Unbound is designed as a set of modular components, so that also
DNSSEC (secure DNS) validation and stub-resolvers (that do not run as
a server, but are linked into an application) are easily possible.
Goals:
* A validating recursive DNS resolver.
* Code diversity in the DNS resolver monoculture.
* Drop-in replacement for BIND apart from config.
* DNSSEC support.
* Fully RFC compliant.
* High performance, even with validation enabled.
* Used as: stub resolver, full caching name server, resolver library.
* Elegant design of validator, resolver, cache modules.
o provide the ability to pick and choose modules.
* Robust.
* In C, open source: The BSD license.
* Smallest as possible component that does the job.
* Stub-zones can be configured (local data or AS112 zones).
Non-goals:
* An authoritative name server.
* Too many Features.
===> The following configuration options are available for unbound-1.26.1:
DEP-RSA1024=off: Deprecate the use of RSA 1024 keys
DNSCRYPT=on: Enable dnscrypt support
DNSTAP=off: Enable dnstap logging support
DOCS=on: Build and/or install documentation
DYNLIB=on: Enable support for dynamic (shared) 3rd-party libraries
ECDSA=on: Enable ECDSA (elliptic curve) support (OpenSSL >= 1.0)
EVAPI=on: Pluggable event based libunbound API support
FILTER_AAAA=off: Build with AAAA filter functionality (contrib)
GOST=on: Enable GOST support (requires OpenSSL >= 1.0)
HIREDIS=off: Enable hiredis support for the cachedb module
LIBEVENT=on: Build against libevent
MUNIN_PLUGIN=off: Install Munin plugin
PYTHON=off: Python bindings or support
SUBNET=off: Enable client subnet support
TFOCL=off: Enable TCP Fast Open for client mode
TFOSE=off: Enable TCP Fast Open for server mode
THREADS=on: Threading support
===> Use 'make config' to modify these settings
- Update to 1.6.0
- Do not silence installation message
- While I'm here:
- Move LIB_DEPENDS upwards
- Use = instead of += for CONFIGURE_ARGS and USES
- Convert to options helper
- Use TEST_TARGET
Changes: https://unbound.nlnetlabs.nl/pipermail/unbound-users/2016-December/004587.html
PR: 215322
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
Update to version 1.5.10
In this release there is a fix for long downtime after connectivity
loss, which was a longstanding unsolved issue. Features for tcp, TCP
Fast Open and timeout pressure to close connections when the tcp
connections are getting full. Option to use ipv6 /64 for extra entropy.
Features
- Create a pkg-config file for libunbound in contrib.
- TCP Fast open patch from Sara Dickinson.
- Finegrained localzone control with define-tag, access-control-tag,
access-control-tag-action, access-control-tag-data, local-zone-tag, and
local-zone-override. And added types always_transparent, always_refuse,
always_nxdomain with that.
- If more than half of tcp connections are in use, a shorter timeout
(Only the first 15 lines of the commit message are shown above )
- Update unbound to version 1.5.8
- add OPTION for DNSTAP logging support
- rename OPTION s/MUNIN/MUNIN_PLUGIN/ so it is consistent with nsd
- use OPTIONS_SUB
- use ${opt}_target
- use @sample macro for unbound.conf
- sort pkg-plist
Features
- ip-transparent option for FreeBSD with IP_BINDANY socket option.
- insecure-lan-zones: yesno config option, patch from Dag-Erling Smorgrav.
- RR Type CSYNC support RFC 7477, in debug printout and config input.
- RR Type OPENPGPKEY support (draft-ietf-dane-openpgpkey-07).
- [bugzilla: 731 ] tcp-mss, outgoing-tcp-mss options for unbound.conf, patch
(Only the first 15 lines of the commit message are shown above )
- Update unbound to 1.5.7
- Bump PORTREVISIOn on dependent ports
Some Upgrade Notes:
This release fixes a validation failure for nodata with wildcards and
emptynonterminals. Fixes OpenSSL Library compability. Fixes correct
response for malformed EDNS queries. For crypto in libunbound there is
libnettle support.
