From a57c3b8b64143bfd597ff30439f00c256b38228c Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Apr 27 2017 01:46:09 +0000 Subject: * Wed Apr 26 2017 Paul Wouters - 1.6.2-1 - Update to 1.6.2 (rhbz#1425649) - Updated unbound.conf with new options --- diff --git a/.gitignore b/.gitignore index 939c908..ab37b68 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ unbound-1.4.5.tar.gz /unbound-1.5.9.tar.gz /unbound-1.5.10.tar.gz /unbound-1.6.0.tar.gz +/unbound-1.6.2.tar.gz diff --git a/sources b/sources index 54ad572..bcfd9b0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (unbound-1.6.0.tar.gz) = c92adee98ef759d033ac39784796e936e292f0671a42ad455411b82a9ba552744e4a0de432ee4ac05609dc0b429b70d5ce8169c20d3d65f4acf5afc5e02822ac +SHA512 (unbound-1.6.2.tar.gz) = ac7a4f7e6e857715bd047060ad27a36637ceaaea965fadea0124eb7d83a8bcffdf64723335ca4baf2428eefbd135909ed7a62530dc7f9fb68980726b4270a751 diff --git a/unbound.conf b/unbound.conf index 5b9c8d7..db0bfe5 100644 --- a/unbound.conf +++ b/unbound.conf @@ -1,7 +1,7 @@ # # Example configuration file. # -# See unbound.conf(5) man page, version 1.5.10. +# See unbound.conf(5) man page # # this is a comment. @@ -20,6 +20,14 @@ server: # Needs to be disabled for munin plugin statistics-interval: 0 + # enable shm for stats, default no. if you enable also enable + # statistics-interval, every time it also writes stats to the + # shared memory segment keyed with shm-key. + # shm-enable: no + + # shm for stats uses this key, and key+1 for the shared mem segment. + # shm-key: 11777 + # enable cumulative statistics, without clearing them after printing. # Needs to be disabled for munin plugin statistics-cumulative: no @@ -221,7 +229,12 @@ server: # Default is 0, system default MSS. # outgoing-tcp-mss: 0 + # Fedora note: do not activate this - can cause a crash + # Use systemd socket activation for UDP, TCP, and control sockets. + # use-systemd: no + # Detach from the terminal, run in background, "yes" or "no". + # Set the value to "no" when unbound runs as systemd service. # do-daemonize: yes # control which clients are allowed to make (recursive) queries @@ -251,6 +264,9 @@ server: # set redirect data for particular tag for access control element # access-control-tag-data: 192.0.2.0/24 tag2 "A 127.0.0.1" + # Set view for access control element + # access-control-view: 192.0.2.0/24 viewname + # if given, a chroot(2) is done to the given directory. # i.e. you can chroot to the working directory, for example, # for extra security, but make sure all files are in that directory. @@ -296,6 +312,10 @@ server: # Log to syslog(3) if yes. The log facility LOG_DAEMON is used to # log to, with identity "unbound". If yes, it overrides the logfile. # use-syslog: yes + + # Log identity to report. if empty, defaults to the name of argv[0] + # (usually "unbound"). + # log-identity: "" # print UTC timestamp in ascii to logfile, default is epoch in seconds. log-time-ascii: yes @@ -303,6 +323,10 @@ server: # print one line with time, IP, name, type, class for every query. # log-queries: no + # print one line per reply, with time, IP, name, type, class, rcode, + # timetoresolve, fromcache and responsesize. + # log-replies: no + # the pid file. Can be an absolute path outside of chroot/work dir. pidfile: "/var/run/unbound/unbound.pid" @@ -313,6 +337,9 @@ server: # enable to not answer id.server and hostname.bind queries. # hide-identity: no + # enable to not answer trustanchor.unbound queries. + # hide-trustanchor: no + # enable to not answer version.server and version.bind queries. # hide-version: no @@ -366,6 +393,12 @@ server: # to NS when possible. qname-minimisation: yes + # QNAME minimisation in strict mode. Do not fall-back to sending full + # QNAME to potentially broken nameservers. A lot of domains will not be + # resolvable when this option in enabled. + # This option only has effect when qname-minimisation is enabled. + # qname-minimisation-strict: no + # Use 0x20-encoded random bits in the query to foil spoof attempts. # This feature is an experimental implementation of draft dns-0x20. # use-caps-for-id: no @@ -503,6 +536,10 @@ server: # that set CD but cannot validate themselves. # ignore-cd-flag: no + # Serve expired reponses from cache, with TTL 0 in the response, + # and then attempt to fetch the data afresh. + # serve-expired: no + # Have the validator log failed validations for your diagnosis. # 0: off. 1: A line per failed user query. 