2 * unbound.h - unbound validating resolver public API
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file contains functions to resolve DNS queries and
40 * validate the answers. Synchronously and asynchronously.
42 * Several ways to use this interface from an application wishing
43 * to perform (validated) DNS lookups.
46 * ctx = ub_ctx_create();
47 * err = ub_ctx_add_ta(ctx, "...");
48 * err = ub_ctx_add_ta(ctx, "...");
50 * ... call ub_ctx_delete(ctx); when you want to stop.
52 * Application not threaded. Blocking.
53 * int err = ub_resolve(ctx, "www.example.com", ...
54 * if(err) fprintf(stderr, "lookup error: %s\n", ub_strerror(err));
57 * Application not threaded. Non-blocking ('asynchronous').
58 * err = ub_resolve_async(ctx, "www.example.com", ... my_callback);
59 * ... application resumes processing ...
60 * ... and when either ub_poll(ctx) is true
61 * ... or when the file descriptor ub_fd(ctx) is readable,
62 * ... or whenever, the app calls ...
64 * ... if no result is ready, the app resumes processing above,
65 * ... or process() calls my_callback() with results.
67 * ... if the application has nothing more to do, wait for answer
70 * Application threaded. Blocking.
71 * Blocking, same as above. The current thread does the work.
72 * Multiple threads can use the *same context*, each does work and uses
73 * shared cache data from the context.
75 * Application threaded. Non-blocking ('asynchronous').
76 * ... setup threaded-asynchronous config option
77 * err = ub_ctx_async(ctx, 1);
78 * ... same as async for non-threaded
79 * ... the callbacks are called in the thread that calls process(ctx)
81 * Openssl needs to have locking in place, and the application must set
82 * it up, because a mere library cannot do this, use the calls
83 * CRYPTO_set_id_callback and CRYPTO_set_locking_callback.
85 * If no threading is compiled in, the above async example uses fork(2) to
86 * create a process to perform the work. The forked process exits when the
87 * calling process exits, or ctx_delete() is called.
88 * Otherwise, for asynchronous with threading, a worker thread is created.
90 * The blocking calls use shared ctx-cache when threaded. Thus
91 * ub_resolve() and ub_resolve_async() && ub_wait() are
92 * not the same. The first makes the current thread do the work, setting
93 * up buffers, etc, to perform the work (but using shared cache data).
94 * The second calls another worker thread (or process) to perform the work.
95 * And no buffers need to be set up, but a context-switch happens.
104 /** the version of this header file */
105 #define UNBOUND_VERSION_MAJOR @UNBOUND_VERSION_MAJOR@
106 #define UNBOUND_VERSION_MINOR @UNBOUND_VERSION_MINOR@
107 #define UNBOUND_VERSION_MICRO @UNBOUND_VERSION_MICRO@
110 * The validation context is created to hold the resolver status,
111 * validation keys and a small cache (containing messages, rrsets,
112 * roundtrip times, trusted keys, lameness information).
114 * Its contents are internally defined.
119 * The validation and resolution results.
120 * Allocated by the resolver, and need to be freed by the application
121 * with ub_resolve_free().
124 /** The original question, name text string. */
126 /** the type asked for */
128 /** the class asked for */
132 * a list of network order DNS rdata items, terminated with a
133 * NULL pointer, so that data[0] is the first result entry,
134 * data[1] the second, and the last entry is NULL.
135 * If there was no data, data[0] is NULL.
139 /** the length in bytes of the data items, len[i] for data[i] */
143 * canonical name for the result (the final cname).
144 * zero terminated string.
145 * May be NULL if no canonical name exists.
150 * DNS RCODE for the result. May contain additional error code if
151 * there was no data due to an error. 0 (NOERROR) if okay.
156 * The DNS answer packet. Network formatted. Can contain DNSSEC types.
159 /** length of the answer packet in octets. */
163 * If there is any data, this is true.
164 * If false, there was no data (nxdomain may be true, rcode can be set).
169 * If there was no data, and the domain did not exist, this is true.
170 * If it is false, and there was no data, then the domain name
171 * is purported to exist, but the requested data type is not available.
176 * True, if the result is validated securely.
177 * False, if validation failed or domain queried has no security info.
179 * It is possible to get a result with no data (havedata is false),
180 * and secure is true. This means that the non-existence of the data
181 * was cryptographically proven (with signatures).
