpl/dhcp/dist/common/tr.c up to 1.3 external/mpl/dhcp/dist/common/tree.c up to 1.3 external/mpl/dhcp/dist/common/upf.c up to 1.3 external/mpl/dhcp/dist/common/tests/Kyuafile up to 1.1.1.2 external/mpl/dhcp/dist/common/tests/Makefile.am up to 1.1.1.2 external/mpl/dhcp/dist/common/tests/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/common/tests/option_unittest.c up to 1.5 external/mpl/dhcp/dist/contrib/dhcp-lease-list.pl up to 1.1.1.2 external/mpl/dhcp/dist/dhcpctl/Makefile.am up to 1.1.1.2 external/mpl/dhcp/dist/dhcpctl/Makefile.am.in up to 1.1.1.2 external/mpl/dhcp/dist/dhcpctl/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/dhcpctl/callback.c up to 1.3 external/mpl/dhcp/dist/dhcpctl/cltest.c up to 1.3 external/mpl/dhcp/dist/dhcpctl/dhcpctl.3 up to 1.3 external/mpl/dhcp/dist/dhcpctl/dhcpctl.c up to 1.3 external/mpl/dhcp/dist/dhcpctl/dhcpctl.h up to 1.3 external/mpl/dhcp/dist/dhcpctl/omshell.1 up to 1.3 external/mpl/dhcp/dist/dhcpctl/omshell.c up to 1.3 external/mpl/dhcp/dist/dhcpctl/remote.c up to 1.3 external/mpl/dhcp/dist/doc/Makefile up to 1.1.1.2 external/mpl/dhcp/dist/doc/References.html up to 1.1.1.2 external/mpl/dhcp/dist/doc/References.txt up to 1.1.1.2 external/mpl/dhcp/dist/doc/References.xml up to 1.1.1.2 external/mpl/dhcp/dist/doc/devel/atf.dox up to 1.1.1.2 external/mpl/dhcp/dist/doc/ja_JP.eucJP/dhclient-script.8 up to 1.3 external/mpl/dhcp/dist/doc/ja_JP.eucJP/dhclient.8 up to 1.3 external/mpl/dhcp/dist/doc/ja_JP.eucJP/dhclient.conf.5 up to 1.3 external/mpl/dhcp/dist/doc/ja_JP.eucJP/dhclient.leases.5 up to 1.3 external/mpl/dhcp/dist/doc/ja_JP.eucJP/dhcp-eval.5 up to 1.3 external/mpl/dhcp/dist/doc/ja_JP.eucJP/dhcp-options.5 up to 1.3 external/mpl/dhcp/dist/includes/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/includes/cdefs.h up to 1.3 external/mpl/dhcp/dist/includes/config.h.in up to 1.1.1.2 external/mpl/dhcp/dist/includes/ctrace.h up to 1.3 external/mpl/dhcp/dist/includes/dhcp.h up to 1.3 external/mpl/dhcp/dist/includes/dhcp6.h up to 1.3 external/mpl/dhcp/dist/includes/dhcpd.h up to 1.4 external/mpl/dhcp/dist/includes/dhctoken.h up to 1.3 external/mpl/dhcp/dist/includes/failover.h up to 1.3 external/mpl/dhcp/dist/includes/inet.h up to 1.3 external/mpl/dhcp/dist/includes/ldap_casa.h up to 1.3 external/mpl/dhcp/dist/includes/ns_name.h up to 1.4 external/mpl/dhcp/dist/includes/osdep.h up to 1.4 external/mpl/dhcp/dist/includes/site.h up to 1.3 external/mpl/dhcp/dist/includes/statement.h up to 1.3 external/mpl/dhcp/dist/includes/tree.h up to 1.3 external/mpl/dhcp/dist/includes/arpa/nameser.h up to 1.3 external/mpl/dhcp/dist/includes/netinet/udp.h up to 1.3 external/mpl/dhcp/dist/includes/omapip/alloc.h up to 1.3 external/mpl/dhcp/dist/includes/omapip/buffer.h up to 1.3 external/mpl/dhcp/dist/includes/omapip/convert.h up to 1.3 external/mpl/dhcp/dist/includes/omapip/hash.h up to 1.3 external/mpl/dhcp/dist/includes/omapip/isclib.h up to 1.5 external/mpl/dhcp/dist/includes/omapip/omapip.h up to 1.3 external/mpl/dhcp/dist/includes/omapip/omapip_p.h up to 1.4 external/mpl/dhcp/dist/includes/omapip/result.h up to 1.4 external/mpl/dhcp/dist/includes/omapip/trace.h up to 1.3 external/mpl/dhcp/dist/omapip/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/omapip/alloc.c up to 1.3 external/mpl/dhcp/dist/omapip/array.c up to 1.3 external/mpl/dhcp/dist/omapip/auth.c up to 1.3 external/mpl/dhcp/dist/omapip/buffer.c up to 1.5 external/mpl/dhcp/dist/omapip/connection.c up to 1.4 external/mpl/dhcp/dist/omapip/convert.c up to 1.3 external/mpl/dhcp/dist/omapip/dispatch.c up to 1.5 external/mpl/dhcp/dist/omapip/errwarn.c up to 1.5 external/mpl/dhcp/dist/omapip/generic.c up to 1.3 external/mpl/dhcp/dist/omapip/handle.c up to 1.3 external/mpl/dhcp/dist/omapip/hash.c up to 1.3 external/mpl/dhcp/dist/omapip/isclib.c up to 1.8 external/mpl/dhcp/dist/omapip/listener.c up to 1.3 external/mpl/dhcp/dist/omapip/message.c up to 1.3 external/mpl/dhcp/dist/omapip/omapi.3 up to 1.3 external/mpl/dhcp/dist/omapip/protocol.c up to 1.3 external/mpl/dhcp/dist/omapip/result.c up to 1.4 external/mpl/dhcp/dist/omapip/support.c up to 1.3 external/mpl/dhcp/dist/omapip/test.c up to 1.3 external/mpl/dhcp/dist/omapip/toisc.c up to 1.3 external/mpl/dhcp/dist/omapip/trace.c up to 1.3 external/mpl/dhcp/dist/relay/Makefile.am up to 1.1.1.2 external/mpl/dhcp/dist/relay/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/relay/dhcrelay.8 up to 1.3 external/mpl/dhcp/dist/relay/dhcrelay.c up to 1.6 external/mpl/dhcp/dist/server/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/server/bootp.c up to 1.3 external/mpl/dhcp/dist/server/class.c up to 1.4 external/mpl/dhcp/dist/server/confpars.c up to 1.4 external/mpl/dhcp/dist/server/db.c up to 1.3 external/mpl/dhcp/dist/server/ddns.c up to 1.4 external/mpl/dhcp/dist/server/dhcp.c up to 1.4 external/mpl/dhcp/dist/server/dhcpd.8 up to 1.3 external/mpl/dhcp/dist/server/dhcpd.c up to 1.5 external/mpl/dhcp/dist/server/dhcpd.conf.5 up to 1.4 external/mpl/dhcp/dist/server/dhcpd.leases.5 up to 1.3 external/mpl/dhcp/dist/server/dhcpleasequery.c up to 1.3 external/mpl/dhcp/dist/server/dhcpv6.c up to 1.4 external/mpl/dhcp/dist/server/failover.c up to 1.4 external/mpl/dhcp/dist/server/ldap.c up to 1.4 external/mpl/dhcp/dist/server/ldap_casa.c up to 1.3 external/mpl/dhcp/dist/server/leasechain.c up to 1.3 external/mpl/dhcp/dist/server/mdb.c up to 1.4 external/mpl/dhcp/dist/server/mdb6.c up to 1.7 external/mpl/dhcp/dist/server/omapi.c up to 1.3 external/mpl/dhcp/dist/server/salloc.c up to 1.3 external/mpl/dhcp/dist/server/stables.c up to 1.4 external/mpl/dhcp/dist/server/tests/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/server/tests/hash_unittest.c up to 1.3 external/mpl/dhcp/dist/tests/Makefile.in up to 1.1.1.4 external/mpl/dhcp/dist/tests/DHCPv6/000-badmsgtype.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/010-solicit-noclientid.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/011-solicit-serverid.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/020-advertise-mcast.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/030-request-noclientid.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/031-request-noserverid.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/032-request-badduid.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/110-information-request-ia_na.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/111-information-request-ia_ta.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/112-badduid.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/210-solicit-nohost.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/211-solicit-opt-in-na.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/212-solicit-opt-in-na-norapidcommit.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/280-release-nohost.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/281-release-bad-address.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/282-release-no-address.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/283-release.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/290-decline-nohost.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/291-decline-bad-address.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/292-decline-no-address.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/293-decline.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/dhcp_client.pm up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/stubcli-opt-in-na.pl up to 1.1.1.2 external/mpl/dhcp/dist/tests/DHCPv6/stubcli.pl up to 1.1.1.2 external/mpl/dhcp/include/config.h up to 1.4 external/mpl/dhcp/lib/common/Makefile up to 1.3 share/mk/bsd.prog.mk 1.348 (via patch) distrib/sets/lists/base/shl.mi 1.975 distrib/sets/lists/debug/shl.mi 1.336 doc/3RDPARTY (manually edited) nsd(8): update to 4.8.0 (fixes various CVEs) unbound(8): update to 1.19.1 (fixes various CVEs) wpa_supplicant(8): fix CVE-2023-52160 dhcpd(8): decouple from bind version. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Feb 13, 2024" "NLnet Labs" "unbound 1.19.1" d66 2 a67 4 There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute is followed by a value, or its containing attributes in which case it is referred to as a clause. Clauses can be repeated throughout the file (or included files) to group attributes under the same clause. a77 6 .P For a more structural include option, the .B include\-toplevel: directive can be used. This closes whatever clause is currently active (if any) and forces the use of clauses in the included files and right after this directive. d84 5 a88 5 The verbosity number, level 0 means no verbosity, only errors. Level 1 gives operational information. Level 2 gives detailed operational information including short information per query. Level 3 gives query level information, output per query. Level 4 gives algorithm level information. Level 5 logs client identification for cache misses. Default is level 1. d99 1 a99 1 If enabled, statistics are cumulative since starting Unbound, without clearing a106 8 .B statistics\-inhibit\-zero: \fI If enabled, selected extended statistics with a value of 0 are inhibited from printing with \fIunbound\-control\fR(8). These are query types, query classes, query opcodes, answer rcodes (except NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMPL, REFUSED) and RPZ actions. Default is on. .TP d113 1 a113 1 .B interface: \fI d117 1 a117 2 given the default is to listen to localhost. If an interface name is used instead of an ip address, the list of ip addresses on that interface are used. d123 1 a123 1 .B ip\-address: \fI d127 3 a129 15 Listen on all addresses on all (current and future) interfaces, detect the source interface on UDP queries and copy them to replies. This is a lot like ip\-transparent, but this option services all interfaces whilst with ip\-transparent you can select which (future) interfaces Unbound provides service on. This feature is experimental, and needs support in your OS for particular socket options. Default value is no. .TP .B interface\-automatic\-ports: \fI List the port numbers that interface-automatic listens on. If empty, the default port is listened on. The port numbers are separated by spaces in the string. Default is "". .IP This can be used to have interface automatic to deal with the interface, and listen on the normal port number, by including it in the list, and also https or dns over tls port numbers by putting them in the list as well. d145 1 a145 1 host running Unbound, and requires OS support for unprivileged non-local binds d165 1 a165 1 Permit Unbound to open this port or range of ports for use to send queries. d178 2 a179 2 Do not permit Unbound to open this port or range of ports for use to send queries. Use this to make sure Unbound does not grab a port that another d198 6 a203 5 not set higher than that value. Default is 1232 which is the DNS Flag Day 2020 recommendation. Setting to 512 bypasses even the most stringent path MTU problems, but is seen as extreme, since the amount of TCP fallback generated is excessive (probably also for this resolver, consider tuning the outgoing tcp number). d208 1 a208 2 Suggested values are 512 to 4096. Default is 1232. The default value is the same as the default for edns\-buffer\-size. a265 4 .B udp\-connect: \fI Perform connect for UDP sockets that mitigates ICMP side channel leakage. Default is yes. .TP d277 1 a277 1 "4m" on a busy server. The OS caps it at a maximum, on linux Unbound d290 1 a290 1 linux Unbound needs root permission to bypass the limit, or the admin d307 1 a307 1 If yes, then use IP_TRANSPARENT socket option on sockets where Unbound d312 2 a313 2 and with this option you can select which (future) interfaces Unbound provides service on. This option needs Unbound to be started with root d318 1 a318 1 If yes, then use IP_FREEBIND socket option on sockets where Unbound a323 6 .B ip-dscp: \fI The value of the Differentiated Services Codepoint (DSCP) in the differentiated services field (DS) of the outgoing IP packet headers. The field replaces the outdated IPv4 Type-Of-Service field and the IPv6 traffic class field. .TP a367 10 .B infra\-cache\-max\-rtt: \fI Upper limit for dynamic retransmit timeout calculation in infrastructure cache. Default is 2 minutes. .TP .B infra\-keep\-probing: \fI If enabled the server keeps probing hosts that are down, in the one probe at a time regime. Default is no. Hosts that are down, eg. they did not respond during the one probe at a time period, are marked as down and it may take \fBinfra\-host\-ttl\fR time to get probed again. .TP d379 1 a379 1 IPv6 transport for sending DNS traffic, it does not impact the contents of a381 7 .B prefer\-ip4: \fI If enabled, prefer IPv4 transport for sending DNS queries to internet nameservers. Default is no. Useful if the IPv6 netblock the server has, the entire /64 of that is not owned by one operator and the reputation of the netblock /64 is an issue, using IPv4 then uses the IPv4 filters that the upstream servers have. .TP a419 13 .B tcp-reuse-timeout: \fI\fR The period Unbound will keep TCP persistent connections open to authority servers. This option defaults to 60000 milliseconds. .TP .B max-reuse-tcp-queries: \fI\fR The maximum number of queries that can be sent on a persistent TCP connection. This option defaults to 200 queries. .TP .B tcp-auth-query-timeout: \fI\fR Timeout in milliseconds for TCP queries to auth servers. This option defaults to 3000 milliseconds. .TP a438 8 .B sock\-queue\-timeout: \fI\fR UDP queries that have waited in the socket buffer for a long time can be dropped. Default is 0, disabled. The time is set in seconds, 3 could be a good value to ignore old queries that likely the client does not need a reply for any more. This could happen if the host has not been able to service the queries for a while, i.e. Unbound is not running, and then is enabled again. It uses timestamp socket options. .TP d441 1 a441 3 Default is no. Useful in tunneling scenarios. If set to no you can specify TCP transport only for selected forward or stub zones using forward-tcp-upstream or stub-tcp-upstream respectively. d453 4 a456 5 If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert or tls\-system\-cert to load CA certs, otherwise the connections cannot be authenticated. This option enables TLS for all of them, but if you do not set this you can configure TLS specifically for some forward zones with forward\-tls\-upstream. And also with stub\-tls\-upstream. d463 9 a471 10 If enabled, the server provides DNS-over-TLS or DNS-over-HTTPS service on the TCP ports marked implicitly or explicitly for these services with tls\-port or https\-port. The file must contain the private key for the TLS session, the public certificate is in the tls\-service\-pem file and it must also be specified if tls\-service\-key is specified. The default is "", turned off. Enabling or disabling this service requires a restart (a reload is not enough), because the key is read while root permissions are held and before chroot (if any). The ports enabled implicitly or explicitly via \fBtls\-port:\fR and \fBhttps\-port:\fR do not provide normal DNS TCP service. Unbound needs to be compiled with libnghttp2 in order to provide DNS-over-HTTPS. d494 1 a494 2 urls, and also DNS over TLS connections. It is read at start up before permission drop and chroot. d503 1 a503 6 the tls\-cert\-bundle option on other systems. On other systems, this option enables the system certificates. .TP .B tls\-system\-cert: \fI This the same setting as the tls\-win\-cert setting, under a different name. Because it is not windows specific. d512 1 a512 1 perform TLS session resumption for clients using the Unbound server. a530 69 .B pad\-responses: \fI If enabled, TLS serviced queries that contained an EDNS Padding option will cause responses padded to the closest multiple of the size specified in \fBpad\-responses\-block\-size\fR. Default is yes. .TP .B pad\-responses\-block\-size: \fI The block size with which to pad responses serviced over TLS. Only responses to padded queries will be padded. Default is 468. .TP .B pad\-queries: \fI If enabled, all queries sent over TLS upstreams will be padded to the closest multiple of the size specified in \fBpad\-queries\-block\-size\fR. Default is yes. .TP .B pad\-queries\-block\-size: \fI The block size with which to pad queries sent over TLS upstreams. Default is 128. .TP .B tls\-use\-sni: \fI Enable or disable sending the SNI extension on TLS connections. Default is yes. Changing the value requires a reload. .TP .B https\-port: \fI The port number on which to provide DNS-over-HTTPS service, default 443, only interfaces configured with that port number as @@number get the HTTPS service. .TP .B http\-endpoint: \fI The HTTP endpoint to provide DNS-over-HTTPS service on. Default "/dns-query". .TP .B http\-max\-streams: \fI Number used in the SETTINGS_MAX_CONCURRENT_STREAMS parameter in the HTTP/2 SETTINGS frame for DNS-over-HTTPS connections. Default 100. .TP .B http\-query\-buffer\-size: \fI Maximum number of bytes used for all HTTP/2 query buffers combined. These buffers contain (partial) DNS queries waiting for request stream completion. An RST_STREAM frame will be send to streams exceeding this limit. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B http\-response\-buffer\-size: \fI Maximum number of bytes used for all HTTP/2 response buffers combined. These buffers contain DNS responses waiting to be written back to the clients. An RST_STREAM frame will be send to streams exceeding this limit. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B http\-nodelay: \fI Set TCP_NODELAY socket option on sockets used to provide DNS-over-HTTPS service. Ignored if the option is not available. Default is yes. .TP .B http\-notls\-downstream: \fI Disable use of TLS for the downstream DNS-over-HTTP connections. Useful for local back end servers. Default is no. .TP .B proxy\-protocol\-port: \fI List port numbers as proxy\-protocol\-port, and when interfaces are defined, eg. with the @@port suffix, as this port number, they support and expect PROXYv2. In this case the proxy address will only be used for the network communication and initial ACL (check if the proxy itself is denied/refused by configuration). The proxied address (if any) will then be used as the true client address and will be used where applicable for logging, ACL, DNSTAP, RPZ and IP ratelimiting. PROXYv2 is supported for UDP and TCP/TLS listening interfaces. There is no support for PROXYv2 on a DoH or DNSCrypt listening interface. Can list multiple, each on a new statement. .TP d536 2 a537 2 Enable or disable whether the Unbound server forks into the background as a daemon. Set the value to \fIno\fR when Unbound runs as systemd service. d548 3 a550 3 \fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIallow_cookie\fR, \fIdeny_non_local\fR or \fIrefuse_non_local\fR. The most specific netblock match is used, if none match \fIrefuse\fR is used. d553 1 a553 1 The \fIdeny\fR action stops queries from hosts from that netblock. d555 1 a555 1 The \fIrefuse\fR action stops queries too, but sends a DNS rcode REFUSED d558 1 a558 1 The \fIallow\fR action gives access to clients from that netblock. d564 1 a564 1 the Unbound server recursive lookup algorithm, and static data is served d578 1 a578 1 The \fIallow_snoop\fR action gives nonrecursive access too. This give a584 14 The \fIallow_cookie\fR action allows access to UDP queries that contain a valid DNS Cookie as specified in RFC 7873 and RFC 9018, when the \fBanswer\-cookie\fR option is enabled. UDP queries containing only a DNS Client Cookie and no Server Cookie, or an invalid DNS Cookie, will receive a BADCOOKIE response including a newly generated DNS Cookie, allowing clients to retry with that DNS Cookie. The \fIallow_cookie\fR action will also accept requests over stateful transports, regardless of the presence of an DNS Cookie and regardless of the \fBanswer\-cookie\fR setting. If \fBip\-ratelimit\fR is used, clients with a valid DNS Cookie will bypass the ratelimit. If a ratelimit for such clients is still needed, \fBip\-ratelimit\-cookie\fR can be used instead. .IP a615 40 .B interface\-action: \fI Similar to \fBaccess\-control:\fR but for interfaces. .IP The action is the same as the ones defined under \fBaccess\-control:\fR. Interfaces are \fIrefuse\fRd by default. By default only localhost (the IP netblock, not the loopback interface) is \fIallow\fRed through the default \fBaccess\-control:\fR behavior. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-tag: \fI <"list of tags"> Similar to \fBaccess\-control-tag:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-tag\-action: \fI Similar to \fBaccess\-control-tag-action:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-tag\-data: \fI <"resource record string"> Similar to \fBaccess\-control-tag-data:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-view: \fI Similar to \fBaccess\-control-view:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP d636 1 a636 1 Additionally, Unbound may need to access /dev/urandom (for entropy) d670 1 a670 1 Sets Unbound to send log messages to the syslogd, using d680 1 a680 1 Unbound, with different configurations, so that the logs can be easily a747 16 .B hide\-http\-user\-agent: \fI If enabled the HTTP header User-Agent is not set. Use with caution as some webserver configurations may reject HTTP requests lacking this header. If needed, it is better to explicitly set the .B http\-user\-agent below. .TP .B http\-user\-agent: \fI Set the HTTP User-Agent header for outgoing HTTP requests. If set to "", the default, then the package name and version are used. .TP .B nsid:\fR Add the specified nsid to the EDNS section of the answer when queried with an NSID EDNS enabled packet. As a sequence of hex characters or with ascii_ prefix and then an ascii string. .TP d752 1 a752 1 Set the target fetch policy used by Unbound to determine if it should fetch d757 1 a757 1 that Unbound will pursue in answering a query. d768 3 a770 2 Very small EDNS buffer sizes from queries are ignored. Default is on, as described in the standard. a819 6 .B harden\-unknown\-additional: \fI Harden against unknown records in the authority section and additional section. Default is no. If no, such records are copied from the upstream and presented to the client together with the answer. If yes, it could hamper future protocol developments that want to add records. .TP d827 2 a828 2 .B caps\-exempt: \fI Exempt the domain so that it does not receive caps\-for\-id perturbed a832 3 .B caps\-whitelist: \fI Alternate syntax for \fBcaps\-exempt\fR. .TP d844 1 a844 1 This option only has effect when qname-minimisation is enabled. Default is no. d849 1 a849 1 Default is yes. It helps to reduce the query rate towards targets that get d906 1 a906 1 If disabled, Unbound responds with a short list of resource records if some d912 1 a912 1 from the query ID, for speed and thread safety). Default is yes. d915 1 a915 1 If yes, Unbound does not insert authority/additional sections into response d933 7 a939 15 the string with quotes (""). The modules can be \fIrespip\fR, \fIvalidator\fR, or \fIiterator\fR (and possibly more, see below). Setting this to just "\fIiterator\fR" will result in a non\-validating server. Setting this to "\fIvalidator iterator\fR" will turn on DNSSEC validation. The ordering of the modules is significant, the order decides the order of processing. You must also set \fItrust\-anchors\fR for validation to be useful. Adding \fIrespip\fR to the front will cause RPZ processing to be done on all queries. The default is "\fIvalidator iterator\fR". .IP When the server is built with EDNS client subnet support the default is "\fIsubnetcache validator iterator\fR". d941 1 a941 2 of the line. The subnetcachedb module has to be listed just before the iterator. d943 1 a943 3 output of the module it is just before. The dynlib module can be listed pretty much anywhere, it is only a very thin wrapper that allows dynamic libraries to run in its place. d955 1 a955 1 so the Unbound user must have write permission. Write permission to the file, d982 15 d1001 1 a1001 1 Can be given multiple times a1032 4 .B val\-max\-restart: \fI The maximum number the validator should restart validation with another authority in case of failed validation. Default is 5. .TP d1052 1 a1052 1 the query that failed is printed but also the reason why Unbound thought d1064 1 a1064 1 Instruct Unbound to ignore the CD flag from clients and refuse to d1068 1 a1068 1 the clients, and then Unbound provides them with DNSSEC protection. a1070 14 .B disable\-edns\-do: \fI Disable the EDNS DO flag in upstream requests. It breaks DNSSEC validation for Unbound's clients. This results in the upstream name servers to not include DNSSEC records in their replies and could be helpful for devices that cannot handle DNSSEC information. When the option is enabled, clients that set the DO flag receive no EDNS record in the response to indicate the lack of support to them. If this option is enabled but Unbound is already configured for DNSSEC validation (i.e., the validator module is enabled; default) this option is implicitly turned off with a warning as to not break DNSSEC validation in Unbound. Default is no. .TP d1072 3 a1074 4 If enabled, Unbound attempts to serve old responses from cache with a TTL of \fBserve\-expired\-reply\-ttl\fR in the response without waiting for the actual resolution to finish. The actual resolution answer ends up in the cache later on. Default is "no". d1078 2 a1079 3 disables the limit. This option only applies when \fBserve\-expired\fR is enabled. A suggested value per RFC 8767 is between 86400 (1 day) and 259200 (3 days). The default is 0. d1083 2 a1084 2 failed attempt to retrieve the record from upstream. This makes sure that the expired records will be served as long as there are queries for it. Default is a1086 26 .B serve\-expired\-reply\-ttl: \fI TTL value to use when replying with expired data. If \fBserve\-expired\-client\-timeout\fR is also used then it is RECOMMENDED to use 30 as the value (RFC 8767). The default is 30. .TP .B serve\-expired\-client\-timeout: \fI Time in milliseconds before replying to the client with expired data. This essentially enables the serve-stale behavior as specified in RFC 8767 that first tries to resolve before immediately responding with expired data. A recommended value per RFC 8767 is 1800. Setting this to 0 will disable this behavior. Default is 0. .TP .B serve\-original\-ttl: \fI If enabled, Unbound will always return the original TTL as received from the upstream name server rather than the decrementing TTL as stored in the cache. This feature may be useful if Unbound serves as a front-end to a hidden authoritative name server. Enabling this feature does not impact cache expiry, it only changes the TTL Unbound embeds in responses to queries. Note that enabling this feature implicitly disables enforcement of the configured minimum and maximum TTL, as it is assumed users who enable this feature do not want Unbound to change the TTL obtained from an upstream server. Thus, the values set using \fBcache\-min\-ttl\fR and \fBcache\-max\-ttl\fR are ignored. Default is "no". .TP d1089 1 a1089 1 by quotes. Default is "1024 150 2048 150 4096 150". This determines the a1095 6 .B zonemd\-permissive\-mode: \fI If enabled the ZONEMD verification failures are only logged and do not cause the zone to be blocked and only return servfail. Useful for testing out if it works, or if the operator only wants to be notified of a problem without disrupting service. Default is no. .TP d1137 1 a1137 1 the reverse lookups are no longer filtered. This allows Unbound when d1141 1 a1141 1 with default local zones. Disable the option when Unbound is running d1155 4 a1158 4 inform_redirect, always_transparent, block_a, always_refuse, always_nxdomain, always_null, noview, and are explained below. After that the default settings are listed. Use local\-data: to enter data into the local zone. Answers for local zones are authoritative DNS answers. By default the zones are class IN. d1162 1 a1162 11 it as detailed in the stub zone section below. A stub\-zone can be used to have unbound send queries to another server, an authoritative server, to fetch the information. With a forward\-zone, unbound sends queries to a server that is a recursive server to fetch the information. With an auth\-zone a zone can be loaded from file and used, it can be used like a local\-zone for users downstream, or the auth\-zone information can be used to fetch information from when resolving like it is an upstream server. The forward\-zone and auth\-zone options are described in their sections below. If you want to perform filtering of the information that the users can fetch, the local\-zone and local\-data statements allow for this, but also the rpz functionality can be used, described in the RPZ section. a1222 6 \h'5'\fIblock_a\fR Like transparent, but ignores local data and resolves normally all query types excluding A. For A queries it unconditionally returns NODATA. Useful in cases when there is a need to explicitly force all apps to use IPv6 protocol and avoid any queries to IPv4. .TP 10 a1228 11 \h'5'\fIalways_nodata\fR Like static, but ignores local data and returns nodata for the query. .TP 10 \h'5'\fIalways_deny\fR Like deny, but ignores local data and drops the query. .TP 10 \h'5'\fIalways_null\fR Always returns 0.0.0.0 or ::0 for every name in the zone. Like redirect with zero data for A and AAAA. Ignores local data in the zone. Used for some block lists. .TP 10 d1234 1 a1234 1 answered from global local zone contents. d1243 7 a1249 7 The default zones are localhost, reverse 127.0.0.1 and ::1, the home.arpa, the onion, test, invalid and the AS112 zones. The AS112 zones are reverse DNS zones for private use and reserved IP addresses for which the servers on the internet cannot provide correct answers. They are configured by default to give nxdomain (no reverse information) answers. The defaults can be turned off by specifying your own local\-zone of that name, or using the 'nodefault' type. Below is a list of the default zone contents. a1289 9 \h'5'\fIhome.arpa (RFC 8375)\fR Default content: .nf local\-zone: "home.arpa." static local\-data: "home.arpa. 10800 IN NS localhost." local\-data: "home.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" .fi .TP 10 d1299 1 a1299 1 \h'5'\fItest (RFC 6761)\fR d1308 1 a1308 1 \h'5'\fIinvalid (RFC 6761)\fR a1383 76 .B response\-ip: \fI This requires use of the "respip" module. .IP If the IP address in an AAAA or A RR in the answer section of a response matches the specified IP netblock, the specified action will apply. \fI\fR has generally the same semantics as that for \fIaccess-control-tag-action\fR, but there are some exceptions. .IP Actions for \fIresponse-ip\fR are different from those for \fIlocal-zone\fR in that in case of the former there is no point of such conditions as "the query matches it but there is no local data". Because of this difference, the semantics of \fIresponse-ip\fR actions are modified or simplified as follows: The \fIstatic, refuse, transparent, typetransparent,\fR and \fInodefault\fR actions are invalid for \fIresponse-ip\fR. Using any of these will cause the configuration to be rejected as faulty. The \fIdeny\fR action is non-conditional, i.e. it always results in dropping the corresponding query. The resolution result before applying the deny action is still cached and can be used for other queries. .TP 5 .B response-ip-data: \fI <"resource record string"> This requires use of the "respip" module. .IP This specifies the action data for \fIresponse-ip\fR with action being to redirect as specified by "\fIresource record string\fR". "Resource record string" is similar to that of \fIaccess-control-tag-action\fR, but it must be of either AAAA, A or CNAME types. If the IP-netblock is an IPv6/IPv4 prefix, the record must be AAAA/A respectively, unless it is a CNAME (which can be used for both versions of IP netblocks). If it is CNAME there must not be more than one \fIresponse-ip-data\fR for the same IP-netblock. Also, CNAME and other types of records must not coexist for the same IP-netblock, following the normal rules for CNAME records. The textual domain name for the CNAME does not have to be explicitly terminated with a dot ("."); the root name is assumed to be the origin for the name. .TP 5 .B response-ip-tag: \fI <"list of tags"> This requires use of the "respip" module. .IP Assign tags to response IP-netblocks. If the IP address in an AAAA or A RR in the answer section of a response matches the specified IP-netblock, the specified tags are assigned to the IP address. Then, if an \fIaccess-control-tag\fR is defined for the client and it includes one of the tags for the response IP, the corresponding \fIaccess-control-tag-action\fR will apply. Tag matching rule is the same as that for \fIaccess-control-tag\fR and \fIlocal-zones\fR. Unlike \fIlocal-zone-tag\fR, \fIresponse-ip-tag\fR can be defined for an IP-netblock even if no \fIresponse-ip\fR is defined for that netblock. If multiple \fIresponse-ip-tag\fR options are specified for the same IP-netblock in different statements, all but the first will be ignored. However, this will not be flagged as a configuration error, but the result is probably not what was intended. .IP Actions specified in an \fIaccess-control-tag-action\fR that has a matching tag with \fIresponse-ip-tag\fR can be those that are "invalid" for \fIresponse-ip\fR listed above, since \fIaccess-control-tag-action\fRs can be shared with local zones. For these actions, if they behave differently depending on whether local data exists or not in case of local zones, the behavior for \fIresponse-ip-data\fR will generally result in NOERROR/NODATA instead of NXDOMAIN, since the \fIresponse-ip\fR data are inherently type specific, and non-existence of data does not indicate anything about the existence or non-existence of the qname itself. For example, if the matching tag action is \fIstatic\fR but there is no data for the corresponding \fIresponse-ip\fR configuration, then the result will be NOERROR/NODATA. The only case where NXDOMAIN is returned is when an \fIalways_nxdomain\fR action applies. .TP 5 d1393 2 a1394 3 overloaded with random names, and keeps Unbound from sending traffic to the nameservers for those zones. Configured forwarders are excluded from ratelimiting. a1415 9 .B ratelimit\-backoff: \fI If enabled, the ratelimit is treated as a hard failure instead of the default maximum allowed constant rate. When the limit is reached, traffic is ratelimited and demand continues to be kept track of for a 2 second rate window. No traffic is allowed, except for ratelimit\-factor, until demand decreases below the configured ratelimit for a 2 second rate window. Useful to set ratelimit to a suspicious rate to aggressively limit unusually high traffic. Default is off. .TP 5 d1432 2 a1433 2 Enable global ratelimiting of queries accepted per IP address. This option is experimental at this time. a1437 16 Default is 0 (disabled). .TP 5 .B ip\-ratelimit\-cookie: \fI Enable global ratelimiting of queries accepted per IP address with a valid DNS Cookie. This option is experimental at this time. The ratelimit is in queries per second that are allowed. More queries are completely dropped and will not receive a reply, SERVFAIL or otherwise. IP ratelimiting happens before looking in the cache. This option could be useful in combination with \fIallow_cookie\fR in an attempt to mitigate other amplification attacks than UDP reflections (e.g., attacks targeting Unbound itself) which are already handled with DNS Cookies. If used, the value is suggested to be higher than \fBip\-ratelimit\fR e.g., tenfold. Default is 0 (disabled). a1458 32 .B ip\-ratelimit\-backoff: \fI If enabled, the ratelimit is treated as a hard failure instead of the default maximum allowed constant rate. When the limit is reached, traffic is ratelimited and demand continues to be kept track of for a 2 second rate window. No traffic is allowed, except for ip\-ratelimit\-factor, until demand decreases below the configured ratelimit for a 2 second rate window. Useful to set ip\-ratelimit to a suspicious rate to aggressively limit unusually high traffic. Default is off. .TP 5 .B outbound\-msg\-retry: \fI The number of retries, per upstream nameserver in a delegation, that Unbound will attempt in case a throwaway response is received. No response (timeout) contributes to the retry counter. If a forward/stub zone is used, this is the number of retries per nameserver in the zone. Default is 5. .TP 5 .B max\-sent\-count: \fI Hard limit on the number of outgoing queries Unbound will make while resolving a name, making sure large NS sets do not loop. Results in SERVFAIL when reached. It resets on query restarts (e.g., CNAME) and referrals. Default is 32. .TP 5 .B max\-query\-restarts: \fI Hard limit on the number of times Unbound is allowed to restart a query upon encountering a CNAME record. Results in SERVFAIL when reached. Changing this value needs caution as it can allow long CNAME chains to be accepted, where Unbound needs to verify (resolve) each link individually. Default is 11. .TP 5 a1472 37 .TP 5 .B answer\-cookie: \fI If enabled, Unbound will answer to requests containing DNS Cookies as specified in RFC 7873 and RFC 9018. Default is no. .TP 5 .B cookie\-secret: \fI<128 bit hex string> Server's secret for DNS Cookie generation. Useful to explicitly set for servers in an anycast deployment that need to share the secret in order to verify each other's Server Cookies. An example hex string would be "000102030405060708090a0b0c0d0e0f". Default is a 128 bits random secret generated at startup time. .TP 5 .B edns\-client\-string: \fI Include an EDNS0 option containing configured ascii string in queries with destination address matching the configured IP netblock. This configuration option can be used multiple times. The most specific match will be used. .TP 5 .B edns\-client\-string\-opcode: \fI EDNS0 option code for the \fIedns\-client\-string\fR option, from 0 to 65535. A value from the `Reserved for Local/Experimental` range (65001-65534) should be used. Default is 65001. .TP 5 .B ede: \fI If enabled, Unbound will respond with Extended DNS Error codes (RFC8914). These EDEs attach informative error messages to a response for various errors. Default is "no". When the \fBval-log-level\fR option is also set to \fB2\fR, responses with Extended DNS Errors concerning DNSSEC failures that are not served from cache, will also contain a descriptive text message about the reason for the failure. .TP 5 .B ede\-serve\-expired: \fI If enabled, Unbound will attach an Extended DNS Error (RFC8914) Code 3 - Stale Answer as EDNS0 option to the expired response. Note that this will not attach the EDE code without setting the global \fBede\fR option to "yes" as well. Default is "no". d1478 1 a1478 1 commands to the running Unbound server. The server uses these clauses d1488 1 a1488 1 .B control\-interface: \fI a1490 2 If an interface name is used instead of an ip address, the list of ip addresses on that interface are used. d1496 1 a1496 1 If you set it to an absolute path, a unix domain socket is used. This socket d1498 1 a1498 1 To restrict access, Unbound sets permissions on the file to the user and d1518 1 a1518 1 This file is used by the Unbound server, but not by \fIunbound\-control\fR. d1523 1 a1523 1 This file is used by the Unbound server, and also by \fIunbound\-control\fR. d1541 1 a1541 1 The servers should be authority servers, not recursors; Unbound performs d1548 1 a1548 1 entry for Unbound with d1551 1 a1551 1 The Unbound resolver can then access the data, without referring to the d1556 1 a1556 1 can be put in config, so that Unbound can validate the data and set the AD d1558 1 a1558 1 AD bit). This setup makes Unbound capable of answering queries for the d1566 1 a1566 1 (reverse\-) zone bypass Unbound's filtering of RFC1918 zones. d1569 1 a1569 1 Name of the stub zone. This is the full domain name of the zone. a1572 5 To use a nondefault port for DNS communication append '@@' with the port number. If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. If only '#' is used the default port is the configured tls\-port. a1576 4 If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. If only '#' is used the default port is the configured tls\-port. a1596 4 .B stub\-tcp\-upstream: \fI If it is set to "yes" then upstream queries use TCP only for transport regardless of global flag tcp-upstream. Default is no. .TP d1608 2 a1609 2 those servers are not authority servers, but are (just like Unbound is) recursive servers too; Unbound does not perform recursion itself for the d1611 1 a1611 1 CNAMEs are chased by Unbound itself, asking the remote server for every d1619 1 a1619 1 Name of the forward zone. This is the full domain name of the zone. a1622 5 To use a nondefault port for DNS communication append '@@' with the port number. If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. If only '#' is used the default port is the configured tls\-port. d1627 3 a1629 4 If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. If only '#' is used the default port is the configured tls\-port. d1637 1 a1637 1 enabled, Unbound will fall back to normal recursive resolution for this a1648 4 .B forward\-tcp\-upstream: \fI If it is set to "yes" then upstream queries use TCP only for transport regardless of global flag tcp-upstream. Default is no. .TP d1657 7 a1663 26 Authority zones can be processed on two distinct, non-exclusive, configurable stages. .LP With \fBfor\-downstream:\fR \fIyes\fR (default), authority zones are processed after \fBlocal\-zones\fR and before cache. When used in this manner, Unbound responds like an authority server with no further processing other than returning an answer from the zone contents. A notable example, in this case, is CNAME records which are returned verbatim to downstream clients without further resolution. .LP With \fBfor\-upstream:\fR \fIyes\fR (default), authority zones are processed after the cache lookup, just before going to the network to fetch information for recursion. When used in this manner they provide a local copy of an authority server that speeds up lookups for that data during resolving. .LP If both options are enabled (default), client queries for an authority zone are answered authoritatively from Unbound, while internal queries that require data from the authority zone consult the local zone data instead of going to the network. .LP An interesting configuration is \fBfor\-downstream:\fR \fIno\fR, \fBfor\-upstream:\fR \fIyes\fR that allows for hyperlocal behavior where both client and internal queries consult the local zone data while resolving. In this case, the aforementioned CNAME example will result in a thoroughly resolved answer. d1672 1 a1672 1 any new serial number is accepted from the primary (even if older), and if d1679 1 a1679 1 .B primary: \fI d1681 2 a1682 13 primaries can be specified. They are all tried if one fails. To use a nondefault port for DNS communication append '@@' with the port number. You can append a '#' and a name, then AXFR over TLS can be used and the tls authentication certificates will be checked with that name. If you combine the '@@' and '#', the '@@' comes first. If you point it at another Unbound instance, it would not work because that does not support AXFR/IXFR for the zone, but if you used \fBurl:\fR to download the zonefile as a text file from a webserver that would work. If you specify the hostname, you cannot use the domain from the zonefile, because it may not have that when retrieving that data, instead use a plain IP address to avoid a circular dependency on retrieving that IP address. .TP .B master: \fI Alternate syntax for \fBprimary\fR. d1689 1 a1689 1 primaries are listed, the primaries are first probed with UDP SOA queries to d1691 1 a1691 1 If none of the urls work, the primaries are tried with IXFR and AXFR. a1693 5 If you specify a hostname in the URL, you cannot use the domain from the zonefile, because it may not have that when retrieving that data, instead use a plain IP address to avoid a circular dependency on retrieving that IP address. Avoid dependencies on name lookups by using a notation like "http://192.0.2.1/unbound-primaries/example.com.zone", with an explicit IP address. d1698 4 a1701 4 If the notify is from a primary, it first attempts that primary. Otherwise other primaries are attempted. If there are no primaries, but only urls, the file is downloaded when notified. The primaries from primary: and url: statements are allowed notify by default. d1704 1 a1704 1 Default no. If enabled, Unbound falls back to querying the internet as d1709 2 a1710 2 Default yes. If enabled, Unbound serves authority responses to downstream clients for this zone. This option makes Unbound behave, for d1712 1 a1712 1 that zone. Turn it off if you want Unbound to provide recursion for the d1714 1 a1714 1 for\-upstream is yes, then Unbound will DNSSEC validate the contents of the d1719 1 a1719 1 Default yes. If enabled, Unbound fetches data from this data collection d1722 1 a1722 1 the zone data. Turn it on when you want Unbound to provide recursion for a1724 19 .B zonemd\-check: \fI Enable this option to check ZONEMD records in the zone. Default is disabled. The ZONEMD record is a checksum over the zone data. This includes glue in the zone and data from the zone file, and excludes comments from the zone file. When there is a DNSSEC chain of trust, DNSSEC signatures are checked too. .TP .B zonemd\-reject\-absence: \fI Enable this option to reject the absence of the ZONEMD record. Without it, when zonemd is not there it is not checked. It is useful to enable for a nonDNSSEC signed zone where the operator wants to require the verification of a ZONEMD, hence a missing ZONEMD is a failure. The action upon failure is controlled by the \fBzonemd\-permissive\-mode\fR option, for log only or also block the zone. The default is no. .IP Without the option absence of a ZONEMD is only a failure when the zone is DNSSEC signed, and we have a trust anchor, and the DNSSEC verification of the absence of the ZONEMD fails. With the option enabled, the absence of a ZONEMD is always a failure, also for nonDNSSEC signed zones. .TP d1727 2 a1728 2 If the file does not exist or is empty, Unbound will attempt to fetch zone data (eg. from the primary servers). d1734 1 a1734 1 \fBlocal\-data\fR elements. Views can also contain view\-first, a1784 18 .SS "Dynamic Library Module Options" .LP The .B dynlib: clause gives the settings for the \fIdynlib\fR module. This module is only a very small wrapper that allows dynamic modules to be loaded on runtime instead of being compiled into the application. To enable the dynlib module it has to be compiled into the daemon, and the word "dynlib" has to be put in the \fBmodule\-config:\fR option. Multiple instances of dynamic libraries are supported by adding the word "dynlib" more than once. .LP The \fBdynlib\-file:\fR path should be specified as an absolute path relative to the new path set by \fBchroot:\fR option, or as a relative path to the working directory. .TP .B dynlib\-file: \fI\fR The dynamic library file to load. Repeat this option for every dynlib module instance added to the \fBmodule\-config:\fR option. a1803 15 .SS "NAT64 Operation" .LP NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only servers. It is controlled by two options in the \fBserver:\fR section: .TP .B do\-nat64: \fI\fR Use NAT64 to reach IPv4-only servers. Consider also enabling \fBprefer\-ip6\fR to prefer native IPv6 connections to nameservers. Default no. .TP .B nat64\-prefix: \fI\fR Use a specific NAT64 prefix to reach IPv4-only servers. Defaults to using the prefix configured in \fBdns64\-prefix\fR, which in turn defaults to 64:ff9b::/96. The prefix length must be one of /32, /40, /48, /56, /64 or /96. d1809 1 a1809 1 available, they are only meaningful if Unbound was compiled with d1811 1 a1811 1 Currently certificate and secret/public keys cannot be generated by Unbound. d1877 4 a1880 4 If the destination address is allowed in the configuration Unbound will add the EDNS0 option to the query containing the relevant part of the client's address. When an answer contains the ECS option the response and the option are placed in a specialized cache. If the authority indicated no support, the response is d1884 1 a1884 3 forward the option when sending the query to addresses that are explicitly allowed in the configuration using \fBsend\-client\-subnet\fR. The option will always be forwarded, regardless the allowed addresses, if a1891 3 .LP This module does not interact with the \fBserve\-expired*\fR and \fBprefetch:\fR options. d1905 1 a1905 1 Specify whether the ECS address check (configured using d1909 2 a1910 3 the client query). If enabled, the address check is skipped when the client query contains an ECS record. And the lookup in the regular cache is skipped. Default is no. d1927 1 a1927 1 accept in queries. Shorter source masks result in REFUSED answers. Source mask d1940 2 a1941 3 validator iterator" directive and be compiled into Unbound by using \fB\-\-enable\-ipsecmod\fR to be enabled. These settings go in the \fBserver:\fR section. d1943 1 a1943 1 When Unbound receives an A/AAAA query that is not in the cache and finds a d1945 1 a1945 1 an IPSECKEY subquery for the same domain name. If an answer was found, Unbound d1974 1 a1974 1 facilitates turning on/off the module without restarting/reloading Unbound. d1978 1 a1978 1 Specifies the external hook that Unbound will call with \fIsystem\fR(3). The d1980 1 a1980 1 permissions to be able to be executed by the same user that runs Unbound. It d1985 2 a1986 2 If enabled Unbound requires the external hook to return a success value of 0. Failing to do so Unbound will reply with SERVFAIL. The A/AAAA answer will also d1994 1 a1994 1 Specifies the behaviour of Unbound when the IPSECKEY answer is bogus. If set d1999 4 a2002 7 .B ipsecmod\-allow: \fI\fR Allow the ipsecmod functionality for the domain so that the module logic will be executed. Can be given multiple times, for different domains. If the option is not specified, all domains are treated as being allowed (default). .TP .B ipsecmod\-whitelist: \fI Alternate syntax for \fBipsecmod\-allow\fR. a2016 7 This module interacts with the \fBserve\-expired\-*\fR options and will reply with expired data if Unbound is configured for that. Currently the use of \fBserve\-expired\-client\-timeout:\fR and \fBserve\-expired\-reply\-ttl:\fR is not consistent for data originating from the external cache as these will result in a reply with 0 TTL without trying to update the data first, ignoring the configured values. .P a2028 5 Additionally, the \fBredis\-expire\-records\fR option can be used in order to set the relative DNS TTL of the message as timeout to the Redis records; keep in mind that some additional memory is used per key and that the expire information is stored as absolute Unix timestamps in Redis (computer time must be stable). a2060 5 .TP .B cachedb-no-store: \fI\fR If the backend should be read from, but not written to. This makes this instance not store dns messages in the backend. But if data is available it is retrieved. The default is no. d2064 1 a2064 1 options are specific to the redis backend. a2076 10 .B redis-server-path: \fI\fR The unix socket path to connect to the redis server. Off by default, and it can be set to "" to turn this off. Unix sockets may have better throughput than the IP address option. .TP .B redis-server-password: \fI""\fR The Redis AUTH password to use for the redis server. Only relevant if Redis is configured for client password authorisation. Off by default, and it can be set to "" to turn this off. .TP a2082 226 .TP .B redis-expire-records: \fI If Redis record expiration is enabled. If yes, Unbound sets timeout for Redis records so that Redis can evict keys that have expired automatically. If Unbound is configured with \fBserve-expired\fR and \fBserve-expired-ttl\fR is 0, this option is internally reverted to "no". Redis SETEX support is required for this option (Redis >= 2.0.0). This option defaults to no. .TP .B redis-logical-db: \fI The logical database in Redis to use. These are databases in the same Redis instance sharing the same configuration and persisted in the same RDB/AOF file. If unsure about using this option, Redis documentation (https://redis.io/commands/select/) suggests not to use a single Redis instance for multiple unrelated applications. The default database in Redis is 0 while other logical databases need to be explicitly SELECT'ed upon connecting. This option defaults to 0. .SS DNSTAP Logging Options DNSTAP support, when compiled in by using \fB\-\-enable\-dnstap\fR, is enabled in the \fBdnstap:\fR section. This starts an extra thread (when compiled with threading) that writes the log information to the destination. If Unbound is compiled without threading it does not spawn a thread, but connects per-process to the destination. .TP .B dnstap-enable: \fI If dnstap is enabled. Default no. If yes, it connects to the dnstap server and if any of the dnstap-log-..