2: With reason and bad IP. val-log-level: 1 @@ -677,6 +714,19 @@ server: # can give this multiple times, the name closest to the zone is used. # ratelimit-below-domain: com 1000 + # global query ratelimit for all ip addresses. + # feature is experimental. + # if 0(default) it is disabled, otherwise states qps allowed per ip address + # ip-ratelimit: 0 + + # ip ratelimits are tracked in a cache, size in bytes of cache (or k,m). + # ip-ratelimit-size: 4m + # ip ratelimit cache slabs, reduces lock contention if equal to cpucount. + # ip-ratelimit-slabs: 4 + + # 0 blocks when ip is ratelimited, otherwise let 1/xth traffic through + # ip-ratelimit-factor: 10 + # Python config section. To enable: # o use --with-pythonmodule to configure before compiling. # o list python in the module-config string (above) to enable. @@ -758,3 +808,43 @@ include: /etc/unbound/conf.d/*.conf # You can now also dynamically create and delete forward-zone's using # unbound-control forward_add domain.com 1.2.3.4 5.6.7.8 # unbound-control forward_remove domain.com 1.2.3.4 5.6.7.8 + +# Views +# Create named views. Name must be unique. Map views to requests using +# the access-control-view option. Views can contain zero or more local-zone +# and local-data options. Options from matching views will override global +# options. Global options will be used if no matching view is found. +# With view-first yes, it will try to answer using the global local-zone and +# local-data elements if there is no view specific match. +# view: +# name: "viewname" +# local-zone: "example.com" redirect +# local-data: "example.com A 192.0.2.3" +# local-data-ptr: "192.0.2.3 www.example.com" +# view-first: no +# view: +# name: "anotherview" +# local-zone: "example.com" refuse + +# Fedora: DNSCrypt support not enabled since it requires linking to +# another crypto library +# +# DNSCrypt +# Caveats: +# 1. the keys/certs cannot be produced by unbound. You can use dnscrypt-wrapper +# for this: https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage +# 2. dnscrypt channel attaches to an interface. you MUST set interfaces to +# listen on `dnscrypt-port` with the follo0wing snippet: +# server: +# interface: 0.0.0.0@443 +# interface: ::0@443 +# +# Finally, `dnscrypt` config has its own section. +# dnscrypt: +# dnscrypt-enable: yes +# dnscrypt-port: 443 +# dnscrypt-provider: 2.dnscrypt-cert.example.com. +# dnscrypt-secret-key: /path/unbound-conf/keys1/1.key +# dnscrypt-secret-key: /path/unbound-conf/keys2/1.key +# dnscrypt-provider-cert: /path/unbound-conf/keys1/1.cert +# dnscrypt-provider-cert: /path/unbound-conf/keys2/1.cert diff --git a/unbound.spec b/unbound.spec index c76da4d..5521732 100644 --- a/unbound.spec +++ b/unbound.spec @@ -20,8 +20,8 @@ Summary: Validating, recursive, and caching DNS(SEC) resolver Name: unbound -Version: 1.6.0 -Release: 6%{?extra_version:.%{extra_version}}%{?dist} +Version: 1.6.2 +Release: 1%{?extra_version:.%{extra_version}}%{?dist} License: BSD Url: http://www.nlnetlabs.nl/unbound/ Source: http://www.unbound.net/downloads/%{name}-%{version}%{?extra_version}.tar.gz @@ -439,6 +439,10 @@ popd %changelog +* Wed Apr 26 2017 Paul Wouters - 1.6.2-1 +- Update to 1.6.2 (rhbz#1425649) +- Updated unbound.conf with new options + * Wed Mar 22 2017 Paul Wouters - 1.6.0-6 - Call make unbound-event-install to install unbound-event.h