186 * If the result was not secure (secure==0), and this result is due
187 * to a security failure, bogus is true.
188 * This means the data has been actively tampered with, signatures
189 * failed, expected signatures were not present, timestamps on
190 * signatures were out of date and so on.
192 * If !secure and !bogus, this can happen if the data is not secure
193 * because security is disabled for that domain name.
194 * This means the data is from a domain where data is not signed.
199 * If the result is bogus this contains a string (zero terminated)
200 * that describes the failure. There may be other errors as well
201 * as the one described, the description may not be perfectly accurate.
202 * Is NULL if the result is not bogus.
207 * If the query or one of its subqueries was ratelimited. Useful if
208 * ratelimiting is enabled and answer to the client is SERVFAIL as a
214 * TTL for the result, in seconds. If the security is bogus, then
215 * you also cannot trust this value.
221 * Callback for results of async queries.
222 * The readable function definition looks like:
223 * void my_callback(void* my_arg, int err, struct ub_result* result);
225 * void* my_arg: your pointer to a (struct of) data of your choice,
227 * int err: if 0 all is OK, otherwise an error occured and no results
229 * struct result: pointer to more detailed result structure.
230 * This structure is allocated on the heap and needs to be
231 * freed with ub_resolve_free(result);
233 typedef void (*ub_callback_type)(void*, int, struct ub_result*);
236 * Create a resolving and validation context.
237 * The information from /etc/resolv.conf and /etc/hosts is not utilised by
238 * default. Use ub_ctx_resolvconf and ub_ctx_hosts to read them.
239 * @return a new context. default initialisation.
240 * returns NULL on error.
242 struct ub_ctx* ub_ctx_create(void);
245 * Destroy a validation context and free all its resources.
246 * Outstanding async queries are killed and callbacks are not called for them.
247 * @param ctx: context to delete.
249 void ub_ctx_delete(struct ub_ctx* ctx);
252 * Set an option for the context.
253 * @param ctx: context.
254 * @param opt: option name from the unbound.conf config file format.
255 * (not all settings applicable). The name includes the trailing ':'
256 * for example ub_ctx_set_option(ctx, "logfile:", "mylog.txt");
257 * This is a power-users interface that lets you specify all sorts
259 * For some specific options, such as adding trust anchors, special
261 * @param val: value of the option.
262 * @return: 0 if OK, else error.
264 int ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val);
267 * Get an option from the context.
268 * @param ctx: context.
269 * @param opt: option name from the unbound.conf config file format.
270 * (not all settings applicable). The name excludes the trailing ':'
271 * for example ub_ctx_get_option(ctx, "logfile", &result);
272 * This is a power-users interface that lets you specify all sorts
274 * @param str: the string is malloced and returned here. NULL on error.
275 * The caller must free() the string. In cases with multiple
276 * entries (auto-trust-anchor-file), a newline delimited list is
277 * returned in the string.
278 * @return 0 if OK else an error code (malloc failure, syntax error).
280 int ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str);
283 * setup configuration for the given context.
284 * @param ctx: context.
285 * @param fname: unbound config file (not all settings applicable).
286 * This is a power-users interface that lets you specify all sorts
288 * For some specific options, such as adding trust anchors, special
290 * @return: 0 if OK, else error.
292 int ub_ctx_config(struct ub_ctx* ctx, const char* fname);
295 * Set machine to forward DNS queries to, the caching resolver to use.
296 * IP4 or IP6 address. Forwards all DNS requests to that machine, which
297 * is expected to run a recursive resolver. If the proxy is not
298 * DNSSEC-capable, validation may fail. Can be called several times, in
299 * that case the addresses are used as backup servers.
301 * To read the list of nameservers from /etc/resolv.conf (from DHCP or so),
302 * use the call ub_ctx_resolvconf.
304 * @param ctx: context.
305 * At this time it is only possible to set configuration before the
306 * first resolve is done.
307 * @param addr: address, IP4 or IP6 in string format.
308 * If the addr is NULL, forwarding is disabled.
309 * @return 0 if OK, else error.
311 int ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr);
314 * Use DNS over TLS to send queries to machines set with ub_ctx_set_fwd().
316 * @param ctx: context.
317 * At this time it is only possible to set configuration before the
318 * first resolve is done.
319 * @param tls: enable or disable DNS over TLS
320 * @return 0 if OK, else error.