-messages options is enabled it sends logs for those messages to the server. .TP .B dnstap-bidirectional: \fI Use frame streams in bidirectional mode to transfer DNSTAP messages. Default is yes. .TP .B dnstap-socket-path: \fI Sets the unix socket file name for connecting to the server that is listening on that socket. Default is "@@DNSTAP_SOCKET_PATH@@". .TP .B dnstap-ip: \fI If "", the unix socket is used, if set with an IP address (IPv4 or IPv6) that address is used to connect to the server. .TP .B dnstap-tls: \fI Set this to use TLS to connect to the server specified in \fBdnstap-ip\fR. The default is yes. If set to no, TCP is used to connect to the server. .TP .B dnstap-tls-server-name: \fI The TLS server name to authenticate the server with. Used when \fBdnstap-tls\fR is enabled. If "" it is ignored, default "". .TP .B dnstap-tls-cert-bundle: \fI The pem file with certs to verify the TLS server certificate. If "" the server default cert bundle is used, or the windows cert bundle on windows. Default is "". .TP .B dnstap-tls-client-key-file: \fI The client key file for TLS client authentication. If "" client authentication is not used. Default is "". .TP .B dnstap-tls-client-cert-file: \fI The client cert file for TLS client authentication. Default is "". .TP .B dnstap-send-identity: \fI If enabled, the server identity is included in the log messages. Default is no. .TP .B dnstap-send-version: \fI If enabled, the server version if included in the log messages. Default is no. .TP .B dnstap-identity: \fI The identity to send with messages, if "" the hostname is used. Default is "". .TP .B dnstap-version: \fI The version to send with messages, if "" the package version is used. Default is "". .TP .B dnstap-log-resolver-query-messages: \fI Enable to log resolver query messages. Default is no. These are messages from Unbound to upstream servers. .TP .B dnstap-log-resolver-response-messages: \fI Enable to log resolver response messages. Default is no. These are replies from upstream servers to Unbound. .TP .B dnstap-log-client-query-messages: \fI Enable to log client query messages. Default is no. These are client queries to Unbound. .TP .B dnstap-log-client-response-messages: \fI Enable to log client response messages. Default is no. These are responses from Unbound to clients. .TP .B dnstap-log-forwarder-query-messages: \fI Enable to log forwarder query messages. Default is no. .TP .B dnstap-log-forwarder-response-messages: \fI Enable to log forwarder response messages. Default is no. .SS Response Policy Zone Options .LP Response Policy Zones are configured with \fBrpz:\fR, and each one must have a \fBname:\fR. There can be multiple ones, by listing multiple rpz clauses, each with a different name. RPZ clauses are applied in order of configuration. The \fBrespip\fR module needs to be added to the \fBmodule-config\fR, e.g.: \fBmodule-config: "respip validator iterator"\fR. .P QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported. Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp\-only and drop. RPZ QNAME triggers are applied after \fBlocal\-zones\fR and before \fBauth\-zones\fR. .P The rpz zone is formatted with a SOA start record as usual. The items in the zone are entries, that specify what to act on (the trigger) and what to do (the action). The trigger to act on is recorded in the name, the action to do is recorded as the resource record. The names all end in the zone name, so you could type the trigger names without a trailing dot in the zonefile. .P An example RPZ record, that answers example.com with NXDOMAIN .nf example.com CNAME . .fi .P The triggers are encoded in the name on the left .nf name query name netblock.rpz-client-ip client IP address netblock.rpz-ip response IP address in the answer name.rpz-nsdname nameserver name netblock.rpz-nsip nameserver IP address .fi The netblock is written as .. For IPv6 use 'zz' for '::'. Specify individual addresses with scope length of 32 or 128. For example, 24.10.100.51.198.rpz-ip is 198.51.100.10/24 and 32.10.zz.db8.2001.rpz-ip is 2001:db8:0:0:0:0:0:10/32. .P The actions are specified with the record on the right .nf CNAME . nxdomain reply CNAME *. nodata reply CNAME rpz-passthru. do nothing, allow to continue CNAME rpz-drop. the query is dropped CNAME rpz-tcp-only. answer over TCP A 192.0.2.1 answer with this IP address .fi Other records like AAAA, TXT and other CNAMEs (not rpz-..) can also be used to answer queries with that content. .P The RPZ zones can be configured in the config file with these settings in the \fBrpz:\fR block. .TP .B name: \fI Name of the authority zone. .TP .B primary: \fI Where to download a copy of the zone from, with AXFR and IXFR. Multiple primaries can be specified. They are all tried if one fails. To use a nondefault port for DNS communication append '@@' with the port number. You can append a '#' and a name, then AXFR over TLS can be used and the tls authentication certificates will be checked with that name. If you combine the '@@' and '#', the '@@' comes first. If you point it at another Unbound instance, it would not work because that does not support AXFR/IXFR for the zone, but if you used \fBurl:\fR to download the zonefile as a text file from a webserver that would work. If you specify the hostname, you cannot use the domain from the zonefile, because it may not have that when retrieving that data, instead use a plain IP address to avoid a circular dependency on retrieving that IP address. .TP .B master: \fI Alternate syntax for \fBprimary\fR. .TP .B url: \fI Where to download a zonefile for the zone. With http or https. An example for the url is "http://www.example.com/example.org.zone". Multiple url statements can be given, they are tried in turn. If only urls are given the SOA refresh timer is used to wait for making new downloads. If also primaries are listed, the primaries are first probed with UDP SOA queries to see if the SOA serial number has changed, reducing the number of downloads. If none of the urls work, the primaries are tried with IXFR and AXFR. For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used to authenticate the connection. .TP .B allow\-notify: \fI With allow\-notify you can specify additional sources of notifies. When notified, the server attempts to first probe and then zone transfer. If the notify is from a primary, it first attempts that primary. Otherwise other primaries are attempted. If there are no primaries, but only urls, the file is downloaded when notified. The primaries from primary: and url: statements are allowed notify by default. .TP .B zonefile: \fI The filename where the zone is stored. If not given then no zonefile is used. If the file does not exist or is empty, Unbound will attempt to fetch zone data (eg. from the primary servers). .TP .B rpz\-action\-override: \fI Always use this RPZ action for matching triggers from this zone. Possible action are: nxdomain, nodata, passthru, drop, disabled and cname. .TP .B rpz\-cname\-override: \fI The CNAME target domain to use if the cname action is configured for \fBrpz\-action\-override\fR. .TP .B rpz\-log: \fI Log all applied RPZ actions for this RPZ zone. Default is no. .TP .B rpz\-log\-name: \fI Specify a string to be part of the log line, for easy referencing. .TP .B rpz\-signal\-nxdomain\-ra: \fI Signal when a query is blocked by the RPZ with NXDOMAIN with an unset RA flag. This allows certain clients, like dnsmasq, to infer that the domain is externally blocked. Default is no. .TP .B for\-downstream: \fI If enabled the zone is authoritatively answered for and queries for the RPZ zone information are answered to downstream clients. This is useful for monitoring scripts, that can then access the SOA information to check if the rpz information is up to date. Default is no. .TP .B tags: \fI Limit the policies from this RPZ clause to clients with a matching tag. Tags need to be defined in \fBdefine\-tag\fR and can be assigned to client addresses using \fBaccess\-control\-tag\fR. Enclose list of tags in quotes ("") and put spaces between tags. If no tags are specified the policies from this clause will be applied for all clients. d2117 1 a2117 1 default Unbound working directory. d2125 1 a2125 1 Unbound configuration file. d2128 1 a2128 1 default Unbound pidfile with process ID of the running daemon. d2131 1 a2131 1 Unbound log file. default is to log to @ 1.1.1.5 log @Import unbound 1.9.6: 6 December 2019: Wouter - Fix ipsecmod compile. - Fix Makefile.in for ipset module compile, from Adi Prasaja. 5 December 2019: Wouter - unbound-fuzzers.tar.bz2: three programs for fuzzing, that are 1:1 replacements for unbound-fuzzme.c that gets created after applying the contrib/unbound-fuzzme.patch. They are contributed by Eric Sesterhenn from X41 D-Sec. - tag for 1.9.6rc1. 4 December 2019: Wouter - Fix lock type for memory purify log lock deletion. - Fix testbound for alloccheck runs, memory purify and lock checks. - update contrib/fastrpz.patch to apply more cleanly. - Fix Make Test Fails when Configured With --enable-alloc-nonregional, reported by X41 D-Sec. 3 December 2019: Wouter - Merge pull request #124 from rmetrich: Changed log lock from 'quick' to 'basic' because this is an I/O lock. - Fix text around serial arithmatic used for RRSIG times to refer to correct RFC number. - Fix Assert Causing DoS in synth_cname(), reported by X41 D-Sec. - Fix similar code in auth_zone synth cname to add the extra checks. - Fix Assert Causing DoS in dname_pkt_copy(), reported by X41 D-Sec. - Fix OOB Read in sldns_wire2str_dname_scan(), reported by X41 D-Sec. - Fix Out of Bounds Write in sldns_str2wire_str_buf(), reported by X41 D-Sec. - Fix Out of Bounds Write in sldns_b64_pton(), fixed by check in sldns_str2wire_int16_data_buf(), reported by X41 D-Sec. - Fix Insufficient Handling of Compressed Names in dname_pkt_copy(), reported by X41 D-Sec. - Fix Out of Bound Write Compressed Names in rdata_copy(), reported by X41 D-Sec. - Fix Hang in sldns_wire2str_pkt_scan(), reported by X41 D-Sec. This further lowers the max to 256. - Fix snprintf() supports the n-specifier, reported by X41 D-Sec. - Fix Bad Indentation, in dnscrypt.c, reported by X41 D-Sec. - Fix Client NONCE Generation used for Server NONCE, reported by X41 D-Sec. - Fix compile error in dnscrypt. - Fix _vfixed not Used, removed from sbuffer code, reported by X41 D-Sec. - Fix Hardcoded Constant, reported by X41 D-Sec. - make depend 2 December 2019: Wouter - Merge pull request #122 from he32: In tcp_callback_writer(), don't disable time-out when changing to read. 22 November 2019: George - Fix compiler warnings. 22 November 2019: Wouter - Fix dname loop maximum, reported by Eric Sesterhenn from X41 D-Sec. - Add make distclean that removes everything configure produced, and make maintainer-clean that removes bison and flex output. 20 November 2019: Wouter - Fix Out of Bounds Read in rrinternal_get_owner(), reported by X41 D-Sec. - Fix Race Condition in autr_tp_create(), reported by X41 D-Sec. - Fix Shared Memory World Writeable, reported by X41 D-Sec. - Adjust unbound-control to make stats_shm a read only operation. - Fix Weak Entropy Used For Nettle, reported by X41 D-Sec. - Fix Randomness Error not Handled Properly, reported by X41 D-Sec. - Fix Out-of-Bounds Read in dname_valid(), reported by X41 D-Sec. - Fix Config Injection in create_unbound_ad_servers.sh, reported by X41 D-Sec. - Fix Local Memory Leak in cachedb_init(), reported by X41 D-Sec. - Fix Integer Underflow in Regional Allocator, reported by X41 D-Sec. - Upgrade compat/getentropy_linux.c to version 1.46 from OpenBSD. - Synchronize compat/getentropy_win.c with version 1.5 from OpenBSD, no changes but makes the file, comments, identical. - Upgrade compat/getentropy_solaris.c to version 1.13 from OpenBSD. - Upgrade compat/getentropy_osx.c to version 1.12 from OpenBSD. - Changes to compat/getentropy files for, no link to openssl if using nettle, and hence config.h for HAVE_NETTLE variable. compat definition of MAP_ANON, for older systems. ifdef stdint.h inclusion for older systems. ifdef sha2.h inclusion for older systems. - Fixed Compat Code Diverging from Upstream, reported by X41 D-Sec. - Fix compile with --enable-alloc-checks, reported by X41 D-Sec. - Fix Terminating Quotes not Written, reported by X41 D-Sec. - Fix Useless memset() in validator, reported by X41 D-Sec. - Fix Unrequired Checks, reported by X41 D-Sec. - Fix Enum Name not Used, reported by X41 D-Sec. - Fix NULL Pointer Dereference via Control Port, reported by X41 D-Sec. - Fix Bad Randomness in Seed, reported by X41 D-Sec. - Fix python examples/calc.py for eval, reported by X41 D-Sec. - Fix comments for doxygen in dns64. 19 November 2019: Wouter - Fix CVE-2019-18934, shell execution in ipsecmod. - 1.9.5 is 1.9.4 with bugfix, trunk is 1.9.6 in development. - Fix authzone printout buffer length check. - Fixes to please lint checks. - Fix Integer Overflow in Regional Allocator, reported by X41 D-Sec. - Fix Unchecked NULL Pointer in dns64_inform_super() and ipsecmod_new(), reported by X41 D-Sec. - Fix Out-of-bounds Read in rr_comment_dnskey(), reported by X41 D-Sec. - Fix Integer Overflows in Size Calculations, reported by X41 D-Sec. - Fix Integer Overflow to Buffer Overflow in sldns_str2wire_dname_buf_origin(), reported by X41 D-Sec. - Fix Out of Bounds Read in sldns_str2wire_dname(), reported by X41 D-Sec. - Fix Out of Bounds Write in sldns_bget_token_par(), reported by X41 D-Sec. 18 November 2019: Wouter - In unbound-host use separate variable for get_option to please code checkers. - update to bison output of 3.4.1 in code repository. - Provide a prototype for compat malloc to remove compile warning. - Portable grep usage for reuseport configure test. - Check return type of HMAC_Init_ex for openssl 0.9.8. - gitignore .source tempfile used for compatible make. 13 November 2019: Wouter - iana portlist updated. - contrib/fastrpz.patch updated to apply for current code. - fixes for splint cleanliness, long vs int in SSL set_mode. 11 November 2019: Wouter - Fix #109: check number of arguments for stdin-pipes in unbound-control and fail if too many arguments. - Merge #102 from jrtc27: Add getentropy emulation for FreeBSD. 24 October 2019: Wouter - Fix #99: Memory leak in ub_ctx (event_base will never be freed). 23 October 2019: George - Add new configure option `--enable-fully-static` to enable full static build if requested; in relation to #91. 23 October 2019: Wouter - Merge #97: manpage: Add missing word on unbound.conf, from Erethon. 22 October 2019: Wouter - drop-tld.diff: adds option drop-tld: yesno that drops 2 label queries, to stop random floods. Apply with patch -p1 < contrib/drop-tld.diff and compile. From Saksham Manchanda (Secure64). Please note that we think this will drop DNSKEY and DS lookups for tlds and hence break DNSSEC lookups for downstream clients. 7 October 2019: Wouter - Add doxygen comments to unbound-anchor source address code, in #86. 3 October 2019: Wouter - Merge #90 from vcunat: fix build with nettle-3.5. - Merge 1.9.4 release with fix for vulnerability CVE-2019-16866. - Continue with development of 1.9.5. - Merge #86 from psquarejho: Added -b source address option to smallapp/unbound-anchor.c, from Lukas Wunner. 26 September 2019: Wouter - Merge #87 from hardfalcon: Fix contrib/unbound.service.in, Drop CAP_KILL, use + prefix for ExecReload= instead. 25 September 2019: Wouter - The unbound.conf includes are sorted ascending, for include statements with a '*' from glob. 23 September 2019: Wouter - Merge #85 for #84 from sam-lunt: Add kill capability to systemd service file to fix that systemctl reload fails. 20 September 2019: Wouter - Merge #82 from hardfalcon: Downgrade CAP_NET_ADMIN to CAP_NET_RAW in unbound.service. - Merge #81 from Maryse47: Consistently use /dev/urandom instead of /dev/random in scripts and docs. - Merge #83 from Maryse47: contrib/unbound.service.in: do not fork into the background. 19 September 2019: Wouter - Fix #78: Memory leak in outside_network.c. - Merge pull request #76 from Maryse47: Improvements and fixes for systemd unbound.service. - oss-fuzz badge on README.md. - Fix fix for #78 to also free service callback struct. - Fix for oss-fuzz build warning. - Fix wrong response ttl for prepended short CNAME ttls, this would create a wrong zero_ttl response count with serve-expired enabled. - Merge #80 from stasic: Improve wording in man page. 11 September 2019: Wouter - Use explicit bzero for wiping clear buffer of hash in cachedb, reported by Eric Sesterhenn from X41 D-Sec. 9 September 2019: Wouter - Fix #72: configure --with-syslog-facility=LOCAL0-7 with default LOG_DAEMON (as before) can set the syslog facility that the server uses to log messages. 4 September 2019: Wouter - Fix #71: fix openssl error squelch commit compilation error. 3 September 2019: Wouter - squelch DNS over TLS errors 'ssl handshake failed crypto error' on low verbosity, they show on verbosity 3 (query details), because there is a high volume and the operator cannot do anything for the remote failure. Specifically filters the high volume errors. 2 September 2019: Wouter - ipset module #28: log that an address is added, when verbosity high. - ipset: refactor long routine into three smaller ones. - updated Makefile dependencies. 23 August 2019: Wouter - Fix contrib/fastrpz.patch asprintf return value checks. 22 August 2019: Wouter - Fix that pkg-config is setup before --enable-systemd needs it. - 1.9.3rc2 release candidate tag. And this became the 1.9.3 release. Master is 1.9.4 in development. 21 August 2019: Wouter - Fix log_dns_msg to log irrespective of minimal responses config. 19 August 2019: Ralph - Document limitation of pidfile removal outside of chroot directory. 16 August 2019: Wouter - Fix unittest valgrind false positive uninitialised value report, where if gcc 9.1.1 uses -O2 (but not -O1) then valgrind 3.15.0 issues an uninitialised value for the token buffer at the str2wire.c rrinternal_get_owner() strcmp with the '@@' value. Rewritten to use straight character comparisons removes the false positive. Also valgrinds --expensive-definedness-checks=yes can stop this false positive. - Please doxygen's parser for "@@" occurrence in doxygen comment. - Fixup contrib/fastrpz.patch - Remove warning about unknown cast-function-type warning pragma. 15 August 2019: Wouter - iana portlist updated. - Fix autotrust temp file uniqueness windows compile. - avoid warning about upcast on 32bit systems for autotrust. - escape commandline contents for -V. - Fix character buffer size in ub_ctx_hosts. - 1.9.3rc1 release candidate tag. - Option -V prints if TCP fastopen is available. 14 August 2019: George - Fix #59, when compiled with systemd support check that we can properly communicate with systemd through the `NOTIFY_SOCKET`. 14 August 2019: Wouter - Generate configlexer with newer flex. - Fix warning for unused variable for compilation without systemd. 12 August 2019: George - Introduce `-V` option to print the version number and build options. Previously reported build options like linked libs and linked modules are now moved from `-h` to `-V` as well for consistency. - PACKAGE_BUGREPORT now also includes link to GitHub issues. 1 August 2019: Wouter - For #52 #53, second context does not close logfile override. - Fix #52 #53, fix for example fail program. - Fix to return after failed auth zone http chunk write. - Fix to remove unused test for task_probe existance. - Fix to timeval_add for remaining second in microseconds. - Check repinfo in worker_handle_request, if null, drop it. 29 July 2019: Wouter - Add verbose log message when auth zone file is written, at level 4. - Add hex print of trust anchor pointer to trust anchor file temp name to make it unique, for libunbound created multiple contexts. 23 July 2019: Wouter - Fix question section mismatch in local zone redirect. 19 July 2019: Wouter - Fix #49: Set no renegotiation on the SSL context to stop client session renegotiation. 12 July 2019: Wouter - Fix #48: Unbound returns additional records on NODATA response, if minimal-responses is enabled, also the additional for negative responses is removed. 9 July 2019: Ralph - Fix in respip addrtree selection. Absence of addr_tree_init_parents() call made it impossible to go up the tree when the matching netmask is too specific. 5 July 2019: Ralph - Fix for possible assertion failure when answering respip CNAME from cache. 25 June 2019: Wouter - For #45, check that 127.0.0.1 and ::1 are not used in unbound.conf when do-not-query-localhost is turned on, or at default on, unbound-checkconf prints a warning if it is found in forward-addr or stub-addr statements. 24 June 2019: Wouter - Fix memleak in unit test, reported from the clang 8.0 static analyzer. 18 June 2019: Wouter - PR #28: IPSet module, by Kevin Chou. Created a module to support the ipset that could add the domain's ip to a list easily. Needs libmnl, and --enable-ipset and config it, doc/README.ipset.md. - Fix to omit RRSIGs from addition to the ipset. - Fix to make unbound-control with ipset, remove unused variable, use unsigned type because of comparison, and assign null instead of compare with it. Remade lex and yacc output. - make depend - Added documentation to the ipset files (for doxygen output). - Merge PR #6: Python module: support multiple instances - Merge PR #5: Python module: define constant MODULE_RESTART_NEXT - Merge PR #4: Python module: assign something useful to the per-query data store 'qdata' - Fix python dict reference and double free in config. 17 June 2019: Wouter - Master contains version 1.9.3 in development. - Fix #39: In libunbound, leftover logfile is close()d unpredictably. - Fix for #24: Fix abort due to scan of auth zone masters using old address from previous scan. 12 June 2019: Wouter - Fix another spoolbuf storage code point, in prefetch. - 1.9.2rc3 release candidate tag. Which became the 1.9.2 release on 17 June 2019. 11 June 2019: Wouter - Fix that fixes the Fix that spoolbuf is not used to store tcp pipelined response between mesh send and callback end, this fixes error cases that did not use the correct spoolbuf. - 1.9.2rc2 release candidate tag. 6 June 2019: Wouter - 1.9.2rc1 release candidate tag. 4 June 2019: Wouter - iana portlist updated. 29 May 2019: Wouter - Fix to guard _OPENBSD_SOURCE from redefinition. 28 May 2019: Wouter - Fix to define _OPENBSD_SOURCE to get reallocarray on NetBSD. - gitignore config.h.in~. 27 May 2019: Wouter - Fix double file close in tcp pipelined response code. 24 May 2019: Wouter - Fix that spoolbuf is not used to store tcp pipelined response between mesh send and callback end. 20 May 2019: Wouter - Note that so-reuseport at extreme load is better turned off, otherwise queries are not distributed evenly, on Linux 4.4.x. 16 May 2019: Wouter - Fix #31: swig 4.0 and python module. 13 May 2019: Wouter - Squelch log messages from tcp send about connection reset by peer. They can be enabled with verbosity at higher values for diagnosing network connectivity issues. - Attempt to fix malformed tcp response. 9 May 2019: Wouter - Revert fix for oss-fuzz, error is in that build script that unconditionally includes .o files detected by configure, also when the machine architecture uses different LIBOBJS files. 8 May 2019: Wouter - Attempt to fix build failure in oss-fuzz because of reallocarray. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14648. Does not omit compile flags from commandline. 7 May 2019: Wouter - Fix edns-subnet locks, in error cases the lock was not unlocked. - Fix doxygen output error on readme markdown vignettes. 6 May 2019: Wouter - Fix #29: Solaris 11.3 and missing symbols be64toh, htobe64. - Fix #30: AddressSanitizer finding in lookup3.c. This sets the hash function to use a slower but better auditable code that does not read beyond array boundaries. This makes code better security checkable, and is better for security. It is fixed to be slower, but not read outside of the array. 2 May 2019: Wouter - contrib/fastrpz.patch updated for code changes, and with git diff. - Fix .gitignore, add pythonmod and dnstap generated files. And unit test generated files, and generated doc files. 1 May 2019: Wouter - Update makedist for git. - Nicer travis output for clang analysis. - PR #16: XoT support, AXFR over TLS, turn it on with master: # in unbound.conf. This uses TLS to download the AXFR (or IXFR). 25 April 2019: Wouter - Fix wrong query name in local zone redirect answers with a CNAME, the copy of the local alias is in unpacked form. 18 April 2019: Ralph - Scrub RRs from answer section when reusing NXDOMAIN message for subdomain answers. - For harden-below-nxdomain: do not consider a name to be non-exitent when message contains a CNAME record. 18 April 2019: Wouter - travis build file. 16 April 2019: Wouter - Better braces in if statement in TCP fastopen code. - iana portlist updated. 15 April 2019: Wouter - Fix tls write event for read state change to re-call SSL_write and not resume the TLS handshake. 11 April 2019: George - Update python documentation for init_standard(). - Typos. 11 April 2019: Wouter - Fix that auth zone uses correct network type for sockets for SOA serial probes. This fixes that probes fail because earlier probe addresses are unreachable. - Fix that auth zone fails over to next master for timeout in tcp. - Squelch SSL read and write connection reset by peer and broken pipe messages. Verbosity 2 and higher enables them. 8 April 2019: Wouter - Fix to use event_assign with libevent for thread-safety. - verbose information about auth zone lookup process, also lookup start, timeout and fail. - Fix #17: Add python module example from Jan Janak, that is a plugin for the Unbound DNS resolver to resolve DNS records in multicast DNS [RFC 6762] via Avahi. The plugin communicates with Avahi via DBus. The comment section at the beginning of the file contains detailed documentation. - Fix to wipe ssl ticket keys from memory with explicit_bzero, if available. 5 April 2019: Wouter - Fix to reinit event structure for accepted TCP (and TLS) sockets. 4 April 2019: Wouter - Fix spelling error in log output for event method. 3 April 2019: Wouter - Move goto label in answer_from_cache to the end of the function where it is more visible. - Fix auth-zone NSEC3 response for wildcard nodata answers, include the closest encloser in the answer. 2 April 2019: Wouter - Fix auth-zone NSEC3 response for empty nonterminals with exact match nsec3 records. - Fix for out of bounds integers, thanks to OSTIF audit. It is in allocation debug code. - Fix for auth zone nsec3 ent fix for wildcard nodata. 25 March 2019: Wouter - Fix that tls-session-ticket-keys: "" on its own in unbound.conf disables the tls session ticker key calls into the OpenSSL API. - Fix crash if tls-servic-pem not filled in when necessary. 21 March 2019: Wouter - Fix #4240: Fix whitespace cleanup in example.conf. 19 March 2019: Wouter - add type CAA to libpyunbound (accessing libunbound from python). 18 March 2019: Wouter - Add log message, at verbosity 4, that says the query is encrypted with TLS, if that is enabled for the query. - Fix #4239: set NOTIMPL when deny-any is enabled, for RFC8482. 7 March 2019: Wouter - Fix for #4233: guard use of NDEBUG, so that it can be passed in CFLAGS into configure. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "dec 12, 2019" "NLnet Labs" "unbound 1.9.6" d53 1 a53 1 # mount \-\-bind \-n /dev/urandom /etc/unbound/dev/urandom a302 2 At extreme load it could be better to turn it off to distribute the queries evenly, reported for Linux systems (4.4.x). d630 1 a630 3 /var/run/unbound.pid and the chroot to be /var/unbound, for example. Note that Unbound is not able to remove the pidfile after termination when it is located outside of the chroot directory. d632 1 a632 1 Additionally, unbound may need to access /dev/urandom (for entropy) d774 1 a774 1 Will trust glue only if it is within the servers authority. Default is yes. d784 1 a784 1 downgrade attack that disables security for a zone. Default is yes. d794 1 a794 1 have DNSSEC. Default is yes. d831 1 a831 1 Only send minimum required labels of the QNAME and set QTYPE to A when d948 1 a948 1 The probes are run several times per month, thus the machine must be online d973 1 a973 1 Send RFC8145 key tag query after trust anchor priming. Default is yes. d976 1 a976 1 Root key trust anchor sentinel. Default is yes. a1677 1 With the "ip#name" notation a AXFR over TLS can be used. d1768 1 a1768 2 (usually first, or between the validator and iterator). Multiple instances of the python module are supported by adding the word "python" more than once. d1777 1 a1777 2 The script file to load. Repeat this option for every python module instance added to the \fBmodule\-config:\fR option. @ 1.1.1.6 log @Import unbound 1.13.1 4 February 2021: Wouter - release 1.13.1rc2 tag on branch-1.13.1 with added changes of 2 feb. This became 1.13.1 release tag on 9 feb. The main branch is set to version 1.13.2. 2 February 2021: Wouter - branch-1.13.1 is created, with release-1.13.1rc1 tag. - Fix dynlibmod link on rhel8 for -ldl inclusion. - Fix windows dependency on libssp.dll because of default stack protector in mingw. - Fix indentation of root anchor for use by windows install script. 1 February 2021: George - Attempt to fix NULL keys in the reuse_tcp tree; relates to #411. 29 January 2021: Wouter - Fix for doxygen 1.8.20 compatibility. 28 January 2021: Wouter - Annotate that we ignore the return value of if_indextoname. - Fix to use correct type for label count in rpz routine. - Fix empty clause warning in config_file nsid parse. - Fix to use correct type for label count in ipdnametoaddr rpz routine. - Fix empty clause warning in edns pass for padding. - Fix fwd ancil test post script when not supported. 26 January 2021: George - Merge PR #408 from fobser: Prevent a few more yacc clashes. - Merge PR #275 from Roland van Rijswijk-Deij: Add feature to return the original instead of a decrementing TTL ('serve-original-ttl') - Merge PR #355 from noloader: Make ICANN Update CA and DS Trust Anchor static data. - Ignore cache blacklisting when trying to reply with expired data from cache (#394). 26 January 2021: Wouter - Fix compile of unbound-dnstap-socket without dnstap installed. 22 January 2021: Willem - Padding of queries and responses with DNS over TLS as specified in RFC7830 and RFC8467. 22 January 2021: George - Fix TTL of SOA record for negative answers (localzone and authzone data) to be the minimum of the SOA TTL and the SOA.MINIMUM. 19 January 2021: Willem - Support for RFC5001: DNS Name Server Identifier (NSID) Option with the nsid: option in unbound.conf 18 January 2021: Wouter - Fix #404: DNS query with small edns bufsize fail. - Fix declaration before statement and signed comparison warning in dns64. 15 January 2021: Wouter - Merge #402 from fobser: Implement IPv4-Embedded addresses according to RFC6052. 14 January 2021: Wouter - Fix for #93: dynlibmodule import library is named libunbound.dll.a. 13 January 2021: Wouter - Merge #399 from xiangbao227: The lock of lruhash table should unlocked after markdel entry. - Fix for #93: dynlibmodule link fix for Windows. 12 January 2021: Wouter - Fix #397: [Feature request] add new type always_null to local-zone similar to always_nxdomain. - Fix so local zone types always_nodata and always_deny can be used from the config file. 8 January 2021: Wouter - Merge PR #391 from fhriley: Add start_time to reply callbacks so modules can compute the response time. - For #391: use struct timeval* start_time for callback information. - For #391: fix indentation. - For #391: more double casts in python start time calculation. - Add comment documentation. - Fix clang analysis warning. 6 January 2021: Wouter - Fix #379: zone loading over HTTP appears to have buffer issues. - Merge PR #395 from mptre: add missing null check. - Fix #387: client-subnet-always-forward seems to effectively bypass any caching? 5 January 2021: Wouter - Fix #385: autoconf 2.70 impacts unbound build - Merge PR #375 by fhriley: Add rpz_enable and rpz_disable commands to unbound-control. 4 January 2021: Wouter - For #376: Fix that comm point event is not double removed or double added to event map. - iana portlist updated. 16 December 2020: George - Fix error cases when udp-connect is set and send() returns an error (modified patch from Xin Li @@delphij). 11 December 2020: Wouter - Fix #371: unbound-control timeout when Unbound is not running. - Fix to squelch permission denied and other errors from remote host, they are logged at higher verbosity but not on low verbosity. - Merge PR #335 from fobser: Sprinkle in some static to prevent missing prototype warnings. - Merge PR #373 from fobser: Warning: arithmetic on a pointer to void is a GNU extension. - Fix missing prototypes in the code. 3 December 2020: Wouter - make depend. - iana portlist updated. 2 December 2020: Wouter - Fix #360: for the additionally reported TCP Fast Open makes TCP connections fail, in that case we print a hint that this is happening with the error in the logs. - Fix #356: deadlock when listening tcp. - Fix unbound-dnstap-socket to not use log routine from interrupt handler and not print so frequently when invoked in sequence. - Fix on windows to ignore connection failure on UDP, unless verbose. - Fix for #283: fix stream reuse and tcp fast open. - Fix update, with write event check with streamreuse and fastopen. 1 December 2020: Wouter - Fix #358: Squelch udp connect 'no route to host' errors on low verbosity. 30 November 2020: Wouter - Fix assertion failure on double callback when iterator loses interest in query at head of line that then has the tcp stream not kept for reuse. - tag for the 1.13.0rc4 release. This also became the 1.13.0 release version on 3 dec 2020 with the streamreuse and fastopen fix from 2 dec 2020. The code repo continues for 1.13.1 in development. 27 November 2020: Wouter - Fix compile warning for type cast in http2_submit_dns_response. - Fix when use free buffer to initialize rbtree for stream reuse. - Fix compile warnings for windows. - Fix compile warnings in rpz initialization. - Fix contrib/metrics.awk for FreeBSD awk compatibility. - tag for the 1.13.0rc3 release. 26 November 2020: Wouter - Fix to omit UDP receive errors from log, if verbosity low. These happen because of udp-connect. - For #352: contrib/metrics.awk for Prometheus style metrics output. - Fix that after failed read, the readagain cannot activate. - Clear readagain upon decommission of pending tcp structure. 25 November 2020: Wouter - with udp-connect ignore connection refused with UDP timeouts. - Fix udp-connect on FreeBSD, do send calls on connected UDP socket. - Better fix for reuse tree comparison for is-tls sockets. Where the tree key identity is preserved after cleanup of the TLS state. - Remove debug commands from reuse tests. - Fix memory leak for edns client tag opcode config element. - Attempt fix for libevent state in tcp reuse cases after a packet is written. - Fix readagain and writeagain callback functions for comm point cleanup. - tag for the 1.13.0rc2 release. 24 November 2020: Wouter - Merge PR #283 : Stream reuse. This implements upstream stream reuse for performing several queries over the same TCP or TLS channel. - set version of main branch to 1.13.0 for upcoming release. - iana portlist updated. - Fix one port unit test for udp-connect. - tag for the 1.13.0rc1 release. - Fix crash when TLS connection is closed prematurely, when reuse tree comparison is not properly identical to insertion. - Fix padding of struct regional for 32bit systems. 23 November 2020: George - Merge PR #313 from Ralph Dolmans: Replace edns-client-tag with edns-client-string option. 23 November 2020: Wouter - Merge #351 from dvzrv: Add AF_NETLINK to set of allowed socket address families. - Fix #350: with the AF_NETLINK permission, to fix 1.12.0 error: failed to list interfaces: getifaddrs: Address family not supported by protocol. - Fix #347: IP_DONTFRAG broken on Apple xcode 12.2. - Option to toggle udp-connect, default is enabled. - Fix for #303 CVE-2020-28935 : Fix that symlink does not interfere with chown of pidfile. - Further fix for it and retvalue 0 fix for it. 12 November 2020: Wouter - Fix to connect() to UDP destinations, default turned on, this lowers vulnerability to ICMP side channels. - Retry for interfaces with unused ports if possible. 10 November 2020: Wouter - Fix #341: fixing a possible memory leak. - Fix memory leak after fix for possible memory leak failure. - Fix #343: Fail to build --with-libnghttp2 with error: 'SSIZE_MAX' undeclared. 27 October 2020: Wouter - In man page note that tls-cert-bundle is read before permission drop and chroot. 22 October 2020: Wouter - Fix #333: Unbound Segmentation Fault w/ log_info Functions From Python Mod. - Fix that minimal-responses does not remove addresses from a priming query response. 21 October 2020: George - Fix #327: net/if.h check fails on some darwin versions; contribution by Joshua Root. - Fix #320: potential memory corruption due to size miscomputation upton custom region alloc init. 21 October 2020: Wouter - Merge PR #228 : infra-keep-probing option to probe hosts that are down. Add infra-keep-probing: yes option. Hosts that are down are probed more frequently. With the option turned on, it probes about every 120 seconds, eventually after exponential backoff, and that keeps that way. If traffic keeps up for the domain. It probes with one at a time, eg. one query is allowed to probe, other queries within that 120 second interval are turned away. 19 October 2020: George - Merge PR #324 from James Renken: Add modern X.509v3 extensions to unbound-control TLS certificates. - Fix for PR #324 to attach the x509v3 extensions to the client certificate. 19 October 2020: Ralph - local-zone regional allocations outside of chunk 19 October 2020: Wouter - Fix that http settings have colon in set_option, for http-endpoint, http-max-streams, http-query-buffer-size, http-response-buffer-size, and http-nodelay. - Fix memory leak of https port string when reading config. - Fix #330: [Feature request] Add unencrypted DNS over HTTPS support. This adds the option http-notls-downstream: yesno to change that, and the dohclient test code has the -n option. - Fix python documentation warning on functions.rst inplace_cb_reply. - Fix dnstap test to wait for log timer to see if queries are logged. - Log ip address when http session recv fails, eg. due to tls fail. - Fix to set the tcp handler event toggle flag back to default when the handler structure is reused. - Clean the fix for out of order TCP processing limits on number of queries. It was tested to work. 16 October 2020: Wouter - Fix that the out of order TCP processing does not limit the number of outstanding queries over a connection. 15 October 2020: George - Fix that if there are reply callbacks for the given rcode, those are called per reply and a new message created if that was modified by the call. - Pass the comm_reply information to the inplace_cb_reply* functions during the mesh state and update the documentation on that. 15 October 2020: Wouter - Merge PR #326 from netblue30: DoH: implement content-length header field - DoH content length, simplify code, remove declaration after statement and fix cast warning. 14 October 2020: Wouter - Fix for python reply callback to see mesh state reply_list member, it only removes it briefly for the commpoint call so that it does not drop it and attempt to modify the reply list during reply. - Fix that if there are on reply callbacks, those are called per reply and a new message created if that was modified by the call. - Free up auth zone parse region after use for lookup of host 13 October 2020: Wouter - Fix #323: unbound testsuite fails on mock build in systemd-nspawn if systemd support is build. 