2012/3/26 Jakob Schlyter <[email protected]>: > Any more feedback on this? We need more testing to proceed!
Unbound has been imported to work on in-tree (not yet linked to the build) [1]. It compiles and functions on amd64 and i386. I can only guess who is actually working on further integrating this tool in base. Therefore I'm sending the diff below to [email protected] inspiration. -- Bjvrn Ketelaars [1] http://marc.info/?l=openbsd-cvs&m=133278525113948&w=2 Index: distrib/sets/lists/base/mi =================================================================== RCS file: /mnt/cvs/src/distrib/sets/lists/base/mi,v retrieving revision 1.566 diff -u -r1.566 mi --- distrib/sets/lists/base/mi 8 Mar 2012 19:28:45 -0000 1.566 +++ distrib/sets/lists/base/mi 2 Apr 2012 11:33:11 -0000 @@ -2548,6 +2548,7 @@ ./usr/sbin/dig ./usr/sbin/dnssec-keygen ./usr/sbin/dnssec-signzone +./usr/sbin/drill ./usr/sbin/dvmrpctl ./usr/sbin/dvmrpd ./usr/sbin/editmap @@ -2699,6 +2700,12 @@ ./usr/sbin/traceroute ./usr/sbin/traceroute6 ./usr/sbin/trpt +./usr/sbin/unbound +./usr/sbin/unbound-anchor +./usr/sbin/unbound-checkconf +./usr/sbin/unbound-control +./usr/sbin/unbound-control-setup +./usr/sbin/unbound-host ./usr/sbin/usbdevs ./usr/sbin/user ./usr/sbin/useradd @@ -5152,6 +5159,11 @@ ./var/spool/uucppublic ./var/tmp ./var/tmp/vi.recover +./var/unbound +./var/unbound/etc +./var/unbound/var +./var/unbound/var/dev +./var/unbound/var/run ./var/www ./var/www/bin ./var/www/bin/bgpctl Index: distrib/sets/lists/etc/mi =================================================================== RCS file: /mnt/cvs/src/distrib/sets/lists/etc/mi,v retrieving revision 1.146 diff -u -r1.146 mi --- distrib/sets/lists/etc/mi 2 Apr 2012 03:08:44 -0000 1.146 +++ distrib/sets/lists/etc/mi 2 Apr 2012 11:33:11 -0000 @@ -166,6 +166,7 @@ ./etc/rc.d/sshd ./etc/rc.d/statd ./etc/rc.d/syslogd +./etc/rc.d/unbound ./etc/rc.d/tftpd ./etc/rc.d/watchdogd ./etc/rc.d/wsmoused @@ -244,6 +245,9 @@ ./var/named/standard/loopback ./var/named/standard/loopback6.arpa ./var/run/utmp +./var/unbound/etc/root.hint +./var/unbound/etc/unbound.conf +./var/unbound/var/run/root.key ./var/www/cgi-bin/printenv ./var/www/cgi-bin/test-cgi ./var/www/conf/bgplg.css Index: distrib/sets/lists/man/mi =================================================================== RCS file: /mnt/cvs/src/distrib/sets/lists/man/mi,v retrieving revision 1.1128 diff -u -r1.1128 mi --- distrib/sets/lists/man/mi 29 Mar 2012 11:03:59 -0000 1.1128 +++ distrib/sets/lists/man/mi 2 Apr 2012 11:33:11 -0000 @@ -353,6 +353,7 @@ ./usr/share/man/man1/dirname.1 ./usr/share/man/man1/domainname.1 ./usr/share/man/man1/dprofpp.1 +./usr/share/man/man1/drill.1 ./usr/share/man/man1/du.1 ./usr/share/man/man1/echo.1 ./usr/share/man/man1/ed.1 @@ -758,6 +759,7 @@ ./usr/share/man/man1/uname.1 ./usr/share/man/man1/uncompress.1 ./usr/share/man/man1/unexpand.1 +./usr/share/man/man1/unbound-host.1 ./usr/share/man/man1/unifdef.1 ./usr/share/man/man1/uniq.1 ./usr/share/man/man1/units.1 @@ -2537,6 +2539,7 @@ ./usr/share/man/man5/texinfo.5 ./usr/share/man/man5/ttys.5 ./usr/share/man/man5/tzfile.5 +./usr/share/man/man5/unbound.conf.5 ./usr/share/man/man5/usermgmt.conf.5 ./usr/share/man/man5/utmp.5 ./usr/share/man/man5/uuencode.5 @@ -3040,6 +3043,10 @@ ./usr/share/man/man8/ttyflags.8 ./usr/share/man/man8/tunefs.8 ./usr/share/man/man8/umount.8 +./usr/share/man/man8/unbound-anchor.8 +./usr/share/man/man8/unbound-checkconf.8 +./usr/share/man/man8/unbound-control.8 +./usr/share/man/man8/unbound.8 ./usr/share/man/man8/updatedb.8 ./usr/share/man/man8/usbdevs.8 ./usr/share/man/man8/uucpd.8 Index: etc/Makefile =================================================================== RCS file: /mnt/cvs/src/etc/Makefile,v retrieving revision 1.316 diff -u -r1.316 Makefile --- etc/Makefile 1 Apr 2012 18:32:51 -0000 1.316 +++ etc/Makefile 2 Apr 2012 11:33:11 -0000 @@ -53,9 +53,9 @@ inetd isakmpd ldapd ldattach ldpd lpd mopd mrouted named nginx \ nsd ntpd ospfd ospf6d portmap pflogd rarpd rbootd relayd ripd \ route6d rtadvd rtsold rwhod sasyncd sendmail sensorsd smtpd \ - snmpd spamd sshd syslogd watchdogd wsmoused xdm ypbind ypldap \ - yppasswdd ypserv kdc kadmind kpasswdd nfsd mountd lockd statd \ - spamlogd sndiod popa3d tftpd + snmpd spamd sshd syslogd unbound watchdogd wsmoused xdm ypbind \ + ypldap yppasswdd ypserv kdc kadmind kpasswdd nfsd mountd lockd \ + statd spamlogd sndiod popa3d tftpd MISETS= base${OSrev}.tgz comp${OSrev}.tgz \ man${OSrev}.tgz game${OSrev}.tgz