Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NetBSD/external/bsd/unbound/dist/testdata/iter_emptydp.rpl

275 lines
7.4 KiB
Plaintext
Raw Permalink Normal View History

Import unbound 1.5.9
2016-08-20 14:08:26 +03:00
; config options
; The island of trust is at example.com
server:
trust-anchor: "example.com. 3600 IN DS 2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
val-override-date: "20070916134226"
target-fetch-policy: "3 2 1 0 0" # make sure it fetches for test
Import unbound-1.7.3 19 June 2018: Wouter - Fix for unbound-control on Windows and set TCP socket parameters more closely. - Fix windows unbound-control no cert bad file descriptor error. 18 June 2018: Wouter - Fix that control-use-cert: no works for 127.0.0.1 to disable certs. - Fix unbound-checkconf for control-use-cert. 15 June 2018: Wouter - tag for 1.7.3rc1. 14 June 2018: Wouter - #4103: Fix that auth-zone does not insist on SOA record first in file for url downloads. - Fix that first control-interface determines if TLS is used. Warn when IP address interfaces are used without TLS. - Fix nettle compile. 12 June 2018: Ralph - Don't count CNAME response types received during qname minimisation as query restart. 12 June 2018: Wouter - #4102 for NSD, but for Unbound. Named unix pipes do not use certificate and key files, access can be restricted with file and directory permissions. The option control-use-cert is no longer used, and ignored if found in unbound.conf. - Rename tls-additional-ports to tls-additional-port, because every line adds one port. - Fix buffer size warning in unit test. - remade dependencies in the Makefile. 6 June 2018: Wouter - Patch to fix openwrt for mac os build darwin detection in configure. 5 June 2018: Wouter - Fix crash if ratelimit taken into use with unbound-control instead of with unbound.conf. 4 June 2018: Wouter - Fix deadlock caused by incoming notify for auth-zone. - tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018, trunk is 1.7.3 in development from this point. - #4100: Fix stub reprime when it becomes useless. 1 June 2018: Wouter - Rename additional-tls-port to tls-additional-ports. The older name is accepted for backwards compatibility. 30 May 2018: Wouter - Patch from Syzdek: Add ability to ignore RD bit and treat all requests as if the RD bit is set. 29 May 2018: Wouter - in compat/arc4random call getentropy_urandom when getentropy fails with ENOSYS. - Fix that fallback for windows port. 28 May 2018: Wouter - Fix windows tcp and tls spin on events. - Add routine from getdns to add windows cert store to the SSL_CTX. - tls-win-cert option that adds the system certificate store for authenticating DNS-over-TLS connections. It can be used instead of the tls-cert-bundle option, or with it to add certificates. 25 May 2018: Wouter - For TCP and TLS connections that don't establish, perform address update in infra cache, so future selections can exclude them. - Fix that tcp sticky events are removed for closed fd on windows. - Fix close events for tcp only. 24 May 2018: Wouter - Fix that libunbound can do DNS-over-TLS, when configured. - Fix that windows unbound service can use DNS-over-TLS. - unbound-host initializes ssl (for potential DNS-over-TLS usage inside libunbound), when ssl upstream or a cert-bundle is configured. 23 May 2018: Wouter - Use accept4 to speed up incoming TCP (and TLS) connections, available on Linux, FreeBSD and OpenBSD. 17 May 2018: Ralph - Qname minimisation default changed to yes. 15 May 2018: Wouter - Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand. 11 May 2018: Wouter - Fix contrib/libunbound.pc for libssl libcrypto references, from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914 7 May 2018: Wouter - Fix windows to not have sticky TLS events for TCP. - Fix read of DNS over TLS length and data in one read call. - Fix mesh state assertion failure due to callback removal. 3 May 2018: Wouter - Fix that configure --with-libhiredis also turns on cachedb. - Fix gcc 8 buffer warning in testcode. - Fix function type cast warning in libunbound context callback type. 2 May 2018: Wouter - Fix fail to reject dead peers in forward-zone, with ssl-upstream. 1 May 2018: Wouter - Fix that unbound-control reload frees the rrset keys and returns the memory pages to the system. 30 April 2018: Wouter - Fix spelling error in man page and note defaults as no instead of off. 26 April 2018: Wouter - Fix for crash in daemon_cleanup with dnstap during reload, from Saksham Manchanda. - Also that for dnscrypt. - tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk is from here 1.7.2 in development. 25 April 2018: Ralph - Fix memory leak when caching wildcard records for aggressive NSEC use 24 April 2018: Wouter - Fix contrib/fastrpz.patch for this release. - Fix auth https for libev. 24 April 2018: Ralph - Added root-key-sentinel support 23 April 2018: Wouter - makedist uses bz2 for expat code, instead of tar.gz. - Fix #4092: libunbound: use-caps-for-id lacks colon in config_set_option. - auth zone http download stores exact copy of downloaded file, including comments in the file. - Fix sldns parse failure for CDS alternate delete syntax empty hex. - Attempt for auth zone fix; add of callback in mesh gets from callback does not skip callback of result. - Fix cname classification with qname minimisation enabled. - list_auth_zones unbound-control command. 20 April 2018: Wouter - man page documentation for dns-over-tls forward-addr '#' notation. - removed free from failed parse case. - Fix #4091: Fix that reload of auth-zone does not merge the zonefile with the previous contents. - Delete auth zone when removed from config. 19 April 2018: Wouter - Can set tls authentication with forward-addr: IP#tls.auth.name And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem". such as forward-addr: 9.9.9.9@853#dns.quad9.net or 1.1.1.1@853#cloudflare-dns.com - Fix #658: unbound using TLS in a forwarding configuration does not verify the server's certificate (RFC 8310 support). - For addr with #authname and no @port notation, the default is 853. 18 April 2018: Wouter - Fix auth-zone retry timer to be on schedule with retry timeout, with backoff. Also time a refresh at the zone expiry. 17 April 2018: Wouter - auth zone notify work. - allow-notify: config statement for auth-zones. - unit test for allow-notify 16 April 2018: Wouter - Fix auth zone target lookup iterator. - auth zone notify with prefix - auth zone notify work. 13 April 2018: Wouter - Fix for max include depth for authzones. - Fix memory free on fail for $INCLUDE in authzone. - Fix that an internal error to look up the wrong rr type for auth zone gets stopped, before trying to send there. - auth zone notify work. 10 April 2018: Ralph - num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN statistics counters. 10 April 2018: Wouter - documentation for low-rtt and low-rtt-pct. - auth zone notify work. 9 April 2018: Wouter - Fix that flush_zone sets prefetch ttl expired, so that with serve-expired enabled it'll start prefetching those entries. - num.query.authzone.up and num.query.authzone.down statistics counters. - Fix downstream auth zone, only fallback when auth zone fails to answer and fallback is enabled. - Accept both option names with and without colon for get_option and set_option. - low-rtt and low-rtt-pct in unbound.conf enable the server selection of fast servers for some percentage of the time. 5 April 2018: Wouter - Combine write of tcp length and tcp query for dns over tls. - nitpick fixes in example.conf. - Fix above stub queries for type NS and useless delegation point. - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3 tls_choose_sigalg routine does not allow the ciphers for the pipe, so use TLSv1.2. - ED448 support. 3 April 2018: Wouter - Fix #4043: make test fails due to v6 presentation issue in macOS. - Fix unable to resolve after new WLAN connection, due to auth-zone failing with a forwarder set. Now, auth-zone is only used for answers (not referrals) when a forwarder is set. 29 March 2018: Ralph - Check "result" in dup_all(), by Florian Obser. 23 March 2018: Ralph - Fix unbound-control get_option aggressive-nsec 21 March 2018: Ralph - Do not use cached NSEC records to generate negative answers for domains under DNSSEC Negative Trust Anchors. 19 March 2018: Wouter - iana port update. 16 March 2018: Wouter - corrected a minor typo in the changelog. - move htobe64/be64toh portability code to cachedb.c. 15 March 2018: Wouter - Add --with-libhiredis, unbound support for a new cachedb backend that uses a Redis server as the storage. This implementation depends on the hiredis client library (https://redislabs.com/lp/hiredis/). And unbound should be built with both --enable-cachedb and --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h should exist). Patch from Jinmei Tatuya (Infoblox). - Fix #3817: core dump happens in libunbound delete, when queued servfail hits deleted message queue. - Create additional tls service interfaces by opening them on other portnumbers and listing the portnumbers as additional-tls-port: nr. 13 March 2018: Wouter - Fix typo in documentation. - Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually flushed with serve-expired on. 12 March 2018: Wouter - Added documentation for aggressive-nsec: yes. - tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk now has 1.7.1 in development. - Fix #3727: Protocol name is TLS, options have been renamed but documentation is not consistent. - Check IXFR start serial. 9 March 2018: Wouter - Fix #3598: Fix swig build issue on rhel6 based system. configure --disable-swig-version-check stops the swig version check. 8 March 2018: Wouter - tag 1.7.0rc2. 7 March 2018: Wouter - Fixed contrib/fastrpz.patch, even though this already applied cleanly for me, now also for others. - patch to log creates keytag queries, from A. Schulze. - patch suggested by Debian lintian: allow to -> allow one to, from A. Schulze. - Attempt to remove warning about trailing whitespace. 6 March 2018: Wouter - Reverted fix for #3512, this may not be the best way forward; although it could be changed at a later time, to stay similar to other implementations. - svn trunk contains 1.7.0, this is the number for the next release. - Fix for windows compile. - tag 1.7.0rc1. 5 March 2018: Wouter - Fix to check define of DSA for when openssl is without deprecated. - iana port update. - Fix #3582: Squelch address already in use log when reuseaddr option causes same port to be used twice for tcp connections. 27 February 2018: Wouter - Fixup contrib/fastrpz.patch so that it applies. - Fix compile without threads, and remove unused variable. - Fix compile with staticexe and python module. - Fix nettle compile. 22 February 2018: Ralph - Save wildcard RRset from answer with original owner for use in aggressive NSEC. 21 February 2018: Wouter - Fix #3512: unbound incorrectly reports SERVFAIL for CAA query when there is a CNAME loop. - Fix validation for CNAME loops. When it detects a cname loop, by finding the cname, cname in the existing list, it returns the partial result with the validation result up to then. - more robust cachedump rrset routine. 19 February 2018: Wouter - Fix #3505: Documentation for default local zones references wrong RFC. - Fix #3494: local-zone noview can be used to break out of the view to the global local zone contents, for queries for that zone. - Fix for more maintainable code in localzone. 16 February 2018: Wouter - Fixes for clang static analyzer, the missing ; in edns-subnet/addrtree.c after the assert made clang analyzer produce a failure to analyze it. 13 February 2018: Ralph - Aggressive NSEC tests 13 February 2018: Wouter - tls-cert-bundle option in unbound.conf enables TLS authentication. - iana port update. 12 February 2018: Wouter - Unit test for auth zone https url download. 12 February 2018: Ralph - Added tests with wildcard expanded NSEC records (CVE-2017-15105 test) - Processed aggressive NSEC code review remarks Wouter 8 February 2018: Ralph - Aggressive use of NSEC implementation. Use cached NSEC records to generate NXDOMAIN, NODATA and positive wildcard answers. 8 February 2018: Wouter - iana port update. - auth zone url config. 5 February 2018: Wouter - Fix #3451: dnstap not building when you have a separate build dir. And removed protoc warning, set dnstap.proto syntax to proto2. - auth-zone provides a way to configure RFC7706 from unbound.conf, eg. with auth-zone: name: "." for-downstream: no for-upstream: yes fallback-enabled: yes and masters or a zonefile with data. 2 February 2018: Wouter - Fix unfreed locks in log and arc4random at exit of unbound. - unit test with valgrind - Fix lock race condition in dns cache dname synthesis. - lock subnet new item before insertion to please checklocks, no modification of critical regions outside of lock region. 1 February 2018: Wouter - fix unaligned structure making a false positive in checklock unitialised memory. 29 January 2018: Ralph - Use NSEC with longest ce to prove wildcard absence. - Only use *.ce to prove wildcard absence, no longer names. 25 January 2018: Wouter - ltrace.conf file for libunbound in contrib. 23 January 2018: Wouter - Fix that unbound-checkconf -f flag works with auto-trust-anchor-file for startup scripts to get the full pathname(s) of anchor file(s). - Print fatal errors about remote control setup before log init, so that it is printed to console. 22 January 2018: Wouter - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is also recognized and means the same. Also for tls-port, tls-service-key, tls-service-pem, stub-tls-upstream and forward-tls-upstream. - Fix #3397: Fix that cachedb could return a partial CNAME chain. - Fix #3397: Fix that when the cache contains an unsigned DNAME in the middle of a cname chain, a result without the DNAME could be returned.
