Unbound is designed as a set of modular components, so that also
DNSSEC (secure DNS) validation and stub-resolvers (that do not run as
a server, but are linked into an application) are easily possible.
Goals:
* A validating recursive DNS resolver.
* Code diversity in the DNS resolver monoculture.
* Drop-in replacement for BIND apart from config.
* DNSSEC support.
* Fully RFC compliant.
* High performance, even with validation enabled.
* Used as: stub resolver, full caching name server, resolver library.
* Elegant design of validator, resolver, cache modules.
o provide the ability to pick and choose modules.
* Robust.
* In C, open source: The BSD license.
* Smallest as possible component that does the job.
* Stub-zones can be configured (local data or AS112 zones).
Non-goals:
* An authoritative name server.
* Too many Features.
===> The following configuration options are available for unbound-1.26.1:
DEP-RSA1024=off: Deprecate the use of RSA 1024 keys
DNSCRYPT=on: Enable dnscrypt support
DNSTAP=off: Enable dnstap logging support
DOCS=on: Build and/or install documentation
DYNLIB=on: Enable support for dynamic (shared) 3rd-party libraries
ECDSA=on: Enable ECDSA (elliptic curve) support (OpenSSL >= 1.0)
EVAPI=on: Pluggable event based libunbound API support
FILTER_AAAA=off: Build with AAAA filter functionality (contrib)
GOST=on: Enable GOST support (requires OpenSSL >= 1.0)
HIREDIS=off: Enable hiredis support for the cachedb module
LIBEVENT=on: Build against libevent
MUNIN_PLUGIN=off: Install Munin plugin
PYTHON=off: Python bindings or support
SUBNET=off: Enable client subnet support
TFOCL=off: Enable TCP Fast Open for client mode
TFOSE=off: Enable TCP Fast Open for server mode
THREADS=on: Threading support
===> Use 'make config' to modify these settings
dns/unbound: fix build with swig-4.4.1
This patch to replace a deprecated keyword in unbound.i should fix the
problem building with swig-4.4.1
Reported by: Vidar Karlsen <vidar@karlsen.tech>
PR: 292625
MFH: 2026Q2
Event: Wiesbaden Hackathon 202604
*/*: Bump PORTREVISION for devel/protobuf-c update
libprotobuf-c.so once again has version info. Force a rebuild of
its consumers.
PR: 282060
MFH: 2025Q3
Sponsored by: <If the change was sponsored by an organization.>
dns/unbound: restores DNS over QUIC and HTTPS
There was a line missing in the Makefile for the port.
This commit correct it and restores DNS over QUIC and HTTPS
PR: 282183
Reported by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
dns/unbound: Update to version 1.21.1
- patch for users who use base OpenSSL
PR: 281894, 281804
Security: 2368755b-83f6-11ef-8d2e-a04a5edf46d9
Security: CVE-2024-8508
dns/unbound: Uodate to 1.20.0
ChangeLog: https://nlnetlabs.nl/news/2024/May/08/unbound-1.20.0-released/
Summary of the DNSBomb vulnerability CVE-2024-33655.
The DNSBomb attack, via specially timed DNS queries and answers, can cause a
Denial of Service on resolvers and spoofed targets.
Unbound itself is not vulnerable for DoS, rather it can be used to take part in
a pulsing DoS amplification attack.
PR: 278870
Reported by: jaap@NLnetLabs.nl (maintainer)
Security: CVE-2024-33655
dns/unbound: Update to unbound 1.19.3
This release has a number of bug fixes. The CNAME synthesized for a
DNAME record uses the original TTL, of the DNAME record, and that means
it can be cached for the TTL, instead of 0.
There is a fix that when a message was stored in cache, but one of the
RRsets was not updated due to cache policy, it now restricts the message
TTL if the cache version of the RRset has a shorter TTL. It avoids a
bug where the message is not expired, but its contents is expired.
For dnstap, it logs type DoH and DoT correctly, if that is used for
the message.
The b.root-servers.net address is updated in the default root hints.
(Only the first 15 lines of the commit message are shown above )
dns/unbound: Update to 1.19.0
ChangeLog: https://nlnetlabs.nl/news/2023/Nov/08/unbound-1.19.0-released/
Features
* Fix #850: [FR] Ability to use specific database in Redis, with new
redis-logical-db configuration option.
* Merge #944: Disable EDNS DO. Disable the EDNS DO flag in upstream requests.
This can be helpful for devices that cannot handle DNSSEC information. But it
should not be enabled otherwise, because that would stop DNSSEC validation.
The DNSSEC validation would not work for Unbound itself, and also not for
downstream users. Default is no. The option is disable-edns-do: no
* Expose the script filename in the Python module environment 'mod_env' instead
of the config_file structure which includes the linked list of scripts in a
multi Python module setup; fixes #79.
(Only the first 15 lines of the commit message are shown above )
dns/unbound: Fix loop when ENOBUFS is returned
- Fix send of udp retries when ENOBUFS is returned. It stops looping
and also waits for the condition to go away. Reported to upstream
by Florian Obser.
