Attachment #168113 for bug #207948




# $FreeBSD$

PORTNAME=	unbound
PORTVERSION=	1.5.8
CATEGORIES=	dns
MASTER_SITES=	http://unbound.net/downloads/


PORTDOCS=	CREDITS Changelog FEATURES LICENSE README README.svn \
		README.tests TODO control_proto_spec.txt ietf67-design-02.odp \
		ietf67-design-02.pdf requirements.txt
PLIST_SUB+=	PYTHON=${PYTHON} MUNIN=${MUNIN}

OPTIONS_SUB=	yes
OPTIONS_DEFINE=	THREADS PYTHON GOST ECDSA MUNIN_PLUGIN DOCS LIBEVENT FILTER_AAAA DNSTAP
OPTIONS_DEFAULT=THREADS ECDSA

LIBEVENT_DESC=	Build against libevent
GOST_DESC=	Enable GOST support (requires OpenSSL >= 1.0)
ECDSA_DESC=	Enable ECDSA (elliptic curve) support (OpenSSL >= 1.0)
MUNIN_PLUGIN_DESC=	Install Munin plugin
FILTER_AAAA_DESC=	Build with AAAA filter functionality (contrib)
DNSTAP_DESC=	Enable dnstap logging support

.include <bsd.port.options.mk>


CONFIGURE_ARGS+=--with-pyunbound=yes --with-pythonmodule=yes LDFLAGS="-L${LOCALBASE}/lib"
BUILD_DEPENDS+=	swig:${PORTSDIR}/devel/swig13
STRIP_FILES+=	.libs/_unbound.so
PYTHON=
.else
PYTHON=		"@comment "
.endif

.if ${PORT_OPTIONS:MGOST}

CONFIGURE_ARGS+=--disable-ecdsa
.endif

.if ${PORT_OPTIONS:MDNSTAP}
CONFIGURE_ARGS+=--enable-dnstap
LIB_DEPENDS+=	libprotobuf-c.so:${PORTSDIR}/devel/protobuf-c
LIB_DEPENDS+=	libfstrm.so:${PORTSDIR}/devel/fstrm
.endif

.if ${PORT_OPTIONS:MMUNIN_PLUGIN}
SUB_FILES+=	pkg-message
MUNIN_PLUGIN_ALL=	hits queue memory by_type by_class by_opcode by_rcode \
		by_flags histogram
MUNIN=
.else
MUNIN=		"@comment "
.endif

.if ${PORT_OPTIONS:MLIBEVENT}

	@${REINPLACE_CMD} -e 's|if test ! -e $$(DESTDIR)$$(configfile); then || ; \
		s|$$(configfile); fi|$$(configfile).sample|' \
		${WRKSRC}/Makefile.in

post-patch-FILTER_AAAA-on:
	${CAT} ${WRKSRC}/contrib/aaaa-filter-iterator.patch | ${PATCH} -d ${WRKSRC} -p1 -s
.endif

post-build:
	@for s in ${STRIP_FILES}; do ${STRIP_CMD} ${WRKSRC}/$$s; done

post-install-PYTHON-on:
.if ${PORT_OPTIONS:MPYTHON}
	@${STRIP_CMD} ${STAGEDIR}${PYTHON_SITELIBDIR}/_unbound.so

post-install-MUNIN_PLUGIN-on:
	@${MKDIR} ${STAGEDIR}${PREFIX}/share/munin/plugins
	@${MKDIR} ${STAGEDIR}${PREFIX}/etc/munin/plugins
	@${INSTALL_SCRIPT} ${WRKDIR}/unbound-${PORTVERSION}/contrib/unbound_munin_\
		${STAGEDIR}${PREFIX}/share/munin/plugins/
	@for i in ${MUNIN_PLUGIN_ALL}; do\
		${LN} -fs ${PREFIX}/share/munin/plugins/unbound_munin_\
			${STAGEDIR}${PREFIX}/etc/munin/plugins/unbound_munin_$$i ;\
	done

	@${ECHO_MSG} "============================================================="
	@${CAT} ${WRKDIR}/pkg-message
	@${ECHO_MSG} "============================================================="
.endif

post-install-DOCS-on:
	${MKDIR} ${STAGEDIR}${DOCSDIR}

Lines 1-2 Link Here

(-)distinfo (-2 / +2 lines)
1	SHA256 (unbound-1.5.7.tar.gz) = 4b2088e5aa81a2d48f6337c30c1cf7e99b2e2dc4f92e463b3bee626eee731ca8	1	SHA256 (unbound-1.5.8.tar.gz) = 33567a20f73e288f8daa4ec021fbb30fe1824b346b34f12677ad77899ecd09be
2	SIZE (unbound-1.5.7.tar.gz) = 4859573	2	SIZE (unbound-1.5.8.tar.gz) = 4895649