2018-09-03 17:08:55 +03:00
qname-minimisation: "no"
Unbound 1.6.8 Download: unbound-1.6.8.tar.gz SHA1 checksum: 492737be9647c26ee39d4d198f2755062803b412 SHA256 checksum: e3b428e33f56a45417107448418865fe08d58e0e7fea199b855515f60884dd49 PGP signature: unbound-1.6.8.tar.gz.asc Date: 19 Jan, 2018 Bug Fixes Fix for CVE-2017-15105: vulnerability in the processing of wildcard synthesized NSEC records. Older versions Unbound 1.6.7 Download: unbound-1.6.7.tar.gz SHA1 checksum: 098f8acfc3e9d1cab54f07863e61eabbb67c80dc SHA256 checksum: 4e7bd43d827004c6d51bef73adf941798e4588bdb40de5e79d89034d69751c9f PGP signature: unbound-1.6.7.tar.gz.asc Date: 10 Oct, 2017 Features Set trust-anchor-signaling default to yes #1440: [dnscrypt] client nonce cache. #1435: Allow UDP to be disabled separately upstream and downstream. Bug Fixes Fix that looping modules always stop the query, and don't pass control. Fix unbound-host to report error for DNSSEC state of failed lookups. Spelling fixes, from Josh Soref. Fix #1400: allowing use of global cache on ECS-forwarding unless always-forward. use a cachedb answer even if it's "expired" when serve-expired is yes (patch from Jinmei Tatuya). trigger refetching of the answer in that case (this will bypass cachedb lookup) allow storing a 0-TTL answer from cachedb in the in-memory message cache when serve-expired is yes Fix DNSCACHE_STORE_ZEROTTL to be bigger than 0xffff. Log name of looping module Fix #1450: Generate again patch contrib/aaaa-filter-iterator.patch (by Danilo G. Baio). Fix param unused warning for windows exportsymbol compile. Use RCODE from A query on DNS64 synthesized answer. Fix trust-anchor-signaling works in libunbound. Fix spelling in unbound-control man page. Unbound 1.6.6 Download: unbound-1.6.6.tar.gz SHA1 checksum: d205c03a402f5d900d5bad3d036849a12804a49e SHA256 checksum: 972b14dc33093e672652a7b2b5f159bab2198b0fe9c9e1c5707e1895d4d4b390 PGP signature: unbound-1.6.6.tar.gz.asc Date: 18 Sep, 2017 Features unbound-control dump_infra prints port number for address if not 53. Fix #1344: RFC6761-reserved domains: test. and invalid. Fix #1349: allow suppression of pidfiles (from Daniel Kahn Gillmor). With the -p option unbound does not create a pidfile. Added stats for queries that have been ratelimited by domain recursion. Patch to show DNSCrypt status in help output, from Carsten Strotmann. Fix #1407: Add ECS options check to unbound-checkconf. Fix #1415: [dnscrypt] shared secret cache, patch from Manu Bretelle. Bug Fixes fixup of dnscrypt_cert_chacha test (from Manu Bretelle). First fix for zero b64 and hex text zone format in sldns. Better fixup of dnscrypt_cert_chacha test for different escapes. Fix that infra cache host hash does not change after reconfig. Fix python example0 return module wait instead of error for pass. enhancement for hardened-tls for DNS over TLS. Removed duplicated security settings. Fix for unbound-checkconf, check ipsecmod-hook if ipsecmod is turned on. Fix #1331: libunbound segfault in threaded mode when context is deleted. Fix pythonmod link line option flag. Fix openssl 1.1.0 load of ssl error strings from ssl init. Fix 1332: Bump verbosity of failed chown'ing of the control socket. Redirect all localhost names to localhost address for RFC6761. Fix #1350: make cachedb backend configurable (from JINMEI Tatuya). Fix tests to use .tdir (from Manu Bretelle) instead of .tpkg. upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02), config.sub(2016-09-05). annotate case statement fallthrough for gcc 7.1.1. flex output from flex 2.6.1. snprintf of thread number does not warn about truncated string. squelch TCP fast open error on FreeBSD when kernel has it disabled, unless verbosity is high. remove warning from windows compile. Fix compile with libnettle Fix DSA configure switch (--disable dsa) for libnettle and libnss. Fix #1365: Add Ed25519 support using libnettle. Fix #1394: mix of serve-expired and response-ip could cause a crash. Remove unused iter_env member (ip6arpa_dname) Do not reset rrset.bogus stats when called using stats_noreset. Do not add rrset_bogus and query ratelimiting stats per thread, these module stats are global. Fix #1397: Recursive DS lookups for AS112 zones names should recurse. Fix #1398: make cachedb secret configurable. Remove spaces from Makefile. Fix issue on macOX 10.10 where TCP fast open is detected but not implemented causing TCP to fail. The fix allows fallback to regular TCP in this case and is also more robust for cases where connectx() fails for some reason. Fix #1402: squelch invalid argument error for fd_set_block on windows. Fix to reclaim tcp handler when it is closed due to dnscrypt buffer allocation failure. Fix #1415: patch to free dnscrypt environment on reload. iana portlist update Small fixes for the shared secret cache patch. Fix WKS records on kvm autobuild host, with default protobyname entries for udp and tcp. Fix #1414: fix segfault on parse failure and log_replies. zero qinfo in handle_request, this zeroes local_alias and also the qname member. new keys and certs for dnscrypt tests. fixup WKS test on buildhost without servicebyname. updated contrib/fastrpz.patch to apply with configparser changes. Fix 1416: qname-minimisation breaks TLSA lookups with CNAMEs. Fix #1424: cachedb:testframe is not thread safe. Fix #1417: [dnscrypt] shared secret cache counters, and works when dnscrypt is not enabled. And cache size configuration option. Fix #1418: [ip ratelimit] initialize slabhash using ip-ratelimit-slabs. Recommend 1472 buffer size in unbound.conf Fix #1412: QNAME minimisation strict mode not honored Fix #1434: Fix windows openssl 1.1.0 linking. Add dns64 for client-subnet in unbound-checkconf. Unbound 1.6.5 Download: unbound-1.6.5.tar.gz SHA1 checksum: ecb260b94d139d84fae2bff80f9701f53a329e26 SHA256 checksum: e297aa1229015f25bf24e4923cb1dadf1f29b84f82a353205006421f82cc104e PGP signature: unbound-1.6.5.tar.gz.asc Date: 21 Aug, 2017 Bug Fixes Fix install of trust anchor when two anchors are present, makes both valid. Checks hash of DS but not signature of new key. This fixes the root.key file if created when unbound is installed between sep11 and oct11 2017. Unbound 1.6.4 Download: unbound-1.6.4.tar.gz SHA1 checksum: 836ecc48518b9159f600a738c276423ef1f95021 SHA256 checksum: df0a88816ec31ccb8284c9eb132e1166fbf6d9cde71fbc4b8cd08a91ee777fed PGP signature: unbound-1.6.4.tar.gz.asc Date: 27 Jun, 2017 Features Implemented trust anchor signaling using key tag query. unbound-checkconf -o allows query of dnstap config variables. Also unbound-control get_option. Also for dnscrypt. unbound.h exports the shm stats structures. They use type long long and no ifdefs, and ub_ before the typenames. Implemented opportunistic IPsec support module (ipsecmod). Added redirect-bogus.patch to contrib directory. Support for the ED25519 algorithm with openssl (from openssl 1.1.1). renumbering B-Root's IPv6 address to 2001:500:200::b. Fix #1276: [dnscrypt] add XChaCha20-Poly1305 cipher. Fix #1277: disable domain ratelimit by setting value to 0. Added fastrpz patch to contrib Bug Fixes Added ECS unit test (from Manu Bretelle). ECS documentation fix (from Manu Bretelle). Fix #1252: more indentation inconsistencies. Fix #1253: unused variable in edns-subnet/addrtree.c:getbit(). Fix #1254: clarify ratelimit-{for,below}-domain (from Manu Bretelle). iana portlist update Based on #1257: check parse limit before t increment in sldns RR string parse routine. Fix #1258: Windows 10 X64 unbound 1.6.2 service will not start. and fix that 64bit getting installed in C:\Program Files (x86). Fix #1259: "--disable-ecdsa" argument overwritten by "#ifdef SHA256_DIGEST_LENGTH@daemon/remote.c". iana portlist update Added test for leak of stub information. Fix sldns wire2str printout of RR type CAA tags. Fix sldns int16_data parse. Fix sldns parse and printout of TSIG RRs. sldns SMIMEA and AVC definitions, same as getdns definitions. Fix tcp-mss failure printout text. Set SO_REUSEADDR on outgoing tcp connections to fix the bind before connect limited tcp connections. With the option tcp connections can share the same source port (for different destinations). Add 'c' to getopt() in testbound. Adjust servfail by iterator to not store in cache when serve-expired is enabled, to avoid overwriting useful information there. Fix queries for nameservers under a stub leaking to the internet. document trust-anchor-signaling in example config file. updated configure, dependencies and flex output. better module memory lookup, fix of unbound-control shm names for module memory printout of statistics. Fix type AVC sldns rrdef. Some whitespace fixup. Fix #1265: contrib/unbound.service contains hardcoded path. Fix #1265 to use /bin/kill. Fix #1267: Libunbound validator/val_secalgo.c uses obsolete APIs, and compatibility with BoringSSL. Fix #1268: SIGSEGV after log_reopen. exec_prefix is by default equal to prefix. printout localzone for duplicate local-zone warnings. Fix assertion for low buffer size and big edns payload when worker overrides udpsize. Support for openssl EVP_DigestVerify. Fix #1269: inconsistent use of built-in local zones with views. Add defaults for new local-zone trees added to views using unbound-control. Fix #1273: cachedb.c doesn't compile with -Wextra. If MSG_FASTOPEN gives EPIPE fallthrough to try normal tcp write. Also use global local-zones when there is a matching view that does not have any local-zone specified. Fix fastopen EPIPE fallthrough to perform connect. Fix #1274: automatically trim chroot path from dnscrypt key/cert paths (from Manu Bretelle). Fix #1275: cached data in cachedb is never used. Fix that unbound-control can set val_clean_additional and val_permissive_mode. Add dnscrypt XChaCha20 tests. Detect