etc${OSrev}.tgz @@ -219,6 +219,13 @@ ${DESTDIR}/var/named/standard/loopback; \ ${INSTALL} -c -o root -g wheel -m 644 db.loopback6.arpa \ ${DESTDIR}/var/named/standard/loopback6.arpa + cd unbound; \ + ${INSTALL} -c -o root -g wheel -m 644 unbound.conf \ + ${DESTDIR}/var/unbound/etc/unbound.conf; \ + ${INSTALL} -c -o root -g wheel -m 644 root.hint \ + ${DESTDIR}/var/unbound/etc/root.hint; \ + ${INSTALL} -c -o root -g _unbound -m 664 root.key \ + ${DESTDIR}/var/unbound/var/run/root.key /bin/rm -f ${DESTDIR}/etc/localtime ln -s ${TZDIR}/${LOCALTIME} ${DESTDIR}/etc/localtime /bin/rm -f ${DESTDIR}/etc/rmt Index: etc/group =================================================================== RCS file: /mnt/cvs/src/etc/group,v retrieving revision 1.59 diff -u -r1.59 group --- etc/group 3 Jun 2010 20:28:22 -0000 1.59 +++ etc/group 2 Apr 2012 11:33:11 -0000 @@ -66,6 +66,7 @@ _sndio:*:99: _ldapd:*:100: _iked:*:101: +_unbound:*:102: dialer:*:117: nogroup:*:32766: nobody:*:32767: Index: etc/master.passwd =================================================================== RCS file: /mnt/cvs/src/etc/master.passwd,v retrieving revision 1.67 diff -u -r1.67 master.passwd --- etc/master.passwd 4 Oct 2011 16:32:13 -0000 1.67 +++ etc/master.passwd 2 Apr 2012 11:33:11 -0000 @@ -48,4 +48,5 @@ _sndio:*:99:99::0:0:sndio privsep:/var/empty:/sbin/nologin _ldapd:*:100:100::0:0:LDAP Daemon:/var/empty:/sbin/nologin _iked:*:101:101::0:0:IKEv2 Daemon:/var/empty:/sbin/nologin +_unbound:*:102:102::0:0:Unbound Daemon:/var/unbound:/sbin/nologin nobody:*:32767:32767::0:0:Unprivileged user:/nonexistent:/sbin/nologin Index: etc/rc =================================================================== RCS file: /mnt/cvs/src/etc/rc,v retrieving revision 1.399 diff -u -r1.399 rc --- etc/rc 10 Mar 2012 10:37:13 -0000 1.399 +++ etc/rc 2 Apr 2012 11:33:11 -0000 @@ -159,6 +159,19 @@ fi fi + if [ X"${unbound_flags}" != X"NO" ]; then + if [[ ! -f /var/unbound/etc/unbound_server.pem \ + || ! -f /var/unbound/etc/unbound_control.key \ + || ! -f /var/unbound/etc/unbound_control.pem ]]; then + echo -n "unbound-control-setup: generating certificate and keys... " + if unbound-control-setup >/dev/null 2>&1; then + echo done. + else + echo failed. + fi + fi + fi + if [ ! -f /etc/isakmpd/private/local.key ]; then echo -n "openssl: generating isakmpd/iked RSA key... " if openssl genrsa -out /etc/isakmpd/private/local.key 2048 \ @@ -396,8 +409,8 @@ make_keys echo -n 'starting early daemons:' -start_daemon syslogd ldattach pflogd named nsd ntpd isakmpd iked sasyncd -start_daemon ldapd +start_daemon syslogd ldattach pflogd named nsd unbound ntpd isakmpd iked +start_daemon sasyncd ldapd echo '.' if [ X"${ipsec}" != X"NO" ]; then Index: etc/rc.conf =================================================================== RCS file: /mnt/cvs/src/etc/rc.conf,v retrieving revision 1.167 diff -u -r1.167 rc.conf --- etc/rc.conf 1 Apr 2012 18:32:51 -0000 1.167 +++ etc/rc.conf 2 Apr 2012 11:33:11 -0000 @@ -17,6 +17,7 @@ sshd_flags="" # for normal use: "" named_flags=NO # for normal use: "" nsd_flags=NO # for normal use: "" +unbound_flags=NO # for normal use: "" ldattach_flags=NO # for normal use: "[options] linedisc cua-device" ntpd_flags=NO # for normal use: "" isakmpd_flags=NO # for normal use: "" Index: etc/mtree/4.4BSD.dist =================================================================== RCS file: /mnt/cvs/src/etc/mtree/4.4BSD.dist,v retrieving revision 1.221 diff -u -r1.221 4.4BSD.dist --- etc/mtree/4.4BSD.dist 19 Feb 2012 11:34:36 -0000 1.221 +++ etc/mtree/4.4BSD.dist 2 Apr 2012 11:33:11 -0000 @@ -1790,6 +1790,33 @@ # ./var/tmp .. +# ./var/unbound +unbound + +# ./var/unbound/var +var + +# ./var/unbound/var/dev +dev +# ./var/unbound/var/dev +.. + +# ./var/unbound/var/run +run uname=root gname=_unbound mode=0775 +# ./var/unbound/var/run +.. + +# ./var/unbound/var +.. + +# ./var/unbound/etc +etc +# ./var/unbound/etc +.. + +# ./var/unbound +.. + # ./www www type=dir uname=root gname=daemon mode=755 Index: etc/rc.d/unbound =================================================================== RCS file: etc/rc.d/unbound diff -N etc/rc.d/unbound --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ etc/rc.d/unbound 2 Apr 2012 11:34:58 -0000 @@ -0,0 +1,20 @@ +#!