--- contrib/aaaa-filter-iterator.patch.orig	2016-01-04 12:57:42 UTC
+++ contrib/aaaa-filter-iterator.patch
@@ -1,8 +1,10 @@
---- unbound-1.4.17.orig/doc/unbound.conf.5.in
-+++ unbound-1.4.17/doc/unbound.conf.5.in
-@@ -519,6 +519,13 @@ authority servers and checks if the repl
- Disabled by default. 
- This feature is an experimental implementation of draft dns\-0x20.
+Index: trunk/doc/unbound.conf.5.in
+===================================================================
+--- trunk/doc/unbound.conf.5.in	(revision 3587)
++++ trunk/doc/unbound.conf.5.in	(working copy)
+@@ -593,6 +593,13 @@
+ possible. Best effort approach, full QNAME and original QTYPE will be sent when
+ upstream replies with a RCODE other than NOERROR. Default is off.
  .TP
 +.B aaaa\-filter: \fI<yes or no>
 +Activate behavior similar to BIND's AAAA-filter.
@@ -13,20 +15,12 @@
 +.TP
  .B private\-address: \fI<IP address or subnet>
  Give IPv4 of IPv6 addresses or classless subnets. These are addresses
- on your private network, and are not allowed to be returned for public
---- unbound-1.4.17.orig/util/config_file.c
-+++ unbound-1.4.17/util/config_file.c
-@@ -160,6 +160,7 @@ config_create(void)
- 	cfg->harden_below_nxdomain = 0;
- 	cfg->harden_referral_path = 0;
- 	cfg->use_caps_bits_for_id = 0;
-+	cfg->aaaa_filter = 0; /* ASN: default is disabled */
- 	cfg->private_address = NULL;
- 	cfg->private_domain = NULL;
- 	cfg->unwanted_threshold = 0;
---- unbound-1.4.17.orig/iterator/iter_scrub.c
-+++ unbound-1.4.17/iterator/iter_scrub.c
-@@ -580,6 +580,32 @@ static int sanitize_nsec_is_overreach(st
+ on your private network, and are not allowed to be returned for
+Index: trunk/iterator/iter_scrub.c
+===================================================================
+--- trunk/iterator/iter_scrub.c	(revision 3587)
++++ trunk/iterator/iter_scrub.c	(working copy)
+@@ -617,6 +617,32 @@
  }
  
  /**
@@ -38,7 +32,7 @@
 + */
 +static int
 +asn_lookup_a_record_from_cache(struct query_info* qinfo,
-+	struct module_env* env, struct iter_env* ie)
++	struct module_env* env, struct iter_env* ATTR_UNUSED(ie))
 +{
 +	struct ub_packed_rrset_key* akey;
 +
@@ -59,7 +53,7 @@
   * Given a response event, remove suspect RRsets from the response.
   * "Suspect" rrsets are potentially poison. Note that this routine expects
   * the response to be in a "normalized" state -- that is, all "irrelevant"
-@@ -598,6 +625,7 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -635,6 +661,7 @@
  	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
  	struct iter_env* ie)
  {
@@ -67,7 +61,7 @@
  	int del_addi = 0; /* if additional-holding rrsets are deleted, we
  		do not trust the normalized additional-A-AAAA any more */
  	struct rrset_parse* rrset, *prev;
-@@ -633,6 +661,13 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -670,6 +697,13 @@
  		rrset = rrset->rrset_all_next;
  	}
  
@@ -81,7 +75,7 @@
  	/* At this point, we brutally remove ALL rrsets that aren't 
  	 * children of the originating zone. The idea here is that, 
  	 * as far as we know, the server that we contacted is ONLY 
-@@ -644,6 +679,24 @@ scrub_sanitize(ldns_buffer* pkt, struct
+@@ -681,6 +715,24 @@
  	rrset = msg->rrset_first;
  	while(rrset) {
  
@@ -105,10 +99,24 @@
 +
  		/* remove private addresses */
  		if( (rrset->type == LDNS_RR_TYPE_A || 
- 			rrset->type == LDNS_RR_TYPE_AAAA) &&
---- unbound-1.4.17.orig/iterator/iterator.c
-+++ unbound-1.4.17/iterator/iterator.c
-@@ -1579,6 +1579,53 @@ processDSNSFind(struct module_qstate* qs
+ 			rrset->type == LDNS_RR_TYPE_AAAA)) {
+Index: trunk/iterator/iter_utils.c
+===================================================================
+--- trunk/iterator/iter_utils.c	(revision 3587)
++++ trunk/iterator/iter_utils.c	(working copy)
+@@ -175,6 +175,7 @@
+ 	}
+ 	iter_env->supports_ipv6 = cfg->do_ip6;
+ 	iter_env->supports_ipv4 = cfg->do_ip4;
++	iter_env->aaaa_filter = cfg->aaaa_filter;
+ 	return 1;
+ }
+ 
+Index: trunk/iterator/iterator.c
+===================================================================
+--- trunk/iterator/iterator.c	(revision 3587)
++++ trunk/iterator/iterator.c	(working copy)
+@@ -1776,6 +1776,53 @@
  
  	return 0;
  }
@@ -128,7 +136,7 @@
 + */
 +static int
 +asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
-+	struct iter_env* ie, int id)
++	struct iter_env* ATTR_UNUSED(ie), int id)
 +{
 +	struct module_qstate* subq = NULL;
 +
@@ -162,7 +170,7 @@
  	
  /** 
   * This is the request event state where the request will be sent to one of
-@@ -1626,6 +1673,13 @@ processQueryTargets(struct module_qstate
+@@ -1823,6 +1870,13 @@
  		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
  	}
  	
@@ -176,7 +184,7 @@
  	/* Make sure we have a delegation point, otherwise priming failed
  	 * or another failure occurred */
  	if(!iq->dp) {
-@@ -2568,6 +2622,62 @@ processFinished(struct module_qstate* qs
+@@ -2922,6 +2976,61 @@
  	return 0;
  }
  