chacha for dnscrypt at configure time. dnscrypt unit tests with chacha. Added domain name based ECS whitelist. Fix #1278: Incomplete wildcard proof. Fix #1279: Memory leak on reload when python module is enabled. Fix #1280: Unbound fails assert when response from authoritative contains malformed qname. When 0x20 caps-for-id is enabled, when assertions are not enabled the malformed qname is handled correctly. More fixes in depth for buffer checks in 0x20 qname checks. Fix stub zone queries leaking to the internet for harden-referral-path ns checks. Fix query for refetch_glue of stub leaking to internet. Fix #1301: memory leak in respip and tests. Free callback in edns-subnetmod on exit and restart. Fix memory leak in sldns_buffer_new_frm_data. Fix memory leak in dnscrypt config read. Fix dnscrypt chacha cert support ifdefs. Fix dnscrypt chacha cert unit test escapes in grep. Fix to unlock view in view test. Fix warning in pythonmod under clang compiler. Fix lintian typo. Fix #1316: heap read buffer overflow in parse_edns_options. Unbound 1.6.3 Download: unbound-1.6.3.tar.gz SHA1 checksum: 4477627c31e8728058565f3bae3a12a1544d8a9c SHA256 checksum: 4c7e655c1d0d2d133fdeb81bc1ab3aa5c155700f66c9f5fb53fa6a5c3ea9845f PGP signature: unbound-1.6.3.tar.gz.asc Date: 13 Jun, 2017 Bug Fixes Fix #1280: Unbound fails assert when response from authoritative contains malformed qname. When 0x20 caps-for-id is enabled, when assertions are not enabled the malformed qname is handled correctly. Unbound 1.6.2 Download: unbound-1.6.2.tar.gz SHA1 checksum: de370b1ac8e260db9c4c1504453752713dd8818f SHA256 checksum: 1a323d72c32180b7141c9e6ebf199fc68a0208dfebad4640cd2c4c27235e3b9c PGP signature: unbound-1.6.2.tar.gz.asc Date: 24 Apr, 2017 Features Add trustanchor.unbound CH TXT that gets a response with a number of TXT RRs with a string like "example.com. 2345 1234" with the trust anchors and their keytags. Patch for view functionality for local-data-ptr from Björn Ketelaars. Response actions based on IP address from Jinmei Tatuya (Infoblox). Patch from Luiz Fernando Softov for Stats Shared Memory. unbound-control stats_shm command prints stats using shared memory, which uses less cpu. --disable-sha1 disables SHA1 support in RRSIG, so from DNSKEY and DS records. NSEC3 is not disabled. #1217. DNSCrypt support, with --enable-dnscrypt, libsodium and then enabled in the config file from Manu Bretelle. Merge EDNS Client subnet implementation from feature branch into main branch, using new EDNS processing framework. harden-algo-downgrade: no also makes unbound more lenient about digest algorithms in DS records. Bug Fixes sldns has ED25519 and ED448 algorithm number and name for display. sldns updated for vfixed and buffer resize indication from getdns. iana portlist update Fix #1224: Fix that defaults should not fall back to "Program Files (x86) if Unbound is 64bit by default on windows. Fix doc/CNAME-basedRedirectionDesignNotes.pdf zone static to redirect. make depend, autoconf, doxygen and lint fixed up. include sys/time.h for new shm code on NetBSD. Fix #1227: Fix that Unbound control allows weak ciphersuits. Fix #1226: provide official 32bit binary for windows. For #1227: if we have sha256, set the cipher list to have no known vulns. Fix testpkts.c, check if DO bit is set, not only if there is an OPT record. Fix #1229: Systemd service sandboxing in contrib/unbound.service. Fix #1230: swig version 2.0.1 is required for pythonmod, with 1.3.40 it crashes when running repeatly unbound-control reload. fix enum conversion warnings fake-sha1 test option; print warning if used. To make unit tests. unbound-control list local zone and data commands listed in the help output. Fix #1234: shortening DNAME loop produces duplicate DNAME records in ANSWER section. testbound understands Deckard MATCH rcode question answer commands. Fix #1235: Fix too long DNAME expansion produces SERVFAIL instead of YXDOMAIN + query loop, reported by Petr Spacek. Fix that SHM is not inited if not enabled. Fix that looped DNAMEs do not cause unbound to spend effort. trustanchor tags are sorted. reusable routine to fetch taglist. Fix #1237 - Wrong resolving in chain, for norec queries that get SERVFAIL returned. make depend, autoconf, remove warnings about statement before var. lru_demote and lruhash_insert_or_retrieve functions for getdns. fixup for lruhash (whitespace and header file comment). dnscrypt tests. Fix doxygen for dnscrypt files. Fix #1238: segmentation fault when adding through the remote interface a per-view local zone to a view with no previous (configured) local zones. Fix #1229: Systemd service sandboxing, options in wrong sections. Fix #1239: configure fails to find python distutils if python prints warning. Fix to prevent non-referal query from being cached as referal when the no_cache_store flag was set. Remove (now unused) event2 include from dnscrypt code. Fix #1217: Add metrics to unbound-control interface showing crypted, cert request, plaintext and malformed queries (from Manu Bretelle). Do not add current time twice to TTL before ECS cache store. Do not touch rrset cache after ECS cache message generation. Use LDNS_EDNS_CLIENT_SUBNET as default ECS opcode. Fix #1244: document that use of chroot requires trust anchor file to be under chroot. Small fixup for documentation. Fix respip for braces when locks arent used. Fix pythonmod for cb changes. Generalise inplace callback (de)registration (de)register inplace callbacks for module id No unbound-control set_option for ECS options Deprecated client-subnet-opcode config option Introduced client-subnet-always-forward config option Changed max-client-subnet-ipv6 default to 56 (as in RFC) Removed extern ECS config options module_restart_next now calls clear on all following modules Also create ECS module qstate on module_event_pass event remove malloc from inplace_cb_register Unlock view in respip unit test Some whitespace fixup. Remove ECS option after REFUSED answer. Fix small memory leak in edns_opt_copy_alloc. Respip dereference after NULL check. Zero initialize addrtree allocation. Use correct identifier for SHM destroy. Display ECS module memory usage. Fix #1247: unbound does not shorten source prefix length when forwarding ECS. Properly check for allocation failure in local_data_find_tag_datas. Fix #1249: unbound doesn't return FORMERR to bogus ECS. Set SHM ECS memory usage to 0 when module not loaded. subnet mem value is available in shm, also when not enabled, to make the struct easier to memmap by other applications, independent of the configuration of unbound. Fix #1250: inconsistent indentation in services/listen_dnsport.c. Unbound 1.6.1 Download: unbound-1.6.1.tar.gz SHA1 checksum: 41369fcfd37844b02b7293b37ec78e69f0db34c7 SHA256 checksum: 42df63f743c0fe8424aeafcf003ad4b880b46c14149d696057313f5c1ef51400 PGP signature: unbound-1.6.1.tar.gz.asc Date: 21 Feb, 2017 Features configure --enable-systemd and lets unbound use systemd sockets if you enable use-systemd: yes in unbound.conf. Also there are contrib/unbound.socket and contrib/unbound.service: systemd files for unbound, install them in /usr/lib/systemd/system. Contributed by Sami Kerola and Pavel Odintsov. [bugzilla: 1187 ] Source IP rate limiting, patch from Larissa Feng. [bugzilla: 1184 ] Log DNS replies. This includes the same logging information that DNS queries and response code and response size, patch from Larissa Feng. Include root trust anchor id 20326 in unbound-anchor. 64bit is default for windows builds. Bug Fixes [bugzilla: 1176 ] Fix stack size too small for Alpine Linux. Fix unbound-control and ipv6 only. [bugzilla: 1182 ] Fix Resource leak (socket), at startup. [bugzilla: 1178 ] Fix attempt to fix setup error at end, pop result values at end of install. iana portlist update Fix inet_ntop and inet_pton warnings in windows compile. [bugzilla: 1191 ] Fix remove comment about view deletion. [bugzilla: 1188 ] Fix unresolved symbol 'fake_dsa' in libunbound.so when built with Nettle [bugzilla: 1190 ] Fix to not echo back EDNS options in local-zone error response. [bugzilla: 1194 ] Fix if cross build fails when $host isn't `uname` for getentropy. Fix reload chdir failure when also chrooted to that directory. Fix to return formerr for queries for meta-types, to avoid packet amplification if this meta-type is sent on to upstream. [bugzilla: 1201 ] Fix missing unlock in answer_from_cache error condition. [bugzilla: 1202 ] Fix code comment that packed_rrset_data is not always 'packed'. Fix to also block meta types 128 through to 248 with formerr. [bugzilla: 1206 ] Fix that some view-related commands are missing from 'unbound-control -h' Fix to rename ub_callback_t to ub_callback_type, because POSIX reserves _t typedefs. Fix to rename internally used types from _t to _type, because _t type names are reserved by POSIX. Increase MAX_MODULE to 16. [bugzilla: 1211 ] Fix can't enable interface-automatic if no IPv6 with more helpful error message. fix root_anchor test for updated icannbundle.pem lower certificates. Fix compile on solaris of the fix to use $host detect. Fix for type name change and fix warning on windows compile. Fix pythonmod for typedef changes. Fix dnstap for warning of set but not used. Fix autoconf of systemd check for lack of pkg-config. Unbound 1.6.0 Download: unbound-1.6.0.tar.gz SHA1 checksum: 9b7606b016b447dc837efc108cee94f3fecf4ede SHA256 checksum: 6b7db874e6debda742fee8869d722e5a17faf1086e93c911b8564532aeeffab7 PGP signature: unbound-1.6.0.tar.gz.asc Date: 15 Dec, 2016 Features Added generic EDNS code for registering known EDNS option codes, bypassing the cache response stage and uniquifying mesh states. Four EDNS option lists were added to module_qstate (module_qstate.edns_opts_*) to