322 int ub_ctx_set_tls(struct ub_ctx* ctx, int tls);
325 * Add a stub zone, with given address to send to. This is for custom
326 * root hints or pointing to a local authoritative dns server.
327 * For dns resolvers and the 'DHCP DNS' ip address, use ub_ctx_set_fwd.
328 * This is similar to a stub-zone entry in unbound.conf.
330 * @param ctx: context.
331 * It is only possible to set configuration before the
332 * first resolve is done.
333 * @param zone: name of the zone, string.
334 * @param addr: address, IP4 or IP6 in string format.
335 * The addr is added to the list of stub-addresses if the entry exists.
336 * If the addr is NULL the stub entry is removed.
337 * @param isprime: set to true to set stub-prime to yes for the stub.
338 * For local authoritative servers, people usually set it to false,
339 * For root hints it should be set to true.
340 * @return 0 if OK, else error.
342 int ub_ctx_set_stub(struct ub_ctx* ctx, const char* zone, const char* addr,
346 * Read list of nameservers to use from the filename given.
347 * Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
348 * If they do not support DNSSEC, validation may fail.
350 * Only nameservers are picked up, the searchdomain, ndots and other
351 * settings from resolv.conf(5) are ignored.
353 * @param ctx: context.
354 * At this time it is only possible to set configuration before the
355 * first resolve is done.
356 * @param fname: file name string. If NULL "/etc/resolv.conf" is used.
357 * @return 0 if OK, else error.
359 int ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname);
362 * Read list of hosts from the filename given.
363 * Usually "/etc/hosts".
364 * These addresses are not flagged as DNSSEC secure when queried for.
366 * @param ctx: context.
367 * At this time it is only possible to set configuration before the
368 * first resolve is done.
369 * @param fname: file name string. If NULL "/etc/hosts" is used.
370 * @return 0 if OK, else error.
372 int ub_ctx_hosts(struct ub_ctx* ctx, const char* fname);
375 * Add a trust anchor to the given context.
376 * The trust anchor is a string, on one line, that holds a valid DNSKEY or
378 * @param ctx: context.
379 * At this time it is only possible to add trusted keys before the
380 * first resolve is done.
381 * @param ta: string, with zone-format RR on one line.
382 * [domainname] [TTL optional] [type] [class optional] [rdata contents]
383 * @return 0 if OK, else error.
385 int ub_ctx_add_ta(struct ub_ctx* ctx, const char* ta);
388 * Add trust anchors to the given context.
389 * Pass name of a file with DS and DNSKEY records (like from dig or drill).
390 * @param ctx: context.
391 * At this time it is only possible to add trusted keys before the
392 * first resolve is done.
393 * @param fname: filename of file with keyfile with trust anchors.
394 * @return 0 if OK, else error.
396 int ub_ctx_add_ta_file(struct ub_ctx* ctx, const char* fname);
399 * Add trust anchor to the given context that is tracked with RFC5011
400 * automated trust anchor maintenance. The file is written to when the
401 * trust anchor is changed.
402 * Pass the name of a file that was output from eg. unbound-anchor,
403 * or you can start it by providing a trusted DNSKEY or DS record on one
405 * @param ctx: context.
406 * At this time it is only possible to add trusted keys before the
407 * first resolve is done.
408 * @param fname: filename of file with trust anchor.
409 * @return 0 if OK, else error.
411 int ub_ctx_add_ta_autr(struct ub_ctx* ctx, const char* fname);
414 * Add trust anchors to the given context.
415 * Pass the name of a bind-style config file with trusted-keys{}.
416 * @param ctx: context.
417 * At this time it is only possible to add trusted keys before the
418 * first resolve is done.
419 * @param fname: filename of file with bind-style config entries with trust
421 * @return 0 if OK, else error.
423 int ub_ctx_trustedkeys(struct ub_ctx* ctx, const char* fname);
426 * Set debug output (and error output) to the specified stream.
427 * Pass NULL to disable. Default is stderr.
428 * @param ctx: context.
429 * @param out: FILE* out file stream to log to.
430 * Type void* to avoid stdio dependency of this header file.
431 * @return 0 if OK, else error.
433 int ub_ctx_debugout(struct ub_ctx* ctx, void* out);
436 * Set debug verbosity for the context
437 * Output is directed to stderr.
438 * @param ctx: context.