@@ -195,9 +203,8 @@
 +asn_processAAAAResponse(struct module_qstate* qstate, int id,
 +	struct module_qstate* super)
 +{
-+	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
++	/*struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];*/
 +	struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
-+	struct ub_packed_rrset_key* rrset;
 +	struct delegpt_ns* dpns = NULL;
 +	int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
 +
@@ -239,7 +246,7 @@
  /*
   * Return priming query results to interestes super querystates.
   * 
-@@ -2587,6 +2697,9 @@ iter_inform_super(struct module_qstate*
+@@ -2941,6 +3050,9 @@
  	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
  		super->minfo[id])->state == DSNS_FIND_STATE)
  		processDSNSResponse(qstate, id, super);
@@ -249,7 +256,7 @@
  	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
  		error_supers(qstate, id, super);
  	else if(qstate->is_priming)
-@@ -2624,6 +2737,9 @@ iter_handle(struct module_qstate* qstate
+@@ -2978,6 +3090,9 @@
  			case INIT_REQUEST_3_STATE:
  				cont = processInitRequest3(qstate, iq, id);
  				break;
@@ -259,7 +266,7 @@
  			case QUERYTARGETS_STATE:
  				cont = processQueryTargets(qstate, iq, ie, id);
  				break;
-@@ -2863,6 +2979,8 @@ iter_state_to_string(enum iter_state sta
+@@ -3270,6 +3385,8 @@
  		return "INIT REQUEST STATE (stage 2)";
  	case INIT_REQUEST_3_STATE:
  		return "INIT REQUEST STATE (stage 3)";
@@ -268,7 +275,7 @@
  	case QUERYTARGETS_STATE :
  		return "QUERY TARGETS STATE";
  	case PRIME_RESP_STATE :
-@@ -2887,6 +3005,7 @@ iter_state_is_responsestate(enum iter_st
+@@ -3294,6 +3411,7 @@
  		case INIT_REQUEST_STATE :
  		case INIT_REQUEST_2_STATE :
  		case INIT_REQUEST_3_STATE :
@@ -276,29 +283,21 @@
  		case QUERYTARGETS_STATE :
  		case COLLECT_CLASS_STATE :
  			return 0;
---- unbound-1.4.17.orig/iterator/iter_utils.c
-+++ unbound-1.4.17/iterator/iter_utils.c
-@@ -128,6 +128,7 @@ iter_apply_cfg(struct iter_env* iter_env
- 	}
- 	iter_env->supports_ipv6 = cfg->do_ip6;
- 	iter_env->supports_ipv4 = cfg->do_ip4;
-+	iter_env->aaaa_filter = cfg->aaaa_filter;
- 	return 1;
- }
- 
---- unbound-1.4.17.orig/iterator/iterator.h
-+++ unbound-1.4.17/iterator/iterator.h
-@@ -110,6 +110,9 @@ struct iter_env {
- 	 * array of max_dependency_depth+1 size.
+Index: trunk/iterator/iterator.h
+===================================================================
+--- trunk/iterator/iterator.h	(revision 3587)
++++ trunk/iterator/iterator.h	(working copy)
+@@ -113,6 +113,9 @@
  	 */
  	int* target_fetch_policy;
-+
+ 
 +	/** ASN: AAAA-filter flag */
 +	int aaaa_filter;
++
+ 	/** ip6.arpa dname in wireformat, used for qname-minimisation */
+ 	uint8_t* ip6arpa_dname;
  };
- 
- /**
-@@ -135,6 +138,14 @@ enum iter_state {
+@@ -163,6 +166,14 @@
  	INIT_REQUEST_3_STATE,
  
  	/**
@@ -312,8 +311,8 @@
 +	/**
  	 * Each time a delegation point changes for a given query or a 
  	 * query times out and/or wakes up, this state is (re)visited. 
- 	 * This state is responsible for iterating through a list of 
-@@ -309,6 +320,13 @@ struct iter_qstate {
+ 	 * This state is reponsible for iterating through a list of 
+@@ -346,6 +357,13 @@
  	 */
  	int refetch_glue;
  
@@ -326,31 +325,61 @@
 +
  	/** list of pending queries to authoritative servers. */
  	struct outbound_list outlist;
- };
---- unbound-1.4.17.orig/util/config_file.h
-+++ unbound-1.4.17/util/config_file.h
-@@ -169,6 +169,8 @@ struct config_file {
- 	int harden_referral_path;
+ 
+Index: trunk/pythonmod/interface.i
+===================================================================
+--- trunk/pythonmod/interface.i	(revision 3587)
++++ trunk/pythonmod/interface.i	(working copy)
+@@ -632,6 +632,7 @@
+    int harden_dnssec_stripped;
+    int harden_referral_path;
+    int use_caps_bits_for_id;
++   int aaaa_filter; /* ASN */
+    struct config_strlist* private_address;
+    struct config_strlist* private_domain;
+    size_t unwanted_threshold;
+Index: trunk/util/config_file.c
+===================================================================
+--- trunk/util/config_file.c	(revision 3587)
++++ trunk/util/config_file.c	(working copy)
+@@ -176,6 +176,7 @@
+ 	cfg->harden_referral_path = 0;
+ 	cfg->harden_algo_downgrade = 0;
+ 	cfg->use_caps_bits_for_id = 0;
++	cfg->aaaa_filter = 0; /* ASN: default is disabled */
+ 	cfg->caps_whitelist = NULL;
+ 	cfg->private_address = NULL;
+ 	cfg->private_domain = NULL;
+Index: trunk/util/config_file.h
+===================================================================
+--- trunk/util/config_file.h	(revision 3587)
++++ trunk/util/config_file.h	(working copy)
+@@ -179,6 +179,8 @@
+ 	int harden_algo_downgrade;
  	/** use 0x20 bits in query as random ID bits */
  	int use_caps_bits_for_id;
 +	/** ASN: enable AAAA filter? */
 +	int aaaa_filter;
+ 	/** 0x20 whitelist, domains that do not use capsforid */
+ 	struct config_strlist* caps_whitelist;
  	/** strip away these private addrs from answers, no DNS Rebinding */
- 	struct config_strlist* private_address;
- 	/** allow domain (and subdomains) to use private address space */
---- unbound-1.4.17.orig/util/configlexer.lex
-+++ unbound-1.4.17/util/configlexer.lex
-@@ -177,6 +177,7 @@ harden-below-nxdomain{COLON}	{ YDVAR(1,
- harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
+Index: trunk/util/configlexer.lex
+===================================================================
+--- trunk/util/configlexer.lex	(revision 3587)
++++ trunk/util/configlexer.lex	(working copy)
+@@ -267,6 +267,7 @@
  use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
+ caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
  unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 +aaaa-filter{COLON}		{ YDVAR(1, VAR_AAAA_FILTER) }
  private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
  private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
  prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
---- unbound-1.4.17.orig/util/configparser.y
-+++ unbound-1.4.17/util/configparser.y
-@@ -92,6 +92,7 @@ extern struct config_parser_state* cfg_p
+Index: trunk/util/configparser.y
+===================================================================
+--- trunk/util/configparser.y	(revision 3587)
++++ trunk/util/configparser.y	(working copy)
+@@ -92,6 +92,7 @@
  %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
  %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
  %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
@@ -358,7 +387,7 @@
  %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
  %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
  %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
-@@ -151,6 +152,7 @@ content_server: server_num_threads | ser
+@@ -169,6 +170,7 @@
  	server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
  	server_harden_referral_path | server_private_address |
  	server_private_domain | server_extended_statistics | 
@@ -366,8 +395,8 @@
  	server_local_data_ptr | server_jostle_timeout | 
  	server_unwanted_reply_threshold | server_log_time_ascii | 
  	server_domain_insecure | server_val_sig_skew_min | 
-@@ -802,6 +803,15 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR
- 		free($2);
+@@ -893,6 +895,15 @@
+ 			yyerror("out of memory");
  	}
  	;
 +server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
@@ -382,13 +411,3 @@
  server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
  	{
  		OUTYY(("P(server_private_address:%s)\n", $2));
---- unbound-1.4.17.orig/pythonmod/interface.i
-+++ unbound-1.4.17/pythonmod/interface.i
-@@ -626,6 +626,7 @@ struct config_file {
-    int harden_dnssec_stripped;
-    int harden_referral_path;
-    int use_caps_bits_for_id;
-+   int aaaa_filter; /* ASN */
-    struct config_strlist* private_address;
-    struct config_strlist* private_domain;
-    size_t unwanted_threshold;