store EDNS options from/to front/back side. Added two flags to module_qstate (no_cache_lookup, no_cache_store) that control the modules' cache interactions. Added code for registering inplace callback functions. The registered functions can be called just before replying with local data or Chaos, replying from cache, replying with SERVFAIL, replying with a resolved query, sending a query to a nameserver. The functions can inspect the available data and maybe change response/query related data (i.e. append EDNS options). Updated Python module for the above. Updated Python documentation. Added views functionality. Added qname-minimisation-strict config option. Patch that resolves CNAMEs entered in local-data conf statements that point to data on the internet, from Jinmei Tatuya (Infoblox). serve-expired config option: serve expired responses with TTL 0. .gitattributes line for githubs code language display. log-identity: config option to set sys log identity, patch from "Robin H. Johnson" (robbat2@gentoo.org). Added stub-ssl-upstream and forward-ssl-upstream options. Added local-zones and local-data bulk addition and removal functionality in unbound-control (local_zones, local_zones_remove, local_datas and local_datas_remove). Bug Fixes Fix #836: unbound could echo back EDNS options in an error response. Fix #838: 1.5.10 cannot be built on Solaris, undefined PATH_MAX. Fix #839: Memory grows unexpectedly with large RPZ files. Fix #840: infinite loop in unbound_munin_ plugin on unowned lockfile. Fix #841: big local-zone's make it consume large amounts of memory. Fix dnstap relaying "random" messages instead of resolver/forwarder responses, from Nikolay Edigaryev. Fix Nits for 1.5.10 reported by Dag-Erling Smorgrav. Fix #1117: spelling errors, from Robert Edmonds. iana portlist update. fix memoryleak logfile when in debug mode. Re-fix #839 from view commit overwrite. Fixup const void cast warning. Removed patch comments from acllist.c and msgencode.c Added documentation doc/CNAME-basedRedirectionDesignNotes.pdf, from Jinmei Tatuya (Infoblox). Fix #1125: unbound could reuse an answer packet incorrectly for clients with different EDNS parameters, from Jinmei Tatuya. Fix #1118: libunbound.pc sets strange Libs, Libs.private values. Added Requires line to libunbound.pc Fix #1130: whitespace in example.conf.in more consistent. suppress compile warning in lex files. init lzt variable, for older gcc compiler warnings. fix --enable-dsa to work, instead of copying ecdsa enable. Fix DNSSEC validation of query type ANY with DNAME answers. Fixup query_info local_alias init. Ported tests for local_cname unit test to testbound framework. g.root-servers.net has AAAA address. Fix #1134: unbound-control set_option -- val-override-date: -1 works immediately to ignore datetime, or back to 0 to enable it again. The -- is to ignore the '-1' as an option flag. Patch for server.num.zero_ttl stats for count of expired replies, from Pavel Odintsov. Fix failure to build on arm64 with no sbrk. Set OpenSSL security level to 0 when using aNULL ciphers. configure detects ssl security level API function in the autoconf manner. Every function on its own, so that other libraries (eg. LibreSSL) can develop their API without hindrance. Fix #1154: segfault when reading config with duplicate zones. Note that for harden-below-nxdomain the nxdomain must be secure, this means nsec3 with optout is insufficient. Fix #1155: test status code of unbound-control in 04-checkconf, not the status code from the tee command. Fix #1158: reference RFC 8020 "NXDOMAIN: There Really Is Nothing Underneath" for the harden-below-nxdomain option. patch from Dag-Erling Smorgrav that removes code that relies on sbrk(). Make access-control-tag-data RDATA absolute. This makes the RDATA origin consistent between local-data and access-control-tag-data. Fix NSEC ENT wildcard check. Matching wildcard does not have to be a subdomain of the NSEC owner. QNAME minimisation uses QTYPE=A, therefore always check cache for this type in harden-below-nxdomain functionality. Added unit test for QNAME minimisation + harden below nxdomain synergy. Fix that with openssl 1.1 control-use-cert: no uses less cpu, by using no encryption over the unix socket. hyphen as minus fix, by Andreas Schulze Fix #1170: document that 'inform' local-zone uses local-data. Fix #1173: differ local-zone type deny from unset tag_actions element. Add DSA support for OpenSSL 1.1.0 Fix remote control without cert for LibreSSL Fix downcast warnings from visual studio in sldns code. Unbound 1.5.10 Download: unbound-1.5.10.tar.gz SHA1 checksum: 6102849c400db3a4195b1f16df8f312568a6ec57 SHA256 checksum: a39b8b4fcca2a2b35a2daa53fe35150cc3f09038dc9acede09c912fc248a9486 PGP signature: unbound-1.5.10.tar.gz.asc Date: 27 Sep, 2016 Features Create a pkg-config file for libunbound in contrib. TCP Fast open patch from Sara Dickinson. Finegrained localzone control with define-tag, access-control-tag, access-control-tag-action, access-control-tag-data, local-zone-tag, and local-zone-override. And added types always_transparent, always_refuse, always_nxdomain with that. If more than half of tcp connections are in use, a shorter timeout is used (200 msec, vs 2 minutes) to pressure tcp for new connects. [bugzilla: 787 ] Fix #787: outgoing-interface netblock/64 ipv6 option to use linux freebind to use 64bits of entropy for every query with random local part. For #787: prefer-ip6 option for unbound.conf prefers to send upstream queries to ipv6 servers. Add default root hints for IPv6 E.ROOT-SERVERS.NET, 2001:500:a8::e. keep debug symbols in windows build. Bug Fixes [bugzilla: 778 ] Fix unbound 1.5.9: -h segfault (null deref). Fix unbound-anchor.exe file location defaults to Program Files with (x86) appended. Fix to not ignore return value of chown() in daemon startup. Better help text from -h (from Ray Griffith). [bugzilla: 773 ] Fix Non-standard Python location build failure with pyunbound. Improve threadsafety for openssl 0.9.8 ecdsa dnssec signatures. Revert fix for NetworkService account on windows due to breakage it causes. Fix that windows install will not overwrite existing service.conf file (and ignore gui config choices if it exists). And delete service.conf.shipped on uninstall. In unbound.conf directory: dir immediately changes to that directory, so that include: file below that is relative to that directory. With chroot, make the directory an absolute path inside chroot. do not delete service.conf on windows uninstall. document directory immediate fix and allow EXECUTABLE syntax in it on windows. Fix directory: fix for unbound-checkconf, it restores cwd. Use QTYPE=A for QNAME minimisation. Keep track of number of time-outs when performing QNAME minimisation. Stop minimising when number of time-outs for a QNAME/QTYPE pair is more than three. [bugzilla: 775 ] Fix unbound-host and unbound-anchor crash on windows, ignore null delete for wsaevent. Fix spelling in freebind option man page text. Fix windows link of ssl with crypt32. [bugzilla: 779 ] Fix Union casting is non-portable. [bugzilla: 780 ] Fix MAP_ANON not defined in HP-UX 11.31. [bugzilla: 781 ] Fix prealloc() is an HP-UX system library call. Decrease dp attempts at each QNAME minimisation iteration [bugzilla: 784 ] Fix Build configure assumess that having getpwnam means there is endpwent function available. Updated repository with newer flex and bison output. Fix static compile on windows missing gdi32. Fix dynamic link of anchor-update.exe on windows. Fix detect of mingw for MXE package build. Fixes for 64bit windows compile. [bugzilla: 788 ] Fix for nettle 3.0: Failed to build with Nettle >= 3.0 and --with-libunbound-only --with-nettle. Fixed unbound.doxygen for 1.8.11. [bugzilla: 798 ] Fix Client-side TCP fast open fails (Linux). [bugzilla: 801 ] Fix missing error condition handling in daemon_create_workers(). [bugzilla: 802 ] Fix workaround for function parameters that are "unused" without log_assert. [bugzilla: 803 ] Fix confusing (and incorrect) code comment in daemon_cleanup(). [bugzilla: 806 ] Fix wrong comment removed. use sendmsg instead of sendto for TFO. [bugzilla: 807 ] Fix workaround for possible some "unused" function parameters in test code, from Jinmei Tatuya. Note that OPENPGPKEY type is RFC 7929. [bugzilla: 804 ] Fix #804: unbound stops responding after outage. Fixes queries that attempt to wait for an empty list of subqueries. Fix for #804: lower num_target_queries for iterator also for failed lookups. [bugzilla: 820 ] Fix set sldns_str2wire_rr_buf() dual meaning len parameter in each iteration in find_tag_datas(). [bugzilla: 777 ] Fix OpenSSL 1.1.0 compatibility, patch from Sebastian A. Siewior. RFC 7958 is now out, updated docs for unbound-anchor. Fix for compile without warnings with openssl 1.1.0. [bugzilla: 826 ] Fix refuse_non_local could result in a broken response. iana portlist update. Fix compile with openssl 1.1.0 with api=1.1.0. [bugzilla: 829 ] Fix doc of sldns_wire2str_rdata_buf() return value has an off-by-one typo, from Jinmei Tatuya (Infoblox). Fix incomplete prototypes reported by Dag-Erling Smørgrav. [bugzilla: 828 ] Fix missing type in access-control-tag-action redirect results in NXDOMAIN. Take configured minimum TTL into consideration when reducing TTL to original TTL from RRSIG. [bugzilla: 831 ] Fix workaround for spurious fread_chk warning against petal.c Silenced flex-generated sign-unsigned warning print with gcc diagnostic pragma. Fix for new splint on FreeBSD. Fix cast for sockaddr_un.sun_len. fix potential memory leak in daemon/remote.c and nullpointer dereference in validator/autotrust. [bugzilla: 883 ] Fix error for duplicate local zone entry. [bugzilla: 835 ] Fix --disable-dsa with nettle verify.