9 October 2020: Wouter - Fix dnstap socket and the chroot not applied properly to the dnstap socket path. - Fix warning in libnss compile, nss_buf2dsa is not used without DSA. 8 October 2020: Wouter - Tag for 1.12.0 release. - Current repo is version 1.12.1 in development. - Fix #319: potential memory leak on config failure, in rpz config. 1 October 2020: Wouter - Current repo is version 1.12.0 for release. Tag for 1.12.0rc1. 30 September 2020: Wouter - Fix doh tests when not compiled in. - Add dohclient test executable to gitignore. - Fix stream_ssl, ssl_req_order and ssl_req_timeout tests for alloc check debug output. - Easier kill of unbound-dnstap-socket tool in test. - Fix memory leak of edns tags at libunbound context delete. - Fix double loopexit for unbound-dnstap-socket after sigterm. 29 September 2020: Ralph - DNS Flag Day 2020: change edns-buffer-size default to 1232. 28 September 2020: Wouter - Fix unit test for dnstap changes, so that it waits for the timer. 23 September 2020: Wouter - Fix #305: dnstap logging significantly affects unbound performance (regression in 1.11). - Fix #305: only wake up thread when threshold reached. - Fix to ifdef fptr wlist item for dnstap. 23 September 2020: Ralph - Fix edns-client-tags get_option typo - Add edns-client-tag-opcode option - Use inclusive language in configuration 21 September 2020: Ralph - Fix #304: dnstap logging not recovering after dnstap process restarts 21 September 2020: Wouter - Merge PR #311 by luismerino: Dynlibmod leak. - Error message is logged for dynlibmod malloc failures. - iana portlist updated. 18 September 2020: Wouter - Fix that prefer-ip4 and prefer-ip6 can be get and set with unbound-control, with libunbound and the unbound-checkconf option output function. - iana portlist updated. 15 September 2020: George - Introduce test for statistics. 15 September 2020: Wouter - Spelling fix. 11 September 2020: Wouter - Remove x file mode on ipset/ipset.c and h files. 9 September 2020: Wouter - Fix num.expired statistics output. 31 August 2020: Wouter - Merge PR #293: Add missing prototype. Also refactor to use the new shorthand function to clean up the code. - Refactor to use sock_strerr shorthand function. - Fix #296: systemd nss-lookup.target is reached before unbound can successfully answer queries. Changed contrib/unbound.service.in. 27 August 2020: Wouter - Similar to NSD PR#113, implement that interface names can be used, eg. something like interface: eth0 is resolved at server start and uses the IP addresses for that named interface. - Review fix, doxygen and assign null in case of error free. 26 August 2020: George - Update documentation in python example code. 24 August 2020: Wouter - Fix that dnstap reconnects do not spam the log with the repeated attempts. Attempts on the timer are only logged on high verbosity, if they produce a connection failure error. - Fix to apply chroot to dnstap-socket-path, if chroot is enabled. - Change configure to use EVP_sha256 instead of HMAC_Update for openssl-3.0.0. 20 August 2020: Ralph - Fix stats double count issue (#289). 13 August 2020: Ralph - Create and init edns tags data for libunbound. 10 August 2020: Ralph - Merge (modified) PR #277, use EVP_MAC_CTX_set_params if available, by Vít#zslav #í#ek. 10 August 2020: Wouter - Fix #287: doc typo: "Additionaly". - Rerun autoconf 6 August 2020: Wouter - Merge PR #284 and Fix #246: Remove DLV entirely from Unbound. The DLV has been decommisioned and in unbound 1.5.4, in 2015, there was advise to stop using it. The current code base does not contain DLV code any more. The use of dlv options displays a warning. 5 August 2020: Wouter - contrib/aaaa-filter-iterator.patch file renewed diff content to apply cleanly to the current coderepo for the current code version. 5 August 2020: Ralph - Merge PR #272: Add EDNS client tag functionality. 4 August 2020: George - Improve error log message when inserting rpz RR. - Merge PR #280, Make tvOS & watchOS checks verify truthiness as well as definedness, by Felipe Gasper. 4 August 2020: Wouter - Fix mini_event.h on OpenBSD cannot find fd_set. 31 July 2020: Wouter - Fix doxygen comment for no ssl for tls session ticket key callback routine. 27 July 2020: George - Merge PR #268, draft-ietf-dnsop-serve-stale-10 has become RFC 8767 on March 2020, by and0x000. 27 July 2020: Ralph - Merge PR #269, Fix python module len() implementations, by Torbjörn Lönnemark 27 July 2020: Wouter - branch now named 1.11.1. 1.11.0rc1 became the 1.11.0 release. - Merge PR #270 from cgzones: munin plugin: always exit 0 in autoconf 20 July 2020: Wouter - Fix streamtcp to print packet data to stdout. This makes the stdout and stderr not mix together lines, when parsing its output. - Fix contrib/fastrpz.patch to apply cleanly. It fixes for changes due to added libdynmod, but it does not compile, it conflicts with new rpz code. - branch now named 1.11.0 and 1.11.0rc1 tag. 17 July 2020: Wouter - Fix libnettle compile for session ticket key callback function changes. - Fix lock dependency cycle in rpz zone config setup. 17 July 2020: Ralph - Merge PR #234 - Ensure proper alignment of cmsg buffers by Jérémie Courrèges-Anglas. - Fix PR #234 log_assert sizeof to use union buffer. 16 July 2020: Wouter - Fix check conf test for referencing installation paths. - Fix unused variable warning for clang analyzer. 16 July 2020: George - Introduce 'include-toplevel:' configuration option. 16 July 2020: Ralph - Add bidirectional frame streams support. 8 July 2020: Wouter - Fix add missing DSA header, for compilation without deprecated OpenSSL APIs. - Fix to use SSL_CTX_set_tlsext_ticket_key_evp_cb in OpenSSL 3.0.0-alpha4. - Longer keys for the test set, this avoids weak crypto errors. 7 July 2020: Wouter - Fix #259: Fix unbound-checkconf does not check view existence. unbound-checkconf checks access-control-view, access-control-tags, access-control-tag-actions and access-control-tag-datas. - Fix offset of error printout for access-control-tag-datas. - Review fixes for checkconf #259 change. 6 July 2020: Wouter - run_vm cleanup better and removes trailing slash on single argument. 29 June 2020: Wouter - Move reply list clean for serve expired mesh callback to after the reply is sent, so that script callbacks have reply_info. - Also move reply list clean for mesh callbacks to the scrip callback can see the reply_info. - Fix for mesh accounting if the reply list already empty to begin with. - Fix for mesh accounting when rpz decides to drop a reply with a tcp stream waiting for it. - Review fix for number of detached states due to use of variable after end of loop. - Fix tcp req info drop due to size call into mesh accounting removal of mesh state during mesh send reply. 24 June 2020: Wouter - iana portlist updated. - doxygen file comments for dynlibmodule. 17 June 2020: Wouter - Fix default explanation in man page for qname-minimisation-strict. - Fix display of event loop method with libev. 8 June 2020: Wouter - Mention tls name possible when tls is enabled for stub-addr in the man page. 27 May 2020: George - Merge PR #241 by Robert Edmonds: contrib/libunbound.pc.in: Do not use "Requires:". 25 May 2020: George - Update contrib/aaaa-filter-iterator.patch for the recent generate_sub_request() change and to apply cleanly. 21 May 2020: George - Fix for integer overflow when printing RDF_TYPE_TIME. 19 May 2020: Wouter - CVE-2020-12662 Unbound can be tricked into amplifying an incoming query into a large number of queries directed to a target. - CVE-2020-12663 Malformed answers from upstream name servers can be used to make Unbound unresponsive. - Release 1.10.1 is 1.10.0 with fixes, code repository continues, including those fixes, towards the next release. Configure has version 1.10.2 version number in it. - For PR #93: windows compile warnings removal - windows compile warnings removal for ip dscp option code. - For PR #93: unit test for dynlib module. 18 May 2020: Wouter - For PR #93: dynlibmod can handle reloads and deinit and inits again, with dlclose and dlopen of the library again. Also for multiple modules. Fix memory leak by not closing dlopened content. Fix to allow one dynlibmod instance by unbound-checkconf. - For PR #93: checkconf allows multiple dynlib in module-config, for a couple cases. - For PR #93: checkconf allows python dynlib in module-config, for a couple cases. - For PR #93: man page spelling reference fix. - For PR #93: fix link of other executables for dynlibmod dependency. 15 May 2020: Wouter - Merge PR #93: Add dynamic library support. - Fixed conflicts for PR #93 and make configure, yacc, lex. - For PR #93: Fix warnings for dynlibmodule. 15 May 2020: Ralph - Cache ECS answers with longest scope of CNAME chain. 22 April 2020: George - Explicitly use 'rrset-roundrobin: no' for test cases. 21 April 2020: Wouter - Merge #225 from akhait: KSK-2010 has been revoked. It removes the KSK-2010 from the default list in unbound-anchor, now that the revocation period is over. KSK-2017 is the only trust anchor in the shipped default now. 21 April 2020: George - Change default value for 'rrset-roundrobin' to yes. - Fix tests for new rrset-roundrobin default. 20 April 2020: Wouter - Fix #222: --enable-rpath, fails to rpath python lib. - Fix for count of reply states in the mesh. - Remove unneeded was_mesh_reply check. 17 April 2020: George - Add SNI support on more TLS connections (fixes #193). - Add SNI support to unbound-anchor. 16 April 2020: George - Add doxygen documentation for DSCP. 16 April 2020: Wouter - Fix help return code in unbound-control-setup script. - Fix for posix shell syntax for trap in nsd-control-setup. - Fix for posix shell syntax for trap in run_msg.sh test script. 15 April 2020: George - Fix #220: auth-zone section in config may lead to segfault. 7 April 2020: Wouter - Merge PR #214 from gearnode: unbound-control-setup recreate certificates. With the -r option the certificates are created again, without it, only the files that do not exist are created. 6 April 2020: Ralph - Keep track of number of timeouts. Use this counter to determine if capsforid fallback should be started. 6 April 2020: George - More documentation for redis-expire-records option. 1 April 2020: George - Merge PR #206: Redis TTL, by Talkabout. 30 March 2020: Wouter - Merge PR #207: Clarify if-automatic listens on 0.0.0.0 and :: - Merge PR #208: Fix uncached CLIENT_RESPONSE'es on stateful transports. 27 March 2020: Wouter - Merge PR #203 from noloader: Update README-Travis.md with current procedures. 27 March 2020: Ralph - Make unbound-control error returned on missing domain name more user friendly. 26 March 2020: Ralph - Fix RPZ concurrency issue when using auth_zone_reload. 25 March 2020: George - Merge PR #201 from noloader: Fix OpenSSL cross-compaile warnings. - Fix on #201. 24 March 2020: Wouter - Merge PR #200 from yarikk: add ip-dscp option to specify the DSCP tag for outgoing packets. - Fixes on #200. - Travis fix for ios by omitting tools from install. 23 March 2020: Wouter - Fix compile on Solaris for unbound-checkconf. 20 March 2020: George - Merge PR #198 from fobser: Declare lz_enter_rr_into_zone() static, it's only used in this file. 20 March 2020: Wouter - Merge PR #197 from fobser: Make log_ident_revert_to_default() a proper prototype. 19 March 2020: Ralph - Merge PR#191: Update iOS testing on Travis, by Jeffrey Walton. - Fix #158: open tls-session-ticket-keys as binary, for Windows. By Daisuke HIGASHI. - Merge PR#134, Allow the kernel to provide random source ports. By Florian Obser. - Log warning when using outgoing-port-permit and outgoing-port-avoid while explicit port randomisation is disabled. - Merge PR#194: Add libevent testing to Travis, by Jeffrey Walton. - Fix .travis.yml error, missing 'env' option. 16 March 2020: Wouter - Fix #192: In the unbound-checkconf tool, the module config of dns64 subnetcache respip validator iterator is whitelisted, it was reported it seems to work. 12 March 2020: Wouter - Fix compile of test tools without protobuf. 11 March 2020: Ralph - Add check to make sure RPZ records are subdomains of configured zone origin. 11 March 2020: George - Fix #189: mini_event.h:142:17: error: field 'ev_timeout' has incomplete type, by noloader. - Changelog entry for (Fix #189, Merge PR #190). 11 March 2020: Wouter - Fix #188: unbound-control.c:882:6: error: 'execlp' is unavailable: not available on tvOS. 6 March 2020: George - Merge PR #186, fix #183: Fix unrecognized 'echo -n' option on OS X, by noloader 5 March 2020: Wouter - Fix PR #182 from noloader: Add iOS testing to Travis. 4 March 2020: Ralph - Update README-Travis.md (from PR #179), by Jeffrey Walton. 4 March 2020: George - Merge PR #181 from noloader: Fix OpenSSL -pie warning on Android. 4 March 2020: Wouter - Merge PR #180 from noloader: Avoid calling exit in Travis script. 3 March 2020: George - Upgrade config.guess(2020-01-01) and config.sub(2020-01-01). 2 March 2020: Ralph - Fix #175, Merge PR #176: fix link error when OpenSSL is configured with no-engine, thanks noloader. 2 March 2020: George - Fix compiler warning in dns64/dns64.c - Merge PR #174: Add Android to Travis testing, by noloader. - Move android build scripts to contrib/ and allow android tests to fail. 2 March 2020: Wouter - Fix #177: dnstap does not build on macOS. 28 February 2020: Ralph - Merge PR #172: Add IBM s390x arch for testing, by noloader. 28 February 2020: Wouter - Merge PR #173: updated makedist.sh for config.guess and config.sub and sha256 digest for gpg, by noloader. - Merge PR #164: Framestreams, this branch implements dnstap unidirectional connectivity in unbound. This has a number of new features. The dependency on libfstrm is removed. The fstrm protocol code resides in dnstap/dnstap_fstrm.h and dnstap/dnstap_fstrm.c. This contains a brief definition of what unbound needs. The make unbound-dnstap-socket builds a debug tool, unbound-dnstap-socket. It can listen, accept multiple DNSTAP streams and print information. Commandline options control it. Unbound can reconnect if the unix domain socket file socket is closed. This uses exponential backoff after which it uses a one second timer to throttle cpu down. There is also support to use TCP and TLS for connecting to the log server. There are new config options to turn them on, in the dnstap section in the man page and example config file. dnstap-ip with IP address of server for TCP or TLS use. dnstap-tls to turn on TLS. And dnstap-tls-server-name, dnstap-tls-cert-bundle, dnstap-tls-client-key-file and dnstap-tls-client-cert-file to configure the certificates for server authentication and client authentication, or leave at "" to not use that. 27 February 2020: George - Merge PR #171: Add additional compilers and platforms to Travis testing, by noloader. 27 February 2020: Wouter - Fix #169: Fix warning for daemon/remote.c output may be truncated from snprintf. - Fix #170: Fix gcc undefined sanitizer signed integer overflow warning in signature expiry RFC1982 serial number arithmetic. - Fix more undefined sanitizer issues, in respip copy_rrset null dname, and in the client_info_compare routine for null memcmp. 26 February 2020: Wouter - iana portlist updated. 25 February 2020: Wouter - Fix #165: Add prefer-ip4: yesno config option to prefer ipv4 for using ipv4 filters, because the hosts ip6 netblock /64 is not owned by one operator, and thus reputation is shared. 24 February 2020: George - Merge PR #166: Fix typo in unbound.service.in, by glitsj16. 20 February 2020: Wouter - Updated contrib/unbound_smf23.tar.gz with Solaris SMF service for Unbound from Yuri Voinov. - master branch has 1.10.1 version. 18 February 2020: Wouter - protect X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS with ifdef for different openssl versions. 17 February 2020: Wouter - changelog point where the tag for 1.10.0rc2 release is. And with the unbound_smf23 commit added to it, that is the 1.10.0 release. 17 February 2020: Ralph - Add respip to supported module-config options in unbound-checkconf. 17 February 2020: George - Remove unused variable. 17 February 2020: Wouter - contrib/drop2rpz: perl script that converts the Spamhaus DROP-List in RPZ-Format, contributed by Andreas Schulze. 14 February 2020: Wouter - Fix spelling in unbound.conf.5.in. - Stop unbound-checkconf from insisting that auth-zone and rpz zonefiles have to exist. They can not exist, and download later. 13 February 2020: Wouter - tag for 1.10.0rc1 release. 12 February 2020: Wouter - Fix with libnettle make test with dsa disabled. - Fix contrib/fastrpz.patch to apply cleanly. Fix for serve-stale fixes, but it does not compile, conflicts with new rpz code. - Fix to clean memory leak of respip_addr.lock when ip_tree deleted. - Fix compile warning when threads disabled. - updated version number to 1.10.0. 10 February 2020: George - Document 'ub_result.was_ratelimited' in libunbound. - Fix use after free on log-identity after a reload; Fixes #163. 6 February 2020: George - Fix num_reply_states and num_detached_states counting with serve_expired_callback. - Cleaner code in mesh_serve_expired_lookup. - Document in unbound.conf manpage that configuration clauses can be repeated in the configuration file. 6 February 2020: Wouter - Fix num_reply_addr counting in mesh and tcp drop due to size after serve_stale commit. - Fix to create and destroy rpz_lock in auth_zones structure. - Fix to lock zone before adding rpz qname trigger. - Fix to lock and release once in mesh_serve_expired_lookup. - Fix to put braces around empty if body when threading is disabled. 5 February 2020: George - Added serve-stale functionality as described in draft-ietf-dnsop-serve-stale-10. `serve-expired-*` options can be used to configure the behavior. - Updated cachedb to honor `serve-expired-ttl`; Fixes #107. - Renamed statistic `num.zero_ttl` to `num.expired` as expired replies come with a configurable TTL value (`serve-expired-reply-ttl`). - Fixed stats when replying with cached, cname-aliased records. - Added missing default values for redis cachedb backend. 3 February 2020: Ralph - Add assertion to please static analyzer 31 January 2020: Wouter - Fix fclose on error in TLS session ticket code. 30 January 2020: Ralph - Fix memory leak in error condition remote.c - Fix double free in error condition view.c - Fix memory leak in do_auth_zone_transfer on success - Merge RPZ support into master. Only QNAME and Response IP triggers are supported. - Stop working on socket when socket() call returns an error. - Check malloc return values in TLS session ticket code 30 January 2020: Wouter - Fix subnet tests for disabled DSA algorithm by default. - Update contrib/fastrpz.patch for clean diff with current code. - Merge PR#151: Fixes for systemd units, by Maryse47, Edmonds and Frzk. Updates the unbound.service systemd file and adds a portable systemd service file. - updated .gitignore for added contrib file. - Add build rule for ipset to Makefile - Add getentropy_freebsd.o to Makefile dependencies. 29 January 2020: Ralph - Merge PR#156 from Alexander Berkes; Added unbound-control view_local_datas_remove command. 29 January 2020: Wouter - Fix #157: undefined reference to `htobe64'. 28 January 2020: Ralph - Merge PR#147; change rfc reference for reserved top level dns names. 28 January 2020: Wouter - iana portlist updated. - Fix to silence the tls handshake errors for broken pipe and reset by peer, unless verbosity is set to 2 or higher. 27 January 2020: Ralph - Merge PR#154; Allow use of libbsd functions with configure option --with-libbsd. By Robert Edmonds and Steven Chamberlain. - Merge PR#148; Add some TLS stats to unbound_munin_. By Fredrik Pettai. 27 January 2020: Wouter - Merge PR#155 from Robert Edmonds: contrib/libunbound.pc.in: Fixes to Libs/Requires for crypto library dependencies. - Fix #153: Disable validation for DSA algorithms. RFC 8624 compliance. 23 January 2020: Wouter - Merge PR#150 from Frzk: Systemd unit without chroot. It add contrib/unbound_nochroot.service.in, a systemd file for use with chroot: "", see comments in the file, it uses systemd protections instead. 14 January 2020: Wouter - Removed the dnscrypt_queries and dnscrypt_queries_chacha tests, because dnscrypt-proxy (2.0.36) does not support the test setup any more, and also the config file format does not seem to have the appropriate keys to recreate that setup. - Fix crash after reload where a stats lookup could reference old key cache and neg cache structures. - Fix for memory leak when edns subnet config options are read when compiled without edns subnet support. - Fix auth zone support for NSEC3 records without salt. 10 January 2020: Wouter - Fix the relationship between serve-expired and prefetch options, patch from Saksham Manchanda from Secure64. - Fix unreachable code in ssl set options code. 8 January 2020: Ralph - Fix #138: stop binding pidfile inside chroot dir in systemd service file. 8 January 2020: Wouter - Fix 'make test' to work for --disable-sha1 configure option. - Fix out-of-bounds null-byte write in sldns_bget_token_par while parsing type WKS, reported by Luis Merino from X41 D-Sec. - Updated sldns_bget_token_par fix for also space for the zero delimiter after the character. And update for more spare space. 6 January 2020: George - Downgrade compat/getentropy_solaris.c to version 1.4 from OpenBSD. The dl_iterate_phdr() function introduced in newer versions raises compilation errors on solaris 10. - Changes to compat/getentropy_solaris.c for, ifdef stdint.h inclusion for older systems. ifdef sha2.h inclusion for older systems. 6 January 2020: Wouter - Merge #135 from Florian Obser: Use passed in neg and key cache if non-NULL. - Fix #140: Document slave not downloading new zonefile upon update. 16 December 2019: George - Update mailing list URL. 12 December 2019: Ralph - Master is 1.9.7 in development. - Fix typo to let serve-expired-ttl work with ub_ctx_set_option(), by Florian Obser 10 December 2019: Wouter - Fix to make auth zone IXFR to fallback to AXFR if a single response RR is received over TCP with the SOA in it. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Feb 9, 2021" "NLnet Labs" "unbound 1.13.1" d66 2 a67 4 There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute is followed by a value, or its containing attributes in which case it is referred to as a clause. Clauses can be repeated throughout the file (or included files) to group attributes under the same clause. a77 6 .P For a more structural include option, the .B include\-toplevel: directive can be used. This closes whatever clause is currently active (if any) and forces the use of clauses in the included files and right after this directive. d117 1 a117 2 given the default is to listen to localhost. If an interface name is used instead of an ip address, the list of ip addresses on that interface are used. d127 3 a129 6 Listen on all addresses on all (current and future) interfaces, detect the source interface on UDP queries and copy them to replies. This is a lot like ip\-transparent, but this option services all interfaces whilst with ip\-transparent you can select which (future) interfaces unbound provides service on. This feature is experimental, and needs support in your OS for particular socket options. Default value is no. d198 6 a203 5 not set higher than that value. Default is 1232 which is the DNS Flag Day 2020 recommendation. Setting to 512 bypasses even the most stringent path MTU problems, but is seen as extreme, since the amount of TCP fallback generated is excessive (probably also for this resolver, consider tuning the outgoing tcp number). a265 4 .B udp\-connect: \fI Perform connect for UDP sockets that mitigates ICMP side channel leakage. Default is yes. .TP a323 6 .B ip-dscp: \fI The value of the Differentiated Services Codepoint (DSCP) in the differentiated services field (DS) of the outgoing IP packet headers. The field replaces the outdated IPv4 Type-Of-Service field and the IPV6 traffic class field. .TP a367 6 .B infra\-keep\-probing: \fI If enabled the server keeps probing hosts that are down, in the one probe at a time regime. Default is no. Hosts that are down, eg. they did not respond during the one probe at a time period, are marked as down and it may take \fBinfra\-host\-ttl\fR time to get probed again. .TP a381 7 .B prefer\-ip4: \fI If enabled, prefer IPv4 transport for sending DNS queries to internet nameservers. Default is no. Useful if the IPv6 netblock the server has, the entire /64 of that is not owned by one operator and the reputation of the netblock /64 is an issue, using IPv4 then uses the IPv4 filters that the upstream servers have. .TP d463 9 a471 10 If enabled, the server provides DNS-over-TLS or DNS-over-HTTPS service on the TCP ports marked implicitly or explicitly for these services with tls\-port or https\-port. The file must contain the private key for the TLS session, the public certificate is in the tls\-service\-pem file and it must also be specified if tls\-service\-key is specified. The default is "", turned off. Enabling or disabling this service requires a restart (a reload is not enough), because the key is read while root permissions are held and before chroot (if any). The ports enabled implicitly or explicitly via \fBtls\-port:\fR and \fBhttps\-port:\fR do not provide normal DNS TCP service. Unbound needs to be compiled with libnghttp2 in order to provide DNS-over-HTTPS. d494 1 a494 2 urls, and also DNS over TLS connections. It is read at start up before permission drop and chroot. a530 57 .B pad\-responses: \fI If enabled, TLS serviced queries that contained an EDNS Padding option will cause responses padded to the closest multiple of the size specified in \fBpad\-responses\-block\-size\fR. Default is yes. .TP .B pad\-responses\-block\-size: \fI The block size with which to pad responses serviced over TLS. Only responses to padded queries will be padded. Default is 468. .TP .B pad\-queries: \fI If enabled, all queries sent over TLS upstreams will be padded to the closest multiple of the size specified in \fBpad\-queries\-block\-size\fR. Default is yes. .TP .B pad\-queries\-block\-size: \fI The block size with which to pad queries sent over TLS upstreams. Default is 128. .B tls\-use\-sni: \fI Enable or disable sending the SNI extension on TLS connections. Default is yes. Changing the value requires a reload. .TP .B https\-port: \fI The port number on which to provide DNS-over-HTTPS service, default 443, only interfaces configured with that port number as @@number get the HTTPS service. .TP .B http\-endpoint: \fI The HTTP endpoint to provide DNS-over-HTTPS service on. Default "/dns-query". .TP .B http\-max\-streams: \fI Number used in the SETTINGS_MAX_CONCURRENT_STREAMS parameter in the HTTP/2 SETTINGS frame for DNS-over-HTTPS connections. Default 100. .TP .B http\-query\-buffer\-size: \fI Maximum number of bytes used for all HTTP/2 query buffers combined. These buffers contain (partial) DNS queries waiting for request stream completion. An RST_STREAM frame will be send to streams exceeding this limit. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B http\-response\-buffer\-size: \fI Maximum number of bytes used for all HTTP/2 response buffers combined. These buffers contain DNS responses waiting to be written back to the clients. An RST_STREAM frame will be send to streams exceeding this limit. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B http\-nodelay: \fI Set TCP_NODELAY socket option on sockets used to provide DNS-over-HTTPS service. Ignored if the option is not available. Default is yes. .TP .B http\-notls\-downstream: \fI Disable use of TLS for the downstream DNS-over-HTTP connections. Useful for local back end servers. Default is no. .TP a747 5 .B nsid:\fR Add the specified nsid to the EDNS section of the answer when queried with an NSID EDNS enabled packet. As a sequence of hex characters or with ascii_ prefix and then an ascii string. .TP d768 3 a770 2 Very small EDNS buffer sizes from queries are ignored. Default is on, as described in the standard. d827 2 a828 2 .B caps\-exempt: \fI Exempt the domain so that it does not receive caps\-for\-id perturbed a832 3 .B caps\-whitelist: \fI Alternate syntax for \fBcaps\-exempt\fR. .TP d844 1 a844 1 This option only has effect when qname-minimisation is enabled. Default is no. d912 1 a912 1 from the query ID, for speed and thread safety). Default is yes. d943 1 a943 3 output of the module it is just before. The dynlib module can be listed pretty much anywhere, it is only a very thin wrapper that allows dynamic libraries to run in its place. d982 15 d1001 1 a1001 1 Can be given multiple times d1073 2 a1074 3 TTL of \fBserve\-expired\-reply\-ttl\fR in the response without waiting for the actual resolution to finish. The actual resolution answer ends up in the cache later on. Default is "no". d1078 2 a1079 3 disables the limit. This option only applies when \fBserve\-expired\fR is enabled. A suggested value per RFC 8767 is between 86400 (1 day) and 259200 (3 days). The default is 0. d1083 2 a1084 2 failed attempt to retrieve the record from upstream. This makes sure that the expired records will be served as long as there are queries for it. Default is a1086 26 .B serve\-expired\-reply\-ttl: \fI TTL value to use when replying with expired data. If \fBserve\-expired\-client\-timeout\fR is also used then it is RECOMMENDED to use 30 as the value (RFC 8767). The default is 30. .TP .B serve\-expired\-client\-timeout: \fI Time in milliseconds before replying to the client with expired data. This essentially enables the serve-stale behavior as specified in RFC 8767 that first tries to resolve before immediately responding with expired data. A recommended value per RFC 8767 is 1800. Setting this to 0 will disable this behavior. Default is 0. .TP .B serve\-original\-ttl: \fI If enabled, unbound will always return the original TTL as received from the upstream name server rather than the decrementing TTL as stored in the cache. This feature may be useful if unbound serves as a front-end to a hidden authoritative name server. Enabling this feature does not impact cache expiry, it only changes the TTL unbound embeds in responses to queries. Note that enabling this feature implicitly disables enforcement of the configured minimum and maximum TTL, as it is assumed users who enable this feature do not want unbound to change the TTL obtained from an upstream server. Thus, the values set using \fBcache\-min\-ttl\fR and \fBcache\-max\-ttl\fR are ignored. Default is "no". .TP d1155 1 a1155 1 inform_redirect, always_transparent, always_refuse, always_nxdomain, always_null, noview, a1228 11 \h'5'\fIalways_nodata\fR Like static, but ignores local data and returns nodata for the query. .TP 10 \h'5'\fIalways_deny\fR Like deny, but ignores local data and drops the query. .TP 10 \h'5'\fIalways_null\fR Always returns 0.0.0.0 or ::0 for every name in the zone. Like redirect with zero data for A and AAAA. Ignores local data in the zone. Used for some block lists. .TP 10 d1299 1 a1299 1 \h'5'\fItest (RFC 6761)\fR d1308 1 a1308 1 \h'5'\fIinvalid (RFC 6761)\fR a1472 10 .TP 5 .B edns\-client\-string: \fI Include an EDNS0 option containing configured ascii string in queries with destination address matching the configured IP netblock. This configuration option can be used multiple times. The most specific match will be used. .TP 5 .B edns\-client\-string\-opcode: \fI EDNS0 option code for the \fIedns\-client\-string\fR option, from 0 to 65535. A value from the `Reserved for Local/Experimental` range (65001-65534) should be used. Default is 65001. a1576 3 If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. d1672 1 a1672 1 any new serial number is accepted from the primary (even if older), and if d1679 1 a1679 1 .B primary: \fI d1681 1 a1681 1 primaries can be specified. They are all tried if one fails. a1682 9 If you point it at another Unbound instance, it would not work because that does not support AXFR/IXFR for the zone, but if you used \fBurl:\fR to download the zonefile as a text file from a webserver that would work. If you specify the hostname, you cannot use the domain from the zonefile, because it may not have that when retrieving that data, instead use a plain IP address to avoid a circular dependency on retrieving that IP address. .TP .B master: \fI Alternate syntax for \fBprimary\fR. d1689 1 a1689 1 primaries are listed, the primaries are first probed with UDP SOA queries to d1691 1 a1691 1 If none of the urls work, the primaries are tried with IXFR and AXFR. a1693 5 If you specify a hostname in the URL, you cannot use the domain from the zonefile, because it may not have that when retrieving that data, instead use a plain IP address to avoid a circular dependency on retrieving that IP address. Avoid dependencies on name lookups by using a notation like "http://192.0.2.1/unbound-primaries/example.com.zone", with an explicit IP address. d1698 3 a1700 3 If the notify is from a primary, it first attempts that primary. Otherwise other primaries are attempted. If there are no primaries, but only urls, the file is downloaded when notified. The primaries from primary: statements are d1728 1 a1728 1 data (eg. from the primary servers). a1784 18 .SS "Dynamic Library Module Options" .LP The .B dynlib: clause gives the settings for the \fIdynlib\fR module. This module is only a very small wrapper that allows dynamic modules to be loaded on runtime instead of being compiled into the application. To enable the dynlib module it has to be compiled into the daemon, and the word "dynlib" has to be put in the \fBmodule\-config:\fR option. Multiple instances of dynamic libraries are supported by adding the word "dynlib" more than once. .LP The \fBdynlib\-file:\fR path should be specified as an absolute path relative to the new path set by \fBchroot:\fR option, or as a relative path to the working directory. .TP .B dynlib\-file: \fI\fR The dynamic library file to load. Repeat this option for every dynlib module instance added to the \fBmodule\-config:\fR option. d1877 4 a1880 4 If the destination address is allowed in the configuration Unbound will add the EDNS0 option to the query containing the relevant part of the client's address. When an answer contains the ECS option the response and the option are placed in a specialized cache. If the authority indicated no support, the response is d1884 1 a1884 3 forward the option when sending the query to addresses that are explicitly allowed in the configuration using \fBsend\-client\-subnet\fR. The option will always be forwarded, regardless the allowed addresses, if d1905 1 a1905 1 Specify whether the ECS address check (configured using d1909 2 a1910 3 the client query). If enabled, the address check is skipped when the client query contains an ECS record. And the lookup in the regular cache is skipped. Default is no. d1999 4 a2002 7 .B ipsecmod\-allow: \fI\fR Allow the ipsecmod functionality for the domain so that the module logic will be executed. Can be given multiple times, for different domains. If the option is not specified, all domains are treated as being allowed (default). .TP .B ipsecmod\-whitelist: \fI Alternate syntax for \fBipsecmod\-allow\fR. a2016 7 This module interacts with the \fBserve\-expired\-*\fR options and will reply with expired data if unbound is configured for that. Currently the use of \fBserve\-expired\-client\-timeout:\fR and \fBserve\-expired\-reply\-ttl:\fR is not consistent for data originating from the external cache as these will result in a reply with 0 TTL without trying to update the data first, ignoring the configured values. .P a2028 5 Additionally, the \fBredis\-expire\-records\fR option can be used in order to set the relative DNS TTL of the message as timeout to the Redis records; keep in mind that some additional memory is used per key and that the expire information is stored as absolute Unix timestamps in Redis (computer time must be stable). a2082 155 .TP .B redis-expire-records: \fI If Redis record expiration is enabled. If yes, unbound sets timeout for Redis records so that Redis can evict keys that have expired automatically. If unbound is configured with \fBserve-expired\fR and \fBserve-expired-ttl\fR is 0, this option is internally reverted to "no". Redis SETEX support is required for this option (Redis >= 2.0.0). This option defaults to no. .SS DNSTAP Logging Options DNSTAP support, when compiled in, is enabled in the \fBdnstap:\fR section. This starts an extra thread (when compiled with threading) that writes the log information to the destination. If unbound is compiled without threading it does not spawn a thread, but connects per-process to the destination. .TP .B dnstap-enable: \fI If dnstap is enabled. Default no. If yes, it connects to the dnstap server and if any of the dnstap-log-..-messages options is enabled it sends logs for those messages to the server. .TP .B dnstap-bidirectional: \fI Use frame streams in bidirectional mode to transfer DNSTAP messages. Default is yes. .TP .B dnstap-socket-path: \fI Sets the unix socket file name for connecting to the server that is listening on that socket. Default is "@@DNSTAP_SOCKET_PATH@@". .TP .B dnstap-ip: \fI If "", the unix socket is used, if set with an IP address (IPv4 or IPv6) that address is used to connect to the server. .TP .B dnstap-tls: \fI Set this to use TLS to connect to the server specified in \fBdnstap-ip\fR. The default is yes. If set to no, TCP is used to connect to the server. .TP .B dnstap-tls-server-name: \fI The TLS server name to authenticate the server with. Used when \fBdnstap-tls\fR is enabled. If "" it is ignored, default "". .TP .B dnstap-tls-cert-bundle: \fI The pem file with certs to verify the TLS server certificate. If "" the server default cert bundle is used, or the windows cert bundle on windows. Default is "". .TP .B dnstap-tls-client-key-file: \fI The client key file for TLS client authentication. If "" client authentication is not used. Default is "". .TP .B dnstap-tls-client-cert-file: \fI The client cert file for TLS client authentication. Default is "". .TP .B dnstap-send-identity: \fI If enabled, the server identity is included in the log messages. Default is no. .TP .B dnstap-send-version: \fI If enabled, the server version if included in the log messages. Default is no. .TP .B dnstap-identity: \fI The identity to send with messages, if "" the hostname is used. Default is "". .TP .B dnstap-version: \fI The version to send with messages, if "" the package version is used. Default is "". .TP .B dnstap-log-resolver-query-messages: \fI Enable to log resolver query messages. Default is no. These are messages from unbound to upstream servers. .TP .B dnstap-log-resolver-response-messages: \fI Enable to log resolver response messages. Default is no. These are replies from upstream servers to unbound. .TP .B dnstap-log-client-query-messages: \fI Enable to log client query messages. Default is no. These are client queries to unbound. .TP .B dnstap-log-client-response-messages: \fI Enable to log client response messages. Default is no. These are responses from unbound to clients. .TP .B dnstap-log-forwarder-query-messages: \fI Enable to log forwarder query messages. Default is no. .TP .B dnstap-log-forwarder-response-messages: \fI Enable to log forwarder response messages. Default is no. .SS Response Policy Zone Options .LP Response Policy Zones are configured with \fBrpz:\fR, and each one must have a \fBname:\fR. There can be multiple ones, by listing multiple rpz clauses, each with a different name. RPZ clauses are applied in order of configuration. The \fBrespip\fR module needs to be added to the \fBmodule-config\fR, e.g.: \fBmodule-config: "respip validator iterator"\fR. .P Only the QNAME and Response IP Address triggers are supported. The supported RPZ actions are: NXDOMAIN, NODATA, PASSTHRU, DROP and Local Data. RPZ QNAME triggers are applied after \fBlocal-zones\fR and before \fBauth-zones\fR. .TP .B name: \fI Name of the authority zone. .TP .B primary: \fI Where to download a copy of the zone from, with AXFR and IXFR. Multiple primaries can be specified. They are all tried if one fails. .TP .B master: \fI Alternate syntax for \fBprimary\fR. .TP .B url: \fI Where to download a zonefile for the zone. With http or https. An example for the url is "http://www.example.com/example.org.zone". Multiple url statements can be given, they are tried in turn. If only urls are given the SOA refresh timer is used to wait for making new downloads. If also primaries are listed, the primaries are first probed with UDP SOA queries to see if the SOA serial number has changed, reducing the number of downloads. If none of the urls work, the primaries are tried with IXFR and AXFR. For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used to authenticate the connection. .TP .B allow\-notify: \fI With allow\-notify you can specify additional sources of notifies. When notified, the server attempts to first probe and then zone transfer. If the notify is from a primary, it first attempts that primary. Otherwise other primaries are attempted. If there are no primaries, but only urls, the file is downloaded when notified. The primaries from primary: statements are allowed notify by default. .TP .B zonefile: \fI The filename where the zone is stored. If not given then no zonefile is used. If the file does not exist or is empty, unbound will attempt to fetch zone data (eg. from the primary servers). .TP .B rpz\-action\-override: \fI Always use this RPZ action for matching triggers from this zone. Possible action are: nxdomain, nodata, passthru, drop, disabled and cname. .TP .B rpz\-cname\-override: \fI The CNAME target domain to use if the cname action is configured for \fBrpz\-action\-override\fR. .TP .B rpz\-log: \fI Log all applied RPZ actions for this RPZ zone. Default is no. .TP .B rpz\-log\-name: \fI Specify a string to be part of the log line, for easy referencing. .TP .B tags: \fI Limit the policies from this RPZ clause to clients with a matching tag. Tags need to be defined in \fBdefine\-tag\fR and can be assigned to client addresses using \fBaccess\-control\-tag\fR. Enclose list of tags in quotes ("") and put spaces between tags. If no tags are specified the policies from this clause will be applied for all clients. @ 1.1.1.7 log @Import unbound-1.16.3; last import was 1.13.1 21 September 2022: Wouter - Patch for CVE-2022-3204 Non-Responsive Delegation Attack. - This patch was released in 1.16.3, the code repository continues with the previous features and fixes for 1.17.0. - Fix doxygen warning in respip.h. 20 September 2022: George - Convert tdir tests to use the new skip_test functionality. - Remove unused testcode/mini_tpkg.sh file. 16 September 2022: George - Merge #753: ACL per interface. (New interface-* configuration options). 2 September 2022: Wouter - Remove include that was there for debug purposes. - Fix to check pthread_t size after pthread has been detected. 1 September 2022: Wouter - Fix to update config tests to fix checking if nonblocking sockets work on OpenBSD. - Slow down log frequency of write wait failures. - Fix to set out of file descriptor warning to operational verbosity. - Fix to log a verbose message at operational notice level if a thread is not responding, to stats requests. It is logged with thread identifiers. 31 August 2022: Wouter - Fix to avoid process wide fcntl calls mixed with nonblocking operations after a blocked write. - Patch from Vadim Fedorenko that adds MSG_DONTWAIT to receive operations, so that instruction reordering does not cause mistakenly blocking socket operations. - Fix to wait for blocked write on UDP sockets, with a timeout if it takes too long the packet is dropped. - Fix for wait for udp send to stop when packet is successfully sent. 22 August 2022: Wouter - Fix #741: systemd socket activation fails on IPv6. 12 August 2022: Wouter - Fix to log accept error ENFILE and EMFILE errno, but slowly, once per 10 seconds. Also log accept failures when no slow down is used. 5 August 2022: Wouter - Fix #734 [FR] enable unbound-checkconf to detect more (basic) errors. 4 August 2022: Wouter - Fix ratelimit inconsistency, for ip-ratelimits the value is the amount allowed, like for ratelimits. 2 August 2022: Wouter - Fix edns subnet so that scope 0 answers only match sourcemask 0 queries for answers from cache if from a query with sourcemask 0. - Fix unittest for edns subnet change. - Merge #730 from luisdallos: Fix startup failure on Windows 8.1 due to unsupported IPV6_USER_MTU socket option being set. 1 August 2022: Wouter - Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699. - Tests for ghost domain fixes. - Tag for 1.16.2 release. The code repo continues with 1.16.3. - Fix #728: alloc_reg_obtain() core dump. Stop double alloc_reg_release when serviced_create fails. 19 July 2022: George - Update documentation for 'outbound-msg-retry:'. 19 July 2022: Wouter - Merge #718: Introduce infra-cache-max-rtt option to config max retransmit timeout. 15 July 2022: Wouter - Merge PR 714: Avoid treat normal hosts as unresponsive servers. And fixup the lock code. - iana portlist update. 12 July 2022: George - For windows crosscompile, fix setting the IPV6_MTU socket option equivalent (IPV6_USER_MTU); allows cross compiling with latest cross-compiler versions. 12 July 2022: Wouter - Fix dname count in sldns parse type descriptor for SVCB and HTTPS. 11 July 2022: Wouter - Fix verbose EDE error printout. 4 July 2022: George - Fix bug introduced in 'improve val_sigcrypt.c::algo_needs_missing for one loop pass'. - Merge PR #668 from Cristian Rodríguez: Set IP_BIND_ADDRESS_NO_PORT on outbound tcp sockets. 4 July 2022: Wouter - Tag for 1.16.1rc1 release. This became 1.16.1 on 11 July 2022. The code repo continues with version 1.16.2 under development. 3 July 2022: George - Merge PR #671 from Petr Men#ík: Disable ED25519 and ED448 in FIPS mode on openssl3. - Merge PR #660 from Petr Men#ík: Sha1 runtime insecure. - For #660: formatting, less verbose logging, add EDE information. - Fix for correct openssl error when adding windows CA certificates to the openssl trust store. - Improve val_sigcrypt.c::algo_needs_missing for one loop pass. - Reintroduce documentation and more EDE support for val_sigcrypt.c::dnskeyset_verify_rrset_sig. 1 July 2022: George - Merge PR #706: NXNS fallback. - From #706: Cached NXDOMAIN does not increase the target nx responses. - From #706: Don't generate parent side queries if we already have the lame records in cache. - From #706: When a lame address is the best choice, don't try to generate target queries when the missing targets are all lame. 29 June 2022: Wouter - iana portlist update. - Fix detection of libz on windows compile with static option. - Fix compile warning for windows compile. 