The DNS64 code was written by Viagenie, 2009, by Simon Perrault as part
of the Ecdysis project.  The code is copyright by them, and has the BSD
license (see the dns64/dns64.c file).

To enable DNS64 functionality in Unbound, two directives in unbound.conf must
be edited:

1. The "module-config" directive must start with "dns64". For example:

    module-config: "dns64 validator iterator"

If you're not using DNSSEC then you may remove "validator".

2. The "dns64-prefix" directive indicates your DNS64 prefix. For example:

    dns64-prefix: 64:FF9B::/96

The prefix must be a /96 or shorter.

To test that things are working right, perform a query against Unbound for a
domain name for which no AAAA record exists. You should see a AAAA record in
the answer section. The corresponding IPv6 address will be inside the DNS64
prefix. For example:

    $ unbound -c unbound.conf
    $ dig @localhost jazz-v4.viagenie.ca aaaa
    [...]
    ;; ANSWER SECTION:
    jazz-v4.viagenie.ca.        86400   IN      AAAA    64:ff9b::ce7b:1f02


NAT64 support was added by David Lamparter in 2022; license(s) of the
surrounding code apply.  Note that NAT64 is closely related but functionally
orthogonal to DNS64;  it allows Unbound to send outgoing queries to IPv4-only
servers over IPv6 through the configured NAT64 prefix.  This allows running
an Unbound instance on an IPv6-only host without breaking every single domain
that only has IPv4 servers.  Whether that Unbound instance also does DNS64 is
an independent choice.

To enable NAT64 in Unbound, add to unbound.conf's "server" section:

    do-nat64: yes

The NAT64 prefix defaults to the DNS64 prefix, which in turn defaults to the
standard 64:FF9B::/96 prefix.  You can reconfigure it with:

    nat64-prefix: 64:FF9B::/96

To test NAT64 operation, pick a domain that only has IPv4 reachability for its
nameservers and try resolving any names in that domain.

## Created a module to support the ipset that could add the domain's ip to a list easily.

### Purposes:
* In my case, I can't access the facebook, twitter, youtube and thousands web site for some reason. VPN is a solution. But the internet too slow whether all traffics pass through the vpn.
So, I set up a transparent proxy to proxy the traffic which has been blocked only.
At the final step, I need to install a dns service which would work with ipset well to launch the system.
I did some research for this. Unfortunately, Unbound, My favorite dns service doesn't support ipset yet. So, I decided to implement it by my self and contribute the patch. It's good for me and the community.
```
# unbound.conf
server:
  ...
  local-zone: "facebook.com" ipset
  local-zone: "twitter.com" ipset
  local-zone: "instagram.com" ipset
  more social website

ipset:
  name-v4: "gfwlist"
```
```
# iptables
iptables -A PREROUTING -p tcp -m set --match-set gfwlist dst -j REDIRECT --to-ports 10800
iptables -A OUTPUT -p tcp -m set --match-set gfwlist dst -j REDIRECT --to-ports 10800
```

* This patch could work with iptables rules to batch block the IPs.
```
# unbound.conf
server:
  ...
  local-zone: "facebook.com" ipset
  local-zone: "twitter.com" ipset
  local-zone: "instagram.com" ipset
  more social website

ipset:
  name-v4: "blacklist"
  name-v6: "blacklist6"
```
```
# iptables
iptables -A INPUT -m set --set blacklist src -j DROP
ip6tables -A INPUT -m set --set blacklist6 src -j DROP
```

### Notes:
* To enable this module the root privileges is required.
* Please create a set with ipset command first. eg. **ipset -N blacklist iphash**

### How to use:
```
./configure --enable-ipset
make && make install
```

### Configuration:
```
# unbound.conf
server:
  ...
  local-zone: "example.com" ipset

ipset:
  name-v4: "blacklist"
```

README.svn

For a svn checkout:
* configure script, aclocal.m4, as well as yacc/lex output files are
  committed to the repository.
* use --enable-debug flag for configure to enable dependency tracking and
  assertions, otherwise, use make clean; make after svn update.

* Note changes in the Changelog.
* Every check-in a postcommit hook is run
	(the postcommit hook is in the svn/unbound/hooks directory).
	* generates commit email with your changes and comment.
	* compiles and runs the tests (with testcode/do-tests.sh).
	* If build errors or test errors happen
		* Please fix your errors and commit again.

* Use gnu make to compile, make or 'gmake'.

README unbound tests

For a quick test that runs unit tests and state machine tests, use
	make test

There is a long test setup for unbound that needs tools installed. Use
	make longtest
To make and run the long tests. The results are summarized at the end.

You need to have the following programs installed and in your PATH.
* dig - from the bind-tools package. Used to send DNS queries.
* splint (optional) - for lint test
* doxygen (optional) - for doc completeness test
* ldns-testns - from ldns examples. Used as DNS auth server.
* xxd and nc (optional) - for (malformed) packet transmission.
The optional programs are detected and can be omitted.

You can also use prepared Dockerfile to run tests inside docker based on latest gcc image:
* build container: docker build -t unbound-tester -f contrib/Dockerfile.tests .
* run container: docker run -it --mount type=bind,source="$(pwd)",target=/usr/src/unbound --rm unbound-tester
* configure environment: ./configure
* run test: make test
* run long tests: make longtest
It is worth to mention that you need to enable [ipv6 in your docker daemon configuration](https://docs.docker.com/config/daemon/ipv6/) because some tests need ipv6 network stack.

testdata/ contains the data for tests.
testcode/ contains scripts and c code for the tests.

do-tests.sh : runs all the tests in the testdata directory.
testbed.sh : compiles on a set of (user specific) hosts and runs do-tests.

Tests are run using testcode/mini_tpkg.sh.