2018-02-06 05:39:25 +03:00
fake-sha1: yes
trust-anchor-signaling: no
Import 1.9.1: 1 March 2019: Wouter - output forwarder log in ssl_req_order test. 28 February 2019: Wouter - Remove memory leak on pythonmod python2 script file init. - Remove swig gcc8 python function cast warnings, they are ignored. - Print correct module that failed when module-config is wrong. 27 February 2019: Wouter - Fix #4229: Unbound man pages lack information, about access-control order and local zone tags, and elements in views. - Fix #14: contrib/unbound.init: Fix wrong comparison judgment before copying. - Fix for python module on Windows, fix fopen. 25 February 2019: Wouter - Fix #4227: pair event del and add for libevent for tcp_req_info. 21 February 2019: Wouter - Fix the error for unknown module in module-config is understandable, and explains it was not compiled in and where to see the list. - In example.conf explain where to put cachedb module in module-config. - In man page and example config explain that most modules have to be listed at the start of module-config. 20 February 2019: Wouter - Fix pythonmod include and sockaddr_un ifdefs for compile on Windows, and for libunbound. 18 February 2019: Wouter - Print query name with ip_ratelimit exceeded log lines. - Spaces instead of tabs in that log message. - Print query name and IP address when domain rate limit exceeded. 14 February 2019: Wouter - Fix capsforid canonical sort qsort callback. 11 February 2019: Wouter - Note default for module-config in man page. - Fix recursion lame test for qname minimisation asked queries, that were not present in the set of prepared answers. - Fix #13: Remove left-over requirements on OpenSSL >= 1.1.0 for cert name matching, from man page. - make depend, with newer gcc, nicer layout. 7 February 2019: Wouter - Fix #4206: OpenSSL 1.0.2 hostname verification for FreeBSD 11.2. - Fix that qname minimisation does not skip a label when missing nameserver targets need to be fetched. - Fix #4225: clients seem to erroneously receive no answer with DNS-over-TLS and qname-minimisation. 4 February 2019: Wouter - Fix that log-replies prints the correct name for local-alias names, for names that have a CNAME in local-data configuration. It logs the original query name, not the target of the CNAME. - Add local-zone type inform_redirect, which logs like type inform, and redirects like type redirect. - Perform canonical sort for 0x20 capsforid compare of replies, this sorts rrsets in the authority and additional section before comparison, so that out of order rrsets do not cause failure. 31 January 2019: Wouter - Set ub_ctx_set_tls call signature in ltrace config file for libunbound in contrib/libunbound.so.conf. - improve documentation for tls-service-key and forward-first. - #10: fixed pkg-config operations, PKG_PROG_PKG_CONFIG moved out of conditional section, fixes systemd builds, from Enrico Scholz. - #9: For openssl 1.0.2 use the CRYPTO_THREADID locking callbacks, still supports the set_id_callback previous API. And for 1.1.0 no locking callbacks are needed. - #8: Fix OpenSSL without ENGINE support compilation. - Wipe TLS session key data from memory on exit. 30 January 2019: Ralph - Fix case in which query timeout can result in marking delegation as edns_lame_known. 29 January 2019: Wouter - Fix spelling of tls-ciphers in example.conf.in. - Fix #4224: auth_xfr_notify.rpl test broken due to typo - Fix locking for libunbound context setup with broken port config. 28 January 2019: Wouter - ub_ctx_set_tls call for libunbound that enables DoT for the machines set with ub_ctx_set_fwd. Patch from Florian Obser. - Set build system for added call in the libunbound API. - List example config for root zone copy locally hosted with auth-zone as suggested from draft-ietf-dnsop-7706-bis-02. But with updated B root address. - set version to 1.9.0 for release. And this was released with the spelling for tls-ciphers fix as 1.9.0 on Feb 5. Trunk has 1.9.1 in development. 25 January 2019: Wouter - Fix that tcp for auth zone and outgoing does not remove and then gets the ssl read again applied to the deleted commpoint. - updated contrib/fastrpz.patch to cleanly diff. - no lock when threads disabled in tcp request buffer count. - remove compile warnings from libnettle compile. - output of newer lex 2.6.1 and bison 3.0.5. 24 January 2019: Wouter - Newer aclocal and libtoolize used for generating configure scripts, aclocal 1.16.1 and libtoolize 2.4.6. - Fix unit test for python 3.7 new keyword 'async'. - clang analysis fixes, assert arc4random buffer in init, no check for already checked delegation pointer in iterator, in testcode check for NULL packet matches, in perf do not copy from NULL start list when growing capacity. Adjust host and file only when present in test header read to please checker. In testcode for unknown macro operand give zero result. Initialise the passed argv array in test code. In test code add EDNS data segment copy only when nonempty. - Patch from Florian Obser fixes some compiler warnings: include mini_event.h to have a prototype for mini_ev_cmp include edns.h to have a prototype for apply_edns_options sldns_wire2str_edns_keepalive_print is only called in the wire2str, module declare it static to get rid of compiler warning: no previous prototype for function infra_find_ip_ratedata() is only called in the infra module, declare it static to get rid of compiler warning: no previous prototype for function do not shadow local variable buf in authzone auth_chunks_delete and az_nsec3_findnode are only called in the authzone module, declare them static to get rid of compiler warning: no previous prototype for function... copy_rrset() is only called in the respip module, declare it static to get rid of compiler warning: no previous prototype for function 'copy_rrset' no need for another variable "r"; gets rid of compiler warning: declaration shadows a local variable in libunbound.c no need for another variable "ns"; gets rid of compiler warning: declaration shadows a local variable in iterator.c - Moved includes and make depend. 23 January 2019: Wouter - Patch from Manabu Sonoda with tls-ciphers and tls-ciphersuites options for unbound.conf. - Fixes for the patch, and man page entry. - Fix configure to detect SSL_CTX_set_ciphersuites, for better library compatibility when compiling. - Patch for TLS session resumption from Manabu Sonoda, enable with tls-session-ticket-keys in unbound.conf. - Fixes for patch (includes, declarations, warnings). Free at end and keep config options in order read from file to keep the first one as the first one. - Fix for IXFR fallback to reset counter when IXFR does not timeout. 22 January 2019: Wouter - Fix space calculation for tcp req buffer size. - Doc for stream-wait-size and unit test. - unbound-control stats has mem.streamwait that counts TCP and TLS waiting result buffers. - Fix for #4219: secondaries not updated after serial change, unbound falls back to AXFR after IXFR gives several timeout failures. - Fix that auth zone after IXFR fallback tries the same master. 21 January 2019: Wouter - Fix tcp idle timeout test, for difference in the tcp reply code. - Unit test for tcp request reorder and timeouts. - Unit tests for ssl out of order processing. - Fix that multiple dns fragments can be carried in one TLS frame. - Add stream-wait-size: 4m config option to limit the maximum memory used by waiting tcp and tls stream replies. This avoids a denial of service where these replies use up all of the memory. 17 January 2019: Wouter - For caps-for-id fallback, use the whitelist to avoid timeout starting a fallback sequence for it. - increase mesh max activation count for capsforid long fetches. 16 January 2019: Ralph - Get ready for the DNS flag day: remove EDNS lame procedure, do not re-query without EDNS after timeout. 15 January 2019: Wouter - In the out of order processing, reset byte count for (potential) partial read. - Review fixes in out of order processing. 14 January 2019: Wouter - streamtcp option -a send queries consecutively and prints answers as they arrive. - Fix for out of order processing administration quit cleanup. - unit test for tcp out of order processing. 11 January 2019: Wouter - Initial commit for out-of-order processing for TCP and TLS. 9 January 2019: Wouter - Log query name for looping module errors. 8 January 2019: Wouter - Fix syntax in comment of local alias processing. - Fix NSEC3 record that is returned in wildcard replies from auth-zone zones with NSEC3 and wildcards. 7 January 2019: Wouter - On FreeBSD warn if systcl settings do not allow server TCP FASTOPEN, and server tcp fastopen is enabled at compile time. - Document interaction between the tls-upstream option in the server section and forward-tls-upstream option in the forward-zone sections. - Add contrib/unbound-fuzzme.patch from Jacob Hoffman-Andrews, the patch adds a program used for fuzzing. 12 December 2018: Wouter - Fix for crash in dns64 module if response is null. 10 December 2018: Wouter - Fix config parser memory leaks. - ip-ratelimit-factor of 1 allows all traffic through, instead of the previous blocking everything. - Fix for FreeBSD port make with dnscrypt and dnstap enabled. - Fix #4206: support openssl 1.0.2 for TLS hostname verification, alongside the 1.1.0 and later support that is already there. - Fixup openssl 1.0.2 compile 6 December 2018: Wouter - Fix dns64 allocation in wrong region for returned internal queries. 3 December 2018: Wouter - Fix icon, no ragged edges and nicer resolutions available, for eg. Win 7 and Windows 10 display. - cache-max-ttl also defines upperbound of initial TTL in response. 30 November 2018: Wouter - Patch for typo in unbound.conf man page. - log-tag-queryreply: yes in unbound.conf tags the log-queries and log-replies in the log file for easier log filter maintenance. 29 November 2018: Wouter - iana portlist updated. - Fix chroot auth-zone fix to remove chroot prefix. - tag for 1.8.2rc1, which became 1.8.2 on 4 dec 2018, with icon updated. Trunk contains 1.8.3 in development. Which became 1.8.3 on 11 december with only the dns64 fix of 6 dec. Trunk then became 1.8.4 in development. - Fix that unbound-checkconf does not complains if the config file is not placed inside the chroot. - Refuse to start with no ports. - Remove clang analysis warnings. 28 November 2018: Wouter - Fix leak in chroot fix for auth-zone. - Fix clang analysis for outside directory build test. 27 November 2018: Wouter - Fix DNS64 to not store intermediate results in cache, this avoids other threads from picking up the wrong data. The module restores the previous no_cache_store setting when the the module is finished. - Fix #4208: 'stub-no-cache' and 'forward-no-cache' not work. - New and better fix for Fix #4193: Fix that prefetch failure does not overwrite valid cache entry with SERVFAIL. - auth-zone give SERVFAIL when expired, fallback activates when expired, and this is documented in the man page. - stat count SERVFAIL downstream auth-zone queries for expired zones. - Put new logos into windows installer. - Fix windows compile for new rrset roundrobin fix. - Update contrib fastrpz patch for latest release. 