Qname minimisation is implemented. Use qname-minimisation: yes to
enable it. This version sends the full query name when an error is
found for intermediate names. It should therefore not fail for names
on nonconformant servers. It combines well with
harden-below-nxdomain: yes because those nxdomains are probed by the
(Only the first 15 lines of the commit message are shown above )
By default libtool replaces -export-symbols <file> with -retain-symbols-file
<file> on ELF systems, but this doesn't really do what -export-symbols is
meant to do. On GNU ELF systems it converts <file> to a simple version
script first and then uses -version-script instead of -retain-symbols-file.
Let USES=libtool patch libtool scripts to do this on all systems with GNU
ld(1).
Bump PORTREVISION on all ports where the build log contains -export-symbols.
audio/calf: This port builds a module that now exports only one function,
but it also builds a number of executables that link to this module and
expect to see other functions. Because it's already a bit dodgy to link to
a module (libtool warns about this) let the module continue to export only
one function and instead build an ordinary library from the same source that
the executables can link to. Fix a number of other issues in the same
(Only the first 15 lines of the commit message are shown above )
- Update to 1.5.0
- Removed FreeBSD 10 check for libevent, because of upstream fixes (as stated in
changelog)
- Converted files/patch-Makefile.in to sed patch, which is position independent
PR: 195674
Submitted by: lightside@gmx.com
Mark unbound BROKEN for FreeBSD 10.0+ if built with libevent
There is a known issue that causes random crashes due to poor
interaction with Capsicum.
PR: 191532
- Switch dns/unbound to USES=libtool, drop .la files
- Bump dependent ports as .so version has changed
- While here, add LICENSE_FILE to dns/getdns
Approved by: portmgr blanket
Only use libevent2
Remove libevent as libevent2 is providing a good compatibility interface as well
as providing better performances.
Remove custom patches from libevent2 and install libevent2 the regular way
Mark ports abusing private fields of the libevent1 API as broken
Import a patch from fedora to have honeyd working with libevent2
Remove most of the patches necessary to find the custom installation we used to
have for libevent2
With hat: portmgr
Remove indefinite articles and trailing periods from COMMENT, plus
minor COMMENT typos and surrounding whitespace fixes. Categories D-F.
CR: D196
Approved by: portmgr (bapt)
- Add STAGE support
- Fix build with custom LOCALBASE/PREFIX
- Add ability to specify flags to unbound-anchor via unbound_anchorflags in
rc.conf (useful for when /etc/resolv.conf only contains 127.0.0.1)
- Bump PORTREVISION
PR: ports/187239
Submitted by: zi@
Approved by: sem@ (maintainer)
- unbound was imported into base in r255597 with group 'unbound'. Chase
this and have the port also add a group to avoid mergemaster conflict
Approved by: maintainer timeout (via email)
- Do not depend on security/openssl if openssl in base is sufficient.
PR: ports/178262
Submitted by: Jan Beich <jbeich@tormail.org>
Reviewed by: ldns' port maintainer
- Update ldns to 1.6.15 [1]
- Add an entry to UPDATING about binary incompatibility in previous version of
ldns
- Fix OptionsNG
- Bump PORTREVISION for all ports dependent on dns/ldns
- Remove ABI version numbers from LIB_DEPENDS while I'm here
PR: ports/173080 [1]
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer) [1]
Approved by: portmgr (erwin)
Feature safe: yes
In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
- Update to 1.4.4
* mistly bugs fix release
* ECC-GOST is not supported by the port yet because of it requires
OpenSSL 1.0.0 from ports. (There is in TODO).
- Forgot to set : ${unbound_enable:-"NO"}
- Allow user to set a pid file location with unbound_pidfile="..."
PR: ports/142793 (based on)
Submitted by: Keith Gaughan <k at stereochro.me>