Lines 1-9 Link Here

(-)pkg-plist (-17 / +17 lines)
1	etc/unbound/unbound.conf.sample	1	%%MUNIN_PLUGIN%%etc/munin/plugins/unbound_munin_by_class
		2	%%MUNIN_PLUGIN%%etc/munin/plugins/unbound_munin_by_flags
		3	%%MUNIN_PLUGIN%%etc/munin/plugins/unbound_munin_by_opcode
		4	%%MUNIN_PLUGIN%%etc/munin/plugins/unbound_munin_by_rcode
		5	%%MUNIN_PLUGIN%%etc/munin/plugins/unbound_munin_by_type
		6	%%MUNIN_PLUGIN%%etc/munin/plugins/unbound_munin_histogram
		7	%%MUNIN_PLUGIN%%etc/munin/plugins/unbound_munin_hits
		8	%%MUNIN_PLUGIN%%etc/munin/plugins/unbound_munin_memory
		9	%%MUNIN_PLUGIN%%etc/munin/plugins/unbound_munin_queue
		10	@sample %%ETCDIR%%/unbound.conf.sample
2	include/unbound.h	11	include/unbound.h
3	lib/libunbound.so.2.3.10	12	lib/libunbound.a
		13	lib/libunbound.so
4	lib/libunbound.so.2	14	lib/libunbound.so.2
5	lib/libunbound.so	15	lib/libunbound.so.2.4.0
6	lib/libunbound.a	16	%%PYTHON%%%%PYTHON_SITELIBDIR%%/_unbound.so
		17	%%PYTHON%%%%PYTHON_SITELIBDIR%%/unbound.py
		18	%%PYTHON%%%%PYTHON_SITELIBDIR%%/unboundmodule.py
7	man/man1/unbound-host.1.gz	19	man/man1/unbound-host.1.gz
8	man/man3/libunbound.3.gz	20	man/man3/libunbound.3.gz
9	man/man3/ub_cancel.3.gz	21	man/man3/ub_cancel.3.gz
Lines 48-64 Link Here
48	sbin/unbound-control	60	sbin/unbound-control
49	sbin/unbound-control-setup	61	sbin/unbound-control-setup
50	sbin/unbound-host	62	sbin/unbound-host
51	%%PYTHON%%%%PYTHON_SITELIBDIR%%/_unbound.so	63	%%MUNIN_PLUGIN%%share/munin/plugins/unbound_munin_
52	%%PYTHON%%%%PYTHON_SITELIBDIR%%/unbound.py
53	%%PYTHON%%%%PYTHON_SITELIBDIR%%/unboundmodule.py
54	%%MUNIN%%etc/munin/plugins/unbound_munin_by_class
55	%%MUNIN%%etc/munin/plugins/unbound_munin_by_flags
56	%%MUNIN%%etc/munin/plugins/unbound_munin_by_opcode
57	%%MUNIN%%etc/munin/plugins/unbound_munin_by_rcode
58	%%MUNIN%%etc/munin/plugins/unbound_munin_by_type
59	%%MUNIN%%etc/munin/plugins/unbound_munin_histogram
60	%%MUNIN%%etc/munin/plugins/unbound_munin_hits
61	%%MUNIN%%etc/munin/plugins/unbound_munin_memory
62	%%MUNIN%%etc/munin/plugins/unbound_munin_queue
63	%%MUNIN%%share/munin/plugins/unbound_munin_
64	@dir(unbound,,) %%ETCDIR%%	64	@dir(unbound,,) %%ETCDIR%%