/bin/sh +# +# $OpenBSD$ + +daemon="/usr/sbin/unbound" +daemon_flags="-c /var/unbound/etc/unbound.conf" + +. /etc/rc.d/rc.subr + +unboundcontrol="/usr/sbin/unbound-control" + +rc_reload() { + ${unboundcontrol} reload +} + +rc_stop() { + ${unboundcontrol} stop +} + +rc_cmd $1 Index: etc/rc.d/syslogd =================================================================== RCS file: /mnt/cvs/src/etc/rc.d/syslogd,v retrieving revision 1.1 diff -u -r1.1 syslogd --- etc/rc.d/syslogd 6 Jul 2011 18:55:36 -0000 1.1 +++ etc/rc.d/syslogd 2 Apr 2012 11:33:11 -0000 @@ -15,6 +15,8 @@ daemon_flags="${daemon_flags} -a /var/named/dev/log" [ X"${nsd_flags}" != X"NO" ] && rm -f /var/nsd/dev/log && \ daemon_flags="${daemon_flags} -a /var/nsd/dev/log" + [ X"${unbound_flags}" != X"NO" ] && rm -f /var/unbound/dev/log && \ + daemon_flags="${daemon_flags} -a /var/unbound/dev/log" [ -d /var/empty ] && rm -f /var/empty/dev/log && \ mkdir -p -m 0555 /var/empty/dev && \ daemon_flags="${daemon_flags} -a /var/empty/dev/log" Index: etc/unbound/root.hint =================================================================== RCS file: etc/unbound/root.hint diff -N etc/unbound/root.hint --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ etc/unbound/root.hint 2 Apr 2012 11:34:58 -0000 @@ -0,0 +1,88 @@ +; This file holds the information on root name servers needed to +; initialize cache of Internet domain name servers +; (e.g. reference this file in the "cache . <file>" +; configuration file of BIND domain name servers). +; +; This file is made available by InterNIC +; under anonymous FTP as +; file /domain/named.cache +; on server FTP.INTERNIC.NET +; -OR- RS.INTERNIC.NET +; +; last update: Jun 8, 2011 +; related version of root zone: 2011060800 +; +; formerly NS.INTERNIC.NET +; +. 3600000 IN NS A.ROOT-SERVERS.NET. +A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4 +A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:BA3E::2:30 +; +; FORMERLY NS1.ISI.EDU +; +. 3600000 NS B.ROOT-SERVERS.NET. +B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201 +; +; FORMERLY C.PSI.NET +; +. 3600000 NS C.ROOT-SERVERS.NET. +C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12 +; +; FORMERLY TERP.UMD.EDU +; +. 3600000 NS D.ROOT-SERVERS.NET. +D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90 +D.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2D::D +; +; FORMERLY NS.NASA.GOV +; +. 3600000 NS E.ROOT-SERVERS.NET. +E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10 +; +; FORMERLY NS.ISC.ORG +; +. 3600000 NS F.ROOT-SERVERS.NET. +F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241 +F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2F::F +; +; FORMERLY NS.NIC.DDN.MIL +; +. 3600000 NS G.ROOT-SERVERS.NET. +G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 +; +; FORMERLY AOS.ARL.ARMY.MIL +; +. 3600000 NS H.ROOT-SERVERS.NET. +H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53 +H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::803F:235 +; +; FORMERLY NIC.NORDU.NET +; +. 3600000 NS I.ROOT-SERVERS.NET. +I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17 +I.ROOT-SERVERS.NET. 3600000 AAAA 2001:7FE::53 +; +; OPERATED BY VERISIGN, INC. +; +. 3600000 NS J.ROOT-SERVERS.NET. +J.ROOT-SERVERS.NET. 3600000 A 192.58.128.30 +J.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:C27::2:30 +; +; OPERATED BY RIPE NCC +; +. 3600000 NS K.ROOT-SERVERS.NET. +K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129 +K.ROOT-SERVERS.NET. 3600000 AAAA 2001:7FD::1 +; +; OPERATED BY ICANN +; +. 3600000 NS L.ROOT-SERVERS.NET. +L.ROOT-SERVERS.NET. 3600000 A 199.7.83.42 +L.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:3::42 +; +; OPERATED BY WIDE +; +. 3600000 NS M.ROOT-SERVERS.NET. +M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 +M.ROOT-SERVERS.NET. 3600000 AAAA 2001:DC3::35 +; End of File Index: etc/unbound/root.key =================================================================== RCS file: etc/unbound/root.key diff -N etc/unbound/root.key --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ etc/unbound/root.key 2 Apr 2012 11:34:58 -0000 @@ -0,0 +1,9 @@ +; autotrust trust anchor file +;;id: . 1 +;;last_queried: 1331115620 ;;Wed Mar 7 11:20:20 2012 +;;last_success: 1331115620 ;;Wed Mar 7 11:20:20 2012 +;;next_probe_time: 1331155998 ;;Wed Mar 7 22:33:18 2012 +;;query_failed: 0 +;;query_interval: 43200 +;;retry_time: 8640 +. 