PR: 274352, 274446
Approved by: jaap@NLnetLabs.nl (maintainer)
MFH: 2023Q4
dns/unbound: Clarify DYNLIB_DESC
The DYNLIB option doesn't change whether unbound itself is dynamically
or statically linked, it enables support for third-party shlibs.
Approved by: maintainer
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
dns: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* Aaron Dalton <aaron@FreeBSD.org>
* Akinori MUSHA aka knu <knu@idaemons.org>
* Alex Samorukov <samm@freebsd.org>
* Alexey Dokuchaev <danfe@FreeBSD.org>
* Allan Jude <allanjude@freebsd.org>
* Amar Takhar <verm@drunkmonk.net>
* Anders Nordby <anders@fix.no>
* Andrew Greenwood <greenwood.andy@gmail.com>
* Anton Berezin <tobez@FreeBSD.org>
* Ashish SHUKLA <ashish@FreeBSD.org>
* Attila Nagy <bra@fsn.hu>
(Only the first 15 lines of the commit message are shown above )
dns/unbound: Update to 1.16.0
This release has EDE support, for extended EDNS error reporting,
it fixes unsupported ZONEMD algorithms to load, and has more bug fixes.
The EDE errors can be turned on by `ede: yes`, it is default disabled.
Validation errors and other errors are then reported. If you also want
stale answers for expired responses to have an error code, the option
`ede-serve-expired: yes` can be used.
On request, the port now also has dnscrypt support default enabled.
PR: 264538
dns/unbound: Update to 1.15.0
[The Makefile of the port got cleaned up to make portfmt happy]
This release has bug fixes for crashes that happened on heavy network
usage. The default for the aggressive-nsec option has changed, it is now
enabled.
The ratelimit logic had to be reworked for the crash fixes. As a result,
there are new options to control the behaviour of ratelimiting.
The ratelimit-backoff and ip-ratelimit-backoff options can be used to
control how severe the backoff is when the ratelimit is exceeded.
The rpz-signal-nxdomain-ra option can be used to unset the RA flag, for
NXDOMAIN answers from RPZ. That is used by some clients to detect that
(Only the first 15 lines of the commit message are shown above )
dns/unbound: Update to 1.14.0
Changelog:
This release contains bug fixes and a full set of RPZ triggers and
actions that are supported. This works with RPZ zones, configured with
`rpz:`.
It is possible to selectively enable use of TCP for stub zones and
forward zones, without having enable it server wide, by enabling it
with the `stub-tcp-upstream: yes` and `forward-tcp-upstream: yes` options.
The added contrib/Dockerfile.tests from ziollek can be used to setup
a Docker environment to run tests in. The documentation is in the
doc/README.tests file.
(Only the first 15 lines of the commit message are shown above )
dns/unbound: Update to 1.13.2
Added a new option DEP-RSA1024 to enable --with-deprecate-rsa-1024
Changelog:
- Merge PR #317: ZONEMD Zone Verification, with RFC 8976 support.
ZONEMD records are checked for zones loaded as auth-zone,
with DNSSEC if available. There is an added option
zonemd-permissive-mode that makes it log but not fail wrong zones.
With zonemd-reject-absence for an auth-zone the presence of a
zonemd can be mandated for specific zones.
- Fix: Resolve interface names on control-interface too.
- Merge #470 from edevil: Allow configuration of persistent TCP
connections.
(Only the first 15 lines of the commit message are shown above )
dns/unbound: update to 1.8.0
Bump PORTREVISION on consumers due to library major version change
PR: 231283
Submitted by: jaap@NLnetLabs.nl (maintainer)
dns/unbound: upgrade 1.6.8 -> 1.7.0
Features
- auth-zone provides a way to configure RFC7706 from unbound.conf,
eg. with auth-zone: name: "." for-downstream: no for-upstream: yes
fallback-enabled: yes and masters or a zonefile with data.
- Aggressive use of NSEC implementation. Use cached NSEC records to
generate NXDOMAIN, NODATA and positive wildcard answers.
- Accept tls-upstream in unbound.conf, the ssl-upstream keyword is
also recognized and means the same. Also for tls-port,
tls-service-key, tls-service-pem, stub-tls-upstream and
forward-tls-upstream.
- [dnscrypt] introduce dnscrypt-provider-cert-rotated option,
from Manu Bretelle.
This option allows handling multiple cert/key pairs while only
(Only the first 15 lines of the commit message are shown above )
Base system contains unbound without libevent support enabled.
Enable libevent by default for the port dns/unbound for performance reasons.
PR: 220733
Submitted by: Dmitry Luhtionov
Approved by: jaap (maintainer), az (mentor)
Update unbound to 1.6.3.
This release fixes a spurious assertion failure when unbound receives a
malformed packet with 0x20 enabled.
Bug Fixes
- Fix #1280: Unbound fails assert when response from authoritative
contains malformed qname. When 0x20 caps-for-id is enabled, when
assertions are not enabled the malformed qname is handled correctly.
PR: 219958
Submitted by: maintainer (jaap NLnetLabs nl)
