* Wed Apr 26 2017 Paul Wouters <pwouters@redhat.com> - 1.6.2-1

- Update to 1.6.2 (rhbz#1425649)
- Updated unbound.conf with new options

.gitignore

@@ -38,3 +38,4 @@ unbound-1.4.5.tar.gz
 /unbound-1.5.9.tar.gz
 /unbound-1.5.10.tar.gz
 /unbound-1.6.0.tar.gz
+/unbound-1.6.2.tar.gz

sources

@@ -1 +1 @@
-SHA512 (unbound-1.6.0.tar.gz) = c92adee98ef759d033ac39784796e936e292f0671a42ad455411b82a9ba552744e4a0de432ee4ac05609dc0b429b70d5ce8169c20d3d65f4acf5afc5e02822ac
+SHA512 (unbound-1.6.2.tar.gz) = ac7a4f7e6e857715bd047060ad27a36637ceaaea965fadea0124eb7d83a8bcffdf64723335ca4baf2428eefbd135909ed7a62530dc7f9fb68980726b4270a751

unbound.conf

@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.5.10.
+# See unbound.conf(5) man page
 #
 # this is a comment.
 
@@ -20,6 +20,14 @@ server:
 	# Needs to be disabled for munin plugin
 	statistics-interval: 0
 
+	# enable shm for stats, default no.  if you enable also enable
+	# statistics-interval, every time it also writes stats to the
+	# shared memory segment keyed with shm-key.
+	# shm-enable: no
+
+	# shm for stats uses this key, and key+1 for the shared mem segment.
+	# shm-key: 11777
+
 	# enable cumulative statistics, without clearing them after printing.
 	# Needs to be disabled for munin plugin
 	statistics-cumulative: no
@@ -221,7 +229,12 @@ server:
 	# Default is 0, system default MSS.
 	# outgoing-tcp-mss: 0
 
+	# Fedora note: do not activate this - can cause a crash
+	# Use systemd socket activation for UDP, TCP, and control sockets.
+	# use-systemd: no
+
 	# Detach from the terminal, run in background, "yes" or "no".
+	# Set the value to "no" when unbound runs as systemd service.
 	# do-daemonize: yes
 
 	# control which clients are allowed to make (recursive) queries
@@ -251,6 +264,9 @@ server:
 	# set redirect data for particular tag for access control element
 	# access-control-tag-data: 192.0.2.0/24 tag2 "A 127.0.0.1"
 
+	# Set view for access control element
+	# access-control-view: 192.0.2.0/24 viewname
+
 	# if given, a chroot(2) is done to the given directory.
 	# i.e. you can chroot to the working directory, for example,
 	# for extra security, but make sure all files are in that directory.
@@ -297,12 +313,20 @@ server:
 	# log to, with identity "unbound". If yes, it overrides the logfile.
 	# use-syslog: yes
  
+	# Log identity to report. if empty, defaults to the name of argv[0]
+	# (usually "unbound").
+	# log-identity: ""
+
 	# print UTC timestamp in ascii to logfile, default is epoch in seconds.
 	log-time-ascii: yes
 
 	# print one line with time, IP, name, type, class for every query.
 	# log-queries: no
 
+	# print one line per reply, with time, IP, name, type, class, rcode,
+	# timetoresolve, fromcache and responsesize.
+	# log-replies: no
+
 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	pidfile: "/var/run/unbound/unbound.pid"
 
@@ -313,6 +337,9 @@ server:
 	# enable to not answer id.server and hostname.bind queries.
 	# hide-identity: no
 
+	# enable to not answer trustanchor.unbound queries.
+	# hide-trustanchor: no
+
 	# enable to not answer version.server and version.bind queries.
 	# hide-version: no
 
@@ -366,6 +393,12 @@ server:
 	# to NS when possible.
 	qname-minimisation: yes
 
+	# QNAME minimisation in strict mode. Do not fall-back to sending full
+	# QNAME to potentially broken nameservers. A lot of domains will not be
+	# resolvable when this option in enabled.
+	# This option only has effect when qname-minimisation is enabled.
+	# qname-minimisation-strict: no
+
 	# Use 0x20-encoded random bits in the query to foil spoof attempts.
 	# This feature is an experimental implementation of draft dns-0x20.
 	# use-caps-for-id: no
@@ -503,6 +536,10 @@ server:
 	# that set CD but cannot validate themselves.
 	# ignore-cd-flag: no
 