172800 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0E zrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZx kjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2h zCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGc LmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= ;{id = 19036 (ksk), size = 2048b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=1331115620 ;;Wed Mar 7 11:20:20 2012 Index: etc/unbound/unbound.conf =================================================================== RCS file: etc/unbound/unbound.conf diff -N etc/unbound/unbound.conf --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ etc/unbound/unbound.conf 2 Apr 2012 11:35:10 -0000 @@ -0,0 +1,525 @@ +# +# Example configuration file. +# +# See unbound.conf(5) man page, version 1.4.16. +# +# this is a comment. + +#Use this to include other text into the file. +#include: "otherfile.conf" + +# The server clause sets the main parameters. +server: + # whitespace is not necessary, but looks cleaner. + + # verbosity number, 0 is least verbose. 1 is default. + verbosity: 1 + + # print statistics to the log (for every thread) every N seconds. + # Set to "" or 0 to disable. Default is disabled. + # statistics-interval: 0 + + # enable cumulative statistics, without clearing them after printing. + # statistics-cumulative: no + + # enable extended statistics (query types, answer codes, status) + # printed from unbound-control. default off, because of speed. + # extended-statistics: no + + # number of threads to create. 1 disables threading. + # num-threads: 1 + + # specify the interfaces to answer queries from by ip-address. + # The default is to listen to localhost (127.0.0.1 and ::1). + # specify 0.0.0.0 and ::0 to bind to all available interfaces. + # specify every interface[@port] on a new 'interface:' labelled line. + # The listen interfaces are not changed on reload, only on restart. + # interface: 192.0.2.153 + # interface: 192.0.2.154 + # interface: 192.0.2.154@5003 + # interface: 2001:DB8::5 + + # enable this feature to copy the source address of queries to reply. + # Socket options are not supported on all platforms. experimental. + # interface-automatic: no + + # port to answer queries from + # port: 53 + + # specify the interfaces to send outgoing queries to authoritative + # server from by ip-address. If none, the default (all) interface + # is used. Specify every interface on a 'outgoing-interface:' line. + # outgoing-interface: 192.0.2.153 + # outgoing-interface: 2001:DB8::5 + # outgoing-interface: 2001:DB8::6 + + # number of ports to allocate per thread, determines the size of the + # port range that can be open simultaneously. About double the + # num-queries-per-thread, or, use as many as the OS will allow you. + # outgoing-range: 4096 + + # permit unbound to use this port number or port range for + # making outgoing queries, using an outgoing interface. + # outgoing-port-permit: 32768 + + # deny unbound the use this of port number or port range for + # making outgoing queries, using an outgoing interface. + # Use this to make sure unbound does not grab a UDP port that some + # other server on this computer needs. The default is to avoid + # IANA-assigned port numbers. + # outgoing-port-avoid: "3200-3208" + + # number of outgoing simultaneous tcp buffers to hold per thread. + # outgoing-num-tcp: 10 + + # number of incoming simultaneous tcp buffers to hold per thread. + # incoming-num-tcp: 10 + + # buffer size for UDP port 53 incoming (SO_RCVBUF socket option). + # 0 is system default. Use 4m to catch query spikes for busy servers. + # so-rcvbuf: 0 + + # buffer size for UDP port 53 outgoing (SO_SNDBUF socket option). + # 0 is system default. Use 4m to handle spikes on very busy servers. + # so-sndbuf: 0 + + # EDNS reassembly buffer to advertise to UDP peers (the actual buffer + # is set with msg-buffer-size). 1480 can solve fragmentation (timeouts). + # edns-buffer-size: 4096 + + # buffer size for handling DNS data. No messages larger than this + # size can be sent or received, by UDP or TCP. In bytes. + # msg-buffer-size: 65552 + + # the amount of memory to use for the message cache. + # plain value in bytes or you can append k, m or G. default is "4Mb". + # msg-cache-size: 4m + + # the number of slabs to use for the message cache. + # the number of slabs must be a power of 2. + # more slabs reduce lock contention, but fragment memory usage. + # msg-cache-slabs: 4 + + # the number of queries that a thread gets to service. + # num-queries-per-thread: 1024 + + # if very busy, 50% queries run to completion, 50% get timeout in msec + # jostle-timeout: 200 + + # the amount of memory to use for the RRset cache. + # plain value in bytes or you can append k, m or G. default is "4Mb". + # rrset-cache-size: 4m + + # the number of slabs