Return to bug 207948

Lines 2-8 Link Here

(-)Makefile (-20 / +19 lines)
2	# $FreeBSD$	2	# $FreeBSD$
3		3
4	PORTNAME= unbound	4	PORTNAME= unbound
5	PORTVERSION= 1.5.7	5	PORTVERSION= 1.5.8
6	CATEGORIES= dns	6	CATEGORIES= dns
7	MASTER_SITES= http://unbound.net/downloads/	7	MASTER_SITES= http://unbound.net/downloads/
8		8
Lines 27-42 Link Here
27	PORTDOCS= CREDITS Changelog FEATURES LICENSE README README.svn \	27	PORTDOCS= CREDITS Changelog FEATURES LICENSE README README.svn \
28	README.tests TODO control_proto_spec.txt ietf67-design-02.odp \	28	README.tests TODO control_proto_spec.txt ietf67-design-02.odp \
29	ietf67-design-02.pdf requirements.txt	29	ietf67-design-02.pdf requirements.txt
30	PLIST_SUB+= PYTHON=${PYTHON} MUNIN=${MUNIN}
31		30
32	OPTIONS_DEFINE= THREADS PYTHON GOST ECDSA MUNIN DOCS LIBEVENT FILTER_AAAA	31	OPTIONS_SUB= yes
		32	OPTIONS_DEFINE= THREADS PYTHON GOST ECDSA MUNIN_PLUGIN DOCS LIBEVENT FILTER_AAAA DNSTAP
33	OPTIONS_DEFAULT=THREADS ECDSA	33	OPTIONS_DEFAULT=THREADS ECDSA
34		34
35	LIBEVENT_DESC= Build against libevent	35	LIBEVENT_DESC= Build against libevent
36	GOST_DESC= Enable GOST support (requires OpenSSL >= 1.0)	36	GOST_DESC= Enable GOST support (requires OpenSSL >= 1.0)
37	ECDSA_DESC= Enable ECDSA (elliptic curve) support (OpenSSL >= 1.0)	37	ECDSA_DESC= Enable ECDSA (elliptic curve) support (OpenSSL >= 1.0)
38	MUNIN_DESC= Install Munin plugin	38	MUNIN_PLUGIN_DESC= Install Munin plugin
39	FILTER_AAAA_DESC= Build with AAAA filter functionality (contrib)	39	FILTER_AAAA_DESC= Build with AAAA filter functionality (contrib)
		40	DNSTAP_DESC= Enable dnstap logging support
40		41
41	.include <bsd.port.options.mk>	42	.include <bsd.port.options.mk>
42		43
Lines 51-59 Link Here
51	CONFIGURE_ARGS+=--with-pyunbound=yes --with-pythonmodule=yes LDFLAGS="-L${LOCALBASE}/lib"	52	CONFIGURE_ARGS+=--with-pyunbound=yes --with-pythonmodule=yes LDFLAGS="-L${LOCALBASE}/lib"
52	BUILD_DEPENDS+= swig:${PORTSDIR}/devel/swig13	53	BUILD_DEPENDS+= swig:${PORTSDIR}/devel/swig13
53	STRIP_FILES+= .libs/_unbound.so	54	STRIP_FILES+= .libs/_unbound.so
54	PYTHON=
55	.else
56	PYTHON= "@comment "
57	.endif	55	.endif
58		56
59	.if ${PORT_OPTIONS:MGOST}	57	.if ${PORT_OPTIONS:MGOST}
Lines 71-83 Link Here
71	CONFIGURE_ARGS+=--disable-ecdsa	69	CONFIGURE_ARGS+=--disable-ecdsa
72	.endif	70	.endif
73		71
74	.if ${PORT_OPTIONS:MMUNIN}	72	.if ${PORT_OPTIONS:MDNSTAP}
		73	CONFIGURE_ARGS+=--enable-dnstap
		74	LIB_DEPENDS+= libprotobuf-c.so:${PORTSDIR}/devel/protobuf-c
		75	LIB_DEPENDS+= libfstrm.so:${PORTSDIR}/devel/fstrm
		76	.endif
		77
		78	.if ${PORT_OPTIONS:MMUNIN_PLUGIN}
75	SUB_FILES+= pkg-message	79	SUB_FILES+= pkg-message
76	MUNIN_ALL= hits queue memory by_type by_class by_opcode by_rcode \	80	MUNIN_PLUGIN_ALL= hits queue memory by_type by_class by_opcode by_rcode \
77	by_flags histogram	81	by_flags histogram
78	MUNIN=
79	.else
80	MUNIN= "@comment "
81	.endif	82	.endif
82		83
83	.if ${PORT_OPTIONS:MLIBEVENT}	84	.if ${PORT_OPTIONS:MLIBEVENT}
Lines 99-121 Link Here
99	@${REINPLACE_CMD} -e 's\|if test ! -e $$(DESTDIR)$$(configfile); then \|\| ; \	100	@${REINPLACE_CMD} -e 's\|if test ! -e $$(DESTDIR)$$(configfile); then \|\| ; \
100	s\|$$(configfile); fi\|$$(configfile).sample\|' \	101	s\|$$(configfile); fi\|$$(configfile).sample\|' \
101	${WRKSRC}/Makefile.in	102	${WRKSRC}/Makefile.in
102	.if ${PORT_OPTIONS:MFILTER_AAAA}	103
		104	post-patch-FILTER_AAAA-on:
103	${CAT} ${WRKSRC}/contrib/aaaa-filter-iterator.patch \| ${PATCH} -d ${WRKSRC} -p1 -s	105	${CAT} ${WRKSRC}/contrib/aaaa-filter-iterator.patch \| ${PATCH} -d ${WRKSRC} -p1 -s
104	.endif
105		106
106	post-build:	107	post-build:
107	@for s in ${STRIP_FILES}; do ${STRIP_CMD} ${WRKSRC}/$$s; done	108	@for s in ${STRIP_FILES}; do ${STRIP_CMD} ${WRKSRC}/$$s; done
108		109
109	post-install:	110	post-install-PYTHON-on:
110	.if ${PORT_OPTIONS:MPYTHON}
111	@${STRIP_CMD} ${STAGEDIR}${PYTHON_SITELIBDIR}/_unbound.so	111	@${STRIP_CMD} ${STAGEDIR}${PYTHON_SITELIBDIR}/_unbound.so
112	.endif	112
113	.if ${PORT_OPTIONS:MMUNIN}	113	post-install-MUNIN_PLUGIN-on:
114	@${MKDIR} ${STAGEDIR}${PREFIX}/share/munin/plugins	114	@${MKDIR} ${STAGEDIR}${PREFIX}/share/munin/plugins
115	@${MKDIR} ${STAGEDIR}${PREFIX}/etc/munin/plugins	115	@${MKDIR} ${STAGEDIR}${PREFIX}/etc/munin/plugins
116	@${INSTALL_SCRIPT} ${WRKDIR}/unbound-${PORTVERSION}/contrib/unbound_munin_\	116	@${INSTALL_SCRIPT} ${WRKDIR}/unbound-${PORTVERSION}/contrib/unbound_munin_\
117	${STAGEDIR}${PREFIX}/share/munin/plugins/	117	${STAGEDIR}${PREFIX}/share/munin/plugins/
118	@for i in ${MUNIN_ALL}; do\	118	@for i in ${MUNIN_PLUGIN_ALL}; do\
119	${LN} -fs ${PREFIX}/share/munin/plugins/unbound_munin_\	119	${LN} -fs ${PREFIX}/share/munin/plugins/unbound_munin_\
120	${STAGEDIR}${PREFIX}/etc/munin/plugins/unbound_munin_$$i ;\	120	${STAGEDIR}${PREFIX}/etc/munin/plugins/unbound_munin_$$i ;\
121	done	121	done
Lines 123-129 Link Here
123	@${ECHO_MSG} "============================================================="	123	@${ECHO_MSG} "============================================================="
124	@${CAT} ${WRKDIR}/pkg-message	124	@${CAT} ${WRKDIR}/pkg-message
125	@${ECHO_MSG} "============================================================="	125	@${ECHO_MSG} "============================================================="
126	.endif
127		126
128	post-install-DOCS-on:	127	post-install-DOCS-on:
129	${MKDIR} ${STAGEDIR}${DOCSDIR}	128	${MKDIR} ${STAGEDIR}${DOCSDIR}