439 * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed,
441 * @return 0 if OK, else error.
443 int ub_ctx_debuglevel(struct ub_ctx* ctx, int d);
446 * Set a context behaviour for asynchronous action.
447 * @param ctx: context.
448 * @param dothread: if true, enables threading and a call to resolve_async()
449 * creates a thread to handle work in the background.
450 * If false, a process is forked to handle work in the background.
451 * Changes to this setting after async() calls have been made have
452 * no effect (delete and re-create the context to change).
453 * @return 0 if OK, else error.
455 int ub_ctx_async(struct ub_ctx* ctx, int dothread);
458 * Poll a context to see if it has any new results
459 * Do not poll in a loop, instead extract the fd below to poll for readiness,
460 * and then check, or wait using the wait routine.
461 * @param ctx: context.
462 * @return: 0 if nothing to read, or nonzero if a result is available.
463 * If nonzero, call ctx_process() to do callbacks.
465 int ub_poll(struct ub_ctx* ctx);
468 * Wait for a context to finish with results. Calls ub_process() after
469 * the wait for you. After the wait, there are no more outstanding
470 * asynchronous queries.
471 * @param ctx: context.
472 * @return: 0 if OK, else error.
474 int ub_wait(struct ub_ctx* ctx);
477 * Get file descriptor. Wait for it to become readable, at this point
478 * answers are returned from the asynchronous validating resolver.
479 * Then call the ub_process to continue processing.
480 * This routine works immediately after context creation, the fd
482 * @param ctx: context.
483 * @return: -1 on error, or file descriptor to use select(2) with.
485 int ub_fd(struct ub_ctx* ctx);
488 * Call this routine to continue processing results from the validating
489 * resolver (when the fd becomes readable).
490 * Will perform necessary callbacks.
491 * @param ctx: context
492 * @return: 0 if OK, else error.
494 int ub_process(struct ub_ctx* ctx);
497 * Perform resolution and validation of the target name.
498 * @param ctx: context.
499 * The context is finalized, and can no longer accept config changes.
500 * @param name: domain name in text format (a zero terminated text string).
501 * @param rrtype: type of RR in host order, 1 is A (address).
502 * @param rrclass: class of RR in host order, 1 is IN (for internet).
503 * @param result: the result data is returned in a newly allocated result
504 * structure. May be NULL on return, return value is set to an error
505 * in that case (out of memory).
506 * @return 0 if OK, else error.
508 int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype,
509 int rrclass, struct ub_result** result);
512 * Perform resolution and validation of the target name.
513 * Asynchronous, after a while, the callback will be called with your
514 * data and the result.
515 * @param ctx: context.
516 * If no thread or process has been created yet to perform the
517 * work in the background, it is created now.
518 * The context is finalized, and can no longer accept config changes.
519 * @param name: domain name in text format (a string).
520 * @param rrtype: type of RR in host order, 1 is A.
521 * @param rrclass: class of RR in host order, 1 is IN (for internet).
522 * @param mydata: this data is your own data (you can pass NULL),
523 * and is passed on to the callback function.
524 * @param callback: this is called on completion of the resolution.
526 * void callback(void* mydata, int err, struct ub_result* result)
527 * with mydata: the same as passed here, you may pass NULL,
528 * with err: is 0 when a result has been found.
529 * with result: a newly allocated result structure.
530 * The result may be NULL, in that case err is set.
532 * If an error happens during processing, your callback will be called
533 * with error set to a nonzero value (and result==NULL).
534 * @param async_id: if you pass a non-NULL value, an identifier number is
535 * returned for the query as it is in progress. It can be used to
537 * @return 0 if OK, else error.
539 int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype,
540 int rrclass, void* mydata, ub_callback_type callback, int* async_id);
543 * Cancel an async query in progress.
544 * Its callback will not be called.
546 * @param ctx: context.
547 * @param async_id: which query to cancel.
548 * @return 0 if OK, else error.
549 * This routine can return an error if the async_id passed does not exist
550 * or has already been delivered. If another thread is processing results
551 * at the same time, the result may be delivered at the same time and the
552 * cancel fails with an error. Also the cancel can fail due to a system
553 * error, no memory or socket failures.
555 int ub_cancel(struct ub_ctx* ctx, int async_id);
558 * Free storage associated with a result structure.