29 June 2022: George - Add debug option to the mini_tdir.sh test code. - Fix #704: [FR] Statistics counter for number of outgoing UDP queries sent; introduces 'num.query.udpout' to the 'unbound-control stats' command. - Fix to not count cached NXDOMAIN for MAX_TARGET_NX. - Allow fallback to the parent side when MAX_TARGET_NX is reached. This will also allow MAX_TARGET_NX more NXDOMAINs. 28 June 2022: George - Show the output of the exact .rpl run that failed with 'make test'. - Fix for cached 0 TTL records to not trigger prefetching when serve-expired-client-timeout is set. 28 June 2022: Wouter - Fix test program dohclient close to use portability routine. 23 June 2022: Tom - Clarify -v flag manpage entry (#705) 22 June 2022: Philip - Fix #663: use after free issue with edns options. 21 June 2022: Philip - Fix for loading locally stored zones that have lines with blanks or blanks and comments. 20 June 2022: George - Remove unused LDNS function check for GOST Engine unloading. 14 June 2022: George - Merge PR #688: Rpz url notify issue. - Note in the unbound.conf text that NOTIFY is allowed from the url: addresses for auth and rpz zones. 3 June 2022: George - Fix for edns client subnet to respect not looking in its cache when instructed to do so (e.g., prefetch). 3 June 2022: Wouter - makedist.sh picks up 32bit libssp-0.dll when 32bit compile. 27 May 2022: Wouter - Fix #684: [FTBS] configure script error with libmnl on openSUSE 15.3 (and possibly other distributions) - Version is set to 1.16.0 for release. Release tag 1.16.0rc1. This became release 1.16.0 on 2 June 2022. The source code branch continues with version 1.16.1 under development. 20 May 2022: Wouter - Fix to silence test for ede error output to the console from the test setup script. - Fix ede test to not use default pidfile, and use local interface. - Fix some lint type warnings. 18 May 2022: George - Fix typos in config_set_option for the 'num-threads' and 'ede-serve-expired' options. 15 May 2022: George - Fix #678: [FR] modify behaviour of unbound-control rpz_enable zone, by updating unbound-control's documentation. 12 May 2022: George - Fix #417: prefetch and ECS causing cache corruption when used together. 12 May 2022: Wouter - Merge #677: Allow using system certificates not only on Windows, from pemensik. - For #677: Added tls-system-cert to config parser and documentation. 11 May 2022: Wouter - Fix #673: DNS over TLS: error: SSL_handshake syscall: No route to host. 10 May 2022: George - Fix Python build in non-source directory; based on patch by Michael Tokarev. 6 May 2022: Tom - Merge PR #604: Add basic support for EDE (RFC8914). 28 April 2022: Wouter - Fix #670: SERVFAIL problems with unbound 1.15.0 running on OpenBSD 7.1. 8 April 2022: Wouter - Fix zonemd check to allow unsupported algorithms to load. If there are only unsupported algorithms, or unsupported schemes, and no failed or successful other ZONEMD records, or malformed or bad ZONEMD records, the unsupported records allow the zone load. - Fix zonemd unsupported algo check. - Fix zonemd unsupported algo check reason to not copy to next record, and check for success for debug printout. - Fix zonemd unsupported algo check to print unsupported reason before zeroing it. - Fix zonemd unsupported algo check to set reason to NULL before the check routine, but after malformed checks, to get the correct NULL output when the digest matches. 25 March 2022: Wouter - Fix spelling error in comment in sldns_str2wire_svcparam_key_lookup. 23 March 2022: Wouter - Fix #651: [FR] Better logging for refused queries. 18 March 2022: George - Merge PR #648 from eaglegai: fix -q doesn't work when use with 'unbound-control stats_shm'. 17 March 2022: Wouter - Fix to describe auth-zone and other configuration at the local-zone configuration option, to allow for more broadly view of the options. 16 March 2022: Wouter - Fix to ensure uniform handling of spaces and tabs when parsing RRs. 9 March 2022: Wouter - Merge #644: Make `install-lib` make target install the pkg-config file. 7 March 2022: Wouter - Fix configure for python to use sysutils, because distutils is deprecated. It uses sysutils when available, distutils otherwise. 3 March 2022: Wouter - Fix #637: Integer Overflow in sldns_str2period function. - Fix for #637: fix integer overflow checks in sldns_str2period. 2 March 2022: George - Merge PR #632 from scottrw93: Match cnames in ipset. - Various fixes for #632: variable initialisation, convert the qinfo to str once, accept trailing dot in the local-zone ipset option. 2 March 2022: Wouter - Fix compile warnings for printf ll format on mingw compile. 1 March 2022: Wouter - Fix pythonmod for change in iter_dp_is_useless function prototype. 28 February 2022: George - Fix #630: Unify the RPZ log messages. - Merge #623 from rex4539: Fix typos. 28 February 2022: Wouter - Fix #633: Document unix domain socket support for unbound-control. - Fix for #633: updated fix with new text. - Fix edns client subnet to add the option based on the option list, so that it is not state dependent, after the state fix of #605 for double EDNS options. - Fix for edns client subnet option add fix in removal code, from review. 25 February 2022: Wouter - Fix to detect that no IPv6 support means that IPv6 addresses are useless for delegation point lookups. - update Makefile dependencies. - Fix check interface existence for support detection in remote lookup. 18 February 2022: Wouter - Fix that address not available is squelched from the logs for udp connect failures. It is visible on verbosity 4 and more. - Merge #631 from mollyim: Replace OpenSSL's ERR_PACK with ERR_GET_REASON. 16 February 2022: Wouter - Fix for #628: fix rpz-passthru for qname trigger by localzone type. 15 February 2022: Wouter - Fix #628: A rpz-passthru action is not ending RPZ zone processing. 11 February 2022: Wouter - Fix #624: Unable to stop Unbound in Windows console (does not respond to CTRL+C command). - Fix #618: enabling interface-automatic disables DNS-over-TLS. Adds the option to list interface-automatic-ports. - Remove debug info from #618 fix. 7 February 2022: Wouter - Fix that TCP interface does not use TLS when TLS is also configured. 4 February 2022: Wouter - Fix #412: cache invalidation issue with CNAME+A. 3 February 2022: Wouter - Fix for #611: Integer overflow in sldns_wire2str_pkt_scan. - Tag for 1.15.0rc1 created. That became 1.15.0 on 10 feb 2022. The repository continues with version 1.15.1. 2 February 2022: George - Merge PR #532 from Shchelk: Fix: buffer overflow bug. - Merge PR #616: Update ratelimit logic. It also introduces ratelimit-backoff and ip-ratelimit-backoff configuration options. - Change aggressive-nsec default to yes. - Merge PR #617: Update stub/forward-host notation to accept port and tls-auth-name. - Update stream_ssl.tdir test to also use the new forward-host notation. 2 February 2022: Wouter - Update version number in repo to 1.15.0 for upcoming release, since it changes the aggressive-nsec default and the ratelimit change. - Fix header comment for doxygen for authextstrtoaddr. - please clang analyzer for loop in test code. - Fix docker splint test to use more portable uname. - Update contrib/aaaa-filter-iterator.patch with diff for current software version. 1 February 2022: George - Merge PR #603 from fobser: Use OpenSSL 1.1 API to access DSA and RSA internals. 31 January 2022: George - Fix review comment for use-after-free when failing to send UDP out. 31 January 2022: Wouter - iana portlist update. 29 January 2022: George - Fix tls-* and ssl-* documented alternate syntax to also be available through remote-control and unbound-checkconf. - Better cleanup on failed DoT/DoH listening socket creation. 26 January 2022: George - Fix #599: [FR] RFC 9156 (obsoletes RFC 7816), by noting the new RFC document. 26 January 2022: Wouter - Test for NSID in SERVFAIL response due to DNSSEC bogus. 25 January 2022: George - Fix #588: Unbound 1.13.2 crashes due to p->pc is NULL in serviced_udp_callback. - Merge PR #612: TCP race condition. 25 January 2022: Wouter - Fix #610: Undefine-shift in sldns_str2wire_hip_buf. 19 January 2022: George - For dnstap, do not wakeupnow right there. Instead zero the timer to force the wakeup callback asap. 14 January 2022: George - Merge PR #605: - Fix EDNS to upstream where the same option could be attached more than once. - Add a region to serviced_query for allocations. 14 January 2022: Wouter - Add rpz: for-downstream: yesno option, where the RPZ zone is authoritatively answered for, so the RPZ zone contents can be checked with DNS queries directed at the RPZ zone. - For #602: Allow the module-config "subnetcache validator cachedb iterator". 11 January 2022: George - Fix prematurely terminated TCP queries when a reply has the same ID. 7 January 2022: Wouter - Merge #600 from pemensik: Change file mode before changing file owner. 5 January 2022: Wouter - Fix for #596: fix that rpz return message is returned and not just the rcode from the iterator return path. This fixes signal unset RA after a CNAME. - Fix unit tests for rpz now that the AA flag returns successfully from the iterator loop. - Fix for #596: add unit test for nsdname trigger and signal unset RA. - Fix for #596: add unit test for nsip trigger and signal unset RA. - Fix #598: Fix unbound-checkconf fatal error: module conf 'respip dns64 validator iterator' is not known to work. - Fix for #596: Fix rpz-signal-nxdomain-ra to work for clientip triggered operation. 4 January 2022: Wouter - Fix #596: unset the RA bit when a query is blocked by an unbound RPZ nxdomain reply. The option rpz-signal-nxdomain-ra allows to signal that a domain is externally blocked to clients when it is blocked with NXDOMAIN by unsetting RA. - Fix to add test for rpz-signal-nxdomain-ra. - Fix #596: only unset RA when NXDOMAIN is signalled. - Fix that RPZ does not set RD flag on replies, it should be copied from the query. 22 December 2021: George - contrib/aaaa-filter-iterator.patch file renewed diff content to apply cleanly to the current coderepo for the current code version. 20 December 2021: George - Fix #591: Unbound-anchor manpage links to non-existent license file. 13 December 2021: George - Add missing configure flags for optional features in the documentation. - Fix Unbound capitalization in the documentation. 13 December 2021: Wouter - Fix to pick up other class local zone information before unlock. 10 December 2021: George - Allow local-data for classes other than IN to inherit a configured local-zone's type if possible, instead of defaulting to type transparent as per the implicit rule. 10 December 2021: Wouter - Add code similar to fix for ldns for tab between strings, for consistency, the test case was not broken. 6 December 2021: Wouter - Merge PR #581 from fobser: Fix -Wmissing-prototypes and -Wshadow warnings in rpz. - Fix validator debug output about DS support, print correct algorithm. 3 December 2021: Wouter - Fix compile warning for if_nametoindex on windows 64bit. 1 December 2021: Wouter - configure is set to 1.14.0, and release branch. This was released as version 1.14.0 on 9 Dec 2021, with the doxygen fix below included. The main branch continues as 1.14.1. - Fix doc/unbound.doxygen to remove obsolete tag warning. 1 December 2021: George - Merge PR #511 from yan12125: Reduce unnecessary linking. - Merge PR #493 from Jaap: Fix generation of libunbound.pc. - Merge PR #555 from fobser: Allow interface names as scope-id in IPv6 link-local addresses. - Merge PR #562 from Willem: Reset keepalive per new tcp session. - Merge PR #522 from sibeream: memory management violations fixed. - Merge PR #530 from Shchelk: Fix: dereferencing a null pointer. - Fix #454: listen_dnsport.c:825: error: `IPV6_TCLASS' undeclared. - Fix #574: Review fixes for size allocation. 30 November 2021: Wouter - Fix to remove git tracking and ci information from release tarballs. - iana portlist update. 29 November 2021: Wouter - Merge PR #570 from rex4539: Fix typos. - Fix for #570: regen aclocal.m4, fix configure.ac for spelling. - Fix to make python module opt_list use opt_list_in. - Fix #574: unbound-checkconf reports fatal error if interface names are used as value for interfaces: - Fix #574: Review fixes for it. - Fix #576: [FR] UB_* error codes in unbound.h - Fix #574: Review fix for spelling. 15 November 2021: Tom - Improve EDNS option handling, now also works for synthesised responses such as local-data and server.id CH TXT responses. 5 November 2021: George - Fix for #558: fix loop in comm_point->tcp_free when a comm_point is reclaimed more than once during callbacks. - Fix for #558: clear the UB_EV_TIMEOUT bit before adding an event. 5 November 2021: Wouter - Fix that forward-zone name is documented as the full name of the zone. It is not relative but a fully qualified domain name. - Fix analyzer review failure in rpz action override code to not crash on unlocking the local zone lock. - Fix to remove unused code from rpz resolve client and action function. - Merge #565: unbound.service.in: Disable ProtectKernelTunables again. 2 November 2021: Wouter - Fix #552: Unbound assumes index.html exists on RPZ host. 11 October 2021: Wouter - Fix chaos replies to have truncation for short message lengths, or long reply strings. - Fix to protect custom regional create against small values. 4 October 2021: Wouter - Fix to add example.conf note for outbound-msg-retry. 27 September 2021: Wouter - Implement RFC8375: Special-Use Domain 'home.arpa.'. 21 September 2021: Wouter - For crosscompile on windows, detect 64bit stackprotector library. - Fix crosscompile shell syntax. - Fix crosscompile windows to use libssp when it exists. - For the windows compile script disable gost. - Fix that on windows, use BIO_set_callback_ex instead of deprecated BIO_set_callback. - Fix crosscompile script for the shared build flags. 20 September 2021: Wouter - Fix crosscompile on windows to work with openssl 3.0.0 the link with ws2_32 needs -l:libssp.a for __strcpy_chk. Also copy results from lib64 directory if needed. 10 September 2021: Wouter - Fix initialisation errors reported by gcc sanitizer. - Fix lock debug code for gcc sanitizer reports. - Fix more initialisation errors reported by gcc sanitizer. 8 September 2021: Wouter - Merged #41 from Moritz Schneider: made outbound-msg-retry configurable. - Small fixes for #41: changelog, conflicts resolved, processQueryResponse takes an iterator env argument like other functions in the iterator, no colon in string for set_option, and some whitespace style, to make it similar to the rest. - Fix for #41: change outbound retry to int to fix signed comparison warnings. - Fix root_anchor test to check with new icannbundle date. 3 September 2021: Wouter - Fix #538: Fix subnetcache statistics. 1 September 2021: Wouter - Fix tcp fastopen failure when disabled, try normal connect instead. 27 August 2021: Wouter - Fix #533: Negative responses get cached even when setting cache-max-negative-ttl: 1 25 August 2021: Wouter - Merge #401: RPZ triggers. This add additional RPZ triggers, unbound supports a full set of rpz triggers, and this now includes nsdname, nsip and clientip triggers. Also actions are fully supported, and this now includes the tcp-only action. - Fix #536: error: RPZ: name of record (drop.spamhaus.org.rpz.local.) to insert into RPZ. - Fix the stream wait stream_wait_count_lock and http2 buffer locks setup and desetup from race condition. - Fix RPZ locks. Do not unlock zones lock if requested and rpz find zone does not find the zone. Readlock the clientip that is found for ipbased triggers. Unlock the nsdname zone lock when done. Unlock zone and ip in rpz nsip and nsdname callback. Unlock authzone and localzone if clientip found in rpz worker call. - Fix compile warning in libunbound for listen desetup routine. - Fix asynclook unit test for setup of lockchecks before log. 20 August 2021: Wouter - Fix #529: Fix: log_assert does nothing if UNBOUND_DEBUG is undefined. - Fix #531: Fix: passed to proc after free. 17 August 2021: Wouter - Fix that --with-ssl can use "/usr/include/openssl11" to pass the location of a different openssl version. - Fix #527: not sending quad9 cert to syslog (and may be more). - Fix sed script in ssldir split handling. 16 August 2021: George - Merge PR #528 from fobser: Make sldns_str2wire_svcparam_buf() static. 16 August 2021: Wouter - Fix to support harden-algo-downgrade for ZONEMD dnssec checks. 13 August 2021: Wouter - Support using system-wide crypto policies. - Fix for #431: Squelch permission denied errors for udp connect, and udp send, they are visible at higher verbosity settings. - Fix zonemd verification of key that is not in DNS but in the zone and needs a chain of trust. - zonemd, fix order of bogus printout string manipulation. 12 August 2021: George - Merge PR #514, from ziollek: Docker environment for run tests. - For #514: generate configure. 12 August 2021: Wouter - And 1.13.2rc1 became the 1.13.2 with the fix for the python module build. The current code repository continues with version 1.13.3. - Add test tool readzone to .gitignore. - Merge #521: Update mini_event.c. - Merge #523: fix: free() call more than once with the same pointer. - Merge #519: Support for selective enabling tcp-upstream for stub/forward zones. - For #519: note stub-tcp-upstream and forward-tcp-upstream in the example configuration file. - For #519: yacc and lex. And fix python bindings, and test program unbound-dnstap-socket. - For #519: fix comments for doxygen. - Fix to print error from unbound-anchor for writing to the key file, also when not verbose. 5 August 2021: Wouter - Tag for 1.13.2rc1 release. - Fix #520: Unbound 1.13.2rc1 fails to build python module. 4 August 2021: George - Merge PR #415 from sibeream: Use /proc/sys/net/ipv4/ip_local_port_range to determine available outgoing ports. (New --enable-linux-ip-local-port-range configuration option) - Bump MAX_RESTART_COUNT to 11 from 8; in relation to #438. This allows longer CNAME chains in Unbound. 4 August 2021: Wouter - In unit test use openssl set security level to allow keys in test. - Fix static analysis warnings about localzone locks that are unused. - Fix missing locks in zonemd unit test. - Fix readzone compile under debug config. - Fix out of sourcedir run of zonemd unit tests. - Fix libnettle zonemd unit test. - Fix unit test zonemd_reload for use in run_vm. 3 August 2021: George - Listen to read or write events after the SSL handshake. Sticky events on windows would stick on read when write was needed. 3 August 2021: Wouter - Merge PR #517 from dyunwei: #420 breaks the mesh reply list function that need to reuse the dns answer. - Annotate assertion into error printout; we think it may be an error, but the situation looks harmless. - Fix sign comparison warning on FreeBSD. 2 August 2021: Wouter - Prepare for OpenSSL 3.0.0 provider API usage, move the sldns keyraw functions to produce EVP_PKEY results. - Move RSA and DSA to use OpenSSL 3.0.0 API. - Move ECDSA functions to use OpenSSL 3.0.0 API. - iana portlist update. - Fix verbose printout failure in tcp reuse unit test. 30 July 2021: Wouter - Fix #515: Compilation against openssl 3.0.0 beta2 is failing to build unbound. - For #515: Fix compilation with openssl 3.0.0 beta2, lib64 dir and SSL_get_peer_certificate. - Move acx_nlnetlabs.m4 to version 41, with lib64 openssl dir check. 26 July 2021: George - Merge #513: Stream reuse, attempt to fix #411, #439, #469. This introduces a couple of fixes for the stream reuse functionality that could result in broken internal structures. 26 July 2021: Wouter - Merge #512: unbound.service.in: upgrade hardening to latest standards. - Fix readzone unknown type print for memory resize. 21 July 2021: Wouter - Fix that ldns_zone_new_frm_fp_l counts the line number for an empty line after a comment. 16 July 2021: George - Introduce 'http-user-agent:' and 'hide-http-user-agent:' options. 16 July 2021: Wouter - Merge #510 from ndptech: Don't call a function which hasn't been defined. - Fix for #510: in depth, use ifdefs for windows api event calls. - Fix spelling in doc/unbound.doxygen comment. - Fix spelling in localzone.h comment. - Fix unbound-control local_data and local_datas to print detailed syntax errors. - review fix to remove duplicate error printout. - Insert header into testcode/readzone.c, it was missing. - Fix from lint for ignored return value. - Fix for older parsers for function call in serve expired get cached. 6 July 2021: Wouter - iana portlist update. 5 July 2021: George - Fix compiler warnings for #491. - Fix clang-analysis warnings for testcode/readzone.c. 4 July 2021: George - Fix Wunused-result compile warnings. 2 July 2021: Tom - Merge PR #491: Add SVCB and HTTPS types and handling according to draft-ietf-dnsop-svcb-https. 2 July 2021: Wouter - Fix #506: Python Module Seems to Leak Memory if it Experiences an Unhandled Exception. 25 June 2021: Wouter - Fix up permissions on rpl data file in tests. - Fix testbound newline treatment in moment_read and tempfile write. - Fix configure grep for reuseport default for failure. - Fix compat ctime_r return value - Fix configure does not require pkg-config if not needed. - Fix unit test in the ctime_r calls for autotrust and in testbound. - Fix auth zone download on windows to unlink before rename. 24 June 2021: Wouter - Add analyzer and port compile github workflow. 23 June 2021: Wouter - Fix #503: DNS over HTTPS response truncated. - Fix warnings reported by the gcc analyzer. 21 June 2021: George - Fix #495: Documentation or implementation of "verbosity" option. 18 June 2021: Wouter - Fix a number of warnings reported by the gcc analyzer. 15 June 2021: George - Merge #440 by kimheino: Various fixes to contrib/unbound_munin_ file. 14 June 2021: Wouter - Fix configure nonblocking test and onmingw test to use host. 10 June 2021: Wouter - Fix #500: SPEC file in version 1.13.1 references version 1.4; unable to build RPM from source. - Fix contrib/unbound.spec, fixed url and comment. 9 June 2021: George - Merge #486 by fobster: Make VAL_MAX_RESTART_COUNT configurable. - Generated lexer and parser for #486; updated example.conf. - Fix #413 (based on patch by k-ronny): unbound: does not compile on macOS 11.1-x86_64 host. - Use host_os instead of target_os in configure for Darwin8 build. 8 June 2021: George - Fix unused variable warning when compiling with --enable-dnstap. 7 June 2021: George - Merge #448 from shoeper: Update unbound-control.8.in, fix rpz_disable typo. - Fix #425: Document auth-zone supports communication with DNS primary on nondefault port. 1 June 2021: George - Fix test for zonemd-check option. 27 May 2021: Wouter - Merge #496 from banburybill: Use build system endianness if available, otherwise try to work it out. - zonemd-check: yesno option, default no, enables the processing of ZONEMD records for that zone. 25 May 2021: Wouter - Move the NSEC3 max iterations count in line with the 150 value used by BIND, Knot and PowerDNS. This sets the default value for it in the configuration to 150 for all key sizes. - Fix #492: module-config respip missing in unbound.conf.5.in man page. Merges #494 from he32. - For #492: Fix font highlighting for the man page on emacs. 21 May 2021: Wouter - Test code has -q option for quiet output. 19 May 2021: George - Fix for #411, #439, #469: Reset the DNS message ID when moving queries between TCP streams. - Refactor for uniform way to produce random DNS message IDs. 17 May 2021: Wouter - Fix #489: Compile using MSYS2 MinGW 64-bit. 12 May 2021: Wouter - Fix that auth-zone zonefiles use last TTL if no TTL is specified. 10 May 2021: Wouter - Merge PR #487: ifdef RLIMIT_AS in recently added check. 7 May 2021: Wouter - Fix #485: Unbound occasionally reports broken stats. - Add ./configure --with-deprecate-rsa-1024 that turns off RSA 1024. - Remove case fallthrough from deprecate-rsa-1024 code. 4 May 2021: George - Fix for #367: only attempt to get the interface for queries that are no longer on the tcp_waiting_list. - Add more logging for out-of-memory cases. 4 May 2021: Wouter - Merge #478: Allow configuration of TCP timeout while waiting for response. - Fix to squelch tcp socket bind failures when the interface is gone. - Rerun flex and bison. 3 May 2021: Wouter - Fix #481: Fix comment in configuration file. 29 April 2021: Wouter - Add that log-servfail prints an IP address and more information about one of the last failures for that query. 28 April 2021: George - Fix compiler warning for signed/unsigned comparison for max_reuse_tcp_queries. 28 April 2021: Wouter - Fix #474: always_null and others inside view. 26 April 2021: Wouter - Merge #470 from edevil: Allow configuration of persistent TCP connections. 22 April 2021: Wouter - Merge #466 from FGasper: Support OpenSSLs that lack SSL_get0_alpn_selected. - Fix #468: OpenSSL 1.0.1 can no longer build Unbound. - Further fix for #468: detect SSL_CTX_set_alpn_protos for build with OpenSSL 1.0.1. - Fix that testcode dohclient has OpenSSL initialisation calls. 13 April 2021: George - Fix documentation comment for files previously residing in checkconf/. - Remove unused functions worker_handle_reply and libworker_handle_reply. 13 April 2021: Wouter - Fix that nxdomain synthesis does not happen above the stub or forward definition. 12 April 2021: George - Fix (increase) verbosity level for iterator error log in processQueryTargets(). 12 April 2021: Wouter - Fix permission denied sendto log, squelch the log messages unless high verbosity is set. 9 April 2021: Wouter - rebuild configure to set EXTRALINK to libunbound.la for #460. 7 April 2021: Wouter - Fix for #411: Depth protect for crash on deleted element timeout. 1 April 2021: Wouter - Merge #460 from orbea: build: Link with the libtool archive. - Fix to stop IPv6 PMTU discovery. 31 March 2021: George - Clean makedist.sh. 31 March 2021: Wouter - Fix stack-protector change to not override other CFLAGS options. 30 March 2021: George - Disable the use of stack-protector for cross compiled 32-bit windows builds; relates to #444. 25 March 2021: Wouter - Fix #429: Also fix end of transfer for http download of auth zones. 24 March 2021: Wouter - Fix deprecation test to work for iOS TVOS and WatchOS, it uses CFLAGS and CPPFLAGS and also checks if the item is unavailable. - Travis, fix script to fail when tasks fail. - Travis, fix warning in ubsan compile. - Fix configure Targetconfiditionals.h header check, to use compile. - Fix that cachedb does not produce empty object files when disabled. 23 March 2021: Wouter - Travis enable all tests again. Clang analyzer only a couple times, when there is a difference. homebrew updates disabled, so it does not hang. removed trailing slashes from configure paths. Moved iOS tests to allow-failure. - travis, analyzer disabled on test without debug, that does not run anway. Turn off failing tests except one. Update iOS test to xcode image 12.2. 22 March 2021: George - Fix unused-function warning when compiling with --enable-dnscrypt. - Fix for #367: fix memory leak when cannot bind to listening port. - Reformat pythonmod/pythonmod_utils.{c,h}. 22 March 2021: Wouter - Merge #449 from orbea: build: Add missing linker flags. - iana portlist update. - Comment out nonworking OSX and IOS travis tests, vm fails to start. - Fix compile error in listen_dnsport on Android. - Fix memory leak reported by asan in rpz SOA record query name. 19 March 2021: Wouter - Fix for #447: squelch connection refused tcp connection failures from the log, unless verbosity is high. 17 March 2021: Wouter - Fix #441: Minimal NSEC range not accepted for top level domains. 11 March 2021: Wouter - Fix parse of LOC RR type for decimetres. 5 March 2021: Wouter - Workaround for #439: prevent loops in the reuse rbtree. - Debug output for #411 and #439: printout internal error and details. 4 March 2021: Wouter - iana portlist update. - Fix spurious errors about "Could not generate request: out of memory". The mesh detect cycle routine no longer wrongly stops the check when the calling mesh state is unique. 26 February 2021: George - Fix for #367: rc_ports don't have ub_sock; skip cleaning up. 26 February 2021: Wouter - Fix: Resolve interface names on control-interface too. 25 February 2021: Wouter - Merge PR #367 : DNSTAP log local address. With code from PR #365 and fixes #368 : dnstap does not log the DNS message ID for FORWARDER_QUERY. - Fix to allow rpz with wildcard that applies to all TLDs at once. 24 February 2021: George - Fix #384: (1) A minor request to improve the log (2) A minor bug in one log message. - ipsecmod: Better logging for detecting a cycle when attaching the A/AAAA subquery. 24 February 2021: Wouter - On startup of unbound it checks if rlimits on memory size look sufficient for the configured cache size, and logs warning if not. - Fix function documentation. - Fix unit test for added ulimit checks. - spelling fix in header. 23 February 2021: Wouter - Fix for zonemd, that domain-insecure zones work without dnssec. - Fix for zonemd, do not reject insecure result from trust anchor validation step in dnssec chain of trust. 22 February 2021: Wouter - Fix #431: Squelch permission denied errors for tcp connect and udp connect from the logs, unless at high verbosity. - Fix for zonemd, that nxdomain for the chain of trust is allowed for island zones, it is treated as an insecure zone for verification. 18 February 2021: Wouter - Merge PR #317: ZONEMD Zone Verification, with RFC 8976 support. ZONEMD records are checked for zones loaded as auth-zone, with DNSSEC if available. There is an added option zonemd-permissive-mode that makes it log but not fail wrong zones. With zonemd-reject-absence for an auth-zone the presence of a zonemd can be mandated for specific zones. - Fix doxygen and pydoc warnings. - Fix #429: rpz: url: with https: broken (regression in 1.13.1). - rpz skip nsec3param records, and nicer log for unsupported actions. 15 February 2021: Wouter - Fix #422: IPv6 fallback issues when IPv6 is not properly enabled/configured. - Fix to make tests work with support indicators set for iterator. - Fix build on Python 3.10. 10 February 2021: Wouter - Merge PR #420 from dyunwei: DOH not responsing with "http2_query_read_done failure" logged. 9 February 2021: Wouter - Fix for Python 3.9, no longer use deprecated functions of PyEval_CallObject (now PyObject_Call), PyEval_InitThreads (now none), PyParser_SimpleParseFile (now Py_CompileString). @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Sep 21, 2022" "NLnet Labs" "unbound 1.16.3" d92 5 a96 5 The verbosity number, level 0 means no verbosity, only errors. Level 1 gives operational information. Level 2 gives detailed operational information including short information per query. Level 3 gives query level information, output per query. Level 4 gives algorithm level information. Level 5 logs client identification for cache misses. Default is level 1. d107 1 a107 1 If enabled, statistics are cumulative since starting Unbound, without clearing d139 1 a139 1 ip\-transparent you can select which (future) interfaces Unbound provides a142 9 .B interface\-automatic\-ports: \fI List the port numbers that interface-automatic listens on. If empty, the default port is listened on. The port numbers are separated by spaces in the string. Default is "". .IP This can be used to have interface automatic to deal with the interface, and listen on the normal port number, by including it in the list, and also https or dns over tls port numbers by putting them in the list as well. .TP d157 1 a157 1 host running Unbound, and requires OS support for unprivileged non-local binds d177 1 a177 1 Permit Unbound to open this port or range of ports for use to send queries. d190 2 a191 2 Do not permit Unbound to open this port or range of ports for use to send queries. Use this to make sure Unbound does not grab a port that another d292 1 a292 1 "4m" on a busy server. The OS caps it at a maximum, on linux Unbound d305 1 a305 1 linux Unbound needs root permission to bypass the limit, or the admin d322 1 a322 1 If yes, then use IP_TRANSPARENT socket option on sockets where Unbound d327 2 a328 2 and with this option you can select which (future) interfaces Unbound provides service on. This option needs Unbound to be started with root d333 1 a333 1 If yes, then use IP_FREEBIND socket option on sockets where Unbound a388 4 .B infra\-cache\-max\-rtt: \fI Upper limit for dynamic retransmit timeout calculation in infrastructure cache. Default is 2 minutes. .TP a453 13 .B tcp-reuse-timeout: \fI\fR The period Unbound will keep TCP persistent connections open to authority servers. This option defaults to 60000 milliseconds. .TP .B max-reuse-tcp-queries: \fI\fR The maximum number of queries that can be sent on a persistent TCP connection. This option defaults to 200 queries. .TP .B tcp-auth-query-timeout: \fI\fR Timeout in milliseconds for TCP queries to auth servers. This option defaults to 3000 milliseconds. .TP d475 1 a475 3 Default is no. Useful in tunneling scenarios. If set to no you can specify TCP transport only for selected forward or stub zones using forward-tcp-upstream or stub-tcp-upstream respectively. d487 4 a490 5 If you enable this, also configure a tls\-cert\-bundle or use tls\-win\-cert or tls\-system\-cert to load CA certs, otherwise the connections cannot be authenticated. This option enables TLS for all of them, but if you do not set this you can configure TLS specifically for some forward zones with forward\-tls\-upstream. And also with stub\-tls\-upstream. d539 1 a539 6 the tls\-cert\-bundle option on other systems. On other systems, this option enables the system certificates. .TP .B tls\-system\-cert: \fI This the same setting as the tls\-win\-cert setting, under a different name. Because it is not windows specific. d548 1 a548 1 perform TLS session resumption for clients using the Unbound server. a585 1 .TP d629 2 a630 2 Enable or disable whether the Unbound server forks into the background as a daemon. Set the value to \fIno\fR when Unbound runs as systemd service. d657 1 a657 1 the Unbound server recursive lookup algorithm, and static data is served d729 1 a729 1 Additionally, Unbound may need to access /dev/urandom (for entropy) d763 1 a763 1 Sets Unbound to send log messages to the syslogd, using d773 1 a773 1 Unbound, with different configurations, so that the logs can be easily a840 11 .B hide\-http\-user\-agent: \fI If enabled the HTTP header User-Agent is not set. Use with caution as some webserver configurations may reject HTTP requests lacking this header. If needed, it is better to explicitly set the .B http\-user\-agent below. .TP .B http\-user\-agent: \fI Set the HTTP User-Agent header for outgoing HTTP requests. If set to "", the default, then the package name and version are used. .TP d850 1 a850 1 Set the target fetch policy used by Unbound to determine if it should fetch d855 1 a855 1 that Unbound will pursue in answering a query. d949 1 a949 1 Default is yes. It helps to reduce the query rate towards targets that get d1006 1 a1006 1 If disabled, Unbound responds with a short list of resource records if some d1015 1 a1015 1 If yes, Unbound does not insert authority/additional sections into response d1033 7 a1039 15 the string with quotes (""). The modules can be \fIrespip\fR, \fIvalidator\fR, or \fIiterator\fR (and possibly more, see below). Setting this to just "\fIiterator\fR" will result in a non\-validating server. Setting this to "\fIvalidator iterator\fR" will turn on DNSSEC validation. The ordering of the modules is significant, the order decides the order of processing. You must also set \fItrust\-anchors\fR for validation to be useful. Adding \fIrespip\fR to the front will cause RPZ processing to be done on all queries. The default is "\fIvalidator iterator\fR". .IP When the server is built with EDNS client subnet support the default is "\fIsubnetcache validator iterator\fR". d1041 1 a1041 2 of the line. The subnetcachedb module has to be listed just before the iterator. d1057 1 a1057 1 so the Unbound user must have write permission. Write permission to the file, a1119 4 .B val\-max\-restart: \fI The maximum number the validator should restart validation with another authority in case of failed validation. Default is 5. .TP d1139 1 a1139 1 the query that failed is printed but also the reason why Unbound thought d1151 1 a1151 1 Instruct Unbound to ignore the CD flag from clients and refuse to d1155 1 a1155 1 the clients, and then Unbound provides them with DNSSEC protection. d1159 1 a1159 1 If enabled, Unbound attempts to serve old responses from cache with a d1190 1 a1190 1 If enabled, Unbound will always return the original TTL as received from d1192 3 a1194 3 stored in the cache. This feature may be useful if Unbound serves as a front-end to a hidden authoritative name server. Enabling this feature does not impact cache expiry, it only changes the TTL Unbound embeds in responses to d1196 2 a1197 2 the configured minimum and maximum TTL, as it is assumed users who enable this feature do not want Unbound to change the TTL obtained from an upstream server. d1204 1 a1204 1 by quotes. Default is "1024 150 2048 150 4096 150". This determines the a1210 6 .B zonemd\-permissive\-mode: \fI If enabled the ZONEMD verification failures are only logged and do not cause the zone to be blocked and only return servfail. Useful for testing out if it works, or if the operator only wants to be notified of a problem without disrupting service. Default is no. .TP d1252 1 a1252 1 the reverse lookups are no longer filtered. This allows Unbound when d1256 1 a1256 1 with default local zones. Disable the option when Unbound is running d1277 1 a1277 11 it as detailed in the stub zone section below. A stub\-zone can be used to have unbound send queries to another server, an authoritative server, to fetch the information. With a forward\-zone, unbound sends queries to a server that is a recursive server to fetch the information. With an auth\-zone a zone can be loaded from file and used, it can be used like a local\-zone for users downstream, or the auth\-zone information can be used to fetch information from when resolving like it is an upstream server. The forward\-zone and auth\-zone options are described in their sections below. If you want to perform filtering of the information that the users can fetch, the local\-zone and local\-data statements allow for this, but also the rpz functionality can be used, described in the RPZ section. d1360 1 a1360 1 answered from global local zone contents. d1369 7 a1375 7 The default zones are localhost, reverse 127.0.0.1 and ::1, the home.arpa, the onion, test, invalid and the AS112 zones. The AS112 zones are reverse DNS zones for private use and reserved IP addresses for which the servers on the internet cannot provide correct answers. They are configured by default to give nxdomain (no reverse information) answers. The defaults can be turned off by specifying your own local\-zone of that name, or using the 'nodefault' type. Below is a list of the default zone contents. a1415 9 \h'5'\fIhome.arpa (RFC 8375)\fR Default content: .nf local\-zone: "home.arpa." static local\-data: "home.arpa. 10800 IN NS localhost." local\-data: "home.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" .fi .TP 10 a1509 76 .B response\-ip: \fI This requires use of the "respip" module. .IP If the IP address in an AAAA or A RR in the answer section of a response matches the specified IP netblock, the specified action will apply. \fI\fR has generally the same semantics as that for \fIaccess-control-tag-action\fR, but there are some exceptions. .IP Actions for \fIresponse-ip\fR are different from those for \fIlocal-zone\fR in that in case of the former there is no point of such conditions as "the query matches it but there is no local data". Because of this difference, the semantics of \fIresponse-ip\fR actions are modified or simplified as follows: The \fIstatic, refuse, transparent, typetransparent,\fR and \fInodefault\fR actions are invalid for \fIresponse-ip\fR. Using any of these will cause the configuration to be rejected as faulty. The \fIdeny\fR action is non-conditional, i.e. it always results in dropping the corresponding query. The resolution result before applying the deny action is still cached and can be used for other queries. .TP 5 .B response-ip-data: \fI <"resource record string"> This requires use of the "respip" module. .IP This specifies the action data for \fIresponse-ip\fR with action being to redirect as specified by "\fIresource record string\fR". "Resource record string" is similar to that of \fIaccess-control-tag-action\fR, but it must be of either AAAA, A or CNAME types. If the IP-netblock is an IPv6/IPV4 prefix, the record must be AAAA/A respectively, unless it is a CNAME (which can be used for both versions of IP netblocks). If it is CNAME there must not be more than one \fIresponse-ip-data\fR for the same IP-netblock. Also, CNAME and other types of records must not coexist for the same IP-netblock, following the normal rules for CNAME records. The textual domain name for the CNAME does not have to be explicitly terminated with a dot ("."); the root name is assumed to be the origin for the name. .TP 5 .B response-ip-tag: \fI <"list of tags"> This requires use of the "respip" module. .IP Assign tags to response IP-netblocks. If the IP address in an AAAA or A RR in the answer section of a response matches the specified IP-netblock, the specified tags are assigned to the IP address. Then, if an \fIaccess-control-tag\fR is defined for the client and it includes one of the tags for the response IP, the corresponding \fIaccess-control-tag-action\fR will apply. Tag matching rule is the same as that for \fIaccess-control-tag\fR and \fIlocal-zones\fR. Unlike \fIlocal-zone-tag\fR, \fIresponse-ip-tag\fR can be defined for an IP-netblock even if no \fIresponse-ip\fR is defined for that netblock. If multiple \fIresponse-ip-tag\fR options are specified for the same IP-netblock in different statements, all but the first will be ignored. However, this will not be flagged as a configuration error, but the result is probably not what was intended. .IP Actions specified in an \fIaccess-control-tag-action\fR that has a matching tag with \fIresponse-ip-tag\fR can be those that are "invalid" for \fIresponse-ip\fR listed above, since \fIaccess-control-tag-action\fRs can be shared with local zones. For these actions, if they behave differently depending on whether local data exists or not in case of local zones, the behavior for \fIresponse-ip-data\fR will generally result in NOERROR/NODATA instead of NXDOMAIN, since the \fIresponse-ip\fR data are inherently type specific, and non-existence of data does not indicate anything about the existence or non-existence of the qname itself. For example, if the matching tag action is \fIstatic\fR but there is no data for the corresponding \fIresponse-ip\fR configuration, then the result will be NOERROR/NODATA. The only case where NXDOMAIN is returned is when an \fIalways_nxdomain\fR action applies. .TP 5 d1519 2 a1520 3 overloaded with random names, and keeps Unbound from sending traffic to the nameservers for those zones. Configured forwarders are excluded from ratelimiting. a1541 9 .B ratelimit\-backoff: \fI If enabled, the ratelimit is treated as a hard failure instead of the default maximum allowed constant rate. When the limit is reached, traffic is ratelimited and demand continues to be kept track of for a 2 second rate window. No traffic is allowed, except for ratelimit\-factor, until demand decreases below the configured ratelimit for a 2 second rate window. Useful to set ratelimit to a suspicious rate to aggressively limit unusually high traffic. Default is off. .TP 5 d1558 1 a1558 1 Enable global ratelimiting of queries accepted per IP address. a1584 17 .B ip\-ratelimit\-backoff: \fI If enabled, the ratelimit is treated as a hard failure instead of the default maximum allowed constant rate. When the limit is reached, traffic is ratelimited and demand continues to be kept track of for a 2 second rate window. No traffic is allowed, except for ip\-ratelimit\-factor, until demand decreases below the configured ratelimit for a 2 second rate window. Useful to set ip\-ratelimit to a suspicious rate to aggressively limit unusually high traffic. Default is off. .TP 5 .B outbound\-msg\-retry: \fI The number of retries, per upstream nameserver in a delegation, that Unbound will attempt in case a throwaway response is received. No response (timeout) contributes to the retry counter. If a forward/stub zone is used, this is the number of retries per nameserver in the zone. Default is 5. .TP 5 a1608 15 .TP 5 .B ede: \fI If enabled, Unbound will respond with Extended DNS Error codes (RFC8914). These EDEs attach informative error messages to a response for various errors. Default is "no". When the \fBval-log-level\fR option is also set to \fB2\fR, responses with Extended DNS Errors concerning DNSSEC failures that are not served from cache, will also contain a descriptive text message about the reason for the failure. .TP .B ede\-serve\-expired: \fI If enabled, Unbound will attach an Extended DNS Error (RFC8914) Code 3 - Stale Answer as EDNS0 option to the expired response. Note that this will not attach the EDE code without setting the global \fBede\fR option to "yes" as well. Default is "no". d1614 1 a1614 1 commands to the running Unbound server. The server uses these clauses d1632 1 a1632 1 If you set it to an absolute path, a unix domain socket is used. This socket d1634 1 a1634 1 To restrict access, Unbound sets permissions on the file to the user and d1654 1 a1654 1 This file is used by the Unbound server, but not by \fIunbound\-control\fR. d1659 1 a1659 1 This file is used by the Unbound server, and also by \fIunbound\-control\fR. d1677 1 a1677 1 The servers should be authority servers, not recursors; Unbound performs d1684 1 a1684 1 entry for Unbound with d1687 1 a1687 1 The Unbound resolver can then access the data, without referring to the d1692 1 a1692 1 can be put in config, so that Unbound can validate the data and set the AD d1694 1 a1694 1 AD bit). This setup makes Unbound capable of answering queries for the d1702 1 a1702 1 (reverse\-) zone bypass Unbound's filtering of RFC1918 zones. d1705 1 a1705 1 Name of the stub zone. This is the full domain name of the zone. a1708 5 To use a nondefault port for DNS communication append '@@' with the port number. If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. If only '#' is used the default port is the configured