- checkconf-zone-check, documentation in the man page.

zone files of auth-zones and RPZ.

CONTRIBUTING.md

@@ -1,54 +0,0 @@
-# Contributing to Unbound
-
-This document offers guidelines on how to best contribute to Unbound, whether
-it being new features or correcting flaws or bugs.
-
-## Code of Conduct
-
-This project and everyone participating in it is governed by the [NLnet Labs
-Code of Conduct](https://www.nlnetlabs.nl/conduct/).
-By participating, you are expected to uphold this code.
-
-## LLM Policy
-
-Before contributing to this project, please be aware of the [NLnet Labs LLM Policy](https://www.nlnetlabs.nl/llm-policy).
-In a nutshell: we do not accept any LLM-generated contributions to
-code or documentation.
-
-## Join the Community
-
-We invite you to join the [NLnet Labs Commununity
-Forum](https://community.nlnetlabs.nl/) where Unbound has its own category.
-Please don't open a GitHub issue for a question.
-Instead, follow the discussion on the forum and ask questions there before you
-start sending patches.
-We prefer public discussions over private ones, so everyone in the community
-can participate and learn.
-
-## License and copyright
-
-When contributing with code, you agree to put your changes and new code under
-the same license Unbound is already using.
-When changing existing source code, do not alter the copyright of the original
-file(s).
-The copyright will still be owned by the original creator(s) or those who have
-been assigned copyright by the original author(s).
-
-By submitting a patch to Unbound, you are assumed to have the right to the code
-and to be allowed by your employer or whatever to hand over that patch/code
-to us.
-We will credit you for your changes as far as possible, to give credit but also
-to keep a trace back to who made what changes.
-
-## Sharing Your Changes
-
-We would like you to submit a [pull request on
-GitHub](https://github.com/NLnetLabs/Unbound/pulls).
-Please note that you can create a draft pull request to indicate that you're
-still working on something but still share it with the maintainers to get some
-early feedback.
-
-Once final, your change will be reviewed and discussed on GitHub.
-You will be expected to correct flaws pointed out and update accordingly.
-As a submitter of a change, you are the owner of that change until it has been
-merged.

doc/Changelog

@@ -1,14 +1,3 @@
-20 October 2026: Wouter
-	- Merge #1534: unbound-checkconf reads config, but zonefiles
-	  are read with an option, '-a'. This speeds up the checkconf
-	  before server start in the presence of large zone files.
-	  And it is similar to how nsd-checkconf behaves.
-
-20 October 2026: Yorgos
-	- Add CONTRIBUTING.md, similar to other NLnet Labs projects.
-	- Merge #1536: Better documentation and warning message for no
-	  configured trust anchors.
-
 19 October 2026: Wouter
 	- Merge #1528 from Ar-maan05: Fix NSEC at apex detection for
 	  short type bitmaps.

doc/example.conf.in

@@ -672,7 +672,6 @@ server:
 	# most modules have to be listed at the beginning of the line,
 	# except cachedb(just before iterator), and python (at the beginning,
 	# or, just before the iterator).
-	# Note that validator needs configured trust-anchors to be of any use.
 	# module-config: "validator iterator"
 
 	# File with trusted keys, kept up-to-date using RFC5011 probes,

doc/unbound.conf.rst

@@ -2171,12 +2171,11 @@ These options are part of the ``server:`` section.
         The ordering of the modules is significant, the order decides the order
         of processing.
 
-    Setting this to just ``"iterator"`` results in a non-validating server.
-    Setting this to ``"validator iterator"`` (default) enables the DNSSEC
-    validator module but not DNSSEC validation.
+    Setting this to just "iterator" will result in a non-validating server.
+    Setting this to "validator iterator" will turn on DNSSEC validation.
 
     .. note::
-        To turn on DNSSEC validation you must configure trust-anchors.
+        You must also set trust-anchors for validation to be useful.
 
     Adding ``respip`` to the front will cause RPZ processing to be done on all
     queries.

services/authzone.c

@@ -5238,7 +5238,7 @@ apply_axfr(struct auth_xfer* xfr, struct auth_zone* z,
 /** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */
 static int
 apply_http(struct auth_xfer* xfr, struct auth_zone* z,
-	struct sldns_buffer* scratch_buffer, char* etag)
+	struct sldns_buffer* scratch_buffer)
 {
 	/* parse data in chunks */
 	/* parse RR's and read into memory. ignore $INCLUDE from the
@@ -5334,11 +5334,7 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 			pstate.lineno,
 			sldns_buffer_begin(scratch_buffer));
 		return 0;
-  }
-	if (etag) {
-		verbose(VERB_OPS, "etag %s stored", etag);
-		strcpy(z->etag, etag);
-  }
+	}
 	return 1;
 }
 
@@ -5496,7 +5492,7 @@ static int xfr_process_reacquire_locks(struct auth_xfer* xfr,
  * return false if it did not work */
 static int
 xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
-	int* ixfr_fail, char *etag)
+	int* ixfr_fail)
 {
 	struct auth_zone* z;
 	int zonemd_in_progress;
@@ -5512,7 +5508,7 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
 