to use for the RRset cache. + # the number of slabs must be a power of 2. + # more slabs reduce lock contention, but fragment memory usage. + # rrset-cache-slabs: 4 + + # the time to live (TTL) value lower bound, in seconds. Default 0. + # If more than an hour could easily give trouble due to stale data. + # cache-min-ttl: 0 + + # the time to live (TTL) value cap for RRsets and messages in the + # cache. Items are not cached for longer. In seconds. + # cache-max-ttl: 86400 + + # the time to live (TTL) value for cached roundtrip times, lameness and + # EDNS version information for hosts. In seconds. + # infra-host-ttl: 900 + + # the number of slabs to use for the Infrastructure cache. + # the number of slabs must be a power of 2. + # more slabs reduce lock contention, but fragment memory usage. + # infra-cache-slabs: 4 + + # the maximum number of hosts that are cached (roundtrip, EDNS, lame). + # infra-cache-numhosts: 10000 + + # Enable IPv4, "yes" or "no". + # do-ip4: yes + + # Enable IPv6, "yes" or "no". + # do-ip6: yes + + # Enable UDP, "yes" or "no". + # do-udp: yes + + # Enable TCP, "yes" or "no". + # do-tcp: yes + + # upstream connections use TCP only (and no UDP), "yes" or "no" + # useful for tunneling scenarios, default no. + # tcp-upstream: no + + # Detach from the terminal, run in background, "yes" or "no". + # do-daemonize: yes + + # control which clients are allowed to make (recursive) queries + # to this server. Specify classless netblocks with /size and action. + # By default everything is refused, except for localhost. + # Choose deny (drop message), refuse (polite error reply), + # allow (recursive ok), allow_snoop (recursive and nonrecursive ok) + # access-control: 0.0.0.0/0 refuse + # access-control: 127.0.0.0/8 allow + # access-control: ::0/0 refuse + # access-control: ::1 allow + # access-control: ::ffff:127.0.0.1 allow + + # if given, a chroot(2) is done to the given directory. + # i.e. you can chroot to the working directory, for example, + # for extra security, but make sure all files are in that directory. + # + # If chroot is enabled, you should pass the configfile (from the + # commandline) as a full path from the original root. After the + # chroot has been performed the now defunct portion of the config + # file path is removed to be able to reread the config after a reload. + # + # All other file paths (working dir, logfile, roothints, and + # key files) can be specified in several ways: + # o as an absolute path relative to the new root. + # o as a relative path to the working directory. + # o as an absolute path relative to the original root. + # In the last case the path is adjusted to remove the unused portion. + # + # The pid file can be absolute and outside of the chroot, it is + # written just prior to performing the chroot and dropping permissions. + # + # Additionally, unbound may need to access /dev/random (for entropy). + # How to do this is specific to your OS. + # + # If you give "" no chroot is performed. The path must not end in a /. + # chroot: "/var/unbound" + + # if given, user privileges are dropped (after binding port), + # and the given username is assumed. Default is user "_unbound". + # If you give "" no privileges are dropped. + # username: "_unbound" + + # the working directory. The relative files in this config are + # relative to this directory. If you give "" the working directory + # is not changed. + # directory: "/var/unbound/etc" + + # the log file, "" means log to stderr. + # Use of this option sets use-syslog to "no". + # logfile: "" + + # Log to syslog(3) if yes. The log facility LOG_DAEMON is used to + # log to, with identity "unbound". If yes, it overrides the logfile. + # use-syslog: yes + + # print UTC timestamp in ascii to logfile, default is epoch in seconds. + # log-time-ascii: no + + # print one line with time, IP, name, type, class for every query. + # log-queries: no + + # the pid file. Can be an absolute path outside of chroot/work dir. + # pidfile: "/var/unbound/var/run/unbound.pid" + + # file to read root hints from. + # get one from ftp://FTP.INTERNIC.NET/domain/named.cache + root-hints: "/var/unbound/etc/root.hint" + + # enable to not answer id.server and hostname.bind queries. + # hide-identity: no + + # enable to not answer version.server and version.bind queries. + # hide-version: no + + # the identity to report. Leave "" or default to return hostname. + # identity: "" + + # the version to report. Leave "" or default to return