Lines 1-345 Link Here

(-)files/patch-contrib-aaaa-filter-iterator.patch (-345 lines)
1	--- contrib/aaaa-filter-iterator.patch.orig 2016-01-04 12:57:42 UTC
2	+++ contrib/aaaa-filter-iterator.patch
3	@@ -1,8 +1,10 @@
4	---- unbound-1.4.17.orig/doc/unbound.conf.5.in
5	-+++ unbound-1.4.17/doc/unbound.conf.5.in
6	-@@ -519,6 +519,13 @@ authority servers and checks if the repl
7	- Disabled by default.
8	- This feature is an experimental implementation of draft dns\-0x20.
9	+Index: trunk/doc/unbound.conf.5.in
10	+===================================================================
11	+--- trunk/doc/unbound.conf.5.in (revision 3587)
12	++++ trunk/doc/unbound.conf.5.in (working copy)
13	+@@ -593,6 +593,13 @@
14	+ possible. Best effort approach, full QNAME and original QTYPE will be sent when
15	+ upstream replies with a RCODE other than NOERROR. Default is off.
16	.TP
17	+.B aaaa\-filter: \fI<yes or no>
18	+Activate behavior similar to BIND's AAAA-filter.
19	@@ -13,20 +15,12 @@
20	+.TP
21	.B private\-address: \fI<IP address or subnet>
22	Give IPv4 of IPv6 addresses or classless subnets. These are addresses
23	- on your private network, and are not allowed to be returned for public
24	---- unbound-1.4.17.orig/util/config_file.c
25	-+++ unbound-1.4.17/util/config_file.c
26	-@@ -160,6 +160,7 @@ config_create(void)
27	- cfg->harden_below_nxdomain = 0;
28	- cfg->harden_referral_path = 0;
29	- cfg->use_caps_bits_for_id = 0;
30	-+ cfg->aaaa_filter = 0; /* ASN: default is disabled */
31	- cfg->private_address = NULL;
32	- cfg->private_domain = NULL;
33	- cfg->unwanted_threshold = 0;
34	---- unbound-1.4.17.orig/iterator/iter_scrub.c
35	-+++ unbound-1.4.17/iterator/iter_scrub.c
36	-@@ -580,6 +580,32 @@ static int sanitize_nsec_is_overreach(st
37	+ on your private network, and are not allowed to be returned for
38	+Index: trunk/iterator/iter_scrub.c
39	+===================================================================
40	+--- trunk/iterator/iter_scrub.c (revision 3587)
41	++++ trunk/iterator/iter_scrub.c (working copy)
42	+@@ -617,6 +617,32 @@
43	}
44
45	/**
46	@@ -38,7 +32,7 @@
47	+ */
48	+static int
49	+asn_lookup_a_record_from_cache(struct query_info* qinfo,
50	-+ struct module_env* env, struct iter_env* ie)
51	++ struct module_env* env, struct iter_env* ATTR_UNUSED(ie))
52	+{
53	+ struct ub_packed_rrset_key* akey;
54	+
55	@@ -59,7 +53,7 @@
56	* Given a response event, remove suspect RRsets from the response.
57	* "Suspect" rrsets are potentially poison. Note that this routine expects
58	* the response to be in a "normalized" state -- that is, all "irrelevant"
59	-@@ -598,6 +625,7 @@ scrub_sanitize(ldns_buffer* pkt, struct
60	+@@ -635,6 +661,7 @@
61	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
62	struct iter_env* ie)
63	{
64	@@ -67,7 +61,7 @@
65	int del_addi = 0; /* if additional-holding rrsets are deleted, we
66	do not trust the normalized additional-A-AAAA any more */
67	struct rrset_parse* rrset, *prev;
68	-@@ -633,6 +661,13 @@ scrub_sanitize(ldns_buffer* pkt, struct
69	+@@ -670,6 +697,13 @@
70	rrset = rrset->rrset_all_next;
71	}
72
73	@@ -81,7 +75,7 @@
74	/* At this point, we brutally remove ALL rrsets that aren't
75	* children of the originating zone. The idea here is that,
76	* as far as we know, the server that we contacted is ONLY
77	-@@ -644,6 +679,24 @@ scrub_sanitize(ldns_buffer* pkt, struct
78	+@@ -681,6 +715,24 @@
79	rrset = msg->rrset_first;
80	while(rrset) {
81
82	@@ -105,10 +99,24 @@
83	+
84	/* remove private addresses */
85	if( (rrset->type == LDNS_RR_TYPE_A \|\|
86	- rrset->type == LDNS_RR_TYPE_AAAA) &&
87	---- unbound-1.4.17.orig/iterator/iterator.c
88	-+++ unbound-1.4.17/iterator/iterator.c
89	-@@ -1579,6 +1579,53 @@ processDSNSFind(struct module_qstate* qs
90	+ rrset->type == LDNS_RR_TYPE_AAAA)) {
91	+Index: trunk/iterator/iter_utils.c
92	+===================================================================
93	+--- trunk/iterator/iter_utils.c (revision 3587)
94	++++ trunk/iterator/iter_utils.c (working copy)
95	+@@ -175,6 +175,7 @@
96	+ }
97	+ iter_env->supports_ipv6 = cfg->do_ip6;
98	+ iter_env->supports_ipv4 = cfg->do_ip4;
99	++ iter_env->aaaa_filter = cfg->aaaa_filter;
100	+ return 1;
101	+ }
102	+
103	+Index: trunk/iterator/iterator.c
104	+===================================================================
105	+--- trunk/iterator/iterator.c (revision 3587)
106	++++ trunk/iterator/iterator.c (working copy)
107	+@@ -1776,6 +1776,53 @@
108
109	return 0;
110	}
111	@@ -128,7 +136,7 @@
112	+ */
113	+static int
114	+asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