559 * @param result: to free
561 void ub_resolve_free(struct ub_result* result);
564 * Convert error value to a human readable string.
565 * @param err: error code from one of the libunbound functions.
566 * @return pointer to constant text string, zero terminated.
568 const char* ub_strerror(int err);
571 * Debug routine. Print the local zone information to debug output.
572 * @param ctx: context. Is finalized by the routine.
573 * @return 0 if OK, else error.
575 int ub_ctx_print_local_zones(struct ub_ctx* ctx);
578 * Add a new zone with the zonetype to the local authority info of the
580 * @param ctx: context. Is finalized by the routine.
581 * @param zone_name: name of the zone in text, "example.com"
582 * If it already exists, the type is updated.
583 * @param zone_type: type of the zone (like for unbound.conf) in text.
584 * @return 0 if OK, else error.
586 int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name,
587 const char *zone_type);
590 * Remove zone from local authority info of the library.
591 * @param ctx: context. Is finalized by the routine.
592 * @param zone_name: name of the zone in text, "example.com"
593 * If it does not exist, nothing happens.
594 * @return 0 if OK, else error.
596 int ub_ctx_zone_remove(struct ub_ctx* ctx, const char *zone_name);
599 * Add localdata to the library local authority info.
600 * Similar to local-data config statement.
601 * @param ctx: context. Is finalized by the routine.
602 * @param data: the resource record in text format, for example
603 * "www.example.com IN A 127.0.0.1"
604 * @return 0 if OK, else error.
606 int ub_ctx_data_add(struct ub_ctx* ctx, const char *data);
609 * Remove localdata from the library local authority info.
610 * @param ctx: context. Is finalized by the routine.
611 * @param data: the name to delete all data from, like "www.example.com".
612 * @return 0 if OK, else error.
614 int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data);
617 * Get a version string from the libunbound implementation.
618 * @return a static constant string with the version number.
620 const char* ub_version(void);
623 * Some global statistics that are not in struct stats_info,
624 * this struct is shared on a shm segment (shm-key in unbound.conf)
626 struct ub_shm_stat_info {
630 long long now_sec, now_usec;
631 long long up_sec, up_usec;
632 long long elapsed_sec, elapsed_usec;
643 long long dnscrypt_shared_secret;
644 long long dnscrypt_nonce;
649 /** number of qtype that is stored for in array */
650 #define UB_STATS_QTYPE_NUM 256
651 /** number of qclass that is stored for in array */
652 #define UB_STATS_QCLASS_NUM 256
653 /** number of rcodes in stats */
654 #define UB_STATS_RCODE_NUM 16
655 /** number of opcodes in stats */
656 #define UB_STATS_OPCODE_NUM 16
657 /** number of histogram buckets */
658 #define UB_STATS_BUCKET_NUM 40
659 /** number of RPZ actions */
660 #define UB_STATS_RPZ_ACTION_NUM 10
662 /** per worker statistics. */
663 struct ub_server_stats {
664 /** number of queries from clients received. */
665 long long num_queries;
666 /** number of queries that have been dropped/ratelimited by ip. */
667 long long num_queries_ip_ratelimited;
668 /** number of queries that had a cache-miss. */
669 long long num_queries_missed_cache;
670 /** number of prefetch queries - cachehits with prefetch */
671 long long num_queries_prefetch;
674 * Sum of the querylistsize of the worker for
675 * every query that missed cache. To calculate average.