package version. + # version: "" + + # the target fetch policy. + # series of integers describing the policy per dependency depth. + # The number of values in the list determines the maximum dependency + # depth the recursor will pursue before giving up. Each integer means: + # -1 : fetch all targets opportunistically, + # 0: fetch on demand, + # positive value: fetch that many targets opportunistically. + # Enclose the list of numbers between quotes (""). + # target-fetch-policy: "3 2 1 0 0" + + # Harden against very small EDNS buffer sizes. + # harden-short-bufsize: no + + # Harden against unseemly large queries. + # harden-large-queries: no + + # Harden against out of zone rrsets, to avoid spoofing attempts. + # harden-glue: yes + + # Harden against receiving dnssec-stripped data. If you turn it + # off, failing to validate dnskey data for a trustanchor will + # trigger insecure mode for that zone (like without a trustanchor). + # Default on, which insists on dnssec data for trust-anchored zones. + # harden-dnssec-stripped: yes + + # Harden against queries that fall under dnssec-signed nxdomain names. + # harden-below-nxdomain: no + + # Harden the referral path by performing additional queries for + # infrastructure data. Validates the replies (if possible). + # Default off, because the lookups burden the server. Experimental + # implementation of draft-wijngaards-dnsext-resolver-side-mitigation. + # harden-referral-path: no + + # Use 0x20-encoded random bits in the query to foil spoof attempts. + # This feature is an experimental implementation of draft dns-0x20. + # use-caps-for-id: no + + # Enforce privacy of these addresses. Strips them away from answers. + # It may cause DNSSEC validation to additionally mark it as bogus. + # Protects against 'DNS Rebinding' (uses browser as network proxy). + # Only 'private-domain' and 'local-data' names are allowed to have + # these private addresses. No default. + # private-address: 10.0.0.0/8 + # private-address: 172.16.0.0/12 + # private-address: 192.168.0.0/16 + # private-address: 169.254.0.0/16 + # private-address: fd00::/8 + # private-address: fe80::/10 + + # Allow the domain (and its subdomains) to contain private addresses. + # local-data statements are allowed to contain private addresses too. + # private-domain: "example.com" + + # If nonzero, unwanted replies are not only reported in statistics, + # but also a running total is kept per thread. If it reaches the + # threshold, a warning is printed and a defensive action is taken, + # the cache is cleared to flush potential poison out of it. + # A suggested value is 10000000, the default is 0 (turned off). + # unwanted-reply-threshold: 0 + + # Do not query the following addresses. No DNS queries are sent there. + # List one address per entry. List classless netblocks with /size, + # do-not-query-address: 127.0.0.1/8 + # do-not-query-address: ::1 + + # if yes, the above default do-not-query-address entries are present. + # if no, localhost can be queried (for testing and debugging). + # do-not-query-localhost: yes + + # if yes, perform prefetching of almost expired message cache entries. + # prefetch: no + + # if yes, perform key lookups adjacent to normal lookups. + # prefetch-key: no + + # module configuration of the server. A string with identifiers + # separated by spaces. "iterator" or "validator iterator" + # module-config: "validator iterator" + + # File with trusted keys, kept uptodate using RFC5011 probes, + # initial file like trust-anchor-file, then it stores metadata. + # Use several entries, one per domain name, to track multiple zones. + # + # If you want to perform DNSSEC validation, run unbound-anchor before + # you start unbound (i.e. in the system boot scripts). And enable: + # Please note usage of unbound-anchor root anchor is at your own risk + # and under the terms of our LICENSE (see that file in the source). + auto-trust-anchor-file: "/var/unbound/var/run/root.key" + + # File with DLV trusted keys. Same format as trust-anchor-file. + # There can be only one DLV configured, it is trusted from root down. + # Download http://ftp.isc.org/www/dlv/dlv.isc.org.key + # dlv-anchor-file: "dlv.isc.org.key" + + # File with trusted keys for validation. Specify more than one file + # with several entries, one file per entry. + # Zone file format, with DS and DNSKEY entries. + # Note this gets out of date, use auto-trust-anchor-file please. + # trust-anchor-file: "" + + # Trusted key for validation. DS