tls\-port. d1713 3 a1715 4 If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. If only '#' is used the default port is the configured tls\-port. a1735 4 .B stub\-tcp\-upstream: \fI If it is set to "yes" then upstream queries use TCP only for transport regardless of global flag tcp-upstream. Default is no. .TP d1747 2 a1748 2 those servers are not authority servers, but are (just like Unbound is) recursive servers too; Unbound does not perform recursion itself for the d1750 1 a1750 1 CNAMEs are chased by Unbound itself, asking the remote server for every d1758 1 a1758 1 Name of the forward zone. This is the full domain name of the zone. a1761 5 To use a nondefault port for DNS communication append '@@' with the port number. If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. If only '#' is used the default port is the configured tls\-port. d1766 3 a1768 4 If tls is enabled, then you can append a '#' and a name, then it'll check the tls authentication certificates with that name. If you combine the '@@' and '#', the '@@' comes first. If only '#' is used the default port is the configured tls\-port. d1776 1 a1776 1 enabled, Unbound will fall back to normal recursive resolution for this a1787 4 .B forward\-tcp\-upstream: \fI If it is set to "yes" then upstream queries use TCP only for transport regardless of global flag tcp-upstream. Default is no. .TP d1798 1 a1798 1 make Unbound respond like an authority server. Authority zones are also d1821 1 a1821 3 To use a nondefault port for DNS communication append '@@' with the port number. You can append a '#' and a name, then AXFR over TLS can be used and the tls authentication certificates will be checked with that name. If you combine the '@@' and '#', the '@@' comes first. d1853 2 a1854 2 file is downloaded when notified. The primaries from primary: and url: statements are allowed notify by default. d1857 1 a1857 1 Default no. If enabled, Unbound falls back to querying the internet as d1862 2 a1863 2 Default yes. If enabled, Unbound serves authority responses to downstream clients for this zone. This option makes Unbound behave, for d1865 1 a1865 1 that zone. Turn it off if you want Unbound to provide recursion for the d1867 1 a1867 1 for\-upstream is yes, then Unbound will DNSSEC validate the contents of the d1872 1 a1872 1 Default yes. If enabled, Unbound fetches data from this data collection d1875 1 a1875 1 the zone data. Turn it on when you want Unbound to provide recursion for a1877 19 .B zonemd\-check: \fI Enable this option to check ZONEMD records in the zone. Default is disabled. The ZONEMD record is a checksum over the zone data. This includes glue in the zone and data from the zone file, and excludes comments from the zone file. When there is a DNSSEC chain of trust, DNSSEC signatures are checked too. .TP .B zonemd\-reject\-absence: \fI Enable this option to reject the absence of the ZONEMD record. Without it, when zonemd is not there it is not checked. It is useful to enable for a nonDNSSEC signed zone where the operator wants to require the verification of a ZONEMD, hence a missing ZONEMD is a failure. The action upon failure is controlled by the \fBzonemd\-permissive\-mode\fR option, for log only or also block the zone. The default is no. .IP Without the option absence of a ZONEMD is only a failure when the zone is DNSSEC signed, and we have a trust anchor, and the DNSSEC verification of the absence of the ZONEMD fails. With the option enabled, the absence of a ZONEMD is always a failure, also for nonDNSSEC signed zones. .TP d1880 1 a1880 1 If the file does not exist or is empty, Unbound will attempt to fetch zone d1887 1 a1887 1 \fBlocal\-data\fR elements. Views can also contain view\-first, d1980 1 a1980 1 available, they are only meaningful if Unbound was compiled with d1982 1 a1982 1 Currently certificate and secret/public keys cannot be generated by Unbound. d2101 1 a2101 1 accept in queries. Shorter source masks result in REFUSED answers. Source mask d2114 2 a2115 3 validator iterator" directive and be compiled into Unbound by using \fB\-\-enable\-ipsecmod\fR to be enabled. These settings go in the \fBserver:\fR section. d2117 1 a2117 1 When Unbound receives an A/AAAA query that is not in the cache and finds a d2119 1 a2119 1 an IPSECKEY subquery for the same domain name. If an answer was found, Unbound d2148 1 a2148 1 facilitates turning on/off the module without restarting/reloading Unbound. d2152 1 a2152 1 Specifies the external hook that Unbound will call with \fIsystem\fR(3). The d2154 1 a2154 1 permissions to be able to be executed by the same user that runs Unbound. It d2159 2 a2160 2 If enabled Unbound requires the external hook to return a success value of 0. Failing to do so Unbound will reply with SERVFAIL. The A/AAAA answer will also d2168 1 a2168 1 Specifies the behaviour of Unbound when the IPSECKEY answer is bogus. If set d2195 1 a2195 1 with expired data if Unbound is configured for that. Currently the use d2253 1 a2253 1 options are specific to the redis backend. d2274 1 a2274 1 If Redis record expiration is enabled. If yes, Unbound sets timeout for Redis d2276 1 a2276 1 Unbound is configured with \fBserve-expired\fR and \fBserve-expired-ttl\fR is 0, d2281 1 a2281 2 DNSTAP support, when compiled in by using \fB\-\-enable\-dnstap\fR, is enabled in the \fBdnstap:\fR section. d2283 1 a2283 1 the log information to the destination. If Unbound is compiled without d2341 1 a2341 1 These are messages from Unbound to upstream servers. d2345 1 a2345 1 These are replies from upstream servers to Unbound. d2349 1 a2349 1 These are client queries to Unbound. d2353 1 a2353 1 These are responses from Unbound to clients. d2368 4 a2371 43 QNAME, Response IP Address, nsdname, nsip and clientip triggers are supported. Supported actions are: NXDOMAIN, NODATA, PASSTHRU, DROP, Local Data, tcp\-only and drop. RPZ QNAME triggers are applied after \fBlocal\-zones\fR and before \fBauth\-zones\fR. .P The rpz zone is formatted with a SOA start record as usual. The items in the zone are entries, that specify what to act on (the trigger) and what to do (the action). The trigger to act on is recorded in the name, the action to do is recorded as the resource record. The names all end in the zone name, so you could type the trigger names without a trailing dot in the zonefile. .P An example RPZ record, that answers example.com with NXDOMAIN .nf example.com CNAME . .fi .P The triggers are encoded in the name on the left .nf name query name netblock.rpz-client-ip client IP address netblock.rpz-ip response IP address in the answer name.rpz-nsdname nameserver name netblock.rpz-nsip nameserver IP address .fi The netblock is written as .. For IPv6 use 'zz' for '::'. Specify individual addresses with scope length of 32 or 128. For example, 24.10.100.51.198.rpz-ip is 198.51.100.10/24 and 32.10.zz.db8.2001.rpz-ip is 2001:db8:0:0:0:0:0:10/32. .P The actions are specified with the record on the right .nf CNAME . nxdomain reply CNAME *. nodata reply CNAME rpz-passthru. do nothing, allow to continue CNAME rpz-drop. the query is dropped CNAME rpz-tcp-only. answer over TCP A 192.0.2.1 answer with this IP address .fi Other records like AAAA, TXT and other CNAMEs (not rpz-..) can also be used to answer queries with that content. .P The RPZ zones can be configured in the config file with these settings in the \fBrpz:\fR block. a2378 9 To use a nondefault port for DNS communication append '@@' with the port number. You can append a '#' and a name, then AXFR over TLS can be used and the tls authentication certificates will be checked with that name. If you combine the '@@' and '#', the '@@' comes first. If you point it at another Unbound instance, it would not work because that does not support AXFR/IXFR for the zone, but if you used \fBurl:\fR to download the zonefile as a text file from a webserver that would work. If you specify the hostname, you cannot use the domain from the zonefile, because it may not have that when retrieving that data, instead use a plain IP address to avoid a circular dependency on retrieving that IP address. d2399 2 a2400 2 file is downloaded when notified. The primaries from primary: and url: statements are allowed notify by default. d2404 1 a2404 1 If the file does not exist or is empty, Unbound will attempt to fetch zone a2420 11 .B rpz\-signal\-nxdomain\-ra: \fI Signal when a query is blocked by the RPZ with NXDOMAIN with an unset RA flag. This allows certain clients, like dnsmasq, to infer that the domain is externally blocked. Default is no. .TP .B for\-downstream: \fI If enabled the zone is authoritatively answered for and queries for the RPZ zone information are answered to downstream clients. This is useful for monitoring scripts, that can then access the SOA information to check if the rpz information is up to date. Default is no. .TP d2461 1 a2461 1 default Unbound working directory. d2469 1 a2469 1 Unbound configuration file. d2472 1 a2472 1 default Unbound pidfile with process ID of the running daemon. d2475 1 a2475 1 Unbound log file. default is to log to @ 1.1.1.7.2.1 log @Pull up the following, requested by christos in ticket #608: external/bsd/nsd/dist/doc/NSD-VERIFY-MODS up to 1.1.1.1 external/bsd/nsd/dist/util/proxy_protocol.c up to 1.1.1.1 external/bsd/nsd/dist/util/proxy_protocol.h up to 1.1.1.1 external/bsd/nsd/dist/contrib/autocomplete_nsd-control.bash up to 1.1.1.1 external/bsd/nsd/dist/SECURITY.md up to 1.1.1.1 external/bsd/nsd/dist/udbradtree.c delete external/bsd/nsd/dist/udbradtree.h delete external/bsd/nsd/dist/udbzone.c delete external/bsd/nsd/dist/udbzone.h delete external/bsd/nsd/dist/.github/FUNDING.yml delete external/bsd/nsd/dist/contrib/nsd.socket delete external/bsd/nsd/Makefile.inc up to 1.8 external/bsd/nsd/dist/Makefile.in up to 1.1.1.9 external/bsd/nsd/dist/README.md up to 1.1.1.4 external/bsd/nsd/dist/acx_nlnetlabs.m4 up to 1.1.1.4 external/bsd/nsd/dist/answer.c up to 1.1.1.2 external/bsd/nsd/dist/answer.h up to 1.1.1.2 external/bsd/nsd/dist/axfr.c up to 1.1.1.5 external/bsd/nsd/dist/axfr.h up to 1.1.1.3 external/bsd/nsd/dist/bitset.h up to 1.1.1.2 external/bsd/nsd/dist/buffer.h up to 1.1.1.2 external/bsd/nsd/dist/config.h.in up to 1.1.1.9 external/bsd/nsd/dist/configlexer.c up to 1.9 external/bsd/nsd/dist/configlexer.lex up to 1.1.1.8 external/bsd/nsd/dist/configparser.c up to 1.9 external/bsd/nsd/dist/configparser.h up to 1.9 external/bsd/nsd/dist/configparser.y up to 1.1.1.8 external/bsd/nsd/dist/configure up to 1.3 external/bsd/nsd/dist/configure.ac up to 1.6 external/bsd/nsd/dist/dbaccess.c up to 1.1.1.6 external/bsd/nsd/dist/dbcreate.c up to 1.1.1.6 external/bsd/nsd/dist/difffile.c up to 1.1.1.8 external/bsd/nsd/dist/difffile.h up to 1.1.1.4 external/bsd/nsd/dist/dname.h up to 1.1.1.2 external/bsd/nsd/dist/dns.h up to 1.1.1.6 external/bsd/nsd/dist/edns.c up to 1.1.1.4 external/bsd/nsd/dist/edns.h up to 1.1.1.3 external/bsd/nsd/dist/ipc.c up to 1.1.1.8 external/bsd/nsd/dist/ixfr.c up to 1.1.1.2 external/bsd/nsd/dist/ixfr.h up to 1.1.1.2 external/bsd/nsd/dist/ixfrcreate.c up to 1.1.1.2 external/bsd/nsd/dist/ixfrcreate.h up to 1.1.1.2 external/bsd/nsd/dist/namedb.h up to 1.1.1.5 external/bsd/nsd/dist/netio.h up to 1.1.1.2 external/bsd/nsd/dist/nsd-checkconf.8.in up to 1.1.1.9 external/bsd/nsd/dist/nsd-checkconf.c up to 1.1.1.8 external/bsd/nsd/dist/nsd-checkzone.8.in up to 1.1.1.9 external/bsd/nsd/dist/nsd-checkzone.c up to 1.1.1.6 external/bsd/nsd/dist/nsd-control.8.in up to 1.1.1.9 external/bsd/nsd/dist/nsd-control.c up to 1.1.1.9 external/bsd/nsd/dist/nsd-mem.c up to 1.1.1.5 external/bsd/nsd/dist/nsd.8.in up to 1.1.1.9 external/bsd/nsd/dist/nsd.c up to 1.1.1.9 external/bsd/nsd/dist/nsd.conf.5.in up to 1.1.1.9 external/bsd/nsd/dist/nsd.conf.sample.in up to 1.1.1.8 external/bsd/nsd/dist/nsd.h up to 1.1.1.8 external/bsd/nsd/dist/nsec3.c up to 1.1.1.7 external/bsd/nsd/dist/nsec3.h up to 1.1.1.4 external/bsd/nsd/dist/options.c up to 1.5 external/bsd/nsd/dist/options.h up to 1.1.1.9 external/bsd/nsd/dist/packet.h up to 1.1.1.5 external/bsd/nsd/dist/popen3.h up to 1.1.1.3 external/bsd/nsd/dist/query.c up to 1.1.1.8 external/bsd/nsd/dist/query.h up to 1.1.1.5 external/bsd/nsd/dist/rbtree.h up to 1.1.1.3 external/bsd/nsd/dist/rdata.c up to 1.1.1.4 external/bsd/nsd/dist/rdata.h up to 1.1.1.3 external/bsd/nsd/dist/region-allocator.h up to 1.1.1.2 external/bsd/nsd/dist/remote.c up to 1.1.1.9 external/bsd/nsd/dist/remote.h up to 1.1.1.4 external/bsd/nsd/dist/rrl.c up to 1.1.1.4 external/bsd/nsd/dist/server.c up to 1.8 external/bsd/nsd/dist/tsig-openssl.h up to 1.1.1.3 external/bsd/nsd/dist/tsig.h up to 1.1.1.2 external/bsd/nsd/dist/udb.h up to 1.1.1.5 external/bsd/nsd/dist/util.h up to 1.8 external/bsd/nsd/dist/verify.c up to 1.1.1.2 external/bsd/nsd/dist/verify.h up to 1.1.1.2 external/bsd/nsd/dist/xfr-inspect.c up to 1.1.1.3 external/bsd/nsd/dist/xfrd-disk.c up to 1.1.1.6 external/bsd/nsd/dist/xfrd-tcp.c up to 1.1.1.6 external/bsd/nsd/dist/xfrd.c up to 1.1.1.8 external/bsd/nsd/dist/xfrd.h up to 1.1.1.5 external/bsd/nsd/dist/zlexer.c up to 1.8 external/bsd/nsd/dist/zlexer.lex up to 1.1.1.6 external/bsd/nsd/dist/zonec.c up to 1.1.1.7 external/bsd/nsd/dist/zonec.h up to 1.1.1.6 external/bsd/nsd/dist/compat/cpuset.h up to 1.1.1.2 external/bsd/nsd/dist/compat/fake-rfc2553.h up to 1.1.1.2 external/bsd/nsd/dist/contrib/README up to 1.1.1.4 external/bsd/nsd/dist/dnstap/dnstap.c up to 1.1.1.4 external/bsd/nsd/dist/dnstap/dnstap.h up to 1.1.1.3 external/bsd/nsd/dist/dnstap/dnstap_collector.c up to 1.1.1.3 external/bsd/nsd/dist/doc/CREDITS up to 1.1.1.3 external/bsd/nsd/dist/doc/ChangeLog up to 1.1.1.9 external/bsd/nsd/dist/doc/README up to 1.3 external/bsd/nsd/dist/doc/README.svn up to 1.1.1.2 external/bsd/nsd/dist/doc/RELNOTES up to 1.1.1.9 external/bsd/nsd/include/config.h up to 1.12 external/bsd/nsd/lib/libnsd/Makefile up to 1.6 external/bsd/unbound/dist/contrib/unbound.init_yocto up to 1.1.1.1 external/bsd/unbound/dist/testdata/00-lint.tdir/00-lint.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.proxy-and-dnscrypt up to 1.1.1.1 external/bsd/unbound/dist/testdata/04-checkconf.tdir/bad.proxy-and-https up to 1.1.1.1 external/bsd/unbound/dist/testdata/07-confroot.tdir/07-confroot.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/conf.bad_credentials up to 1.1.1.1 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/conf.spoofed_credentials up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/dnskey-failures.test.signed up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/dnssec-failures.test.signed up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/nsec-failures.test.signed up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/rrsig-failures.test.signed up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede.tdir/bogus/trust-anchors up to 1.1.1.1 external/bsd/unbound/dist/testdata/nss_compile.tdir/nss_compile.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_anchor.tdir/root_anchor.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_hints.tdir/root_hints.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/clang-analysis.tdir/clang-analysis.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_cached_ede.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values_cachedb.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values_downstream_cookies.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_ignore_empty.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_prezero.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.test.scenario up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/acl_interface.tdir/acl_interface.testns2 up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_cached_ede.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_servfail_cname.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/disable_edns_do.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/ede_cache_snoop_not_auth.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/edns_downstream_cookies.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_auth_tc.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_cname_minimise_nx.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_failreply.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_scopezero.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_nat64.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_nat64_prefix.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_nat64_prefix48.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/iter_scrub_rr_length.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/rpz_cached_cname.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_0ttl_nodata.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_0ttl_nxdomain.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_0ttl_servfail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_cached_servfail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_cached_servfail_refresh.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/serve_expired_client_timeout_servfail.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_cached_servfail.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_global_prefetch.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_global_prefetch_always_forward.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_global_prefetch_expired.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/subnet_global_prefetch_with_client_ecs.crpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/val_any_negcache.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/val_scrub_rr_length.rpl up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.servfail.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/cachedb_no_store.tdir/cachedb_no_store.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/ip_ratelimit.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/unbound_control.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/unbound_control.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/ip_ratelimit.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.test.scenario up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/proxy_protocol.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/unbound_server.key up to 1.1.1.1 external/bsd/unbound/dist/testdata/proxy_protocol.tdir/unbound_server.pem up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/root_zonemd.tdir/root_zonemd.testns up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.conf up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.dsc up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.post up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.pre up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.test up to 1.1.1.1 external/bsd/unbound/dist/testdata/stub_auth_tc.tdir/stub_auth_tc.testns up to 1.1.1.1 external/bsd/unbound/dist/util/proxy_protocol.c up to 1.1.1.1 external/bsd/unbound/dist/util/proxy_protocol.h up to 1.1.1.1 external/bsd/unbound/dist/util/rfc_1982.c up to 1.1.1.1 external/bsd/unbound/dist/util/rfc_1982.h up to 1.1.1.1 external/bsd/unbound/dist/util/siphash.c up to 1.1.1.1 external/bsd/unbound/dist/util/siphash.h up to 1.1.1.1 external/bsd/unbound/dist/util/timeval_func.c up to 1.1.1.1 external/bsd/unbound/dist/util/timeval_func.h up to 1.1.1.1 external/bsd/unbound/dist/testcode/mini_tpkg.sh delete external/bsd/unbound/dist/testdata/ede_cache_snoop_noth_auth.rpl delete external/bsd/unbound/dist/testdata/serve_expired_servfail.rpl delete external/bsd/unbound/dist/testdata/subnet_prefetch_with_client_ecs.crpl delete external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/precheck.sh delete external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/precheck.sh delete external/bsd/unbound/dist/testdata/ede.tdir/bogus/clean.sh delete external/bsd/unbound/Makefile.inc up to 1.5 external/bsd/unbound/dist/Makefile.in up to 1.1.1.8 external/bsd/unbound/dist/README.md up to 1.1.1.4 external/bsd/unbound/dist/acx_nlnetlabs.m4 up to 1.1.1.5 external/bsd/unbound/dist/acx_python.m4 up to 1.1.1.5 external/bsd/unbound/dist/config.guess up to 1.8 external/bsd/unbound/dist/config.h.in up to 1.1.1.8 external/bsd/unbound/dist/config.sub up to 1.7 external/bsd/unbound/dist/configure up to 1.1.1.8 external/bsd/unbound/dist/configure.ac up to 1.1.1.8 external/bsd/unbound/dist/cachedb/cachedb.c up to 1.1.1.8 external/bsd/unbound/dist/cachedb/redis.c up to 1.1.1.3 external/bsd/unbound/dist/compat/arc4random.c up to 1.1.1.5 external/bsd/unbound/dist/compat/getentropy_solaris.c up to 1.1.1.4 external/bsd/unbound/dist/contrib/Dockerfile.tests up to 1.1.1.2 external/bsd/unbound/dist/contrib/README up to 1.1.1.7 external/bsd/unbound/dist/contrib/aaaa-filter-iterator.patch up to 1.1.1.5 external/bsd/unbound/dist/contrib/unbound.service.in up to 1.1.1.6 external/bsd/unbound/dist/daemon/acl_list.c up to 1.1.1.6 external/bsd/unbound/dist/daemon/acl_list.h up to 1.1.1.5 external/bsd/unbound/dist/daemon/cachedump.c up to 1.1.1.6 external/bsd/unbound/dist/daemon/daemon.c up to 1.1.1.8 external/bsd/unbound/dist/daemon/daemon.h up to 1.1.1.5 external/bsd/unbound/dist/daemon/remote.c up to 1.1.1.8 external/bsd/unbound/dist/daemon/remote.h up to 1.1.1.4 external/bsd/unbound/dist/daemon/stats.c up to 1.1.1.8 external/bsd/unbound/dist/daemon/stats.h up to 1.1.1.3 external/bsd/unbound/dist/daemon/worker.c up to 1.1.1.8 external/bsd/unbound/dist/daemon/worker.h up to 1.1.1.3 external/bsd/unbound/dist/dns64/dns64.c up to 1.1.1.7 external/bsd/unbound/dist/dnstap/dnstap.c up to 1.1.1.6 external/bsd/unbound/dist/dnstap/dnstap.h up to 1.1.1.4 external/bsd/unbound/dist/dnstap/dnstap.m4 up to 1.1.1.3 external/bsd/unbound/dist/dnstap/dtstream.c up to 1.1.1.3 external/bsd/unbound/dist/dnstap/unbound-dnstap-socket.c up to 1.1.1.3 external/bsd/unbound/dist/doc/Changelog up to 1.1.1.8 external/bsd/unbound/dist/doc/README up to 1.1.1.8 external/bsd/unbound/dist/doc/README.DNS64 up to 1.1.1.2 external/bsd/unbound/dist/doc/example.conf.in up to 1.1.1.8 external/bsd/unbound/dist/doc/libunbound.3.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound-anchor.8.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound-checkconf.8.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound-control.8.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound-host.1.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound.8.in up to 1.1.1.8 external/bsd/unbound/dist/doc/unbound.conf.5.in up to 1.1.1.8 external/bsd/unbound/dist/dynlibmod/dynlibmod.c up to 1.1.1.2 external/bsd/unbound/dist/edns-subnet/addrtree.c up to 1.1.1.4 external/bsd/unbound/dist/edns-subnet/addrtree.h up to 1.1.1.3 external/bsd/unbound/dist/edns-subnet/subnetmod.c up to 1.1.1.7 external/bsd/unbound/dist/edns-subnet/subnetmod.h up to 1.1.1.5 external/bsd/unbound/dist/ipset/ipset.c up to 1.1.1.3 external/bsd/unbound/dist/iterator/iter_delegpt.c up to 1.1.1.6 external/bsd/unbound/dist/iterator/iter_delegpt.h up to 1.1.1.7 external/bsd/unbound/dist/iterator/iter_hints.c up to 1.1.1.6 external/bsd/unbound/dist/iterator/iter_priv.c up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_resptype.c up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_resptype.h up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_scrub.c up to 1.1.1.8 external/bsd/unbound/dist/iterator/iter_scrub.h up to 1.1.1.2 external/bsd/unbound/dist/iterator/iter_utils.c up to 1.1.1.8 external/bsd/unbound/dist/iterator/iter_utils.h up to 1.1.1.7 external/bsd/unbound/dist/iterator/iterator.c up to 1.1.1.8 external/bsd/unbound/dist/iterator/iterator.h up to 1.1.1.7 external/bsd/unbound/dist/libunbound/context.c up to 1.1.1.8 external/bsd/unbound/dist/libunbound/context.h up to 1.1.1.6 external/bsd/unbound/dist/libunbound/libunbound.c up to 1.1.1.8 external/bsd/unbound/dist/libunbound/libworker.c up to 1.1.1.8 external/bsd/unbound/dist/libunbound/unbound-event.h up to 1.1.1.5 external/bsd/unbound/dist/libunbound/unbound.h up to 1.5 external/bsd/unbound/dist/libunbound/python/libunbound.i up to 1.1.1.5 external/bsd/unbound/dist/pythonmod/interface.i up to 1.1.1.8 external/bsd/unbound/dist/pythonmod/pythonmod.c up to 1.1.1.6 external/bsd/unbound/dist/pythonmod/pythonmod.h up to 1.1.1.5 external/bsd/unbound/dist/pythonmod/pythonmod_utils.c up to 1.1.1.5 external/bsd/unbound/dist/pythonmod/ubmodule-msg.py up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/ubmodule-tst.py up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/doc/examples/example0-1.py up to 1.1.1.4 external/bsd/unbound/dist/pythonmod/doc/examples/example0.rst up to 1.1.1.4 external/bsd/unbound/dist/pythonmod/doc/modules/config.rst up to 1.1.1.3 external/bsd/unbound/dist/pythonmod/doc/modules/env.rst up to 1.1.1.2 external/bsd/unbound/dist/pythonmod/examples/edns.py up to 1.1.1.4 external/bsd/unbound/dist/pythonmod/examples/inplace_callbacks.py up to 1.1.1.6 external/bsd/unbound/dist/pythonmod/examples/log.py up to 1.1.1.2 external/bsd/unbound/dist/respip/respip.c up to 1.1.1.6 external/bsd/unbound/dist/respip/respip.h up to 1.1.1.4 external/bsd/unbound/dist/services/authzone.c up to 1.3 external/bsd/unbound/dist/services/listen_dnsport.c up to 1.1.1.8 external/bsd/unbound/dist/services/listen_dnsport.h up to 1.1.1.6 external/bsd/unbound/dist/services/localzone.c up to 1.1.1.8 external/bsd/unbound/dist/services/localzone.h up to 1.1.1.7 external/bsd/unbound/dist/services/mesh.c up to 1.1.1.8 external/bsd/unbound/dist/services/mesh.h up to 1.1.1.6 external/bsd/unbound/dist/services/modstack.c up to 1.1.1.7 external/bsd/unbound/dist/services/outside_network.c up to 1.1.1.8 external/bsd/unbound/dist/services/outside_network.h up to 1.1.1.8 external/bsd/unbound/dist/services/rpz.c up to 1.1.1.3 external/bsd/unbound/dist/services/rpz.h up to 1.1.1.3 external/bsd/unbound/dist/services/view.c up to 1.1.1.3 external/bsd/unbound/dist/services/cache/dns.c up to 1.1.1.8 external/bsd/unbound/dist/services/cache/dns.h up to 1.1.1.7 external/bsd/unbound/dist/services/cache/infra.c up to 1.1.1.7 external/bsd/unbound/dist/services/cache/infra.h up to 1.1.1.6 external/bsd/unbound/dist/sldns/rrdef.c up to 1.1.1.6 external/bsd/unbound/dist/sldns/rrdef.h up to 1.1.1.6 external/bsd/unbound/dist/sldns/str2wire.c up to 1.1.1.7 external/bsd/unbound/dist/sldns/str2wire.h up to 1.1.1.5 external/bsd/unbound/dist/sldns/wire2str.c up to 1.1.1.7 external/bsd/unbound/dist/sldns/wire2str.h up to 1.1.1.6 external/bsd/unbound/dist/smallapp/unbound-anchor.c up to 1.1.1.7 external/bsd/unbound/dist/smallapp/unbound-checkconf.c up to 1.1.1.8 external/bsd/unbound/dist/smallapp/unbound-control.c up to 1.1.1.8 external/bsd/unbound/dist/smallapp/unbound-host.c up to 1.1.1.7 external/bsd/unbound/dist/testcode/delayer.c up to 1.1.1.6 external/bsd/unbound/dist/testcode/do-tests.sh up to 1.1.1.5 external/bsd/unbound/dist/testcode/dohclient.c up to 1.1.1.3 external/bsd/unbound/dist/testcode/fake_event.c up to 1.1.1.8 external/bsd/unbound/dist/testcode/lock_verify.c up to 1.1.1.4 external/bsd/unbound/dist/testcode/mini_tdir.sh up to 1.1.1.4 external/bsd/unbound/dist/testcode/perf.c up to 1.1.1.7 external/bsd/unbound/dist/testcode/replay.c up to 1.1.1.6 external/bsd/unbound/dist/testcode/streamtcp.1 up to 1.1.1.3 external/bsd/unbound/dist/testcode/streamtcp.c up to 1.1.1.8 external/bsd/unbound/dist/testcode/testpkts.c up to 1.1.1.8 external/bsd/unbound/dist/testcode/testpkts.h up to 1.1.1.5 external/bsd/unbound/dist/testcode/unitauth.c up to 1.1.1.5 external/bsd/unbound/dist/testcode/unitecs.c up to 1.1.1.3 external/bsd/unbound/dist/testcode/unitlruhash.c up to 1.1.1.3 external/bsd/unbound/dist/testcode/unitmain.c up to 1.1.1.8 external/bsd/unbound/dist/testcode/unittcpreuse.c up to 1.1.1.2 external/bsd/unbound/dist/testcode/unitverify.c up to 1.1.1.6 external/bsd/unbound/dist/testdata/auth_xfr_host.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/autotrust_init_fail.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/autotrust_init_failsig.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/autotrust_probefail.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/autotrust_probefailsig.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/autotrust_revtp_use.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/black_ds_entry.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/black_key_entry.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/black_prime_entry.rpl up to 1.1.1.6 external/bsd/unbound/dist/testdata/common.sh up to 1.1.1.4 external/bsd/unbound/dist/testdata/dns64_lookup.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/fetch_glue.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/fetch_glue_cname.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/fwd_0ttlservfail.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_dnsseclame_bug.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_dnsseclame_ds.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_dnsseclame_ta.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_donotq127.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/iter_emptydp.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/iter_emptydp_for_glue.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/iter_lame_aaaa.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_lamescrub.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/iter_nxns_cached.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_nxns_fallback.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_primenoglue.rpl up to 1.1.1.6 external/bsd/unbound/dist/testdata/iter_privaddr.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_ranoaa_lame.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_reclame_two.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_recurse.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/iter_scrub_ns.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_scrub_ns_fwd.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_scrub_ns_side.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/iter_stublastresort.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/nsid_bogus.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/root_key_sentinel.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/rpz_ixfr.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/rpz_nsdname.rpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/rpz_respip.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/subnet_derived.crpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/subnet_format_ip4.crpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/subnet_not_whitelisted.crpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/subnet_prefetch.crpl up to 1.1.1.2 external/bsd/unbound/dist/testdata/subnet_without_validator.crpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_any.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_any_dname.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_cnametocloser_nosig.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_cnametoinsecure.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_cnametonodata_nonsec.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_cnametooptout.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_cnametoposnowc.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_deleg_nons.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_dnamewc.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_ds_cname.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_faildnskey.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_faildnskey_ok.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nodata_failsig.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nodata_failwc.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_nokeyprime.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b1_nameerror_nowc.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nsec3_b2_nodata_nons.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_b4_wild_wr.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_entnodata_optout_badopt.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_nsec3_nods_badsig.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nx_failwc.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_nx_nsec3_collision.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_nx_overreach.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/val_positive_nosigs.rpl up to 1.1.1.3 external/bsd/unbound/dist/testdata/val_secds_nosig.rpl up to 1.1.1.4 external/bsd/unbound/dist/testdata/val_ta_algo_missing.rpl up to 1.1.1.5 external/bsd/unbound/dist/testdata/00-lint.tdir/00-lint.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/01-doc.tdir/01-doc.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/03-testbound.tdir/03-testbound.test up to 1.1.1.3 external/bsd/unbound/dist/testdata/04-checkconf.tdir/04-checkconf.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/07-confroot.tdir/07-confroot.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/07-confroot.tdir/07-confroot.test up to 1.1.1.3 external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/08-host-lib.tdir/08-host-lib.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.conf up to 1.1.1.2 external/bsd/unbound/dist/testdata/09-unbound-control.tdir/09-unbound-control.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/clang-analysis.tdir/clang-analysis.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/clang-analysis.tdir/clang-analysis.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert.tdir/dnscrypt_cert.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap.tdir/dnstap.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap.tdir/dnstap.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap.tdir/dnstap.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/dnstap_reconnect.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/dnstap_reconnect.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_reconnect.tdir/dnstap_reconnect.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/dnstap_tcp.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/dnstap_tcp.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tcp.tdir/dnstap_tcp.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/dnstap_tls.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/dnstap_tls.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls.tdir/dnstap_tls.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/dnstap_tls_badcert.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/dnstap_tls_badcert.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badcert.tdir/dnstap_tls_badcert.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/dnstap_tls_badname.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/dnstap_tls_badname.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_badname.tdir/dnstap_tls_badname.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/dnstap_tls_clientauth.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/dnstap_tls_clientauth.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_clientauth.tdir/dnstap_tls_clientauth.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/dnstap_tls_peername.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/dnstap_tls_peername.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dnstap_tls_peername.tdir/dnstap_tls_peername.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream.tdir/doh_downstream.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream.tdir/doh_downstream.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream.tdir/doh_downstream.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/doh_downstream_buffer_size.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/doh_downstream_buffer_size.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_buffer_size.tdir/doh_downstream_buffer_size.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/doh_downstream_endpoint.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/doh_downstream_endpoint.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_endpoint.tdir/doh_downstream_endpoint.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/doh_downstream_notls.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/doh_downstream_notls.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_notls.tdir/doh_downstream_notls.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/doh_downstream_post.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/doh_downstream_post.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/doh_downstream_post.tdir/doh_downstream_post.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/dynlibmod.tdir/dynlibmod.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/dynlibmod.tdir/dynlibmod.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/dynlibmod.tdir/dynlibmod.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ede.tdir/ede.conf up to 1.1.1.2 external/bsd/unbound/dist/testdata/ede.tdir/ede.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/ede.tdir/ede.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ede.tdir/bogus/make-broken-zone.sh up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.post up to 1.1.1.3 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/fwd_ancil.tdir/fwd_ancil.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.conf up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ipset.tdir/ipset.testns up to 1.1.1.2 external/bsd/unbound/dist/testdata/nss_compile.tdir/nss_compile.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/nss_compile.tdir/nss_compile.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/padding.tdir/padding.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/padding.tdir/padding.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/padding.tdir/padding.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.post up to 1.1.1.3 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.pre up to 1.1.1.3 external/bsd/unbound/dist/testdata/pylib.tdir/pylib.test up to 1.1.1.4 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.py up to 1.1.1.3 external/bsd/unbound/dist/testdata/pymod.tdir/pymod.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.post up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.py up to 1.1.1.3 external/bsd/unbound/dist/testdata/pymod_thread.tdir/pymod_thread.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/ratelimit.tdir/ratelimit.testns up to 1.1.1.2 external/bsd/unbound/dist/testdata/root_anchor.tdir/root_anchor.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/root_anchor.tdir/root_anchor.test up to 1.1.1.3 external/bsd/unbound/dist/testdata/root_hints.tdir/root_hints.dsc up to 1.1.1.2 external/bsd/unbound/dist/testdata/root_hints.tdir/root_hints.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/speed_local.tdir/speed_local.test up to 1.1.1.2 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.pre up to 1.1.1.2 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.test up to 1.1.1.3 external/bsd/unbound/dist/testdata/stat_values.tdir/stat_values.testns up to 1.1.1.2 external/bsd/unbound/dist/testdata/stream_ssl.tdir/stream_ssl.serv.conf up to 1.1.1.4 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.failure-cases-01 up to 1.1.1.2 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.success-cases.zone up to 1.1.1.2 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.success-cases.zone.cmp up to 1.1.1.2 external/bsd/unbound/dist/testdata/svcb.tdir/svcb.test up to 1.1.1.2 external/bsd/unbound/dist/util/config_file.c up to 1.1.1.8 external/bsd/unbound/dist/util/config_file.h up to 1.1.1.8 external/bsd/unbound/dist/util/configlexer.c up to 1.1.1.8 external/bsd/unbound/dist/util/configlexer.lex up to 1.1.1.8 external/bsd/unbound/dist/util/configparser.c up to 1.1.1.8 external/bsd/unbound/dist/util/configparser.h up to 1.1.1.8 external/bsd/unbound/dist/util/configparser.y up to 1.1.1.8 external/bsd/unbound/dist/util/edns.c up to 1.1.1.4 external/bsd/unbound/dist/util/edns.h up to 1.1.1.4 external/bsd/unbound/dist/util/fptr_wlist.c up to 1.1.1.8 external/bsd/unbound/dist/util/iana_ports.inc up to 1.1.1.8 external/bsd/unbound/dist/util/log.c up to 1.1.1.7 external/bsd/unbound/dist/util/module.c up to 1.1.1.5 external/bsd/unbound/dist/util/module.h up to 1.1.1.7 external/bsd/unbound/dist/util/net_help.c up to 1.1.1.8 external/bsd/unbound/dist/util/net_help.h up to 1.1.1.8 external/bsd/unbound/dist/util/netevent.c up to 1.6 external/bsd/unbound/dist/util/netevent.h up to 1.1.1.7 external/bsd/unbound/dist/util/regional.c up to 1.1.1.5 external/bsd/unbound/dist/util/timehist.c up to 1.1.1.3 external/bsd/unbound/dist/util/tube.c up to 1.1.1.5 external/bsd/unbound/dist/util/tube.h up to 1.1.1.3 external/bsd/unbound/dist/util/data/msgencode.c up to 1.1.1.7 external/bsd/unbound/dist/util/data/msgencode.h up to 1.1.1.3 external/bsd/unbound/dist/util/data/msgparse.c up to 1.1.1.7 external/bsd/unbound/dist/util/data/msgparse.h up to 1.1.1.6 external/bsd/unbound/dist/util/data/msgreply.c up to 1.1.1.8 external/bsd/unbound/dist/util/data/msgreply.h up to 1.1.1.8 external/bsd/unbound/dist/util/storage/dnstree.c up to 1.1.1.4 external/bsd/unbound/dist/util/storage/dnstree.h up to 1.1.1.4 external/bsd/unbound/dist/util/storage/lruhash.c up to 1.1.1.4 external/bsd/unbound/dist/util/storage/lruhash.h up to 1.1.1.3 external/bsd/unbound/dist/util/storage/slabhash.c up to 1.1.1.4 external/bsd/unbound/dist/util/storage/slabhash.h up to 1.1.1.4 external/bsd/unbound/dist/validator/autotrust.c up to 1.1.1.7 external/bsd/unbound/dist/validator/val_anchor.c up to 1.1.1.7 external/bsd/unbound/dist/validator/val_anchor.h up to 1.1.1.5 external/bsd/unbound/dist/validator/val_kcache.c up to 1.1.1.4 external/bsd/unbound/dist/validator/val_kcache.h up to 1.1.1.2 external/bsd/unbound/dist/validator/val_kentry.c up to 1.1.1.3 external/bsd/unbound/dist/validator/val_kentry.h up to 1.1.1.3 external/bsd/unbound/dist/validator/val_neg.c up to 1.1.1.6 external/bsd/unbound/dist/validator/val_nsec.c up to 1.1.1.6 external/bsd/unbound/dist/validator/val_nsec.h up to 1.1.1.4 external/bsd/unbound/dist/validator/val_nsec3.c up to 1.1.1.5 external/bsd/unbound/dist/validator/val_nsec3.h up to 1.1.1.4 external/bsd/unbound/dist/validator/val_sigcrypt.c up to 1.1.1.7 external/bsd/unbound/dist/validator/val_sigcrypt.h up to 1.1.1.4 external/bsd/unbound/dist/validator/val_utils.c up to 1.1.1.5 external/bsd/unbound/dist/validator/val_utils.h up to 1.1.1.5 external/bsd/unbound/dist/validator/validator.c up to 1.1.1.8 external/bsd/unbound/dist/validator/validator.h up to 1.1.1.6 external/bsd/unbound/include/config.h up to 1.12 external/bsd/unbound/lib/libunbound/Makefile up to 1.9 external/bsd/unbound/lib/libunbound/shlib_version up to 1.6 external/bsd/wpa/bin/hostapd/Makefile up to 1.17 external/bsd/wpa/dist/src/eap_peer/eap_config.h up to 1.2 external/bsd/wpa/dist/src/eap_peer/eap_peap.c up to 1.2 external/bsd/wpa/dist/src/eap_peer/eap_tls_common.c up to 1.2 external/bsd/wpa/dist/src/eap_peer/eap_tls_common.h up to 1.2 external/bsd/wpa/dist/wpa_supplicant/wpa_supplicant.conf up to 1.2 external/mpl/dhcp/bind/dist/lib/dns/dst_api.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/Kyuafile up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/acl.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/adb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/badcache.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/byaddr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/cache.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/callbacks.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/catz.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/client.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/clientinfo.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/compress.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/db.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dbiterator.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dbtable.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/diff.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dispatch.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dlz.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dns64.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dnsrps.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dnssec.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dnstap.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dnstap.proto up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ds.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tsig_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_internal.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_openssl.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_parse.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_parse.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_pkcs11.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dst_result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/dyndb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ecdb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ecs.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/fixedname.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/forward.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gen-unix.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gen-win32.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gen.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/geoip2.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gssapi_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/gssapictx.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/hmac_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ipkeylist.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/iptable.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/journal.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/kasp.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/key.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/keydata.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/time.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/keymgr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/keytable.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/lib.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/log.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/lookup.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/mapapi up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/master.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/masterdump.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/message.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/name.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ncache.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/nsec.