 	/* apply data */
 	if(xfr->task_transfer->master->http) {
-		if(!apply_http(xfr, z, env->scratch_buffer, etag)) {
+		if(!apply_http(xfr, z, env->scratch_buffer)) {
 			auth_zone_clear_data(z);
 			lock_rw_unlock(&z->lock);
 			verbose(VERB_ALGO, "http from %s: could not store data",
@@ -5792,21 +5788,6 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 	xfr->task_transfer->start_time = *env->now_tv;
 
 	if(master->http) {
-		char etag[128], *etag_str = NULL;
-		struct auth_zone* z;
-		/* Obtain locks and structures. */
-		lock_basic_unlock(&xfr->lock);
-		if(!xfr_process_reacquire_locks(xfr, env, &z)) {
-			/* The zone is gone, ignore xfr transfer. */
-			return 1; /* Stop processing this xfr. */
-		}
-		/* Holding xfr and z locks. */
-
-		if(z && z->etag[0] && strlen(z->etag) < sizeof(etag)) {
-			strlcpy(etag, z->etag, sizeof(etag));
-			etag_str = etag;
-		}
-		lock_rw_unlock(&z->lock);
 		/* perform http fetch */
 		/* store http port number into sockaddr,
 		 * unless someone used unbound's host@port notation */
@@ -5816,7 +5797,7 @@ xfr_transfer_init_fetch(struct auth_xfer* xfr, struct module_env* env)
 		xfr->task_transfer->cp = outnet_comm_point_for_http(
 			env->outnet, auth_xfer_transfer_http_callback, xfr,
 			&addr, addrlen, -1, master->ssl, master->host,
-			master->file, env->cfg, etag_str);
+			master->file, env->cfg);
 		if(!xfr->task_transfer->cp) {
 			char zname[LDNS_MAX_DOMAINLEN], as[256];
 			dname_str(xfr->name, zname);
@@ -6408,10 +6389,10 @@ xfer_link_data(sldns_buffer* pkt, struct auth_xfer* xfr)
 /** task transfer.  the list of data is complete. process it and if failed
  * move to next master, if succeeded, end the task transfer */
 static void
-process_list_end_transfer(struct auth_xfer* xfr, struct module_env* env, char* etag)
+process_list_end_transfer(struct auth_xfer* xfr, struct module_env* env)
 {
 	int ixfr_fail = 0;
-	if(xfr_process_chunk_list(xfr, env, &ixfr_fail, etag)) {
+	if(xfr_process_chunk_list(xfr, env, &ixfr_fail)) {
 		/* it worked! */
 		auth_chunks_delete(xfr->task_transfer);
 
@@ -6583,15 +6564,9 @@ auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err,
 	}
 	/* if the transfer is done now, disconnect and process the list */
 	if(transferdone) {
-		/* Convey etag (captured on the comm_point) to auth zone,
-		 * if there was any */
-		struct comm_point *cp;
-		cp = xfr->task_transfer->cp;
+		comm_point_delete(xfr->task_transfer->cp);
 		xfr->task_transfer->cp = NULL;
-		process_list_end_transfer(xfr, env,
-			(  xfr->task_transfer->master->http && cp->etag[0]
-			?  cp->etag : NULL));
-		comm_point_delete(cp);
+		process_list_end_transfer(xfr, env);
 		return 0;
 	}
 
@@ -6673,17 +6648,11 @@ auth_xfer_transfer_http_callback(struct comm_point* c, void* arg, int err,
 	}
 	/* if the transfer is done now, disconnect and process the list */
 	if(err == NETEVENT_DONE) {
-		/* Convey etag (captured on the comm_point) to auth zone,
-		 * if there was any */
-		struct comm_point *cp;
 		if(repinfo) repinfo->c = NULL; /* signal cp deleted to
 				the routine calling this callback */
-		cp = xfr->task_transfer->cp;
+		comm_point_delete(xfr->task_transfer->cp);
 		xfr->task_transfer->cp = NULL;
-		process_list_end_transfer(xfr, env,
-			(  xfr->task_transfer->master->http && cp->etag[0]
-			?  cp->etag : NULL));
-		comm_point_delete(cp);
+		process_list_end_transfer(xfr, env);
 		return 0;
 	}
 

services/authzone.h

@@ -125,8 +125,6 @@ struct auth_zone {
 	int zone_expired;
 	/** zone is a slave zone (it has masters) */
 	int zone_is_slave;
-	/** store etag */
-	char etag[128];
 	/** for downstream: this zone answers queries towards the downstream
 	 * clients */
 	int for_downstream;