26 November 2018: Wouter - Fix to not set GLOB_NOSORT so the unbound.conf include: files are sorted and in a predictable order. - Fix #4193: Fix that prefetch failure does not overwrite valid cache entry with SERVFAIL. - Add unbound-control view_local_datas command, like local_datas. - Fix that unbound-control can send file for view_local_datas. 22 November 2018: Wouter - With ./configure --with-pyunbound --with-pythonmodule PYTHON_VERSION=3.6 or with 2.7 unbound can compile and unit tests succeed for the python module. - pythonmod logs the python error and traceback on failure. - ignore debug python module for test in doxygen output. - review fixes for python module. - Fix #4209: Crash in libunbound when called from getdns. - auth zone zonefiles can be in a chroot, the chroot directory components are removed before use. - Fix that empty zonefile means the zonefile is not set and not used. - make depend. 21 November 2018: Wouter - Scrub NS records from NODATA responses as well. 20 November 2018: Wouter - Scrub NS records from NXDOMAIN responses to stop fragmentation poisoning of the cache. - Add patch from Jan Vcelak for pythonmod, add sockaddr_storage getters, add support for query callbacks, allow raw address access via comm_reply and update API documentation. - Removed compile warnings in pythonmod sockaddr routines. 19 November 2018: Wouter - Support SO_REUSEPORT_LB in FreeBSD 12 with the so-reuseport: yes option in unbound.conf. 6 November 2018: Ralph - Bugfix min-client-subnet-ipv6 25 October 2018: Ralph - Add min-client-subnet-ipv6 and min-client-subnet-ipv4 options. 25 October 2018: Wouter - Fix #4191: NXDOMAIN vs SERVFAIL during dns64 PTR query. - Fix #4190: Please create a "ANY" deny option, adds the option deny-any: yes in unbound.conf. This responds with an empty message to queries of type ANY. - Fix #4141: More randomness to rrset-roundrobin. - Fix #4132: Openness/closeness of RANGE intervals in rpl files. - Fix #4126: RTT_band too low on VSAT links with 600+ms latency, adds the option unknown-server-time-limit to unbound.conf that can be increased to avoid the problem. - remade makefile dependencies. - Fix #4152: Logs shows wrong time when using log-time-ascii: yes. 24 October 2018: Ralph - Add markdel function to ECS slabhash. - Limit ECS scope returned to client to the scope used for caching. - Make lint like previous #4154 fix. 22 October 2018: Wouter - Fix #4192: unbound-control-setup generates keys not readable by group. - check that the dnstap socket file can be opened and exists, print error if not. - Fix #4154: make ECS_MAX_TREESIZE configurable, with the max-ecs-tree-size-ipv4 and max-ecs-tree-size-ipv6 options. 22 October 2018: Ralph - Change fast-server-num default to 3. 8 October 2018: Ralph - Add fast-server-permil and fast-server-num options. - Deprecate low-rtt and low-rtt-permil options. 8 October 2018: Wouter - Squelch log of failed to tcp initiate after TCP Fastopen failure. 5 October 2018: Wouter - Squelch EADDRNOTAVAIL errors when the interface goes away, this omits 'can't assign requested address' errors unless verbosity is set to a high value. - Set default for so-reuseport to no for FreeBSD. It is enabled by default for Linux and DragonFlyBSD. The setting can be configured in unbound.conf to override the default. - iana port update. 2 October 2018: Wouter - updated contrib/fastrpz.patch to apply for this version - dnscrypt.c removed sizeof to get array bounds. - Fix testlock code to set noreturn on error routine. - Remove unused variable from contrib fastrpz/rpz.c and remove unused diagnostic pragmas that themselves generate warnings - clang analyze test is used only when assertions are enabled. 1 October 2018: Wouter - tag for release 1.8.1rc1. Became release 1.8.1 on 8 oct, with fastrpz.patch fix included. Trunk has 1.8.2 in development. 27 September 2018: Wouter - Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, fixes qname minimisation with a forwarder when connectivity has issues from rejecting responses. 25 September 2018: Wouter - Perform TLS SNI indication of the host that is being contacted for DNS over TLS service. It sets the configured tls auth name. This is useful for hosts that apart from the DNS over TLS services also provide other (web) services. - Fix #4149: Add SSL cleanup for tcp timeout. 17 September 2018: Wouter - Fix compile on Mac for unbound, provide explicit_bzero when libc does not have it. - Fix unbound for openssl in FIPS mode, it uses the digests with the EVP call contexts. - Fix that with harden-below-nxdomain and qname minisation enabled some iterator states for nonresponsive domains can get into a state where they waited for an empty list. - Stop UDP to TCP failover after timeouts that causes the ping count to be reset by the TCP time measurement (that exists for TLS), because that causes the UDP part to not be measured as timeout. - Fix #4156: Fix systemd service manager state change notification. 13 September 2018: Wouter - Fix seed for random backup code to use explicit zero when wiped. - exit log routine is annotated as noreturn function. - free memory leaks in config strlist and str2list insert functions. - do not move unused argv variable after getopt. - Remove unused if clause in testcode. - in testcode, free async ids, initialise array, and check for null pointer during test of the test. And use exit for return to note irregular program stop. - Free memory leak in config strlist append. - make sure nsec3 comparison salt is initialized. - unit test has clang analysis. - remove unused variable assignment from iterator scrub routine. - check for null in delegation point during iterator refetch in forward zone. - neater pointer cast in libunbound context quit routine. - initialize statistics totals for printout. - in authzone check that node exists before adding rrset. - in unbound-anchor, use readwrite memory BIO. - assertion in autotrust that packed rrset is formed correctly. - Fix memory leak when message parse fails partway through copy. - remove unused udpsize assignment in message encode. - nicer bio free code in unbound-anchor. - annotate exit functions with noreturn in unbound-control. 11 September 2018: Wouter - Fixed unused return value warnings in contrib/fastrpz.patch for asprintf. - Fix to squelch respip warning in unit test, it is printed at higher verbosity settings. - Fix spelling errors. - Fix initialisation in remote.c 10 September 2018: Wouter - 1.8.1 in svn trunk. (changes from 4,5,.. sep apply). - iana port update. 5 September 2018: Wouter - Fix spelling error in header, from getdns commit by Andreas Gelmini. 4 September 2018: Ralph - More explicitly mention the type of ratelimit when applying ip-ratelimit. 4 September 2018: Wouter - Tag for 1.8.0rc1 release, became 1.8.0 release on 10 Sep 2018. 31 August 2018: Wouter - Disable minimal-responses in subnet unit tests. 30 August 2018: Wouter - Fix that a local-zone with a local-zone-type that is transparent in a view with view-first, makes queries check for answers from the local-zones defined outside of views. 28 August 2018: Ralph - Disable minimal-responses in ipsecmod unit tests. - Added serve-expired-ttl and serve-expired-ttl-reset options. 27 August 2018: Wouter - Set defaults to yes for a number of options to increase speed and resilience of the server. The so-reuseport, harden-below-nxdomain, and minimal-responses options are enabled by default. They used to be disabled by default, waiting to make sure they worked. They are enabled by default now, and can be disabled explicitly by setting them to "no" in the unbound.conf config file. The reuseport and minimal options increases speed of the server, and should be otherwise harmless. The harden-below-nxdomain option works well together with the recently default enabled qname minimisation, this causes more fetches to use information from the cache. - next release is called 1.8.0. - Fix lintflags for lint on FreeBSD. 22 August 2018: George - #4140: Expose repinfo (comm_reply) to the inplace_callbacks. This gives access to reply information for the client's communication point when the callback is called before the mesh state (modules). Changes to C and Python's inplace_callback signatures were also necessary. 21 August 2018: Wouter - log-local-actions: yes option for unbound.conf that logs all the local zone actions, a patch from Saksham Manchanda (Secure64). - #4146: num.query.subnet and num.query.subnet_cache counters. - Fix only misc failure from log-servfail when val-log-level is not enabled. 17 August 2018: Ralph - Fix classification for QTYPE=CNAME queries when QNAME minimisation is enabled. 17 August 2018: Wouter - Set libunbound to increase current, because the libunbound change to the event callback function signature. That needs programs, that use it, to recompile against the new header definition. - print servfail info to log as error. - added more servfail printout statements, to the iterator. - log-servfail: yes prints log lines that say why queries are returning SERVFAIL to clients. 16 August 2018: Wouter - Fix warning on compile without threads. - Fix contrib/fastrpz.patch. 15 August 2018: Wouter - Fix segfault in auth-zone read and reorder of RRSIGs. 14 August 2018: Wouter - Fix that printout of error for cycle targets is a verbosity 4 printout and does not wrongly print it is a memory error. - Upgraded crosscompile script to include libunbound DLL in the zipfile. 10 August 2018: Wouter - Fix #4144: dns64 module caches wrong (negative) information. 9 August 2018: Wouter - unbound-checkconf checks if modules exist and prints if they are not compiled in the name of the wrong module. - document --enable-subnet in doc/README. - Patch for stub-no-cache and forward-no-cache options that disable caching for the contents of that stub or forward, for when you want immediate changes visible, from Bjoern A. Zeeb. 7 August 2018: Ralph - Make capsforid fallback QNAME minimisation aware. 