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/nsec3.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/nta.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/openssl_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/openssldh_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/opensslecdsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/openssleddsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/opensslrsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/order.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/peer.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/pkcs11.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/pkcs11ecdsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/pkcs11eddsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/pkcs11rsa_link.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/portlist.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/private.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rbt.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rbtdb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rbtdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rcode.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdatalist.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdatalist_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdataset.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdatasetiter.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdataslab.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/request.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/resolver.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rootns.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rpz.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rriterator.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rrl.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/sdb.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/sdlz.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/soa.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ssu.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ssu_external.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/stats.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/timer.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tcpmsg.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tkey.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tsec.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/tsig.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/ttl.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/update.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/validator.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/version.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/view.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/xfrin.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zone.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/acl.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/adb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/badcache.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/bit.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/byaddr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/cache.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/callbacks.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/catz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/cert.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/client.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/clientinfo.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/compress.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/db.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dbiterator.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dbtable.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/diff.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dispatch.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dlz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dlz_dlopen.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dns64.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dnsrps.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dnssec.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dnstap.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ds.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dsdigest.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/dyndb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ecdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ecs.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/edns.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/events.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/fixedname.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/forward.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/geoip.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ipkeylist.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/iptable.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/journal.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/kasp.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keydata.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keyflags.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keymgr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keytable.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/keyvalues.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/lib.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/librpz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/lmdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/log.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/lookup.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/master.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/masterdump.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/message.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/name.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ncache.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/nsec.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/nsec3.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/nta.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/opcode.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/order.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/peer.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/portlist.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/private.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rbt.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rcode.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdata.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdataclass.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdatalist.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdataset.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdatasetiter.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdataslab.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rdatatype.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/request.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/resolver.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rootns.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rpz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rriterator.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/rrl.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/sdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/sdlz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/secalg.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/secproto.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/soa.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ssu.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/stats.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/tcpmsg.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/time.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/timer.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/tkey.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/tsec.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/tsig.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/ttl.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/types.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/update.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/validator.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/version.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/view.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/xfrin.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/zone.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/zonekey.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/zoneverify.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dns/zt.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dst/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dst/dst.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dst/gssapi.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/dst/result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zone_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zonekey.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zoneverify.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/zt.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/any_255/tsig_250.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/any_255/tsig_250.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/rdatastructpre.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/rdatastructsuf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/ch_3/a_1.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/ch_3/a_1.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/afsdb_18.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/afsdb_18.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/amtrelay_260.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/amtrelay_260.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/avc_258.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/avc_258.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/caa_257.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/caa_257.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cdnskey_60.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cdnskey_60.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cds_59.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cds_59.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cert_37.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cert_37.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cname_5.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/cname_5.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/csync_62.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/csync_62.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dlv_32769.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dlv_32769.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dname_39.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ds_43.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dname_39.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dnskey_48.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/dnskey_48.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/doa_259.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/doa_259.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ds_43.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/eui48_108.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/eui48_108.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/eui64_109.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/eui64_109.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/gpos_27.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/gpos_27.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/hinfo_13.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/hinfo_13.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/hip_55.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/hip_55.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ipseckey_45.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ipseckey_45.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/isdn_20.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/isdn_20.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/key_25.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/key_25.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/keydata_65533.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/keydata_65533.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/l32_105.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/l32_105.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/l64_106.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/l64_106.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/loc_29.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/loc_29.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/lp_107.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/lp_107.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mb_7.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mb_7.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/md_3.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/md_3.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mf_4.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mf_4.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mg_8.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mg_8.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/minfo_14.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/minfo_14.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mr_9.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mr_9.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mx_15.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/mx_15.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/naptr_35.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/naptr_35.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nid_104.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nid_104.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ninfo_56.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ninfo_56.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ns_2.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ns_2.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec3_50.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec3_50.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec3param_51.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec3param_51.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec_47.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nsec_47.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/null_10.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/null_10.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nxt_30.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/nxt_30.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/openpgpkey_61.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/openpgpkey_61.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/opt_41.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/opt_41.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/proforma.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/proforma.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ptr_12.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ptr_12.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rkey_57.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rkey_57.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rp_17.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rp_17.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rrsig_46.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rrsig_46.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rt_21.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/rt_21.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sig_24.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sig_24.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sink_40.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sink_40.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/smimea_53.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/smimea_53.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/soa_6.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/soa_6.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/spf_99.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/spf_99.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sshfp_44.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/sshfp_44.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ta_32768.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/ta_32768.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/talink_58.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/talink_58.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/tkey_249.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/tkey_249.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/tlsa_52.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/tlsa_52.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/txt_16.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/txt_16.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/uri_256.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/uri_256.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/x25_19.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/x25_19.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/zonemd_63.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/generic/zonemd_63.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/hs_4/a_1.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/hs_4/a_1.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/a6_38.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/a6_38.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/a_1.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/a_1.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/aaaa_28.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/aaaa_28.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/apl_42.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/apl_42.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/atma_34.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/atma_34.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/dhcid_49.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/dhcid_49.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/eid_31.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/eid_31.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/https_65.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/https_65.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/kx_36.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/kx_36.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nimloc_32.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nimloc_32.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nsap-ptr_23.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nsap-ptr_23.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nsap_22.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/nsap_22.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/px_26.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/px_26.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/srv_33.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/srv_33.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/svcb_64.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/svcb_64.h up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/wks_11.c up to 1.1 external/mpl/dhcp/bind/dist/lib/dns/rdata/in_1/wks_11.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/context.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/dnsconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/netdb.h.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/platform.h.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/resconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/types.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/irs/version.h up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/Kyuafile up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/context.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/dnsconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/gai_strerror.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/getaddrinfo.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/getnameinfo.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/resconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/irs/version.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/aes.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/app.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/assertions.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/astack.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/atomic.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/backtrace.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/barrier.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/base32.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/base64.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/bind9.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/buffer.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/bufferlist.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/cmocka.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/commandline.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/counter.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/crc64.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/deprecated.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/endian.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/errno.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/error.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/event.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/eventclass.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/file.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/formatcheck.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/fsaccess.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/fuzz.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/hash.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/heap.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/hex.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/hmac.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/ht.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/httpd.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/interfaceiter.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/iterated_hash.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/lang.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/lex.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/lfsr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/lib.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/likely.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/list.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/log.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/magic.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/managers.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/md.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/mem.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/meminfo.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/mutexblock.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/netaddr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/netmgr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/netscope.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/nonce.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/os.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/parseint.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/platform.h.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/pool.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/portset.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/print.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/quota.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/radix.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/random.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/ratelimiter.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/refcount.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/regex.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/region.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/resource.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/resultclass.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/rwlock.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/safe.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/serial.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/siphash.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/sockaddr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/socket.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/stats.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/stdio.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/strerr.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/string.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/symtab.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/task.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/taskpool.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/timer.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/tm.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/types.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/url.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/utf8.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/util.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/isc/version.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/constants.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/internal.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/pk11.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pk11/site.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pkcs11/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/include/pkcs11/pkcs11.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/Kyuafile up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/aes.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/app.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/assertions.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/astack.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/backtrace-emptytbl.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/backtrace.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/base32.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/base64.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/bind9.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/buffer.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/bufferlist.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/commandline.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/counter.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/crc64.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/entropy.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/entropy_private.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/error.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/event.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/fsaccess.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/hash.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/heap.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/hex.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/hmac.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/ht.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/httpd.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/iterated_hash.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/lex.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/lfsr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/lib.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/lib_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/log.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/managers.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/md.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/mem.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/mem_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/mutexblock.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netaddr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netscope.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/nonce.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/openssl_shim.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/openssl_shim.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/parseint.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pk11.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pk11_result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pool.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/portset.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/quota.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/radix.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/random.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/ratelimiter.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/regex.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/region.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/rwlock.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/safe.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/serial.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/siphash.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/sockaddr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/stats.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/string.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/symtab.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/task.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/task_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/taskpool.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/timer.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/timer_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/tls.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/tls_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/tm.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/trampoline.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/trampoline_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/url.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/utf8.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/version.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/xoshiro128starstar.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/netmgr-int.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/netmgr.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/tcp.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/tcpdns.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/udp.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/uv-compat.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/uv-compat.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/netmgr/uverr2result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/condition.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/mutex.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/once.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/isc/thread.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/condition.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/mutex.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/pthreads/thread.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/align.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/dir.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/net.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/netdb.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/offset.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/stat.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/stdatomic.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/stdtime.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/syslog.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/isc/time.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/dir.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/errno.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/errno2result.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/errno2result.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/file.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/fsaccess.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/ifiter_getifaddrs.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/interfaceiter.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/meminfo.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/net.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/os.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/pk11_api.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/resource.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/socket.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/socket_p.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/stdio.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/stdtime.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/syslog.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isc/unix/time.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/aclconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/cfg.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/dnsconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/grammar.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/kaspconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/log.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/namedconf.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/isccfg/version.h up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/include/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/Kyuafile up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/Makefile.in up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/aclconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/dnsconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/kaspconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/log.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/namedconf.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/parser.c up to 1.1 external/mpl/dhcp/bind/dist/lib/isccfg/version.c up to 1.1 external/mpl/dhcp/bind/dist/version up to 1.1 external/mpl/dhcp/bind/Makefile up to 1.1 external/mpl/dhcp/bind/Makefile.inc up to 1.1 external/mpl/dhcp/bind/include/dns/enumclass.h up to 1.1 external/mpl/dhcp/bind/include/dns/code.h up to 1.1 external/mpl/dhcp/bind/include/dns/enumtype.h up to 1.1 external/mpl/dhcp/bind/include/dns/rdatastruct.h up to 1.1 external/mpl/dhcp/bind/include/irs/netdb.h up to 1.1 external/mpl/dhcp/bind/include/irs/platform.h up to 1.1 external/mpl/dhcp/bind/include/config.h up to 1.1 external/mpl/dhcp/bind/include/isc/atomic.h up to 1.1 external/mpl/dhcp/bind/include/isc/platform.h up to 1.1 external/mpl/dhcp/bind/include/isc/stdatomic.h up to 1.1 external/mpl/dhcp/bind/lib/libdns/Makefile up to 1.1 external/mpl/dhcp/bind/lib/Makefile up to 1.1 external/mpl/dhcp/bind/lib/Makefile.inc up to 1.1 external/mpl/dhcp/bind/lib/libirs/Makefile up to 1.1 external/mpl/dhcp/bind/lib/libisc/Makefile up to 1.1 external/mpl/dhcp/bind/lib/libisc/isc.map up to 1.1 external/mpl/dhcp/bind/lib/libisccfg/Makefile up to 1.1 external/mpl/dhcp/Makefile up to 1.2 external/mpl/dhcp/Makefile.inc up to 1.13 external/mpl/dhcp/bin/relay/Makefile up to 1.3 external/mpl/dhcp/bin/server/Makefile up to 1.10 external/mpl/dhcp/lib/common/Makefile up to 1.3 share/mk/bsd.prog.mk (apply patch) doc/3RDPARTY (manually edited) nsd(8): update to 4.8.0 (fixes various CVEs) unbound(8): update to 1.19.1 (fixes various CVEs) wpa_supplicant(8): fix CVE-2023-52160 dhcpd(8): decouple from bind version. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Feb 13, 2024" "NLnet Labs" "unbound 1.19.1" a114 8 .B statistics\-inhibit\-zero: \fI If enabled, selected extended statistics with a value of 0 are inhibited from printing with \fIunbound\-control\fR(8). These are query types, query classes, query opcodes, answer rcodes (except NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMPL, REFUSED) and RPZ actions. Default is on. .TP d121 1 a121 1 .B interface: \fI d132 1 a132 1 .B ip\-address: \fI d228 1 a228 2 Suggested values are 512 to 4096. Default is 1232. The default value is the same as the default for edns\-buffer\-size. d352 1 a352 1 IPv6 traffic class field. d419 1 a419 1 IPv6 transport for sending DNS traffic, it does not impact the contents of a498 8 .B sock\-queue\-timeout: \fI\fR UDP queries that have waited in the socket buffer for a long time can be dropped. Default is 0, disabled. The time is set in seconds, 3 could be a good value to ignore old queries that likely the client does not need a reply for any more. This could happen if the host has not been able to service the queries for a while, i.e. Unbound is not running, and then is enabled again. It uses timestamp socket options. .TP a658 11 .B proxy\-protocol\-port: \fI List port numbers as proxy\-protocol\-port, and when interfaces are defined, eg. with the @@port suffix, as this port number, they support and expect PROXYv2. In this case the proxy address will only be used for the network communication and initial ACL (check if the proxy itself is denied/refused by configuration). The proxied address (if any) will then be used as the true client address and will be used where applicable for logging, ACL, DNSTAP, RPZ and IP ratelimiting. PROXYv2 is supported for UDP and TCP/TLS listening interfaces. There is no support for PROXYv2 on a DoH or DNSCrypt listening interface. Can list multiple, each on a new statement. .TP d676 3 a678 3 \fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIallow_cookie\fR, \fIdeny_non_local\fR or \fIrefuse_non_local\fR. The most specific netblock match is used, if none match \fIrefuse\fR is used. d681 1 a681 1 The \fIdeny\fR action stops queries from hosts from that netblock. d683 1 a683 1 The \fIrefuse\fR action stops queries too, but sends a DNS rcode REFUSED d686 1 a686 1 The \fIallow\fR action gives access to clients from that netblock. d706 1 a706 1 The \fIallow_snoop\fR action gives nonrecursive access too. This give a712 14 The \fIallow_cookie\fR action allows access to UDP queries that contain a valid DNS Cookie as specified in RFC 7873 and RFC 9018, when the \fBanswer\-cookie\fR option is enabled. UDP queries containing only a DNS Client Cookie and no Server Cookie, or an invalid DNS Cookie, will receive a BADCOOKIE response including a newly generated DNS Cookie, allowing clients to retry with that DNS Cookie. The \fIallow_cookie\fR action will also accept requests over stateful transports, regardless of the presence of an DNS Cookie and regardless of the \fBanswer\-cookie\fR setting. If \fBip\-ratelimit\fR is used, clients with a valid DNS Cookie will bypass the ratelimit. If a ratelimit for such clients is still needed, \fBip\-ratelimit\-cookie\fR can be used instead. .IP a743 40 .B interface\-action: \fI Similar to \fBaccess\-control:\fR but for interfaces. .IP The action is the same as the ones defined under \fBaccess\-control:\fR. Interfaces are \fIrefuse\fRd by default. By default only localhost (the IP netblock, not the loopback interface) is \fIallow\fRed through the default \fBaccess\-control:\fR behavior. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-tag: \fI <"list of tags"> Similar to \fBaccess\-control-tag:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-tag\-action: \fI Similar to \fBaccess\-control-tag-action:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-tag\-data: \fI <"resource record string"> Similar to \fBaccess\-control-tag-data:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-view: \fI Similar to \fBaccess\-control-view:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP a962 6 .B harden\-unknown\-additional: \fI Harden against unknown records in the authority section and additional section. Default is no. If no, such records are copied from the upstream and presented to the client together with the answer. If yes, it could hamper future protocol developments that want to add records. .TP a1216 14 .B disable\-edns\-do: \fI Disable the EDNS DO flag in upstream requests. It breaks DNSSEC validation for Unbound's clients. This results in the upstream name servers to not include DNSSEC records in their replies and could be helpful for devices that cannot handle DNSSEC information. When the option is enabled, clients that set the DO flag receive no EDNS record in the response to indicate the lack of support to them. If this option is enabled but Unbound is already configured for DNSSEC validation (i.e., the validator module is enabled; default) this option is implicitly turned off with a warning as to not break DNSSEC validation in Unbound. Default is no. .TP d1335 4 a1338 4 inform_redirect, always_transparent, block_a, always_refuse, always_nxdomain, always_null, noview, and are explained below. After that the default settings are listed. Use local\-data: to enter data into the local zone. Answers for local zones are authoritative DNS answers. By default the zones are class IN. a1412 6 \h'5'\fIblock_a\fR Like transparent, but ignores local data and resolves normally all query types excluding A. For A queries it unconditionally returns NODATA. Useful in cases when there is a need to explicitly force all apps to use IPv6 protocol and avoid any queries to IPv4. .TP 10 d1623 1 a1623 1 If the IP-netblock is an IPv6/IPv4 prefix, the record d1729 1 a1729 1 This option is experimental at this time. a1733 16 Default is 0 (disabled). .TP 5 .B ip\-ratelimit\-cookie: \fI Enable global ratelimiting of queries accepted per IP address with a valid DNS Cookie. This option is experimental at this time. The ratelimit is in queries per second that are allowed. More queries are completely dropped and will not receive a reply, SERVFAIL or otherwise. IP ratelimiting happens before looking in the cache. This option could be useful in combination with \fIallow_cookie\fR in an attempt to mitigate other amplification attacks than UDP reflections (e.g., attacks targeting Unbound itself) which are already handled with DNS Cookies. If used, the value is suggested to be higher than \fBip\-ratelimit\fR e.g., tenfold. Default is 0 (disabled). a1771 15 .B max\-sent\-count: \fI Hard limit on the number of outgoing queries Unbound will make while resolving a name, making sure large NS sets do not loop. Results in SERVFAIL when reached. It resets on query restarts (e.g., CNAME) and referrals. Default is 32. .TP 5 .B max\-query\-restarts: \fI Hard limit on the number of times Unbound is allowed to restart a query upon encountering a CNAME record. Results in SERVFAIL when reached. Changing this value needs caution as it can allow long CNAME chains to be accepted, where Unbound needs to verify (resolve) each link individually. Default is 11. .TP 5 a1786 12 .B answer\-cookie: \fI If enabled, Unbound will answer to requests containing DNS Cookies as specified in RFC 7873 and RFC 9018. Default is no. .TP 5 .B cookie\-secret: \fI<128 bit hex string> Server's secret for DNS Cookie generation. Useful to explicitly set for servers in an anycast deployment that need to share the secret in order to verify each other's Server Cookies. An example hex string would be "000102030405060708090a0b0c0d0e0f". Default is a 128 bits random secret generated at startup time. .TP 5 d1805 1 a1805 1 .TP 5 d1826 1 a1826 1 .B control\-interface: \fI a1828 2 If an interface name is used instead of an ip address, the list of ip addresses on that interface are used. d2018 7 a2024 26 Authority zones can be processed on two distinct, non-exclusive, configurable stages. .LP With \fBfor\-downstream:\fR \fIyes\fR (default), authority zones are processed after \fBlocal\-zones\fR and before cache. When used in this manner, Unbound responds like an authority server with no further processing other than returning an answer from the zone contents. A notable example, in this case, is CNAME records which are returned verbatim to downstream clients without further resolution. .LP With \fBfor\-upstream:\fR \fIyes\fR (default), authority zones are processed after the cache lookup, just before going to the network to fetch information for recursion. When used in this manner they provide a local copy of an authority server that speeds up lookups for that data during resolving. .LP If both options are enabled (default), client queries for an authority zone are answered authoritatively from Unbound, while internal queries that require data from the authority zone consult the local zone data instead of going to the network. .LP An interesting configuration is \fBfor\-downstream:\fR \fIno\fR, \fBfor\-upstream:\fR \fIyes\fR that allows for hyperlocal behavior where both client and internal queries consult the local zone data while resolving. In this case, the aforementioned CNAME example will result in a thoroughly resolved answer. a2217 15 .SS "NAT64 Operation" .LP NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only servers. It is controlled by two options in the \fBserver:\fR section: .TP .B do\-nat64: \fI\fR Use NAT64 to reach IPv4-only servers. Consider also enabling \fBprefer\-ip6\fR to prefer native IPv6 connections to nameservers. Default no. .TP .B nat64\-prefix: \fI\fR Use a specific NAT64 prefix to reach IPv4-only servers. Defaults to using the prefix configured in \fBdns64\-prefix\fR, which in turn defaults to 64:ff9b::/96. The prefix length must be one of /32, /40, /48, /56, /64 or /96. a2307 3 .LP This module does not interact with the \fBserve\-expired*\fR and \fBprefetch:\fR options. a2493 5 .TP .B cachedb-no-store: \fI\fR If the backend should be read from, but not written to. This makes this instance not store dns messages in the backend. But if data is available it is retrieved. The default is no. a2509 10 .B redis-server-path: \fI\fR The unix socket path to connect to the redis server. Off by default, and it can be set to "" to turn this off. Unix sockets may have better throughput than the IP address option. .TP .B redis-server-password: \fI""\fR The Redis AUTH password to use for the redis server. Only relevant if Redis is configured for client password authorisation. Off by default, and it can be set to "" to turn this off. .TP a2523 11 .TP .B redis-logical-db: \fI The logical database in Redis to use. These are databases in the same Redis instance sharing the same configuration and persisted in the same RDB/AOF file. If unsure about using this option, Redis documentation (https://redis.io/commands/select/) suggests not to use a single Redis instance for multiple unrelated applications. The default database in Redis is 0 while other logical databases need to be explicitly SELECT'ed upon connecting. This option defaults to 0. @ 1.1.1.8 log @Import 1.19.1 (previous was 1.16.3) 2 November 2023: Wouter - Set version number to 1.19.0. - Tag for 1.19.0rc1 release. 