115	-+ struct iter_env* ie, int id)
116	++ struct iter_env* ATTR_UNUSED(ie), int id)
117	+{
118	+ struct module_qstate* subq = NULL;
119	+
120	@@ -162,7 +170,7 @@
121
122	/**
123	* This is the request event state where the request will be sent to one of
124	-@@ -1626,6 +1673,13 @@ processQueryTargets(struct module_qstate
125	+@@ -1823,6 +1870,13 @@
126	return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
127	}
128
129	@@ -176,7 +184,7 @@
130	/* Make sure we have a delegation point, otherwise priming failed
131	* or another failure occurred */
132	if(!iq->dp) {
133	-@@ -2568,6 +2622,62 @@ processFinished(struct module_qstate* qs
134	+@@ -2922,6 +2976,61 @@
135	return 0;
136	}
137
138	@@ -195,9 +203,8 @@
139	+asn_processAAAAResponse(struct module_qstate* qstate, int id,
140	+ struct module_qstate* super)
141	+{
142	-+ struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
143	++ /struct iter_qstate iq = (struct iter_qstate)qstate->minfo[id];/
144	+ struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
145	-+ struct ub_packed_rrset_key* rrset;
146	+ struct delegpt_ns* dpns = NULL;
147	+ int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
148	+
149	@@ -239,7 +246,7 @@
150	/*
151	* Return priming query results to interestes super querystates.
152	*
153	-@@ -2587,6 +2697,9 @@ iter_inform_super(struct module_qstate*
154	+@@ -2941,6 +3050,9 @@
155	else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
156	super->minfo[id])->state == DSNS_FIND_STATE)
157	processDSNSResponse(qstate, id, super);
158	@@ -249,7 +256,7 @@
159	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
160	error_supers(qstate, id, super);
161	else if(qstate->is_priming)
162	-@@ -2624,6 +2737,9 @@ iter_handle(struct module_qstate* qstate
163	+@@ -2978,6 +3090,9 @@
164	case INIT_REQUEST_3_STATE:
165	cont = processInitRequest3(qstate, iq, id);
166	break;
167	@@ -259,7 +266,7 @@
168	case QUERYTARGETS_STATE:
169	cont = processQueryTargets(qstate, iq, ie, id);
170	break;
171	-@@ -2863,6 +2979,8 @@ iter_state_to_string(enum iter_state sta
172	+@@ -3270,6 +3385,8 @@
173	return "INIT REQUEST STATE (stage 2)";
174	case INIT_REQUEST_3_STATE:
175	return "INIT REQUEST STATE (stage 3)";
176	@@ -268,7 +275,7 @@
177	case QUERYTARGETS_STATE :
178	return "QUERY TARGETS STATE";
179	case PRIME_RESP_STATE :
180	-@@ -2887,6 +3005,7 @@ iter_state_is_responsestate(enum iter_st
181	+@@ -3294,6 +3411,7 @@
182	case INIT_REQUEST_STATE :
183	case INIT_REQUEST_2_STATE :
184	case INIT_REQUEST_3_STATE :
185	@@ -276,29 +283,21 @@
186	case QUERYTARGETS_STATE :
187	case COLLECT_CLASS_STATE :
188	return 0;
189	---- unbound-1.4.17.orig/iterator/iter_utils.c
190	-+++ unbound-1.4.17/iterator/iter_utils.c
191	-@@ -128,6 +128,7 @@ iter_apply_cfg(struct iter_env* iter_env
192	- }
193	- iter_env->supports_ipv6 = cfg->do_ip6;
194	- iter_env->supports_ipv4 = cfg->do_ip4;
195	-+ iter_env->aaaa_filter = cfg->aaaa_filter;
196	- return 1;
197	- }
198	-
199	---- unbound-1.4.17.orig/iterator/iterator.h
200	-+++ unbound-1.4.17/iterator/iterator.h
201	-@@ -110,6 +110,9 @@ struct iter_env {
202	- * array of max_dependency_depth+1 size.
203	+Index: trunk/iterator/iterator.h
204	+===================================================================
205	+--- trunk/iterator/iterator.h (revision 3587)
206	++++ trunk/iterator/iterator.h (working copy)
207	+@@ -113,6 +113,9 @@
208	*/
209	int* target_fetch_policy;
210	-+
211	+
212	+ /** ASN: AAAA-filter flag */
213	+ int aaaa_filter;
214	++
215	+ /** ip6.arpa dname in wireformat, used for qname-minimisation */
216	+ uint8_t* ip6arpa_dname;
217	};
218	-
219	- /**
220	-@@ -135,6 +138,14 @@ enum iter_state {
221	+@@ -163,6 +166,14 @@
222	INIT_REQUEST_3_STATE,
223
224	/**
225	@@ -312,8 +311,8 @@
226	+ /**
227	* Each time a delegation point changes for a given query or a
228	* query times out and/or wakes up, this state is (re)visited.
229	- * This state is responsible for iterating through a list of
230	-@@ -309,6 +320,13 @@ struct iter_qstate {
231	+ * This state is reponsible for iterating through a list of
232	+@@ -346,6 +357,13 @@
233	*/
234	int refetch_glue;
235
236	@@ -326,31 +325,61 @@
237	+
238	/** list of pending queries to authoritative servers. */
239	struct outbound_list outlist;
240	- };
241	---- unbound-1.4.17.orig/util/config_file.h
242	-+++ unbound-1.4.17/util/config_file.h
243	-@@ -169,6 +169,8 @@ struct config_file {
244	- int harden_referral_path;
245	+
246	+Index: trunk/pythonmod/interface.i
247	+===================================================================
248	+--- trunk/pythonmod/interface.i (revision 3587)