7 August 2018: Wouter - Fix #4142: unbound.service.in: improvements and fixes. Add unit dependency ordering (based on systemd-resolved). Add 'CAP_SYS_RESOURCE' to 'CapabilityBoundingSet' (fixes warnings about missing privileges during startup). Add 'AF_INET6' to 'RestrictAddressFamilies' (without it IPV6 can't work). From Guido Shanahan. - Patch to implement tcp-connection-limit from Jim Hague (Sinodun). This limits the number of simultaneous TCP client connections from a nominated netblock. - make depend, yacc, lex, doc, headers. And log the limit exceeded message only on high verbosity, so as to not spam the logs when it is busy. 6 August 2018: Wouter - Fix for #4136: Fix to unconditionally call destroy in daemon.c. 3 August 2018: George - Expose if a query (or a subquery) was ratelimited (not src IP ratelimiting) to libunbound under 'ub_result.was_ratelimited'. This also introduces a change to 'ub_event_callback_type' in libunbound/unbound-event.h. - Tidy pylib tests. 3 August 2018: Wouter - Revert previous change for #4136: because it introduces build problems. - New fix for #4136: This one ignores lex without without yylex_destroy. 1 August 2018: Wouter - Fix to remove systemd sockaddr function check, that is not always present. Make socket activation more lenient. But not different when socket activation is not used. - iana port list update. 31 July 2018: Wouter - Patches from Jim Hague (Sinodun) for EDNS KeepAlive. - Sort out test runs when the build directory isn't the project root directory. - Add config tcp-idle-timeout (default 30s). This applies to client connections only; the timeout on TCP connections upstream is unaffected. - Error if EDNS Keepalive received over UDP. - Add edns-tcp-keepalive and edns-tcp-keepalive timeout options and implement option in client responses. - Correct and expand manual page entries for keepalive and idle timeout. - Implement progressive backoff of TCP idle/keepalive timeout. - Fix 'make depend' to work when build dir is not project root. - Add delay parameter to streamtcp, -d secs. To be used when testing idle timeout. - From Wouter: make depend, the dependencies in the patches did not apply cleanly. Also remade yacc and lex. - Fix mesh.c incompatible pointer pass. - Please doxygen so it passes. - Fix #4139: Fix unbound-host leaks memory on ANY. 30 July 2018: Wouter - Fix #4136: insufficiency from mismatch of FLEX capability between released tarball and build host. 27 July 2018: Wouter - Fix man page, say that chroot is enabled by default. 26 July 2018: Wouter - Fix #4135: 64-bit Windows Installer Creates Entries Under The Wrong Registry Key, reported by Brian White. 23 July 2018: Wouter - Fix use-systemd readiness signalling, only when use-systemd is yes and not in signal handler. 20 July 2018: Wouter - Fix #4130: print text describing -dd and unbound-checkconf on config file read error at startup, the errors may have been moved away by the startup process. - Fix #4131: for solaris, error YY_CURRENT_BUFFER undeclared. 19 July 2018: Wouter - Fix #4129 unbound-control error message with wrong cert permissions is too cryptic. 17 July 2018: Wouter - Fix #4127 unbound -h does not list -p help. - Print error if SSL name verification configured but not available in the ssl library. - Fix that ratelimit and ip-ratelimit are applied after reload of changed config file. - Resize ratelimit and ip-ratelimit caches if changed on reload. 16 July 2018: Wouter - Fix qname minimisation NXDOMAIN validation lookup failures causing error_supers assertion fails. - Squelch can't bind socket errors with Permission denied unless verbosity is 4 or higher, for UDP outgoing sockets. 12 July 2018: Wouter - Fix to improve systemd socket activation code file descriptor assignment. - Fix for 4126 that the #define for UNKNOWN_SERVER_NICENESS can be more easily changed to adjust default rtt assumptions. 10 July 2018: Wouter - Note in documentation that the cert name match code needs OpenSSL 1.1.0 or later to be enabled. 6 July 2018: Wouter - Fix documentation ambiguity for tls-win-cert in tls-upstream and forward-tls-upstream docs. - iana port update. - Note RFC8162 support. SMIMEA record type can be read in by the zone record parser. - Fix round robin for failed addresses with prefer-ip6: yes 4 July 2018: Wouter - Fix #4112: Fix that unbound-anchor -f /etc/resolv.conf will not pass if DNSSEC is not enabled. New option -R allows fallback from resolv.conf to direct queries. 3 July 2018: Wouter - Better documentation for unblock-lan-zones and insecure-lan-zones config statements. - Fix permission denied printed for auth zone probe random port nrs. 2 July 2018: Wouter - Fix checking for libhiredis printout in configure output. - Fix typo on man page in ip-address description. - Update libunbound/python/examples/dnssec_test.py example code to also set the 20326 trust anchor for the root in the example code. 29 June 2018: Wouter - dns64-ignore-aaaa: config option to list domain names for which the existing AAAA is ignored and dns64 processing is used on the A record. 28 June 2018: Wouter - num.queries.tls counter for queries over TLS. - log port number with err_addr logs. 27 June 2018: Wouter - #4109: Fix that package config depends on python unconditionally. - Patch, do not export python from pkg-config, from Petr Menšík. 26 June 2018: Wouter - Partial fix for permission denied on IPv6 address on FreeBSD. - Fix that auth-zone master reply with current SOA serial does not stop scan of masters for an updated zone. - Fix that auth-zone does not start the wait timer without checking if the wait timer has already been started. 21 June 2018: Wouter - #4108: systemd reload hang fix. - Fix usage printout for unbound-host, hostname has to be last argument on BSDs and Windows.
2019-05-26 00:17:56 +03:00
minimal-responses: no
Import unbound 1.5.9
2016-08-20 14:08:26 +03:00
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
CONFIG_END
SCENARIO_BEGIN Test iterator with empty delegation from cache.
; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 100
ADDRESS 193.0.14.129
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS K.ROOT-SERVERS.NET.
SECTION ADDITIONAL
K.ROOT-SERVERS.NET. IN A 193.0.14.129
ENTRY_END
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
com. IN A
SECTION AUTHORITY
com. IN NS a.gtld-servers.net.
; sneak in some data into the cache to simulate partial data after timeouts
; gets scrubbed anyway.
example.net. NS ns.example.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
net. IN A
SECTION AUTHORITY
net. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
RANGE_END
; a.gtld-servers.net.
RANGE_BEGIN 0 100
ADDRESS 192.5.6.30
; com zone
ENTRY_BEGIN
MATCH opcode qname
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
com. IN NS
SECTION ANSWER
com. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
example.com. IN A
SECTION AUTHORITY
example.com. IN NS ns.example.net.
SECTION ADDITIONAL
ENTRY_END
; net zone
ENTRY_BEGIN
MATCH opcode qname
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
net. IN NS
SECTION ANSWER
net. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
ENTRY_BEGIN
MATCH opcode qname
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
a.gtld-servers.net. IN AAAA
SECTION ANSWER
Import 1.19.1 (previous was 1.16.3) 2 November 2023: Wouter - Set version number to 1.19.0. - Tag for 1.19.0rc1 release. 1 November 2023: George - Mention flex and bison in README.md when building from repository source. 1 November 2023: Wouter - Fix SSL compile failure for definition in log_crypto_err_io_code_arg. - Fix SSL compile failure for other missing definitions in log_crypto_err_io_code_arg. - Fix compilation without openssl, remove unused function warning. 31 October 2023: George - Fix #941: dnscrypt doesn't work after upgrade to 1.18 with suggestion by dukeartem to also fix the udp_ancil with dnscrypt. 30 October 2023: George - Merge #930 from Stuart Henderson: add void to log_ident_revert_to_default declaration. 30 October 2023: Wouter - autoconf. 24 October 2023: George - Clearer configure text for missing protobuf-c development libraries. 20 October 2023: Wouter - Merge #951: Cachedb no store. The cachedb-no-store: yes option is used to stop cachedb from writing messages to the backend storage. It reads messages when data is available from the backend. The default is no. 19 October 2023: Wouter - Fix to print detailed errors when an SSL IO routine fails via SSL_get_error. 18 October 2023: George - Mailing list patches from Daniel Gröber for DNS64 fallback to plain AAAA when no A record exists for synthesis, and minor DNS64 code refactoring for better readability. - Fixes for the DNS64 patches. - Update the dns64_lookup.rpl test for the DNS64 fallback patch. - Merge #955 from buevsan: fix ipset wrong behavior. - Update testdata/ipset.tdir test for ipset fix. 17 October 2023: Wouter - Fix #954: Inconsistent RPZ handling for A record returned along with CNAME. 16 October 2023: George - Expose the script filename in the Python module environment 'mod_env' instead of the config_file structure which includes the linked list of scripts in a multi Python module setup; fixes #79. - Expose the configured listening and outgoing interfaces, if any, as a list of strings in the Python 'config_file' class instead of the current Swig object proxy; fixes #79. - For multi Python module setups, clean previously parsed module functions in __main__'s dictionary, if any, so that only current module functions are registered. 13 October 2023: George - Better fix for infinite loop when reading multiple lines of input on a broken remote control socket, by treating a zero byte line the same as transmission end. Addesses #947 and #948. 12 October 2023: Wouter - Merge #944: Disable EDNS DO. Disable the EDNS DO flag in upstream requests. This can be helpful for devices that cannot handle DNSSEC information. But it should not be enabled otherwise, because that would stop DNSSEC validation. The DNSSEC validation would not work for Unbound itself, and also not for downstream users. Default is no. The option is disable-edns-do: no 11 October 2023: George - Fix #850: [FR] Ability to use specific database in Redis, with new redis-logical-db configuration option. 11 October 2023: Wouter - Fix #949: "could not create control compt". - Fix that cachedb does not warn when serve-expired is disabled about use of serve-expired-reply-ttl and serve-expired-client-timeout. - Fix for #949: Fix pythonmod/ubmodule-tst.py for Python 3.x. 10 October 2023: George - Fix infinite loop when reading multiple lines of input on a broken remote control socket. Addesses #947 and #948. 9 October 2023: Wouter - Fix edns subnet so that queries with a source prefix of zero cause the recursor send no edns subnet option to the upstream. - Fix that printout of EDNS options shows the EDNS cookie option by name. 4 October 2023: Wouter - Fix #946: Forwarder returns servfail on upstream response noerror no data. 3 October 2023: George - Merge #881: Generalise the proxy protocol code. 2 October 2023: George - Fix misplaced comment. 22 September 2023: Wouter - Fix #942: 1.18.0 libunbound DNS regression when built without OpenSSL. 