or DNSKEY. specify the RR on a + # single line, surrounded by "". TTL is ignored. class is IN default. + # Note this gets out of date, use auto-trust-anchor-file please. + # (These examples are from August 2007 and may not be valid anymore). + # trust-anchor: "nlnetlabs.nl. DNSKEY 257 3 5 AQPzzTWMz8qSWIQlfRnPckx2BiVmkVN6LPupO3mbz7FhLSnm26n6iG9N Lby97Ji453aWZY3M5/xJBSOS2vWtco2t8C0+xeO1bc/d6ZTy32DHchpW 6rDH1vp86Ll+ha0tmwyy9QP7y2bVw5zSbFCrefk8qCUBgfHm9bHzMG1U BYtEIQ==" + # trust-anchor: "jelte.nlnetlabs.nl. DS 42860 5 1 14D739EB566D2B1A5E216A0BA4D17FA9B038BE4A" + + # File with trusted keys for validation. Specify more than one file + # with several entries, one file per entry. Like trust-anchor-file + # but has a different file format. Format is BIND-9 style format, + # the trusted-keys { name flag proto algo "key"; }; clauses are read. + # you need external update procedures to track changes in keys. + # trusted-keys-file: "" + + # Ignore chain of trust. Domain is treated as insecure. + # domain-insecure: "example.com" + + # Override the date for validation with a specific fixed date. + # Do not set this unless you are debugging signature inception + # and expiration. "" or "0" turns the feature off. -1 ignores date. + # val-override-date: "" + + # The time to live for bogus data, rrsets and messages. This avoids + # some of the revalidation, until the time interval expires. in secs. + # val-bogus-ttl: 60 + + # The signature inception and expiration dates are allowed to be off + # by 10% of the signature lifetime (expir-incep) from our local clock. + # This leeway is capped with a minimum and a maximum. In seconds. + # val-sig-skew-min: 3600 + # val-sig-skew-max: 86400 + + # Should additional section of secure message also be kept clean of + # unsecure data. Useful to shield the users of this validator from + # potential bogus data in the additional section. All unsigned data + # in the additional section is removed from secure messages. + # val-clean-additional: yes + + # Turn permissive mode on to permit bogus messages. Thus, messages + # for which security checks failed will be returned to clients, + # instead of SERVFAIL. It still performs the security checks, which + # result in interesting log files and possibly the AD bit in + # replies if the message is found secure. The default is off. + # val-permissive-mode: no + + # Ignore the CD flag in incoming queries and refuse them bogus data. + # Enable it if the only clients of unbound are legacy servers (w2008) + # that set CD but cannot validate themselves. + # ignore-cd-flag: no + + # Have the validator log failed validations for your diagnosis. + # 0: off. 1: A line per failed user query. 2: With reason and bad IP. + # val-log-level: 0 + + # It is possible to configure NSEC3 maximum iteration counts per + # keysize. Keep this table very short, as linear search is done. + # A message with an NSEC3 with larger count is marked insecure. + # List in ascending order the keysize and count values. + # val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500" + + # instruct the auto-trust-anchor-file probing to add anchors after ttl. + # add-holddown: 2592000 # 30 days + + # instruct the auto-trust-anchor-file probing to del anchors after ttl. + # del-holddown: 2592000 # 30 days + + # auto-trust-anchor-file probing removes missing anchors after ttl. + # If the value 0 is given, missing anchors are not removed. + # keep-missing: 31622400 # 366 days + + # the amount of memory to use for the key cache. + # plain value in bytes or you can append k, m or G. default is "4Mb". + # key-cache-size: 4m + + # the number of slabs to use for the key cache. + # the number of slabs must be a power of 2. + # more slabs reduce lock contention, but fragment memory usage. + # key-cache-slabs: 4 + + # the amount of memory to use for the negative cache (used for DLV). + # plain value in bytes or you can append k, m or G. default is "1Mb". + # neg-cache-size: 1m + + # a number of locally served zones can be configured. + # local-zone: <zone> <type> + # local-data: "<resource record string>" + # o deny serves local data (if any), else, drops queries. + # o refuse serves local data (if any), else, replies with error. + # o static serves local data, else, nxdomain or nodata answer. + # o transparent gives local data, but resolves normally for other names + # o redirect serves the zone data for any subdomain in the zone. + # o nodefault can be used to normally resolve AS112 