1 November 2023: George - Mention flex and bison in README.md when building from repository source. 1 November 2023: Wouter - Fix SSL compile failure for definition in log_crypto_err_io_code_arg. - Fix SSL compile failure for other missing definitions in log_crypto_err_io_code_arg. - Fix compilation without openssl, remove unused function warning. 31 October 2023: George - Fix #941: dnscrypt doesn't work after upgrade to 1.18 with suggestion by dukeartem to also fix the udp_ancil with dnscrypt. 30 October 2023: George - Merge #930 from Stuart Henderson: add void to log_ident_revert_to_default declaration. 30 October 2023: Wouter - autoconf. 24 October 2023: George - Clearer configure text for missing protobuf-c development libraries. 20 October 2023: Wouter - Merge #951: Cachedb no store. The cachedb-no-store: yes option is used to stop cachedb from writing messages to the backend storage. It reads messages when data is available from the backend. The default is no. 19 October 2023: Wouter - Fix to print detailed errors when an SSL IO routine fails via SSL_get_error. 18 October 2023: George - Mailing list patches from Daniel Gröber for DNS64 fallback to plain AAAA when no A record exists for synthesis, and minor DNS64 code refactoring for better readability. - Fixes for the DNS64 patches. - Update the dns64_lookup.rpl test for the DNS64 fallback patch. - Merge #955 from buevsan: fix ipset wrong behavior. - Update testdata/ipset.tdir test for ipset fix. 17 October 2023: Wouter - Fix #954: Inconsistent RPZ handling for A record returned along with CNAME. 16 October 2023: George - Expose the script filename in the Python module environment 'mod_env' instead of the config_file structure which includes the linked list of scripts in a multi Python module setup; fixes #79. - Expose the configured listening and outgoing interfaces, if any, as a list of strings in the Python 'config_file' class instead of the current Swig object proxy; fixes #79. - For multi Python module setups, clean previously parsed module functions in __main__'s dictionary, if any, so that only current module functions are registered. 13 October 2023: George - Better fix for infinite loop when reading multiple lines of input on a broken remote control socket, by treating a zero byte line the same as transmission end. Addesses #947 and #948. 12 October 2023: Wouter - Merge #944: Disable EDNS DO. Disable the EDNS DO flag in upstream requests. This can be helpful for devices that cannot handle DNSSEC information. But it should not be enabled otherwise, because that would stop DNSSEC validation. The DNSSEC validation would not work for Unbound itself, and also not for downstream users. Default is no. The option is disable-edns-do: no 11 October 2023: George - Fix #850: [FR] Ability to use specific database in Redis, with new redis-logical-db configuration option. 11 October 2023: Wouter - Fix #949: "could not create control compt". - Fix that cachedb does not warn when serve-expired is disabled about use of serve-expired-reply-ttl and serve-expired-client-timeout. - Fix for #949: Fix pythonmod/ubmodule-tst.py for Python 3.x. 10 October 2023: George - Fix infinite loop when reading multiple lines of input on a broken remote control socket. Addesses #947 and #948. 9 October 2023: Wouter - Fix edns subnet so that queries with a source prefix of zero cause the recursor send no edns subnet option to the upstream. - Fix that printout of EDNS options shows the EDNS cookie option by name. 4 October 2023: Wouter - Fix #946: Forwarder returns servfail on upstream response noerror no data. 3 October 2023: George - Merge #881: Generalise the proxy protocol code. 2 October 2023: George - Fix misplaced comment. 22 September 2023: Wouter - Fix #942: 1.18.0 libunbound DNS regression when built without OpenSSL. 18 September 2023: Wouter - Fix rpz tcp-only action with rpz triggers nsdname and nsip. 15 September 2023: Wouter - Merge #936: Check for c99 with autoconf versions prior to 2.70. - Fix to remove two c99 notations. 14 September 2023: Wouter - Fix authority zone answers for obscured DNAMEs and delegations. 8 September 2023: Wouter - Fix send of udp retries when ENOBUFS is returned. It stops looping and also waits for the condition to go away. Reported by Florian Obser. 7 September 2023: Wouter - Fix to scrub resource records of type A and AAAA that have an inappropriate size. They are removed from responses. - Fix to move msgparse_rrset_remove_rr code to util/msgparse.c. - Fix to add EDE text when RRs have been removed due to length. - Fix to set ede match in unit test for rr length removal. - Fix to print EDE text in readable form in output logs. 6 September 2023: Wouter - Merge #931: Prevent warnings from -Wmissing-prototypes. 31 August 2023: Wouter - Fix autoconf 2.69 warnings in configure. - Fix #927: unbound 1.18.0 make test error. Fix make test without SHA1. 30 August 2023: Wouter - Fix for WKS call to getservbyname that creates allocation on exit in unit test by testing numbers first and testing from the services list later. 28 August 2023: Wouter - Fix for version generation race condition that ignored changes. 25 August 2023: Wouter - Fix compile error on NetBSD in util/netevent.h. 23 August 2023: Wouter - Tag for 1.18.0rc1 release. This became the 1.18.0 release on 30 aug 2023, with the fix from 25 aug, fix compile on NetBSD included. The repository continues with version 1.18.1. 22 August 2023: Wouter - Set version number to 1.18.0. 21 August 2023: Wouter - Debug Windows ci workflow. - Fix windows ci workflow to install bison and flex. - Fix for #925: unbound.service: Main process exited, code=killed, status=11/SEGV. Fixes cachedb configuration handling. - Fix #923: processQueryResponse() THROWAWAY should be mindful of fail_reply. - Fix unit test for unbound-control to work when threads are disabled, and fix cache dump check. 18 August 2023: Wouter - Fix for iter_dec_attempts that could cause a hang, part of capsforid and qname minimisation, depending on the settings. - Fix uninitialized memory passed in padding bytes of cmsg to sendmsg. - Fix stat_values test to work with dig that enables DNS cookies. 17 August 2023: Wouter - Merge PR #762: Downstream DNS Server Cookies a la RFC7873 and RFC9018. Create server cookies for clients that send client cookies. This needs to be explicitly turned on in the config file with: `answer-cookie: yes`. A `cookie-secret:` can be configured for anycast setups. Without one, a random cookie secret is generated. The acl option `allow_cookie` allows queries with either a valid cookie or over a stateful transport. The statistics output has `queries_cookie_valid` and `queries_cookie_client` and `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:` value determines a rate limit for queries with cookies, if desired. - Fix regional_alloc_init for potential unaligned source of the copy. - Fix ip_ratelimit test to work with dig that enables DNS cookies. 2 August 2023: George - Move a cache reply callback in worker.c closer to the cache reply generation. 1 August 2023: George - Merge #911 from natalie-reece: Exclude EDE before other EDNS options when there isn't enough space. - For #911: Try to trim EXTRA-TEXT (and LDNS_EDE_OTHER options altogether) before giving up on attaching EDE options. - More braces and formatting for Fix for EDNS EDE size calculation to avoid future bugs. - Fix to use the now cached EDE, if any, for CD_bit queries. 1 August 2023: Wouter - Fix for EDNS EDE size calculation. 31 July 2023: George - Merge #790 from Tom Carpay: Add support for EDE caching in cachedb and subnetcache. 31 July 2023: Wouter - iana portlist update. 30 July 2023: George - Merge #759 from Tom Carpay: Add EDE (RFC8914) caching. 28 July 2023: George - Fix unused variable compile warning for kernel timestamps in netevent.c 21 July 2023: George - Merge #857 from eaglegai: fix potential memory leaks when errors happen. - For #857: fix mixed declarations and code. - Merge #118 from mibere: Changed verbosity level for Redis init & deinit. - Merge #390 from Frank Riley: Add missing callbacks to the python module. - Cleaner failure code for callback functions in interface.i. - Merge #889 from borisVanhoof: Free memory in error case + remove unused function. - For #889: use netcat-openbsd instead of netcat-traditional. - For #889: Account for num_detached_states before possible mesh_state_delete when erroring out. 20 July 2023: George - Merge #909 from headshog: Numeric truncation when parsing TYPEXX and CLASSXX representation. - For #909: Fix return values. - Merge #901 from Sergei Trofimovich: config: improve handling of unknown modules. 20 July 2023: Wouter - For #909: Fix RR class comparison. 14 July 2023: George - More clear description of the different auth-zone behaviors on the man page. 13 July 2023: George - Merge #880 from chipitsine: services/authzone.c: remove redundant check. 11 July 2023: George - Merge #664 from tilan7763: Add prefetch support for subnet cache entries. - For #664: Easier code flow for subnetcache prefetching. - For #664: Add testcase. - For #664: Rename subnet_prefetch tests to subnet_global_prefetch to differentiate from the new subnet prefetch support. 3 July 2023: George - Merge #739: Add SVCB dohpath support. - Code cleanup for sldns_str2wire_svcparam_key_lookup. - Merge #802: add validation EDEs to queries where the CD bit is set. - For #802: Cleanup comments and add RCODE check for CD bit test case. - Skip the 00-lint test. splint is not maintained; it either does not work or produces false positives. Static analysis is handled in the clang test. 3 July 2023: Wouter - Fix #906: warning: ‘Py_SetProgramName’ is deprecated. - Fix dereference of NULL variable warning in mesh_do_callback. 29 June 2023: George - More fixes for reference counting for python module and clean up failure code. - Merge #827 from rcmcdonald91: Eliminate unnecessary Python reloading which causes memory leaks. 29 June 2023: Wouter - Fix python modules with multiple scripts, by incrementing reference counts. 27 June 2023: George - Merge #892: Add cachedb hit stat. Introduces 'num.query.cachedb' as a new statistical counter. - Remove warning about unknown cast-function-type warning pragma. 22 June 2023: Wouter - Merge #903: contrib: add yocto compatible init script. 15 June 2023: Philip - Fix for issue #887 (Timeouts to forward servers on BSD based system with ASLR) - Probably fixes #516 (Stream reuse does not work on Windows) as well 14 June 2023: George - Properly handle all return values of worker_check_request during early EDE code. - Do not check the incoming request more than once. 12 June 2023: Wouter - Merge #896: Fix: #895: pythonmodule: add all site-packages directories to sys.path. - Fix #895: python + sysconfig gives ANOTHER path comparing to distutils. - Fix for uncertain unit test for doh buffer size events. 25 May 2023: Wouter - Fix unbound-dnstap-socket printout when no query is present. - Fix unbound-dnstap-socket time fraction conversion for printout. 19 May 2023: Wouter - Fix RPZ removal of client-ip, nsip, nsdname triggers from IXFR. - Fix to remove unused variables from RPZ clientip data structure. 16 May 2023: Wouter - Fix #888: [FR] Use kernel timestamps for dnstap. - Fix to print debug log for ancillary data with correct IP address. 11 May 2023: Wouter - Fix warning in windows compile, in set_recvtimestamp. 4 May 2023: Wouter - Fix #885: Error: util/configlexer.c: No such file or directory, adds error messages explaining to install flex and bison. - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h. - Fix doxygen in addr_to_nat64 header definition. 1 May 2023: George - Merge #722 from David 'eqvinox' Lamparter: NAT64 support. - For #722: minor fixes, formatting, refactoring. 1 May 2023: Wouter - Fix RPZ IP responses with trigger rpz-drop on cache entries, that they are dropped. 26 April 2023: Philip - Fix issue #860: Bad interaction with 0 TTL records and serve-expired 26 April 2023: Wouter - Merge #882 from vvfedorenko: Features/dropqueuedpackets, with sock-queue-timeout option that drops packets that have been in the socket queue for too long. Added statistics num.queries_timed_out and query.queue_time_us.max that track the socket queue timeouts. - Fix for #882: small changes, date updated in Copyright for util/timeval_func.c and util/timeval_func.h. Man page entries and example entry. - Fix for #882: document variable to stop doxygen warning. 19 April 2023: Wouter - Fix for #878: Invalid IP address in unbound.conf causes Segmentation Fault on OpenBSD. 14 April 2023: Wouter - Merge #875: change obsolete txt URL in unbound-anchor.c to point to RFC 7958, and Fix #874. 13 April 2023: Wouter - Fix build badge, from failing travis link to github ci action link. 6 April 2023: Wouter - Fix for #870: Add test case for the qname minimisation and CNAME. 4 April 2023: Wouter - Fix #870: NXDOMAIN instead of NOERROR rcode when asked for existing CNAME record. 24 March 2023: Philip - Fix issue #676: Unencrypted query is sent when forward-tls-upstream: yes is used without tls-cert-bundle - Extra consistency check to make sure that when TLS is requested, either we set up a TLS connection or we return an error. 21 March 2023: Philip - Fix issue #851: reserved identifier violation 20 March 2023: Wouter - iana portlist update. 17 March 2023: George - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option to ignore the unexpected eof while reading in openssl >= 3. 16 March 2023: Wouter - Fix ssl.h include brackets, instead of quotes. 14 March 2023: Wouter - Fix unbound-dnstap-socket test program to reply the finish frame over a TLS connection correctly. 23 February 2023: Wouter - Fix for #852: Completion of error handling. 21 February 2023: Philip - Fix #825: Unexpected behavior with client-subnet-always-forward and serve-expired 10 February 2023: George - Clean up iterator/iterator.c::error_response_cache() and allow for better interaction with serve-expired, prefetch and cached error responses. 9 February 2023: George - Allow TTL refresh of expired error responses. - Add testcase for refreshing expired error responses. 9 February 2023: Wouter - Fix to ignore entirely empty responses, and try at another authority. This turns completely empty responses, a type of noerror/nodata into a servfail, but they do not conform to RFC2308, and the retry can fetch improved content. - Fix unit tests for spurious empty messages. - Fix consistency of unit test without roundrobin answers for the cnametooptout unit test. - Fix to git ignore the library symbol file that configure can create. 8 February 2023: Wouter - Fix #841: Unbound won't build with aaaa-filter-iterator.patch. 30 January 2023: George - Add duration variable for speed_local.test. 26 January 2023: Wouter - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes. 23 January 2023: George - Fix #833: [FR] Ability to set the Redis password. 23 January 2023: Wouter - Fix #835: [FR] Ability to use Redis unix sockets. 20 January 2023: Wouter - Merge #819: Added new static zone type block_a to suppress all A queries for specific zones. 19 January 2023: Wouter - Set max-udp-size default to 1232. This is the same default value as the default value for edns-buffer-size. It restricts client edns buffer size choices, and makes unbound behave similar to other DNS resolvers. The new choice, down from 4096 means it is harder to get large responses from Unbound. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Add harden-unknown-additional option. It removes unknown records from the authority section and additional section. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Set default for harden-unknown-additional to no. So that it does not hamper future protocol developments. - Fix test for new default. 18 January 2023: Wouter - Fix not following cleared RD flags potentially enables amplification DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab, Tsinghua University. The fix stops query loops, by refusing to send RD=0 queries to a forwarder, they still get answered from cache. 13 January 2023: Wouter - Merge #826: Ðdd a metric about the maximum number of collisions in lrushah. - Improve documentation for #826, describe the large collisions amount. 9 January 2023: Wouter - Fix python module install path detection. - Fix python version detection in configure. 6 January 2023: Wouter - Fix #823: Response change to NODATA for some ANY queries since 1.12, tested on 1.16.1. - Fix wildcard in hyperlocal zone service degradation, reported by Sergey Kacheev. This fix is included in 1.17.1rc2. That became 1.17.1 on 12 Jan 2023, the code repo continues with 1.17.2. 1.17.1 excludes fix #823, it is included forwards. 5 January 2023: Wouter - Tag for 1.17.1 release. 2 January 2023: Wouter - Fix windows compile for libunbound subprocess reap comm point closes. - Update github workflows to use checkout v3. 14 December 2022: George - Merge #569 from JINMEI Tatuya: add keep-cache option to 'unbound-control reload' to keep caches. 13 December 2022: George - Expose 'statistics-inhibit-zero' as a configuration option; the default value retains Unbound's behavior. - Expose 'max-sent-count' as a configuration option; the default value retains Unbound's behavior. - Merge #461 from Christian Allred: Add max-query-restarts option. Exposes an internal configuration but the default value retains Unbound's behavior. 13 December 2022: Wouter - Merge #808: Wrap Makefile script's directory variables in quotes. - Fix to wrap Makefile scripts directory in quotes for uninstall. 1 December 2022: Wouter - Fix #773: When used with systemd-networkd, unbound does not start until systemd-networkd-wait-online.service times out. 30 November 2022: George - Add SVCB and HTTPS to the types removed by 'unbound-control flush'. - Clear documentation for interactivity between the subnet module and the serve-expired and prefetch configuration options. 30 November 2022: Wouter - Fix #782: Segmentation fault in stats.c:404. 28 November 2022: Wouter - Fix for the ignore of tcp events for closed comm points, preserve the use after free protection features. 23 November 2022: Philip - Merge #720 from jonathangray: fix use after free when WSACreateEvent() fails. 22 November 2022: George - Ignore expired error responses. 11 November 2022: Wouter - Fix #779: [doc] Missing documention in ub_resolve_event() for callback parameter was_ratelimited. 9 November 2022: George - Complementary fix for distutils.sysconfig deprecation in Python 3.10 to commit 62c5039ab9da42713e006e840b7578e01d66e7f2. 8 November 2022: Wouter - Fix to ignore tcp events for closed comm points. - Fix to make sure to not read again after a tcp comm point is closed. - Fix #775: libunbound: subprocess reap causes parent process reap to hang. - iana portlist update. 21 October 2022: George - Merge #767 from jonathangray: consistently use IPv4/IPv6 in unbound.conf.5. 21 October 2022: Wouter - Fix that cachedb does not store failures in the external cache. 18 October 2022: George - Clarify the use of MAX_SENT_COUNT in the iterator code. 17 October 2022: Wouter - testcode/dohclient sets log identity to its name. 14 October 2022: Wouter - Merge #768 from fobser: Arithmetic on a pointer to void is a GNU extension. - In unit test, print python script name list correctly. 13 October 2022: Wouter - Tag for 1.17.0 release. The code repository continues with 1.17.1. 11 October 2022: George - Fix PROXYv2 header read for TCP connections when no proxied addresses are provided. 7 October 2022: Wouter - Tag for 1.17.0rc1 release. 7 October 2022: George - Fix to stop possible loops in the tcp reuse code (write_wait list and tcp_wait list). Based on analysis and patch from Prad Seniappan and Karthik Umashankar. - Fix unit test to properly test the reuse_write_wait_pop function. 6 October 2022: Wouter - Fix to stop responses with TC flag from resulting in partial responses. It retries to fetch the data elsewhere, or fails the query and in depth fix removes the TC flag from the cached item. - Fix proxy length debug output printout typecasts. 5 October 2022: Wouter - Fix dnscrypt compile for proxy protocol code changes. 5 October 2022: George - Use DEBUG_TDIR from environment in mini_tdir.sh for debugging. - Fix string comparison in mini_tdir.sh. - Make ede.tdir test more predictable by using static data. - Fix checkconf test for dnscrypt and proxy port. 4 October 2022: George - Merge #764: Leniency for target discovery when under load (for NRDelegation changes). 4 October 2022: Wouter - Fix static analysis report to remove dead code from the rpz_callback_from_iterator_module function. - Fix to clean up after the acl_interface unit test. 3 October 2022: George - Merge #760: PROXYv2 downstream support. (New proxy-protocol-port configuration option). 3 October 2022: Wouter - Fix to remove erroneous TC flag from TCP upstream. - Fix test tdir skip report printout. - Fix windows compile, the identifier interface is defined in headers. - Fix to close errno block in comm_point_tcp_handle_read outside of ifdef. 26 September 2022: George - Better output for skipped tdir tests. @ text @d1 1 a1 1 .TH "unbound.conf" "5" "Feb 13, 2024" "NLnet Labs" "unbound 1.19.1" a114 8 .B statistics\-inhibit\-zero: \fI If enabled, selected extended statistics with a value of 0 are inhibited from printing with \fIunbound\-control\fR(8). These are query types, query classes, query opcodes, answer rcodes (except NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMPL, REFUSED) and RPZ actions. Default is on. .TP d121 1 a121 1 .B interface: \fI d132 1 a132 1 .B ip\-address: \fI d228 1 a228 2 Suggested values are 512 to 4096. Default is 1232. The default value is the same as the default for edns\-buffer\-size. d352 1 a352 1 IPv6 traffic class field. d419 1 a419 1 IPv6 transport for sending DNS traffic, it does not impact the contents of a498 8 .B sock\-queue\-timeout: \fI\fR UDP queries that have waited in the socket buffer for a long time can be dropped. Default is 0, disabled. The time is set in seconds, 3 could be a good value to ignore old queries that likely the client does not need a reply for any more. This could happen if the host has not been able to service the queries for a while, i.e. Unbound is not running, and then is enabled again. It uses timestamp socket options. .TP a658 11 .B proxy\-protocol\-port: \fI List port numbers as proxy\-protocol\-port, and when interfaces are defined, eg. with the @@port suffix, as this port number, they support and expect PROXYv2. In this case the proxy address will only be used for the network communication and initial ACL (check if the proxy itself is denied/refused by configuration). The proxied address (if any) will then be used as the true client address and will be used where applicable for logging, ACL, DNSTAP, RPZ and IP ratelimiting. PROXYv2 is supported for UDP and TCP/TLS listening interfaces. There is no support for PROXYv2 on a DoH or DNSCrypt listening interface. Can list multiple, each on a new statement. .TP d676 3 a678 3 \fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIallow_cookie\fR, \fIdeny_non_local\fR or \fIrefuse_non_local\fR. The most specific netblock match is used, if none match \fIrefuse\fR is used. d681 1 a681 1 The \fIdeny\fR action stops queries from hosts from that netblock. d683 1 a683 1 The \fIrefuse\fR action stops queries too, but sends a DNS rcode REFUSED d686 1 a686 1 The \fIallow\fR action gives access to clients from that netblock. d706 1 a706 1 The \fIallow_snoop\fR action gives nonrecursive access too. This give a712 14 The \fIallow_cookie\fR action allows access to UDP queries that contain a valid DNS Cookie as specified in RFC 7873 and RFC 9018, when the \fBanswer\-cookie\fR option is enabled. UDP queries containing only a DNS Client Cookie and no Server Cookie, or an invalid DNS Cookie, will receive a BADCOOKIE response including a newly generated DNS Cookie, allowing clients to retry with that DNS Cookie. The \fIallow_cookie\fR action will also accept requests over stateful transports, regardless of the presence of an DNS Cookie and regardless of the \fBanswer\-cookie\fR setting. If \fBip\-ratelimit\fR is used, clients with a valid DNS Cookie will bypass the ratelimit. If a ratelimit for such clients is still needed, \fBip\-ratelimit\-cookie\fR can be used instead. .IP a743 40 .B interface\-action: \fI Similar to \fBaccess\-control:\fR but for interfaces. .IP The action is the same as the ones defined under \fBaccess\-control:\fR. Interfaces are \fIrefuse\fRd by default. By default only localhost (the IP netblock, not the loopback interface) is \fIallow\fRed through the default \fBaccess\-control:\fR behavior. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-tag: \fI <"list of tags"> Similar to \fBaccess\-control-tag:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-tag\-action: \fI Similar to \fBaccess\-control-tag-action:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-tag\-data: \fI <"resource record string"> Similar to \fBaccess\-control-tag-data:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP .B interface\-view: \fI Similar to \fBaccess\-control-view:\fR but for interfaces. .IP Note that the interface needs to be already specified with \fBinterface:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR settings for targeted clients. .TP a962 6 .B harden\-unknown\-additional: \fI Harden against unknown records in the authority section and additional section. Default is no. If no, such records are copied from the upstream and presented to the client together with the answer. If yes, it could hamper future protocol developments that want to add records. .TP a1216 14 .B disable\-edns\-do: \fI Disable the EDNS DO flag in upstream requests. It breaks DNSSEC validation for Unbound's clients. This results in the upstream name servers to not include DNSSEC records in their replies and could be helpful for devices that cannot handle DNSSEC information. When the option is enabled, clients that set the DO flag receive no EDNS record in the response to indicate the lack of support to them. If this option is enabled but Unbound is already configured for DNSSEC validation (i.e., the validator module is enabled; default) this option is implicitly turned off with a warning as to not break DNSSEC validation in Unbound. Default is no. .TP d1335 4 a1338 4 inform_redirect, always_transparent, block_a, always_refuse, always_nxdomain, always_null, noview, and are explained below. After that the default settings are listed. Use local\-data: to enter data into the local zone. Answers for local zones are authoritative DNS answers. By default the zones are class IN. a1412 6 \h'5'\fIblock_a\fR Like transparent, but ignores local data and resolves normally all query types excluding A. For A queries it unconditionally returns NODATA. Useful in cases when there is a need to explicitly force all apps to use IPv6 protocol and avoid any queries to IPv4. .TP 10 d1623 1 a1623 1 If the IP-netblock is an IPv6/IPv4 prefix, the record d1729 1 a1729 1 This option is experimental at this time. a1733 16 Default is 0 (disabled). .TP 5 .B ip\-ratelimit\-cookie: \fI Enable global ratelimiting of queries accepted per IP address with a valid DNS Cookie. This option is experimental at this time. The ratelimit is in queries per second that are allowed. More queries are completely dropped and will not receive a reply, SERVFAIL or otherwise. IP ratelimiting happens before looking in the cache. This option could be useful in combination with \fIallow_cookie\fR in an attempt to mitigate other amplification attacks than UDP reflections (e.g., attacks targeting Unbound itself) which are already handled with DNS Cookies. If used, the value is suggested to be higher than \fBip\-ratelimit\fR e.g., tenfold. Default is 0 (disabled). a1771 15 .B max\-sent\-count: \fI Hard limit on the number of outgoing queries Unbound will make while resolving a name, making sure large NS sets do not loop. Results in SERVFAIL when reached. It resets on query restarts (e.g., CNAME) and referrals. Default is 32. .TP 5 .B max\-query\-restarts: \fI Hard limit on the number of times Unbound is allowed to restart a query upon encountering a CNAME record. Results in SERVFAIL when reached. Changing this value needs caution as it can allow long CNAME chains to be accepted, where Unbound needs to verify (resolve) each link individually. Default is 11. .TP 5 a1786 12 .B answer\-cookie: \fI If enabled, Unbound will answer to requests containing DNS Cookies as specified in RFC 7873 and RFC 9018. Default is no. .TP 5 .B cookie\-secret: \fI<128 bit hex string> Server's secret for DNS Cookie generation. Useful to explicitly set for servers in an anycast deployment that need to share the secret in order to verify each other's Server Cookies. An example hex string would be "000102030405060708090a0b0c0d0e0f". Default is a 128 bits random secret generated at startup time. .TP 5 d1805 1 a1805 1 .TP 5 d1826 1 a1826 1 .B control\-interface: \fI a1828 2 If an interface name is used instead of an ip address, the list of ip addresses on that interface are used. d2018 7 a2024 26 Authority zones can be processed on two distinct, non-exclusive, configurable stages. .LP With \fBfor\-downstream:\fR \fIyes\fR (default), authority zones are processed after \fBlocal\-zones\fR and before cache. When used in this manner, Unbound responds like an authority server with no further processing other than returning an answer from the zone contents. A notable example, in this case, is CNAME records which are returned verbatim to downstream clients without further resolution. .LP With \fBfor\-upstream:\fR \fIyes\fR (default), authority zones are processed after the cache lookup, just before going to the network to fetch information for recursion. When used in this manner they provide a local copy of an authority server that speeds up lookups for that data during resolving. .LP If both options are enabled (default), client queries for an authority zone are answered authoritatively from Unbound, while internal queries that require data from the authority zone consult the local zone data instead of going to the network. .LP An interesting configuration is \fBfor\-downstream:\fR \fIno\fR, \fBfor\-upstream:\fR \fIyes\fR that allows for hyperlocal behavior where both client and internal queries consult the local zone data while resolving. In this case, the aforementioned CNAME example will result in a thoroughly resolved answer. a2217 15 .SS "NAT64 Operation" .LP NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only servers. It is controlled by two options in the \fBserver:\fR section: .TP .B do\-nat64: \fI\fR Use NAT64 to reach IPv4-only servers. Consider also enabling \fBprefer\-ip6\fR to prefer native IPv6 connections to nameservers. Default no. .TP .B nat64\-prefix: \fI\fR Use a specific NAT64 prefix to reach IPv4-only servers. Defaults to using the prefix configured in \fBdns64\-prefix\fR, which in turn defaults to 64:ff9b::/96. The prefix length must be one of /32, /40, /48, /56, /64 or /96. a2307 3 .LP This module does not interact with the \fBserve\-expired*\fR and \fBprefetch:\fR options. a2493 5 .TP .B cachedb-no-store: \fI\fR If the backend should be read from, but not written to. This makes this instance not store dns messages in the backend. But if data is available it is retrieved. The default is no. a2509 10 .B redis-server-path: \fI\fR The unix socket path to connect to the redis server. Off by default, and it can be set to "" to turn this off. Unix sockets may have better throughput than the IP address option. .TP .B redis-server-password: \fI""\fR The Redis AUTH password to use for the redis server. Only relevant if Redis is configured for client password authorisation. Off by default, and it can be set to "" to turn this off. .TP a2523 11 .TP .B redis-logical-db: \fI The logical database in Redis to use. These are databases in the same Redis instance sharing the same configuration and persisted in the same RDB/AOF file. If unsure about using this option, Redis documentation (https://redis.io/commands/select/) suggests not to use a single Redis instance for multiple unrelated applications. The default database in Redis is 0 while other logical databases need to be explicitly SELECT'ed upon connecting. This option defaults to 0. @ 1.1.1.1.2.1 log @file unbound.conf.5.in was added on branch pgoyette-localcount on 2016-09-14 03:04:07 +0000 @ text @d1 1328 @ 1.1.1.1.2.2 log @Sync with HEAD @ text @a0 1328 .TH "unbound.conf" "5" "Jun 9, 2016" "NLnet Labs" "unbound 1.5.9" .\" .\" unbound.conf.5 -- unbound.conf manual .\" .\" Copyright (c) 2007, NLnet Labs. All rights reserved. .\" .\" See LICENSE for the license. .\" .\" .SH "NAME" .B unbound.conf \- Unbound configuration file. .SH "SYNOPSIS" .B unbound.conf .SH "DESCRIPTION" .B unbound.conf is used to configure \fIunbound\fR(8). The file format has attributes and values. Some attributes have attributes inside them. The notation is: attribute: value. .P Comments start with # and last to the end of line. Empty lines are ignored as is whitespace at the beginning of a line. .P The utility \fIunbound\-checkconf\fR(8) can be used to check unbound.conf prior to usage. .SH "EXAMPLE" An example config file is shown below. Copy this to /etc/unbound/unbound.conf and start the server with: .P .nf $ unbound \-c /etc/unbound/unbound.conf .fi .P Most settings are the defaults. Stop the server with: .P .nf $ kill `cat /etc/unbound/unbound.pid` .fi .P Below is a minimal config file. The source distribution contains an extensive example.conf file with all the options. .P .nf # unbound.conf(5) config file for unbound(8). server: directory: "/etc/unbound" username: unbound # make sure unbound can access entropy from inside the chroot. # e.g. on linux the use these commands (on BSD, devfs(8) is used): # mount \-\-bind \-n /dev/random /etc/unbound/dev/random # and mount \-\-bind \-n /dev/log /etc/unbound/dev/log chroot: "/etc/unbound" # logfile: "/etc/unbound/unbound.log" #uncomment to use logfile. pidfile: "/etc/unbound/unbound.pid" # verbosity: 1 # uncomment and increase to get more logging. # listen on all interfaces, answer queries from the local subnet. interface: 0.0.0.0 interface: ::0 access\-control: 10.0.0.0/8 allow access\-control: 2001:DB8::/64 allow .fi .SH "FILE FORMAT" There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute is followed by its containing attributes, or a value. .P Files can be included using the .B include: directive. It can appear anywhere, it accepts a single file name as argument. Processing continues as if the text from the included file was copied into the config file at that point. If also using chroot, using full path names for the included files works, relative pathnames for the included names work if the directory where the daemon is started equals its chroot/working directory. Wildcards can be used to include multiple files, see \fIglob\fR(7). .SS "Server Options" These options are part of the .B server: clause. .TP .B verbosity: \fI The verbosity number, level 0 means no verbosity, only errors. Level 1 gives operational information. Level 2 gives detailed operational information. Level 3 gives query level information, output per query. Level 4 gives algorithm level information. Level 5 logs client identification for cache misses. Default is level 1. The verbosity can also be increased from the commandline, see \fIunbound\fR(8). .TP .B statistics\-interval: \fI The number of seconds between printing statistics to the log for every thread. Disable with value 0 or "". Default is disabled. The histogram statistics are only printed if replies were sent during the statistics interval, requestlist statistics are printed for every interval (but can be 0). This is because the median calculation requires data to be present. .TP .B statistics\-cumulative: \fI If enabled, statistics are cumulative since starting unbound, without clearing the statistics counters after logging the statistics. Default is no. .TP .B extended\-statistics: \fI If enabled, extended statistics are printed from \fIunbound\-control\fR(8). Default is off, because keeping track of more statistics takes time. The counters are listed in \fIunbound\-control\fR(8). .TP .B num\-threads: \fI The number of threads to create to serve clients. Use 1 for no threading. .TP .B port: \fI The port number, default 53, on which the server responds to queries. .TP .B interface: \fI Interface to use to connect to the network. This interface is listened to for queries from clients, and answers to clients are given from it. Can be given multiple times to work on several interfaces. If none are given the default is to listen to localhost. The interfaces are not changed on a reload (kill \-HUP) but only on restart. A port number can be specified with @@port (without spaces between interface and port number), if not specified the default port (from \fBport\fR) is used. .TP .B ip\-address: \fI Same as interface: (for easy of compatibility with nsd.conf). .TP .B interface\-automatic: \fI Detect source interface on UDP queries and copy them to replies. This feature is experimental, and needs support in your OS for particular socket options. Default value is no. .TP .B outgoing\-interface: \fI Interface to use to connect to the network. This interface is used to send queries to authoritative servers and receive their replies. Can be given multiple times to work on several interfaces. If none are given the default (all) is used. You can specify the same interfaces in .B interface: and .B outgoing\-interface: lines, the interfaces are then used for both purposes. Outgoing queries are sent via a random outgoing interface to counter spoofing. .TP .B outgoing\-range: \fI Number of ports to open. This number of file descriptors can be opened per thread. Must be at least 1. Default depends on compile options. Larger numbers need extra resources from the operating system. For performance a a very large value is best, use libevent to make this possible. .TP .B outgoing\-port\-permit: \fI Permit unbound to open this port or range of ports for use to send queries. A larger number of permitted outgoing ports increases resilience against spoofing attempts. Make sure these ports are not needed by other daemons. By default only ports above 1024 that have not been assigned by IANA are used. Give a port number or a range of the form "low\-high", without spaces. .IP The \fBoutgoing\-port\-permit\fR and \fBoutgoing\-port\-avoid\fR statements are processed in the line order of the config file, adding the permitted ports and subtracting the avoided ports from the set of allowed ports. The processing starts with the non IANA allocated ports above 1024 in the set of allowed ports. .TP .B outgoing\-port\-avoid: \fI Do not permit unbound to open this port or range of ports for use to send queries. Use this to make sure unbound does not grab a port that another daemon needs. The port is avoided on all outgoing interfaces, both IP4 and IP6. By default only ports above 1024 that have not been assigned by IANA are used. Give a port number or a range of the form "low\-high", without spaces. .TP .B outgoing\-num\-tcp: \fI Number of outgoing TCP buffers to allocate per thread. Default is 10. If set to 0, or if do\-tcp is "no", no TCP queries to authoritative servers are done. For larger installations increasing this value is a good idea. .TP .B incoming\-num\-tcp: \fI Number of incoming TCP buffers to allocate per thread. Default is 10. If set to 0, or if do\-tcp is "no", no TCP queries from clients are accepted. For larger installations increasing this value is a good idea. .TP .B edns\-buffer\-size: \fI Number of bytes size to advertise as the EDNS reassembly buffer size. This is the value put into datagrams over UDP towards peers. The actual buffer size is determined by msg\-buffer\-size (both for TCP and UDP). Do not set higher than that value. Default is 4096 which is RFC recommended. If you have fragmentation reassembly problems, usually seen as timeouts, then a value of 1480 can fix it. Setting to 512 bypasses even the most stringent path MTU problems, but is seen as extreme, since the amount of TCP fallback generated is excessive (probably also for this resolver, consider tuning the outgoing tcp number). .TP .B max\-udp\-size: \fI Maximum UDP response size (not applied to TCP response). 65536 disables the udp response size maximum, and uses the choice from the client, always. Suggested values are 512 to 4096. Default is 4096. .TP .B msg\-buffer\-size: \fI Number of bytes size of the message buffers. Default is 65552 bytes, enough for 64 Kb packets, the maximum DNS message size. No message larger than this can be sent or received. Can be reduced to use less memory, but some requests for DNS data, such as for huge resource records, will result in a SERVFAIL reply to the client. .TP .B msg\-cache\-size: \fI Number of bytes size of the message cache. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B msg\-cache\-slabs: \fI Number of slabs in the message cache. Slabs reduce lock contention by threads. Must be set to a power of 2. Setting (close) to the number of cpus is a reasonable guess. .TP .B num\-queries\-per\-thread: \fI The number of queries that every thread will service simultaneously. If more queries arrive that need servicing, and no queries can be jostled out (see \fIjostle\-timeout\fR), then the queries are dropped. This forces the client to resend after a timeout; allowing the server time to work on the existing queries. Default depends on compile options, 512 or 1024. .TP .B jostle\-timeout: \fI Timeout used when the server is very busy. Set to a value that usually results in one roundtrip to the authority servers. If too many queries arrive, then 50% of the queries are allowed to run to completion, and the other 50% are replaced with the new incoming query if they have already spent more than their allowed time. This protects against denial of service by slow queries or high query rates. Default 200 milliseconds. The effect is that the qps for long-lasting queries is about (numqueriesperthread / 2) / (average time for such long queries) qps. The qps for short queries can be about (numqueriesperthread / 2) / (jostletimeout in whole seconds) qps per thread, about (1024/2)*5 = 2560 qps by default. .TP .B delay\-close: \fI Extra delay for timeouted UDP ports before they are closed, in msec. Default is 0, and that disables it. This prevents very delayed answer packets from the upstream (recursive) servers from bouncing against closed ports and setting off all sort of close-port counters, with eg. 1500 msec. When timeouts happen you need extra sockets, it checks the ID and remote IP of packets, and unwanted packets are added to the unwanted packet counter. .TP .B so\-rcvbuf: \fI If not 0, then set the SO_RCVBUF socket option to get more buffer space on UDP port 53 incoming queries. So that short spikes on busy servers do not drop packets (see counter in netstat \-su). Default is 0 (use system value). Otherwise, the number of bytes to ask for, try "4m" on a busy server. The OS caps it at a maximum, on linux unbound needs root permission to bypass the limit, or the admin can use sysctl net.core.rmem_max. On BSD change kern.ipc.maxsockbuf in /etc/sysctl.conf. On OpenBSD change header and recompile kernel. On Solaris ndd \-set /dev/udp udp_max_buf 8388608. .TP .B so\-sndbuf: \fI If not 0, then set the SO_SNDBUF socket option to get more buffer space on UDP port 53 outgoing queries. This for very busy servers handles spikes in answer traffic, otherwise 'send: resource temporarily unavailable' can get logged, the buffer overrun is also visible by netstat \-su. Default is 0 (use system value). Specify the number of bytes to ask for, try "4m" on a very busy server. The OS caps it at a maximum, on linux unbound needs root permission to bypass the limit, or the admin can use sysctl net.core.wmem_max. On BSD, Solaris changes are similar to so\-rcvbuf. .TP .B so\-reuseport: \fI If yes, then open dedicated listening sockets for incoming queries for each thread and try to set the SO_REUSEPORT socket option on each socket. May distribute incoming queries to threads more evenly. Default is no. On Linux it is supported in kernels >= 3.9. On other systems, FreeBSD, OSX it may also work. You can enable it (on any platform and kernel), it then attempts to open the port and passes the option if it was available at compile time, if that works it is used, if it fails, it continues silently (unless verbosity 3) without the option. .TP .B ip\-transparent: \fI If yes, then use IP_TRANSPARENT socket option on sockets where unbound is listening for incoming traffic. Default no. Allows you to bind to non\-local interfaces. For example for non\-existant IP addresses that are going to exist later on, with host failover configuration. This is a lot like interface\-automatic, but that one services all interfaces and with this option you can select which (future) interfaces unbound provides service on. This option needs unbound to be started with root permissions on some systems. The option uses IP_BINDANY on FreeBSD systems. .TP .B ip\-freebind: \fI If yes, then use IP_FREEBIND socket option on sockets where unbound is listening to incoming traffic. Default no. Allows you to bind to IP addresses that are nonlocal or do not exist, like when the network interface or IP adress is down. Exists only on Linux, where the similar ip\-transparent option is also available. .TP .B rrset\-cache\-size: \fI Number of bytes size of the RRset cache. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B rrset\-cache\-slabs: \fI Number of slabs in the RRset cache. Slabs reduce lock contention by threads. Must be set to a power of 2. .TP .B cache\-max\-ttl: \fI Time to live maximum for RRsets and messages in the cache. Default is 86400 seconds (1 day). If the maximum kicks in, responses to clients still get decrementing TTLs based on the original (larger) values. When the internal TTL expires, the cache item has expired. Can be set lower to force the resolver to query for data often, and not trust (very large) TTL values. .TP .B cache\-min\-ttl: \fI Time to live minimum for RRsets and messages in the cache. Default is 0. If the minimum kicks in, the data is cached for longer than the domain owner intended, and thus less queries are made to look up the data. Zero makes sure the data in the cache is as the domain owner intended, higher values, especially more than an hour or so, can lead to trouble as the data in the cache does not match up with the actual data any more. .TP .B cache\-max\-negative\-ttl: \fI Time to live maximum for negative responses, these have a SOA in the authority section that is limited in time. Default is 3600. .TP .B infra\-host\-ttl: \fI Time to live for entries in the host cache. The host cache contains roundtrip timing, lameness and EDNS support information. Default is 900. .TP .B infra\-cache\-slabs: \fI Number of slabs in the infrastructure cache. Slabs reduce lock contention by threads. Must be set to a power of 2. .TP .B infra\-cache\-numhosts: \fI Number of hosts for which information is cached. Default is 10000. .TP .B infra\-cache\-min\-rtt: \fI Lower limit for dynamic retransmit timeout calculation in infrastructure cache. Default is 50 milliseconds. Increase this value if using forwarders needing more time to do recursive name resolution. .TP .B do\-ip4: \fI Enable or disable whether ip4 queries are answered or issued. Default is yes. .TP .B do\-ip6: \fI Enable or disable whether ip6 queries are answered or issued. Default is yes. If disabled, queries are not answered on IPv6, and queries are not sent on IPv6 to the internet nameservers. With this option you can disable the ipv6 transport for sending DNS traffic, it does not impact the contents of the DNS traffic, which may have ip4 and ip6 addresses in it. .TP .B do\-udp: \fI Enable or disable whether UDP queries are answered or issued. Default is yes. .TP .B do\-tcp: \fI Enable or disable whether TCP queries are answered or issued. Default is yes. .TP .B tcp\-mss: \fI Maximum segment size (MSS) of TCP socket on which the server responds to queries. Value lower than common MSS on Ethernet (1220 for example) will address path MTU problem. Note that not all platform supports socket option to set MSS (TCP_MAXSEG). Default is system default MSS determined by interface MTU and negotiation between server and client. .TP .B outgoing\-tcp\-mss: \fI Maximum segment size (MSS) of TCP socket for outgoing queries (from Unbound to other servers). Value lower than common MSS on Ethernet (1220 for example) will address path MTU problem. Note that not all platform supports socket option to set MSS (TCP_MAXSEG). Default is system default MSS determined by interface MTU and negotiation between Unbound and other servers. .TP .B tcp\-upstream: \fI Enable or disable whether the upstream queries use TCP only for transport. Default is no. Useful in tunneling scenarios. .TP .B ssl\-upstream: \fI Enabled or disable whether the upstream queries use SSL only for transport. Default is no. Useful in tunneling scenarios. The SSL contains plain DNS in TCP wireformat. The other server must support this (see \fBssl\-service\-key\fR). .TP .B ssl\-service-key: \fI If enabled, the server provider SSL service on its TCP sockets. The clients have to use ssl\-upstream: yes. The file is the private key for the TLS session. The public certificate is in the ssl\-service\-pem file. Default is "", turned off. Requires a restart (a reload is not enough) if changed, because the private key is read while root permissions are held and before chroot (if any). Normal DNS TCP service is not provided and gives errors, this service is best run with a different \fBport:\fR config or \fI@@port\fR suffixes in the \fBinterface\fR config. .TP .B ssl\-service\-pem: \fI The public key certificate pem file for the ssl service. Default is "", turned off. .TP .B ssl\-port: \fI The port number on which to provide TCP SSL service, default 853, only interfaces configured with that port number as @@number get the SSL service. .TP .B do\-daemonize: \fI Enable or disable whether the unbound server forks into the background as a daemon. Default is yes. .TP .B access\-control: \fI The netblock is given as an IP4 or IP6 address with /size appended for a classless network block. The action can be \fIdeny\fR, \fIrefuse\fR, \fIallow\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or \fIrefuse_non_local\fR. The most specific netblock match is used, if none match \fIdeny\fR is used. .IP The action \fIdeny\fR stops queries from hosts from that netblock. .IP The action \fIrefuse\fR stops queries too, but sends a DNS rcode REFUSED error message back. .IP The action \fIallow\fR gives access to clients from that netblock. It gives only access for recursion clients (which is what almost all clients need). Nonrecursive queries are refused. .IP The \fIallow\fR action does allow nonrecursive queries to access the local\-data that is configured. The reason is that this does not involve the unbound server recursive lookup algorithm, and static data is served in the reply. This supports normal operations where nonrecursive queries are made for the authoritative data. For nonrecursive queries any replies from the dynamic cache are refused. .IP The action \fIallow_snoop\fR gives nonrecursive access too. This give both recursive and non recursive access. The name \fIallow_snoop\fR refers to cache snooping, a technique to use nonrecursive queries to examine the cache contents (for malicious acts). However, nonrecursive queries can also be a valuable debugging tool (when you want to examine the cache contents). In that case use \fIallow_snoop\fR for your administration host. .IP By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd. The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS protocol is not designed to handle dropped packets due to policy, and dropping may result in (possibly excessive) retried queries. .IP The deny_non_local and refuse_non_local settings are for hosts that are only allowed to query for the authoritative local\-data, they are not allowed full recursion but only the static data. With deny_non_local, messages that are disallowed are dropped, with refuse_non_local they receive error code REFUSED. .TP .B chroot: \fI If chroot is enabled, you should pass the configfile (from the commandline) as a full path from the original root. After the chroot has been performed the now defunct portion of the config file path is removed to be able to reread the config after a reload. .IP All other file paths (working dir, logfile, roothints, and key files) can be specified in several ways: as an absolute path relative to the new root, as a relative path to the working directory, or as an absolute path relative to the original root. In the last case the path is adjusted to remove the unused portion. .IP The pidfile can be either a relative path to the working directory, or an absolute path relative to the original root. It is written just prior to chroot and dropping permissions. This allows the pidfile to be /var/run/unbound.pid and the chroot to be /var/unbound, for example. .IP Additionally, unbound may need to access /dev/random (for entropy) from inside the chroot. .IP If given a chroot is done to the given directory. The default is "@@UNBOUND_CHROOT_DIR@@". If you give "" no chroot is performed. .TP .B username: \fI If given, after binding the port the user privileges are dropped. Default is "@@UNBOUND_USERNAME@@". If you give username: "" no user change is performed. .IP If this user is not capable of binding the port, reloads (by signal HUP) will still retain the opened ports. If you change the port number in the config file, and that new port number requires privileges, then a reload will fail; a restart is needed. .TP .B directory: \fI Sets the working directory for the program. Default is "@@UNBOUND_RUN_DIR@@". On Windows the string "%EXECUTABLE%" tries to change to the directory that unbound.exe resides in. .TP .B logfile: \fI If "" is given, logging goes to stderr, or nowhere once daemonized. The logfile is appended to, in the following format: .nf [seconds since 1970] unbound[pid:tid]: type: message. .fi If this option is given, the use\-syslog is option is set to "no". The logfile is reopened (for append) when the config file is reread, on SIGHUP. .TP .B use\-syslog: \fI Sets unbound to send log messages to the syslogd, using \fIsyslog\fR(3). The log facility LOG_DAEMON is used, with identity "unbound". The logfile setting is overridden when use\-syslog is turned on. The default is to log to syslog. .TP .B log\-time\-ascii: \fI Sets logfile lines to use a timestamp in UTC ascii. Default is no, which prints the seconds since 1970 in brackets. No effect if using syslog, in that case syslog formats the timestamp printed into the log files. .TP .B log\-queries: \fI Prints one line per query to the log, with the log timestamp and IP address, name, type and class. Default is no. Note that it takes time to print these lines which makes the server (significantly) slower. Odd (nonprintable) characters in names are printed as '?'. .TP .B pidfile: \fI The process id is written to the file. Default is "@@UNBOUND_PIDFILE@@". So, .nf kill \-HUP `cat @@UNBOUND_PIDFILE@@` .fi triggers a reload, .nf kill \-TERM `cat @@UNBOUND_PIDFILE@@` .fi gracefully terminates. .TP .B root\-hints: \fI Read the root hints from this file. Default is nothing, using builtin hints for the IN class. The file has the format of zone files, with root nameserver names and addresses only. The default may become outdated, when servers change, therefore it is good practice to use a root\-hints file. .TP .B hide\-identity: \fI If enabled id.server and hostname.bind queries are refused. .TP .B identity: \fI Set the identity to report. If set to "", the default, then the hostname of the server is returned. .TP .B hide\-version: \fI If enabled version.server and version.bind queries are refused. .TP .B version: \fI Set the version to report. If set to "", the default, then the package version is returned. .TP .B target\-fetch\-policy: \fI<"list of numbers"> Set the target fetch policy used by unbound to determine if it should fetch nameserver target addresses opportunistically. The policy is described per dependency depth. .IP The number of values determines the maximum dependency depth that unbound will pursue in answering a query. A value of \-1 means to fetch all targets opportunistically for that dependency depth. A value of 0 means to fetch on demand only. A positive value fetches that many targets opportunistically. .IP Enclose the list between quotes ("") and put spaces between numbers. The default is "3 2 1 0 0". Setting all zeroes, "0 0 0 0 0" gives behaviour closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour rumoured to be closer to that of BIND 8. .TP .B harden\-short\-bufsize: \fI Very small EDNS buffer sizes from queries are ignored. Default is off, since it is legal protocol wise to send these, and unbound tries to give very small answers to these queries, where possible. .TP .B harden\-large\-queries: \fI Very large queries are ignored. Default is off, since it is legal protocol wise to send these, and could be necessary for operation if TSIG or EDNS payload is very large. .TP .B harden\-glue: \fI Will trust glue only if it is within the servers authority. Default is on. .TP .B harden\-dnssec\-stripped: \fI Require DNSSEC data for trust\-anchored zones, if such data is absent, the zone becomes bogus. If turned off, and no DNSSEC data is received (or the DNSKEY data fails to validate), then the zone is made insecure, this behaves like there is no trust anchor. You could turn this off if you are sometimes behind an intrusive firewall (of some sort) that removes DNSSEC data from packets, or a zone changes from signed to unsigned to badly signed often. If turned off you run the risk of a downgrade attack that disables security for a zone. Default is on. .TP .B harden\-below\-nxdomain: \fI From draft\-vixie\-dnsext\-resimprove, returns nxdomain to queries for a name below another name that is already known to be nxdomain. DNSSEC mandates noerror for empty nonterminals, hence this is possible. Very old software might return nxdomain for empty nonterminals (that usually happen for reverse IP address lookups), and thus may be incompatible with this. To try to avoid this only DNSSEC-secure nxdomains are used, because the old software does not have DNSSEC. Default is off. Currently, draft\-ietf\-dnsop\-nxdomain\-cut promotes this technique. .TP .B harden\-referral\-path: \fI Harden the referral path by performing additional queries for infrastructure data. Validates the replies if trust anchors are configured and the zones are signed. This enforces DNSSEC validation on nameserver NS sets and the nameserver addresses that are encountered on the referral path to the answer. Default off, because it burdens the authority servers, and it is not RFC standard, and could lead to performance problems because of the extra query load that is generated. Experimental option. If you enable it consider adding more numbers after the target\-fetch\-policy to increase the max depth that is checked to. .TP .B harden\-algo\-downgrade: \fI Harden against algorithm downgrade when multiple algorithms are advertised in the DS record. If no, allows the weakest algorithm to validate the zone. Default is no. Zone signers must produce zones that allow this feature to work, but sometimes they do not, and turning this option off avoids that validation failure. .TP .B use\-caps\-for\-id: \fI Use 0x20\-encoded random bits in the query to foil spoof attempts. This perturbs the lowercase and uppercase of query names sent to authority servers and checks if the reply still has the correct casing. Disabled by default. This feature is an experimental implementation of draft dns\-0x20. .TP .B caps\-whitelist: \fI Whitelist the domain so that it does not receive caps\-for\-id perturbed queries. For domains that do not support 0x20 and also fail with fallback because they keep sending different answers, like some load balancers. Can be given multiple times, for different domains. .TP .B qname\-minimisation: \fI Send minimum amount of information to upstream servers to enhance privacy. Only sent minimum required labels of the QNAME and set QTYPE to NS when possible. Best effort approach, full QNAME and original QTYPE will be sent when upstream replies with a RCODE other than NOERROR. Default is off. .TP .B private\-address: \fI Give IPv4 of IPv6 addresses or classless subnets. These are addresses on your private network, and are not allowed to be returned for public internet names. Any occurrence of such addresses are removed from DNS answers. Additionally, the DNSSEC validator may mark the answers bogus. This protects against so\-called DNS Rebinding, where a user browser is turned into a network proxy, allowing remote access through the browser to other parts of your private network. Some names can be allowed to contain your private addresses, by default all the \fBlocal\-data\fR that you configured is allowed to, and you can specify additional names using \fBprivate\-domain\fR. No private addresses are enabled by default. We consider to enable this for the RFC1918 private IP address space by default in later releases. That would enable private addresses for 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fd00::/8 and fe80::/10, since the RFC standards say these addresses should not be visible on the public internet. Turning on 127.0.0.0/8 would hinder many spamblocklists as they use that. Adding ::ffff:0:0/96 stops IPv4-mapped IPv6 addresses from bypassing the filter. .TP .B private\-domain: \fI Allow this domain, and all its subdomains to contain private addresses. Give multiple times to allow multiple domain names to contain private addresses. Default is none. .TP .B unwanted\-reply\-threshold: \fI If set, a total number of unwanted replies is kept track of in every thread. When it reaches the threshold, a defensive action is taken and a warning is printed to the log. The defensive action is to clear the rrset and message caches, hopefully flushing away any poison. A value of 10 million is suggested. Default is 0 (turned off). .TP .B do\-not\-query\-address: \fI Do not query the given IP address. Can be IP4 or IP6. Append /num to indicate a classless delegation netblock, for example like 10.2.3.4/24 or 2001::11/64. .TP .B do\-not\-query\-localhost: \fI If yes, localhost is added to the do\-not\-query\-address entries, both IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send queries to. Default is yes. .TP .B prefetch: \fI If yes, message cache elements are prefetched before they expire to keep the cache up to date. Default is no. Turning it on gives about 10 percent more traffic and load on the machine, but popular items do not expire from the cache. .TP .B prefetch-key: \fI If yes, fetch the DNSKEYs earlier in the validation process, when a DS record is encountered. This lowers the latency of requests. It does use a little more CPU. Also if the cache is set to 0, it is no use. Default is no. .TP .B rrset-roundrobin: \fI If yes, Unbound rotates RRSet order in response (the random number is taken from the query ID, for speed and thread safety). Default is no. .TP .B minimal-responses: \fI If yes, Unbound doesn't insert authority/additional sections into response messages when those sections are not required. This reduces response size significantly, and may avoid TCP fallback for some responses. This may cause a slight speedup. The default is no, because the DNS protocol RFCs mandate these sections, and the additional content could be of use and save roundtrips for clients. .TP .B disable-dnssec-lame-check: \fI If true, disables the DNSSEC lameness check in the iterator. This check sees if RRSIGs are present in the answer, when dnssec is expected, and retries another authority if RRSIGs are unexpectedly missing. The validator will insist in RRSIGs for DNSSEC signed domains regardless of this setting, if a trust anchor is loaded. .TP .B module\-config: \fI<"module names"> Module configuration, a list of module names separated by spaces, surround the string with quotes (""). The modules can be validator, iterator. Setting this to "iterator" will result in a non\-validating server. Setting this to "validator iterator" will turn on DNSSEC validation. The ordering of the modules is important. You must also set trust\-anchors for validation to be useful. .TP .B trust\-anchor\-file: \fI File with trusted keys for validation. Both DS and DNSKEY entries can appear in the file. The format of the file is the standard DNS Zone file format. Default is "", or no trust anchor file. .TP .B auto\-trust\-anchor\-file: \fI File with trust anchor for one zone, which is tracked with RFC5011 probes. The probes are several times per month, thus the machine must be online frequently. The initial file can be one with contents as described in \fBtrust\-anchor\-file\fR. The file is written to when the anchor is updated, so the unbound user must have write permission. Write permission to the file, but also to the directory it is in (to create a temporary file, which is necessary to deal with filesystem full events). .TP .B trust\-anchor: \fI<"Resource Record"> A DS or DNSKEY RR for a key to use for validation. Multiple entries can be given to specify multiple trusted keys, in addition to the trust\-anchor\-files. The resource record is entered in the same format as 'dig' or 'drill' prints them, the same format as in the zone file. Has to be on a single line, with "" around it. A TTL can be specified for ease of cut and paste, but is ignored. A class can be specified, but class IN is default. .TP .B trusted\-keys\-file: \fI File with trusted keys for validation. Specify more than one file with several entries, one file per entry. Like \fBtrust\-anchor\-file\fR but has a different file format. Format is BIND\-9 style format, the trusted\-keys { name flag proto algo "key"; }; clauses are read. It is possible to use wildcards with this statement, the wildcard is expanded on start and on reload. .TP .B dlv\-anchor\-file: \fI This option was used during early days DNSSEC deployment when no parent-side DS record registrations were easily available. Nowadays, it is best to have DS records registered with the parent zone (many top level zones are signed). File with trusted keys for DLV (DNSSEC Lookaside Validation). Both DS and DNSKEY entries can be used in the file, in the same format as for \fItrust\-anchor\-file:\fR statements. Only one DLV can be configured, more would be slow. The DLV configured is used as a root trusted DLV, this means that it is a lookaside for the root. Default is "", or no dlv anchor file. DLV is going to be decommissioned. Please do not use it any more. .TP .B dlv\-anchor: \fI<"Resource Record"> Much like trust\-anchor, this is a DLV anchor with the DS or DNSKEY inline. DLV is going to be decommissioned. Please do not use it any more. .TP .B domain\-insecure: \fI Sets domain name to be insecure, DNSSEC chain of trust is ignored towards the domain name. So a trust anchor above the domain name can not make the domain secure with a DS record, such a DS record is then ignored. Also keys from DLV are ignored for the domain. Can be given multiple times to specify multiple domains that are treated as if unsigned. If you set trust anchors for the domain they override this setting (and the domain is secured). .IP This can be useful if you want to make sure a trust anchor for external lookups does not affect an (unsigned) internal domain. A DS record externally can create validation failures for that internal domain. .TP .B val\-override\-date: \fI Default is "" or "0", which disables this debugging feature. If enabled by giving a RRSIG style date, that date is used for verifying RRSIG inception and expiration dates, instead of the current date. Do not set this unless you are debugging signature inception and expiration. The value \-1 ignores the date altogether, useful for some special applications. .TP .B val\-sig\-skew\-min: \fI Minimum number of seconds of clock skew to apply to validated signatures. A value of 10% of the signature lifetime (expiration \- inception) is used, capped by this setting. Default is 3600 (1 hour) which allows for daylight savings differences. Lower this value for more strict checking of short lived signatures. .TP .B val\-sig\-skew\-max: \fI Maximum number of seconds of clock skew to apply to validated signatures. A value of 10% of the signature lifetime (expiration \- inception) is used, capped by this setting. Default is 86400 (24 hours) which allows for timezone setting problems in stable domains. Setting both min and max very low disables the clock skew allowances. Setting both min and max very high makes the validator check the signature timestamps less strictly. .TP .B val\-bogus\-ttl: \fI The time to live for bogus data. This is data that has failed validation; due to invalid signatures or other checks. The TTL from that data cannot be trusted, and this value is used instead. The value is in seconds, default 60. The time interval prevents repeated revalidation of bogus data. .TP .B val\-clean\-additional: \fI Instruct the validator to remove data from the additional section of secure messages that are not signed properly. Messages that are insecure, bogus, indeterminate or unchecked are not affected. Default is yes. Use this setting to protect the users that rely on this validator for authentication from potentially bad data in the additional section. .TP .B val\-log\-level: \fI Have the validator print validation failures to the log. Regardless of the verbosity setting. Default is 0, off. At 1, for every user query that fails a line is printed to the logs. This way you can monitor what happens with validation. Use a diagnosis tool, such as dig or drill, to find out why validation is failing for these queries. At 2, not only the query that failed is printed but also the reason why unbound thought it was wrong and which server sent the faulty data. .TP .B val\-permissive\-mode: \fI Instruct the validator to mark bogus messages as indeterminate. The security checks are performed, but if the result is bogus (failed security), the reply is not withheld from the client with SERVFAIL as usual. The client receives the bogus data. For messages that are found to be secure the AD bit is set in replies. Also logging is performed as for full validation. The default value is "no". .TP .B ignore\-cd\-flag: \fI Instruct unbound to ignore the CD flag from clients and refuse to return bogus answers to them. Thus, the CD (Checking Disabled) flag does not disable checking any more. This is useful if legacy (w2008) servers that set the CD flag but cannot validate DNSSEC themselves are the clients, and then unbound provides them with DNSSEC protection. The default value is "no". .TP .B val\-nsec3\-keysize\-iterations: \fI<"list of values"> List of keysize and iteration count values, separated by spaces, surrounded by quotes. Default is "1024 150 2048 500 4096 2500". This determines the maximum allowed NSEC3 iteration count before a message is simply marked insecure instead of performing the many hashing iterations. The list must be in ascending order and have at least one entry. If you set it to "1024 65535" there is no restriction to NSEC3 iteration values. This table must be kept short; a very long list could cause slower operation. .TP .B add\-holddown: \fI Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011 autotrust updates to add new trust anchors only after they have been visible for this time. Default is 30 days as per the RFC. .TP .B del\-holddown: \fI Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011 autotrust updates to remove revoked trust anchors after they have been kept in the revoked list for this long. Default is 30 days as per the RFC. .TP .B keep\-missing: \fI Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011 autotrust updates to remove missing trust anchors after they have been unseen for this long. This cleans up the state file if the target zone does not perform trust anchor revocation, so this makes the auto probe mechanism work with zones that perform regular (non\-5011) rollovers. The default is 366 days. The value 0 does not remove missing anchors, as per the RFC. .TP .B permit\-small\-holddown: \fI Debug option that allows the autotrust 5011 rollover timers to assume very small values. Default is no. .TP .B key\-cache\-size: \fI Number of bytes size of the key cache. Default is 4 megabytes. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B key\-cache\-slabs: \fI Number of slabs in the key cache. Slabs reduce lock contention by threads. Must be set to a power of 2. Setting (close) to the number of cpus is a reasonable guess. .TP .B neg\-cache\-size: \fI Number of bytes size of the aggressive negative cache. Default is 1 megabyte. A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes or gigabytes (1024*1024 bytes in a megabyte). .TP .B unblock\-lan\-zones: \fI Default is disabled. If enabled, then for private address space, the reverse lookups are no longer filtered. This allows unbound when running as dns service on a host where it provides service for that host, to put out all of the queries for the 'lan' upstream. When enabled, only localhost, 127.0.0.1 reverse and ::1 reverse zones are configured with default local zones. Disable the option when unbound is running as a (DHCP-) DNS network resolver for a group of machines, where such lookups should be filtered (RFC compliance), this also stops potential data leakage about the local network to the upstream DNS servers. .TP .B insecure\-lan\-zones: \fI Default is disabled. If enabled, then reverse lookups in private address space are not validated. This is usually required whenever \fIunblock\-lan\-zones\fR is used. .TP .B local\-zone: \fI Configure a local zone. The type determines the answer to give if there is no match from local\-data. The types are deny, refuse, static, transparent, redirect, nodefault, typetransparent, inform, inform_deny, and are explained below. After that the default settings are listed. Use local\-data: to enter data into the local zone. Answers for local zones are authoritative DNS answers. By default the zones are class IN. .IP If you need more complicated authoritative data, with referrals, wildcards, CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for it as detailed in the stub zone section below. .TP 10 \h'5'\fIdeny\fR Do not send an answer, drop the query. If there is a match from local data, the query is answered. .TP 10 \h'5'\fIrefuse\fR Send an error message reply, with rcode REFUSED. If there is a match from local data, the query is answered. .TP 10 \h'5'\fIstatic\fR If there is a match from local data, the query is answered. Otherwise, the query is answered with nodata or nxdomain. For a negative answer a SOA is included in the answer if present as local\-data for the zone apex domain. .TP 10 \h'5'\fItransparent\fR If there is a match from local data, the query is answered. Otherwise if the query has a different name, the query is resolved normally. If the query is for a name given in localdata but no such type of data is given in localdata, then a noerror nodata answer is returned. If no local\-zone is given local\-data causes a transparent zone to be created by default. .TP 10 \h'5'\fItypetransparent\fR If there is a match from local data, the query is answered. If the query is for a different name, or for the same name but for a different type, the query is resolved normally. So, similar to transparent but types that are not listed in local data are resolved normally, so if an A record is in the local data that does not cause a nodata reply for AAAA queries. .TP 10 \h'5'\fIredirect\fR The query is answered from the local data for the zone name. There may be no local data beneath the zone name. This answers queries for the zone, and all subdomains of the zone with the local data for the zone. It can be used to redirect a domain to return a different address record to the end user, with local\-zone: "example.com." redirect and local\-data: "example.com. A 127.0.0.1" queries for www.example.com and www.foo.example.com are redirected, so that users with web browsers cannot access sites with suffix example.com. .TP 10 \h'5'\fIinform\fR The query is answered normally. The client IP address (@@portnumber) is printed to the logfile. The log message is: timestamp, unbound-pid, info: zonename inform IP@@port queryname type class. This option can be used for normal resolution, but machines looking up infected names are logged, eg. to run antivirus on them. .TP 10 \h'5'\fIinform_deny\fR The query is dropped, like 'deny', and logged, like 'inform'. Ie. find infected machines without answering the queries. .TP 10 \h'5'\fInodefault\fR Used to turn off default contents for AS112 zones. The other types also turn off default contents for the zone. The 'nodefault' option has no other effect than turning off default contents for the given zone. Use \fInodefault\fR if you use exactly that zone, if you want to use a subzone, use \fItransparent\fR. .P The default zones are localhost, reverse 127.0.0.1 and ::1, the onion and the AS112 zones. The AS112 zones are reverse DNS zones for private use and reserved IP addresses for which the servers on the internet cannot provide correct answers. They are configured by default to give nxdomain (no reverse information) answers. The defaults can be turned off by specifying your own local\-zone of that name, or using the 'nodefault' type. Below is a list of the default zone contents. .TP 10 \h'5'\fIlocalhost\fR The IP4 and IP6 localhost information is given. NS and SOA records are provided for completeness and to satisfy some DNS update tools. Default content: .nf local\-zone: "localhost." static local\-data: "localhost. 10800 IN NS localhost." local\-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local\-data: "localhost. 10800 IN A 127.0.0.1" local\-data: "localhost. 10800 IN AAAA ::1" .fi .TP 10 \h'5'\fIreverse IPv4 loopback\fR Default content: .nf local\-zone: "127.in\-addr.arpa." static local\-data: "127.in\-addr.arpa. 10800 IN NS localhost." local\-data: "127.in\-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN PTR localhost." .fi .TP 10 \h'5'\fIreverse IPv6 loopback\fR Default content: .nf local\-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost." local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost." .fi .TP 10 \h'5'\fIonion (RFC 7686)\fR Default content: .nf local\-zone: "onion." static local\-data: "onion. 10800 IN NS localhost." local\-data: "onion. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" .fi .TP 10 \h'5'\fIreverse RFC1918 local use zones\fR Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to 31.172.in\-addr.arpa, 168.192.in\-addr.arpa. The \fBlocal\-zone:\fR is set static and as \fBlocal\-data:\fR SOA and NS records are provided. .TP 10 \h'5'\fIreverse RFC3330 IP4 this, link\-local, testnet and broadcast\fR Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa, 2.0.192.in\-addr.arpa (TEST NET 1), 100.51.198.in\-addr.arpa (TEST NET 2), 113.0.203.in\-addr.arpa (TEST NET 3), 255.255.255.255.in\-addr.arpa. And from 64.100.in\-addr.arpa to 127.100.in\-addr.arpa (Shared Address Space). .TP 10 \h'5'\fIreverse RFC4291 IP6 unspecified\fR Reverse data for zone .nf 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. .fi .TP 10 \h'5'\fIreverse RFC4193 IPv6 Locally Assigned Local Addresses\fR Reverse data for zone D.F.ip6.arpa. .TP 10 \h'5'\fIreverse RFC4291 IPv6 Link Local Addresses\fR Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa. .TP 10 \h'5'\fIreverse IPv6 Example Prefix\fR Reverse data for zone 8.B.D.0.1.0.0.2.ip6.arpa. This zone is used for tutorials and examples. You can remove the block on this zone with: .nf local\-zone: 8.B.D.0.1.0.0.2.ip6.arpa. nodefault .fi You can also selectively unblock a part of the zone by making that part transparent with a local\-zone statement. This also works with the other default zones. .\" End of local-zone listing. .TP 5 .B local\-data: \fI"" Configure local data, which is served in reply to queries for it. The query has to match exactly unless you configure the local\-zone as redirect. If not matched exactly, the local\-zone type determines further processing. If local\-data is configured that is not a subdomain of a local\-zone, a transparent local\-zone is configured. For record types such as TXT, use single quotes, as in local\-data: 'example. TXT "text"'. .IP If you need more complicated authoritative data, with referrals, wildcards, CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for it as detailed in the stub zone section below. .TP 5 .B local\-data\-ptr: \fI"IPaddr name" Configure local data shorthand for a PTR record with the reversed IPv4 or IPv6 address and the host name. For example "192.0.2.4 www.example.com". TTL can be inserted like this: "2001:DB8::4 7200 www.example.com" .TP 5 .B ratelimit: \fI Enable ratelimiting of queries sent to nameserver for performing recursion. If 0, the default, it is disabled. This option is experimental at this time. The ratelimit is in queries per second that are allowed. More queries are turned away with an error (servfail). This stops recursive floods, eg. random query names, but not spoofed reflection floods. Cached responses are not ratelimited by this setting. The zone of the query is determined by examining the nameservers for it, the zone name is used to keep track of the rate. For example, 1000 may be a suitable value to stop the server from being overloaded with random names, and keeps unbound from sending traffic to the nameservers for those zones. .TP 5 .B ratelimit\-size: \fI Give the size of the data structure in which the current ongoing rates are kept track in. Default 4m. In bytes or use m(mega), k(kilo), g(giga). The ratelimit structure is small, so this data structure likely does not need to be large. .TP 5 .B ratelimit\-slabs: \fI Give power of 2 number of slabs, this is used to reduce lock contention in the ratelimit tracking data structure. Close to the number of cpus is a fairly good setting. .TP 5 .B ratelimit\-factor: \fI Set the amount of queries to rate limit when the limit is exceeded. If set to 0, all queries are dropped for domains where the limit is exceeded. If set to another value, 1 in that number is allowed through to complete. Default is 10, allowing 1/10 traffic to flow normally. This can make ordinary queries complete (if repeatedly queried for), and enter the cache, whilst also mitigating the traffic flow by the factor given. .TP 5 .B ratelimit\-for\-domain: \fI Override the global ratelimit for an exact match domain name with the listed number. You can give this for any number of names. For example, for a top\-level\-domain you may want to have a higher limit than other names. .TP 5 .B ratelimit\-below\-domain: \fI Override the global ratelimit for a domain name that ends in this name. You can give this multiple times, it then describes different settings in different parts of the namespace. The closest matching suffix is used to determine the qps limit. The rate for the exact matching domain name is not changed, use ratelimit\-for\-domain to set that, you might want to use different settings for a top\-level\-domain and subdomains. .SS "Remote Control Options" In the .B remote\-control: clause are the declarations for the remote control facility. If this is enabled, the \fIunbound\-control\fR(8) utility can be used to send commands to the running unbound server. The server uses these clauses to setup SSLv3 / TLSv1 security for the connection. The \fIunbound\-control\fR(8) utility also reads the \fBremote\-control\fR section for options. To setup the correct self\-signed certificates use the \fIunbound\-control\-setup\fR(8) utility. .TP 5 .B control\-enable: \fI The option is used to enable remote control, default is "no". If turned off, the server does not listen for control commands. .TP 5 .B control\-interface: \fI Give IPv4 or IPv6 addresses or local socket path to listen on for control commands. By default localhost (127.0.0.1 and ::1) is listened to. Use 0.0.0.0 and ::0 to listen to all interfaces. If you change this and permissions have been dropped, you must restart the server for the change to take effect. .TP 5 .B control\-port: \fI The port number to listen on for IPv4 or IPv6 control interfaces, default is 8953. If you change this and permissions have been dropped, you must restart the server for the change to take effect. .TP 5 .B control\-use\-cert: \fI Whether to require certificate authentication of control connections. The default is "yes". This should not be changed unless there are other mechanisms in place to prevent untrusted users from accessing the remote control interface. .TP 5 .B server\-key\-file: \fI Path to the server private key, by default unbound_server.key. This file is generated by the \fIunbound\-control\-setup\fR utility. This file is used by the unbound server, but not by \fIunbound\-control\fR. .TP 5 .B server\-cert\-file: \fI Path to the server self signed certificate, by default unbound_server.pem. This file is generated by the \fIunbound\-control\-setup\fR utility. This file is used by the unbound server, and also by \fIunbound\-control\fR. .TP 5 .B control\-key\-file: \fI Path to the control client private key, by default unbound_control.key. This file is generated by the \fIunbound\-control\-setup\fR utility. This file is used by \fIunbound\-control\fR. .TP 5 .B control\-cert\-file: \fI Path to the control client certificate, by default unbound_control.pem. This certificate has to be signed with the server certificate. This file is generated by the \fIunbound\-control\-setup\fR utility. This file is used by \fIunbound\-control\fR. .SS "Stub Zone Options" .LP There may be multiple .B stub\-zone: clauses. Each with a name: and zero or more hostnames or IP addresses. For the stub zone this list of nameservers is used. Class IN is assumed. The servers should be authority servers, not recursors; unbound performs the recursive processing itself for stub zones. .P The stub zone can be used to configure authoritative data to be used by the resolver that cannot be accessed using the public internet servers. This is useful for company\-local data or private zones. Setup an authoritative server on a different host (or different port). Enter a config entry for unbound with .B stub\-addr: . The unbound resolver can then access the data, without referring to the public internet for it. .P This setup allows DNSSEC signed zones to be served by that authoritative server, in which case a trusted key entry with the public key can be put in config, so that unbound can validate the data and set the AD bit on replies for the private zone (authoritative servers do not set the AD bit). This setup makes unbound capable of answering queries for the private zone, and can even set the AD bit ('authentic'), but the AA ('authoritative') bit is not set on these replies. .P Consider adding \fBserver:\fR statements for \fBdomain\-insecure:\fR and for \fBlocal\-zone:\fI name nodefault\fR for the zone if it is a locally served zone. The insecure clause stops DNSSEC from invalidating the zone. The local zone nodefault (or \fItransparent\fR) clause makes the (reverse\-) zone bypass unbound's filtering of RFC1918 zones. .TP .B name: \fI Name of the stub zone. .TP .B stub\-host: \fI Name of stub zone nameserver. Is itself resolved before it is used. .TP .B stub\-addr: \fI IP address of stub zone nameserver. Can be IP 4 or IP 6. To use a nondefault port for DNS communication append '@@' with the port number. .TP .B stub\-prime: \fI This option is by default off. If enabled it performs NS set priming, which is similar to root hints, where it starts using the list of nameservers currently published by the zone. Thus, if the hint list is slightly outdated, the resolver picks up a correct list online. .TP .B stub\-first: \fI If enabled, a query is attempted without the stub clause if it fails. The data could not be retrieved and would have caused SERVFAIL because the servers are unreachable, instead it is tried without this clause. The default is no. .SS "Forward Zone Options" .LP There may be multiple .B forward\-zone: clauses. Each with a \fBname:\fR and zero or more hostnames or IP addresses. For the forward zone this list of nameservers is used to forward the queries to. The servers listed as \fBforward\-host:\fR and \fBforward\-addr:\fR have to handle further recursion for the query. Thus, those servers are not authority servers, but are (just like unbound is) recursive servers too; unbound does not perform recursion itself for the forward zone, it lets the remote server do it. Class IN is assumed. A forward\-zone entry with name "." and a forward\-addr target will forward all queries to that other server (unless it can answer from the cache). .TP .B name: \fI Name of the forward zone. .TP .B forward\-host: \fI Name of server to forward to. Is itself resolved before it is used. .TP .B forward\-addr: \fI IP address of server to forward to. Can be IP 4 or IP 6. To use a nondefault port for DNS communication append '@@' with the port number. .TP .B forward\-first: \fI If enabled, a query is attempted without the forward clause if it fails. The data could not be retrieved and would have caused SERVFAIL because the servers are unreachable, instead it is tried without this clause. The default is no. .SS "Python Module Options" .LP The .B python: clause gives the settings for the \fIpython\fR(1) script module. This module acts like the iterator and validator modules do, on queries and answers. To enable the script module it has to be compiled into the daemon, and the word "python" has to be put in the \fBmodule\-config:\fR option (usually first, or between the validator and iterator). .TP .B python\-script: \fI\fR The script file to load. .SS "DNS64 Module Options" .LP The dns64 module must be configured in the \fBmodule\-config:\fR "dns64 validator iterator" directive and be compiled into the daemon to be enabled. These settings go in the \fBserver:\fR section. .TP .B dns64\-prefix: \fI\fR This sets the DNS64 prefix to use to synthesize AAAA records with. It must be /96 or shorter. The default prefix is 64:ff9b::/96. .TP .B dns64\-synthall: \fI\fR Debug option, default no. If enabled, synthesize all AAAA records despite the presence of actual AAAA records. .SH "MEMORY CONTROL EXAMPLE" In the example config settings below memory usage is reduced. Some service levels are lower, notable very large data and a high TCP load are no longer supported. Very large data and high TCP loads are exceptional for the DNS. DNSSEC validation is enabled, just add trust anchors. If you do not have to worry about programs using more than 3 Mb of memory, the below example is not for you. Use the defaults to receive full service, which on BSD\-32bit tops out at 30\-40 Mb after heavy usage. .P .nf # example settings that reduce memory usage server: num\-threads: 1 outgoing\-num\-tcp: 1 # this limits TCP service, uses less buffers. incoming\-num\-tcp: 1 outgoing\-range: 60 # uses less memory, but less performance. msg\-buffer\-size: 8192 # note this limits service, 'no huge stuff'. msg\-cache\-size: 100k msg\-cache\-slabs: 1 rrset\-cache\-size: 100k rrset\-cache\-slabs: 1 infra\-cache\-numhosts: 200 infra\-cache\-slabs: 1 key\-cache\-size: 100k key\-cache\-slabs: 1 neg\-cache\-size: 10k num\-queries\-per\-thread: 30 target\-fetch\-policy: "2 1 0 0 0 0" harden\-large\-queries: "yes" harden\-short\-bufsize: "yes" .fi .SH "FILES" .TP .I @@UNBOUND_RUN_DIR@@ default unbound working directory. .TP .I @@UNBOUND_CHROOT_DIR@@ default \fIchroot\fR(2) location. .TP .I @@ub_conf_file@@ unbound configuration file. .TP .I @@UNBOUND_PIDFILE@@ default unbound pidfile with process ID of the running daemon. .TP .I unbound.log unbound log file. default is to log to \fIsyslog\fR(3). .SH "SEE ALSO" \fIunbound\fR(8), \fIunbound\-checkconf\fR(8). .SH "AUTHORS" .B Unbound was written by NLnet Labs. Please see CREDITS file in the distribution for further details. @