677 long long sum_query_list_size;
678 /** max value of query list size reached. */
679 long long max_query_list_size;
681 /** Extended stats below (bool) */
685 long long qtype[UB_STATS_QTYPE_NUM];
686 /** bigger qtype values not in array */
689 long long qclass[UB_STATS_QCLASS_NUM];
690 /** bigger qclass values not in array */
691 long long qclass_big;
693 long long qopcode[UB_STATS_OPCODE_NUM];
694 /** number of queries over TCP */
696 /** number of outgoing queries over TCP */
697 long long qtcp_outgoing;
698 /** number of queries over (DNS over) TLS */
700 /** number of queries over (DNS over) HTTPS */
702 /** number of queries over IPv6 */
704 /** number of queries with QR bit */
706 /** number of queries with AA bit */
708 /** number of queries with TC bit */
710 /** number of queries with RD bit */
712 /** number of queries with RA bit */
714 /** number of queries with Z bit */
716 /** number of queries with AD bit */
718 /** number of queries with CD bit */
720 /** number of queries with EDNS OPT record */
722 /** number of queries with EDNS with DO flag */
725 long long ans_rcode[UB_STATS_RCODE_NUM];
726 /** answers with pseudo rcode 'nodata' */
727 long long ans_rcode_nodata;
728 /** answers that were secure (AD) */
729 long long ans_secure;
730 /** answers that were bogus (withheld as SERVFAIL) */
732 /** rrsets marked bogus by validator */
733 long long rrset_bogus;
734 /** number of queries that have been ratelimited by domain recursion. */
735 long long queries_ratelimited;
736 /** unwanted traffic received on server-facing ports */
737 long long unwanted_replies;
738 /** unwanted traffic received on client-facing ports */
739 long long unwanted_queries;
740 /** usage of tcp accept list */
741 long long tcp_accept_usage;
742 /** expired answers served from cache */
743 long long ans_expired;
744 /** histogram data exported to array
745 * if the array is the same size, no data is lost, and
746 * if all histograms are same size (is so by default) then
747 * adding up works well. */
748 long long hist[UB_STATS_BUCKET_NUM];
750 /** number of message cache entries */
751 long long msg_cache_count;
752 /** number of rrset cache entries */
753 long long rrset_cache_count;
754 /** number of infra cache entries */
755 long long infra_cache_count;
756 /** number of key cache entries */
757 long long key_cache_count;
759 /** number of queries that used dnscrypt */
760 long long num_query_dnscrypt_crypted;
761 /** number of queries that queried dnscrypt certificates */
762 long long num_query_dnscrypt_cert;
763 /** number of queries in clear text and not asking for the certificates */
764 long long num_query_dnscrypt_cleartext;
765 /** number of malformed encrypted queries */
766 long long num_query_dnscrypt_crypted_malformed;
767 /** number of queries which did not have a shared secret in cache */
768 long long num_query_dnscrypt_secret_missed_cache;
769 /** number of dnscrypt shared secret cache entries */
770 long long shared_secret_cache_count;
771 /** number of queries which are replays */
772 long long num_query_dnscrypt_replay;
773 /** number of dnscrypt nonces cache entries */
774 long long nonce_cache_count;
775 /** number of queries for unbound's auth_zones, upstream query */
776 long long num_query_authzone_up;
777 /** number of queries for unbound's auth_zones, downstream answers */
778 long long num_query_authzone_down;
779 /** number of times neg cache records were used to generate NOERROR
781 long long num_neg_cache_noerror;
782 /** number of times neg cache records were used to generate NXDOMAIN
784 long long num_neg_cache_nxdomain;
785 /** number of queries answered from edns-subnet specific data */
786 long long num_query_subnet;
787 /** number of queries answered from edns-subnet specific data, and
788 * the answer was from the edns-subnet cache. */
789 long long num_query_subnet_cache;
790 /** number of bytes in the stream wait buffers */
791 long long mem_stream_wait;
792 /** number of bytes in the HTTP2 query buffers */
793 long long mem_http2_query_buffer;
794 /** number of bytes in the HTTP2 response buffers */
795 long long mem_http2_response_buffer;
796 /** number of TLS connection resume */
797 long long qtls_resume;
798 /** RPZ action stats */
799 long long rpz_action[UB_STATS_RPZ_ACTION_NUM];
803 * Statistics to send over the control pipe when asked
804 * This struct is made to be memcopied, sent in binary.
805 * shm mapped with (number+1) at num_threads+1, with first as total
807 struct ub_stats_info {
808 /** the thread stats */
809 struct ub_server_stats svr;
811 /** mesh stats: current number of states */
812 long long mesh_num_states;
813 /** mesh stats: current number of reply (user) states */
814 long long mesh_num_reply_states;
815 /** mesh stats: number of reply states overwritten with a new one */
816 long long mesh_jostled;
817 /** mesh stats: number of incoming queries dropped */
818 long long mesh_dropped;
819 /** mesh stats: replies sent */
820 long long mesh_replies_sent;
821 /** mesh stats: sum of waiting times for the replies */
822 long long mesh_replies_sum_wait_sec, mesh_replies_sum_wait_usec;
823 /** mesh stats: median of waiting times for replies (in sec) */
824 double mesh_time_median;
831 #endif /* _UB_UNBOUND_H */