zones. + # o typetransparent resolves normally for other types and other names + # + # defaults are localhost address, reverse for 127.0.0.1 and ::1 + # and nxdomain for AS112 zones. If you configure one of these zones + # the default content is omitted, or you can omit it with 'nodefault'. + # + # If you configure local-data without specifying local-zone, by + # default a transparent local-zone is created for the data. + # + # You can add locally served data with + # local-zone: "local." static + # local-data: "mycomputer.local. IN A 192.0.2.51" + # local-data: 'mytext.local TXT "content of text record"' + # + # You can override certain queries with + # local-data: "adserver.example.com A 127.0.0.1" + # + # You can redirect a domain to a fixed address with + # (this makes example.com, www.example.com, etc, all go to 192.0.2.3) + # local-zone: "example.com" redirect + # local-data: "example.com A 192.0.2.3" + # + # Shorthand to make PTR records, "IPv4 name" or "IPv6 name". + # You can also add PTR records using local-data directly, but then + # you need to do the reverse notation yourself. + # local-data-ptr: "192.0.2.3 www.example.com" + + # service clients over SSL (on the TCP sockets), with plain DNS inside + # the SSL stream. Give the certificate to use and private key. + # default is "" (disabled). requires restart to take effect. + # ssl-service-key: "path/to/privatekeyfile.key" + # ssl-service-pem: "path/to/publiccertfile.pem" + # ssl-port: 443 + + # request upstream over SSL (with plain DNS inside the SSL stream). + # Default is no. Can be turned on and off with unbound-control. + # ssl-upstream: no + +# Python config section. To enable: +# o use --with-pythonmodule to configure before compiling. +# o list python in the module-config string (above) to enable. +# o and give a python-script to run. +python: + # Script file to load + # python-script: "/var/unbound/etc/ubmodule-tst.py" + +# Remote control config section. +remote-control: + # Enable remote control with unbound-control(8) here. + # set up the keys and certificates with unbound-control-setup. + control-enable: yes + + # what interfaces are listened to for remote control. + # give 0.0.0.0 and ::0 to listen to all interfaces. + # control-interface: 127.0.0.1 + # control-interface: ::1 + + # port number for remote control operations. + # control-port: 8953 + + # unbound server key file. + # server-key-file: "/var/unbound/etc/unbound_server.key" + + # unbound server certificate file. + # server-cert-file: "/var/unbound/etc/unbound_server.pem" + + # unbound-control key file. + # control-key-file: "/var/unbound/etc/unbound_control.key" + + # unbound-control certificate file. + # control-cert-file: "/var/unbound/etc/unbound_control.pem" + +# Stub zones. +# Create entries like below, to make all queries for 'example.com' and +# 'example.org' go to the given list of nameservers. list zero or more +# nameservers by hostname or by ipaddress. If you set stub-prime to yes, +# the list is treated as priming hints (default is no). +# stub-zone: +# name: "example.com" +# stub-addr: 192.0.2.68 +# stub-prime: no +# stub-zone: +# name: "example.org" +# stub-host: ns.example.com. + +# Forward zones +# Create entries like below, to make all queries for 'example.com' and +# 'example.org' go to the given list of servers. These servers have to handle +# recursion to other nameservers. List zero or more nameservers by hostname +# or by ipaddress. Use an entry with name "." to forward all queries. +# forward-zone: +# name: "example.com" +# forward-addr: 192.0.2.68 +# forward-addr: 192.0.2.73@5355 # forward to port 5355. +# forward-zone: +# name: "example.org" +# forward-host: fwd.example.com Index: usr.sbin/Makefile =================================================================== RCS file: /mnt/cvs/src/usr.sbin/Makefile,v retrieving revision 1.161 diff -u -r1.161 Makefile --- usr.sbin/Makefile 5 Mar 2012 11:15:41 -0000 1.161 +++ usr.sbin/Makefile 2 Apr 2012 11:33:11 -0000 @@ -15,8 +15,8 @@ rmt route6d rpc.bootparamd rpc.lockd rpc.statd rtadvd rtsold rwhod \ sa sasyncd sensorsd sliplogin slstats smtpd snmpctl snmpd spamdb \ spray syslogc syslogd sysmerge tcpdrop tcpdump tftpd tokenadm \ - tokeninit traceroute traceroute6 trpt usbdevs user vipw watchdogd \ - wsconscfg wsfontload wsmoused zdump zic ztsscale + tokeninit traceroute traceroute6 trpt unbound usbdevs user vipw \ + watchdogd wsconscfg wsfontload wsmoused zdump zic ztsscale .if (${AFS:L} == "yes") SUBDIR+=afs