249	++++ trunk/pythonmod/interface.i (working copy)
250	+@@ -632,6 +632,7 @@
251	+ int harden_dnssec_stripped;
252	+ int harden_referral_path;
253	+ int use_caps_bits_for_id;
254	++ int aaaa_filter; /* ASN */
255	+ struct config_strlist* private_address;
256	+ struct config_strlist* private_domain;
257	+ size_t unwanted_threshold;
258	+Index: trunk/util/config_file.c
259	+===================================================================
260	+--- trunk/util/config_file.c (revision 3587)
261	++++ trunk/util/config_file.c (working copy)
262	+@@ -176,6 +176,7 @@
263	+ cfg->harden_referral_path = 0;
264	+ cfg->harden_algo_downgrade = 0;
265	+ cfg->use_caps_bits_for_id = 0;
266	++ cfg->aaaa_filter = 0; /* ASN: default is disabled */
267	+ cfg->caps_whitelist = NULL;
268	+ cfg->private_address = NULL;
269	+ cfg->private_domain = NULL;
270	+Index: trunk/util/config_file.h
271	+===================================================================
272	+--- trunk/util/config_file.h (revision 3587)
273	++++ trunk/util/config_file.h (working copy)
274	+@@ -179,6 +179,8 @@
275	+ int harden_algo_downgrade;
276	/** use 0x20 bits in query as random ID bits */
277	int use_caps_bits_for_id;
278	+ /** ASN: enable AAAA filter? */
279	+ int aaaa_filter;
280	+ /** 0x20 whitelist, domains that do not use capsforid */
281	+ struct config_strlist* caps_whitelist;
282	/** strip away these private addrs from answers, no DNS Rebinding */
283	- struct config_strlist* private_address;
284	- /** allow domain (and subdomains) to use private address space */
285	---- unbound-1.4.17.orig/util/configlexer.lex
286	-+++ unbound-1.4.17/util/configlexer.lex
287	-@@ -177,6 +177,7 @@ harden-below-nxdomain{COLON} { YDVAR(1,
288	- harden-referral-path{COLON} { YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
289	+Index: trunk/util/configlexer.lex
290	+===================================================================
291	+--- trunk/util/configlexer.lex (revision 3587)
292	++++ trunk/util/configlexer.lex (working copy)
293	+@@ -267,6 +267,7 @@
294	use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) }
295	+ caps-whitelist{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) }
296	unwanted-reply-threshold{COLON} { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
297	+aaaa-filter{COLON} { YDVAR(1, VAR_AAAA_FILTER) }
298	private-address{COLON} { YDVAR(1, VAR_PRIVATE_ADDRESS) }
299	private-domain{COLON} { YDVAR(1, VAR_PRIVATE_DOMAIN) }
300	prefetch-key{COLON} { YDVAR(1, VAR_PREFETCH_KEY) }
301	---- unbound-1.4.17.orig/util/configparser.y
302	-+++ unbound-1.4.17/util/configparser.y
303	-@@ -92,6 +92,7 @@ extern struct config_parser_state* cfg_p
304	+Index: trunk/util/configparser.y
305	+===================================================================
306	+--- trunk/util/configparser.y (revision 3587)
307	++++ trunk/util/configparser.y (working copy)
308	+@@ -92,6 +92,7 @@
309	%token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT
310	%token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
311	%token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
312	@@ -358,7 +387,7 @@
313	%token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
314	%token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
315	%token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
316	-@@ -151,6 +152,7 @@ content_server: server_num_threads \| ser
317	+@@ -169,6 +170,7 @@
318	server_dlv_anchor_file \| server_dlv_anchor \| server_neg_cache_size \|
319	server_harden_referral_path \| server_private_address \|
320	server_private_domain \| server_extended_statistics \|
321	@@ -366,8 +395,8 @@
322	server_local_data_ptr \| server_jostle_timeout \|
323	server_unwanted_reply_threshold \| server_log_time_ascii \|
324	server_domain_insecure \| server_val_sig_skew_min \|
325	-@@ -802,6 +803,15 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR
326	- free($2);
327	+@@ -893,6 +895,15 @@
328	+ yyerror("out of memory");
329	}
330	;
331	+server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
332	@@ -382,13 +411,3 @@
333	server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
334	{
335	OUTYY(("P(server_private_address:%s)\n", $2));
336	---- unbound-1.4.17.orig/pythonmod/interface.i
337	-+++ unbound-1.4.17/pythonmod/interface.i
338	-@@ -626,6 +626,7 @@ struct config_file {
339	- int harden_dnssec_stripped;
340	- int harden_referral_path;
341	- int use_caps_bits_for_id;
342	-+ int aaaa_filter; /* ASN */
343	- struct config_strlist* private_address;
344	- struct config_strlist* private_domain;
345	- size_t unwanted_threshold;