services/outside_network.c

@@ -3900,15 +3900,11 @@ setup_http_user_agent(sldns_buffer* buf, struct config_file* cfg)
 /** setup http request headers in buffer for sending query to destination */
 static int
 setup_http_request(sldns_buffer* buf, char* host, char* path,
-	struct config_file* cfg, const char* etag)
+	struct config_file* cfg)
 {
 	sldns_buffer_clear(buf);
 	sldns_buffer_printf(buf, "GET /%s HTTP/1.1\r\n", path);
 	sldns_buffer_printf(buf, "Host: %s\r\n", host);
-	if (etag) {
-		verbose(VERB_OPS, "sending along ETag %s in http request", etag);
-		sldns_buffer_printf(buf, "If-None-Match: %s\r\n", etag);
-	}
 	setup_http_user_agent(buf, cfg);
 	/* We do not really do multiple queries per connection,
 	 * but this header setting is also not needed.
@@ -3925,7 +3921,7 @@ struct comm_point*
 outnet_comm_point_for_http(struct outside_network* outnet,
 	comm_point_callback_type* cb, void* cb_arg,
 	struct sockaddr_storage* to_addr, socklen_t to_addrlen, int timeout,
-	int ssl, char* host, char* path, struct config_file* cfg, char* etag)
+	int ssl, char* host, char* path, struct config_file* cfg)
 {
 	/* cp calls cb with err=NETEVENT_DONE when transfer is done */
 	struct comm_point* cp;
@@ -3963,7 +3959,7 @@ outnet_comm_point_for_http(struct outside_network* outnet,
 	comm_point_start_listening(cp, fd, timeout);
 
 	/* setup http request in cp->buffer */
-	if(!setup_http_request(cp->buffer, host, path, cfg, etag)) {
+	if(!setup_http_request(cp->buffer, host, path, cfg)) {
 		log_err("error setting up http request");
 		comm_point_delete(cp);
 		return NULL;

services/outside_network.h

@@ -854,7 +854,7 @@ struct comm_point* outnet_comm_point_for_tcp(struct outside_network* outnet,
 struct comm_point* outnet_comm_point_for_http(struct outside_network* outnet,
 	comm_point_callback_type* cb, void* cb_arg,
 	struct sockaddr_storage* to_addr, socklen_t to_addrlen, int timeout,
-	int ssl, char* host, char* path, struct config_file* cfg, char* etag);
+	int ssl, char* host, char* path, struct config_file* cfg);
 
 /** connect tcp connection to addr, 0 on failure */
 int outnet_tcp_connect(int s, struct sockaddr_storage* addr, socklen_t addrlen);

util/netevent.c

@@ -5037,10 +5037,6 @@ http_process_initial_header(struct comm_point* c)
 	} else if(strncasecmp(line, "Transfer-Encoding: chunked", 19+7) == 0) {
 		c->tcp_byte_count = 0;
 		c->http_is_chunked = 1;
-	} else if(strncasecmp(line, "ETag: ", 6) == 0) {
-		if (strlen(line + 6) < sizeof(c->etag)) {
-			strcpy(c->etag, line + 6);
-		}
 	} else if(line[0] == 0) {
 		/* end of initial headers */
 		c->http_in_headers = 0;
@@ -6585,7 +6581,6 @@ comm_point_create_http_out(struct comm_base *base, size_t bufsize,
 	c->http_in_chunk_headers = 0;
 	c->http_is_chunked = 0;
 	c->http_temp = temp;
-	c->etag[0] = 0;
 #ifdef USE_MSG_FASTOPEN
 	c->tcp_do_fastopen = 1;
 #endif

util/netevent.h

@@ -286,8 +286,6 @@ struct comm_point {
 	struct sldns_buffer* http_temp;
 	/** http stored content in buffer */
 	size_t http_stored;
-	/** http Entity-Tag */
-	char etag[128];
 	/* -------- HTTP/2 ------- */
 	/** http2 session */
 	struct http2_session* h2_session;

validator/validator.c

@@ -231,7 +231,6 @@ val_init(struct module_env* env, int id)
 {
 	struct val_env* val_env = (struct val_env*)calloc(1,
 		sizeof(struct val_env));
-	struct trust_anchor* anchor = NULL;
 	if(!val_env) {
 		log_err("malloc failure");
 		return 0;
@@ -248,22 +247,16 @@ val_init(struct module_env* env, int id)
 		log_err("validator: could not apply configuration settings.");
 		return 0;
 	}
-
-	anchor = anchors_find_any_noninsecure(env->anchors);
-	if(anchor) {
-		if(env->cfg->disable_edns_do) {
+	if(env->cfg->disable_edns_do) {
+		struct trust_anchor* anchor = anchors_find_any_noninsecure(
+			env->anchors);
+		if(anchor) {
 			char b[LDNS_MAX_DOMAINLEN];
 			dname_str(anchor->name, b);
 			log_warn("validator: disable-edns-do is enabled, but there is a trust anchor for '%s'. Since DNSSEC could not work, the disable-edns-do setting is turned off. Continuing without it.", b);
+			lock_basic_unlock(&anchor->lock);
 			env->cfg->disable_edns_do = 0;
 		}
-		lock_basic_unlock(&anchor->lock);
-	} else {
-		log_warn("validator: no DNSSEC trust anchors configured. "
-			"DNSSEC validation is now effectively DISABLED. "
-			"Either configure a trust anchor to enable DNSSEC "
-			"validation or remove the validator from "
-			"module-config.");
 	}
 
 	return 1;