+	# Serve expired reponses from cache, with TTL 0 in the response,
+	# and then attempt to fetch the data afresh.
+	# serve-expired: no
+
 	# Have the validator log failed validations for your diagnosis.
 	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
 	val-log-level: 1
@@ -677,6 +714,19 @@ server:
 	# can give this multiple times, the name closest to the zone is used.
 	# ratelimit-below-domain: com 1000
 
+	# global query ratelimit for all ip addresses.
+	# feature is experimental.
+	# if 0(default) it is disabled, otherwise states qps allowed per ip address
+	# ip-ratelimit: 0
+
+	# ip ratelimits are tracked in a cache, size in bytes of cache (or k,m).
+	# ip-ratelimit-size: 4m
+	# ip ratelimit cache slabs, reduces lock contention if equal to cpucount.
+	# ip-ratelimit-slabs: 4
+
+	# 0 blocks when ip is ratelimited, otherwise let 1/xth traffic through
+	# ip-ratelimit-factor: 10
+
 # Python config section. To enable:
 # o use --with-pythonmodule to configure before compiling.
 # o list python in the module-config string (above) to enable.
@@ -758,3 +808,43 @@ include: /etc/unbound/conf.d/*.conf
 # You can now also dynamically create and delete forward-zone's using
 # unbound-control forward_add domain.com 1.2.3.4 5.6.7.8
 # unbound-control forward_remove domain.com 1.2.3.4 5.6.7.8
+
+# Views
+# Create named views. Name must be unique. Map views to requests using
+# the access-control-view option. Views can contain zero or more local-zone
+# and local-data options. Options from matching views will override global
+# options. Global options will be used if no matching view is found.
+# With view-first yes, it will try to answer using the global local-zone and
+# local-data elements if there is no view specific match.
+# view:
+#	name: "viewname"
+#	local-zone: "example.com" redirect
+#	local-data: "example.com A 192.0.2.3"
+# 	local-data-ptr: "192.0.2.3 www.example.com"
+#	view-first: no
+# view:
+#	name: "anotherview"
+#	local-zone: "example.com" refuse
+
+# Fedora: DNSCrypt support not enabled since it requires linking to
+#         another crypto library
+#
+# DNSCrypt
+# Caveats:
+# 1. the keys/certs cannot be produced by unbound. You can use dnscrypt-wrapper
+#   for this: https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage
+# 2. dnscrypt channel attaches to an interface. you MUST set interfaces to
+#   listen on `dnscrypt-port` with the follo0wing snippet:
+# server:
+#     interface: 0.0.0.0@443
+#     interface: ::0@443
+#
+# Finally, `dnscrypt` config has its own section.
+# dnscrypt:
+#     dnscrypt-enable: yes
+#     dnscrypt-port: 443
+#     dnscrypt-provider: 2.dnscrypt-cert.example.com.
+#     dnscrypt-secret-key: /path/unbound-conf/keys1/1.key
+#     dnscrypt-secret-key: /path/unbound-conf/keys2/1.key
+#     dnscrypt-provider-cert: /path/unbound-conf/keys1/1.cert
+#     dnscrypt-provider-cert: /path/unbound-conf/keys2/1.cert

unbound.spec

@@ -20,8 +20,8 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.6.0
-Release: 6%{?extra_version:.%{extra_version}}%{?dist}
+Version: 1.6.2
+Release: 1%{?extra_version:.%{extra_version}}%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
 Source: http://www.unbound.net/downloads/%{name}-%{version}%{?extra_version}.tar.gz
@@ -439,6 +439,10 @@ popd
 
 
 %changelog
+* Wed Apr 26 2017 Paul Wouters <pwouters@redhat.com> - 1.6.2-1
+- Update to 1.6.2 (rhbz#1425649)
+- Updated unbound.conf with new options
+
 * Wed Mar 22 2017 Paul Wouters <pwouters@redhat.com> - 1.6.0-6
 - Call make unbound-event-install to install unbound-event.h