18 September 2023: Wouter - Fix rpz tcp-only action with rpz triggers nsdname and nsip. 15 September 2023: Wouter - Merge #936: Check for c99 with autoconf versions prior to 2.70. - Fix to remove two c99 notations. 14 September 2023: Wouter - Fix authority zone answers for obscured DNAMEs and delegations. 8 September 2023: Wouter - Fix send of udp retries when ENOBUFS is returned. It stops looping and also waits for the condition to go away. Reported by Florian Obser. 7 September 2023: Wouter - Fix to scrub resource records of type A and AAAA that have an inappropriate size. They are removed from responses. - Fix to move msgparse_rrset_remove_rr code to util/msgparse.c. - Fix to add EDE text when RRs have been removed due to length. - Fix to set ede match in unit test for rr length removal. - Fix to print EDE text in readable form in output logs. 6 September 2023: Wouter - Merge #931: Prevent warnings from -Wmissing-prototypes. 31 August 2023: Wouter - Fix autoconf 2.69 warnings in configure. - Fix #927: unbound 1.18.0 make test error. Fix make test without SHA1. 30 August 2023: Wouter - Fix for WKS call to getservbyname that creates allocation on exit in unit test by testing numbers first and testing from the services list later. 28 August 2023: Wouter - Fix for version generation race condition that ignored changes. 25 August 2023: Wouter - Fix compile error on NetBSD in util/netevent.h. 23 August 2023: Wouter - Tag for 1.18.0rc1 release. This became the 1.18.0 release on 30 aug 2023, with the fix from 25 aug, fix compile on NetBSD included. The repository continues with version 1.18.1. 22 August 2023: Wouter - Set version number to 1.18.0. 21 August 2023: Wouter - Debug Windows ci workflow. - Fix windows ci workflow to install bison and flex. - Fix for #925: unbound.service: Main process exited, code=killed, status=11/SEGV. Fixes cachedb configuration handling. - Fix #923: processQueryResponse() THROWAWAY should be mindful of fail_reply. - Fix unit test for unbound-control to work when threads are disabled, and fix cache dump check. 18 August 2023: Wouter - Fix for iter_dec_attempts that could cause a hang, part of capsforid and qname minimisation, depending on the settings. - Fix uninitialized memory passed in padding bytes of cmsg to sendmsg. - Fix stat_values test to work with dig that enables DNS cookies. 17 August 2023: Wouter - Merge PR #762: Downstream DNS Server Cookies a la RFC7873 and RFC9018. Create server cookies for clients that send client cookies. This needs to be explicitly turned on in the config file with: `answer-cookie: yes`. A `cookie-secret:` can be configured for anycast setups. Without one, a random cookie secret is generated. The acl option `allow_cookie` allows queries with either a valid cookie or over a stateful transport. The statistics output has `queries_cookie_valid` and `queries_cookie_client` and `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:` value determines a rate limit for queries with cookies, if desired. - Fix regional_alloc_init for potential unaligned source of the copy. - Fix ip_ratelimit test to work with dig that enables DNS cookies. 2 August 2023: George - Move a cache reply callback in worker.c closer to the cache reply generation. 1 August 2023: George - Merge #911 from natalie-reece: Exclude EDE before other EDNS options when there isn't enough space. - For #911: Try to trim EXTRA-TEXT (and LDNS_EDE_OTHER options altogether) before giving up on attaching EDE options. - More braces and formatting for Fix for EDNS EDE size calculation to avoid future bugs. - Fix to use the now cached EDE, if any, for CD_bit queries. 1 August 2023: Wouter - Fix for EDNS EDE size calculation. 31 July 2023: George - Merge #790 from Tom Carpay: Add support for EDE caching in cachedb and subnetcache. 31 July 2023: Wouter - iana portlist update. 30 July 2023: George - Merge #759 from Tom Carpay: Add EDE (RFC8914) caching. 28 July 2023: George - Fix unused variable compile warning for kernel timestamps in netevent.c 21 July 2023: George - Merge #857 from eaglegai: fix potential memory leaks when errors happen. - For #857: fix mixed declarations and code. - Merge #118 from mibere: Changed verbosity level for Redis init & deinit. - Merge #390 from Frank Riley: Add missing callbacks to the python module. - Cleaner failure code for callback functions in interface.i. - Merge #889 from borisVanhoof: Free memory in error case + remove unused function. - For #889: use netcat-openbsd instead of netcat-traditional. - For #889: Account for num_detached_states before possible mesh_state_delete when erroring out. 20 July 2023: George - Merge #909 from headshog: Numeric truncation when parsing TYPEXX and CLASSXX representation. - For #909: Fix return values. - Merge #901 from Sergei Trofimovich: config: improve handling of unknown modules. 20 July 2023: Wouter - For #909: Fix RR class comparison. 14 July 2023: George - More clear description of the different auth-zone behaviors on the man page. 13 July 2023: George - Merge #880 from chipitsine: services/authzone.c: remove redundant check. 11 July 2023: George - Merge #664 from tilan7763: Add prefetch support for subnet cache entries. - For #664: Easier code flow for subnetcache prefetching. - For #664: Add testcase. - For #664: Rename subnet_prefetch tests to subnet_global_prefetch to differentiate from the new subnet prefetch support. 3 July 2023: George - Merge #739: Add SVCB dohpath support. - Code cleanup for sldns_str2wire_svcparam_key_lookup. - Merge #802: add validation EDEs to queries where the CD bit is set. - For #802: Cleanup comments and add RCODE check for CD bit test case. - Skip the 00-lint test. splint is not maintained; it either does not work or produces false positives. Static analysis is handled in the clang test. 3 July 2023: Wouter - Fix #906: warning: ‘Py_SetProgramName’ is deprecated. - Fix dereference of NULL variable warning in mesh_do_callback. 29 June 2023: George - More fixes for reference counting for python module and clean up failure code. - Merge #827 from rcmcdonald91: Eliminate unnecessary Python reloading which causes memory leaks. 29 June 2023: Wouter - Fix python modules with multiple scripts, by incrementing reference counts. 27 June 2023: George - Merge #892: Add cachedb hit stat. Introduces 'num.query.cachedb' as a new statistical counter. - Remove warning about unknown cast-function-type warning pragma. 22 June 2023: Wouter - Merge #903: contrib: add yocto compatible init script. 15 June 2023: Philip - Fix for issue #887 (Timeouts to forward servers on BSD based system with ASLR) - Probably fixes #516 (Stream reuse does not work on Windows) as well 14 June 2023: George - Properly handle all return values of worker_check_request during early EDE code. - Do not check the incoming request more than once. 12 June 2023: Wouter - Merge #896: Fix: #895: pythonmodule: add all site-packages directories to sys.path. - Fix #895: python + sysconfig gives ANOTHER path comparing to distutils. - Fix for uncertain unit test for doh buffer size events. 25 May 2023: Wouter - Fix unbound-dnstap-socket printout when no query is present. - Fix unbound-dnstap-socket time fraction conversion for printout. 19 May 2023: Wouter - Fix RPZ removal of client-ip, nsip, nsdname triggers from IXFR. - Fix to remove unused variables from RPZ clientip data structure. 16 May 2023: Wouter - Fix #888: [FR] Use kernel timestamps for dnstap. - Fix to print debug log for ancillary data with correct IP address. 11 May 2023: Wouter - Fix warning in windows compile, in set_recvtimestamp. 4 May 2023: Wouter - Fix #885: Error: util/configlexer.c: No such file or directory, adds error messages explaining to install flex and bison. - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h. - Fix doxygen in addr_to_nat64 header definition. 1 May 2023: George - Merge #722 from David 'eqvinox' Lamparter: NAT64 support. - For #722: minor fixes, formatting, refactoring. 1 May 2023: Wouter - Fix RPZ IP responses with trigger rpz-drop on cache entries, that they are dropped. 26 April 2023: Philip - Fix issue #860: Bad interaction with 0 TTL records and serve-expired 26 April 2023: Wouter - Merge #882 from vvfedorenko: Features/dropqueuedpackets, with sock-queue-timeout option that drops packets that have been in the socket queue for too long. Added statistics num.queries_timed_out and query.queue_time_us.max that track the socket queue timeouts. - Fix for #882: small changes, date updated in Copyright for util/timeval_func.c and util/timeval_func.h. Man page entries and example entry. - Fix for #882: document variable to stop doxygen warning. 19 April 2023: Wouter - Fix for #878: Invalid IP address in unbound.conf causes Segmentation Fault on OpenBSD. 14 April 2023: Wouter - Merge #875: change obsolete txt URL in unbound-anchor.c to point to RFC 7958, and Fix #874. 13 April 2023: Wouter - Fix build badge, from failing travis link to github ci action link. 6 April 2023: Wouter - Fix for #870: Add test case for the qname minimisation and CNAME. 4 April 2023: Wouter - Fix #870: NXDOMAIN instead of NOERROR rcode when asked for existing CNAME record. 24 March 2023: Philip - Fix issue #676: Unencrypted query is sent when forward-tls-upstream: yes is used without tls-cert-bundle - Extra consistency check to make sure that when TLS is requested, either we set up a TLS connection or we return an error. 21 March 2023: Philip - Fix issue #851: reserved identifier violation 20 March 2023: Wouter - iana portlist update. 17 March 2023: George - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option to ignore the unexpected eof while reading in openssl >= 3. 16 March 2023: Wouter - Fix ssl.h include brackets, instead of quotes. 14 March 2023: Wouter - Fix unbound-dnstap-socket test program to reply the finish frame over a TLS connection correctly. 23 February 2023: Wouter - Fix for #852: Completion of error handling. 21 February 2023: Philip - Fix #825: Unexpected behavior with client-subnet-always-forward and serve-expired 10 February 2023: George - Clean up iterator/iterator.c::error_response_cache() and allow for better interaction with serve-expired, prefetch and cached error responses. 9 February 2023: George - Allow TTL refresh of expired error responses. - Add testcase for refreshing expired error responses. 9 February 2023: Wouter - Fix to ignore entirely empty responses, and try at another authority. This turns completely empty responses, a type of noerror/nodata into a servfail, but they do not conform to RFC2308, and the retry can fetch improved content. - Fix unit tests for spurious empty messages. - Fix consistency of unit test without roundrobin answers for the cnametooptout unit test. - Fix to git ignore the library symbol file that configure can create. 8 February 2023: Wouter - Fix #841: Unbound won't build with aaaa-filter-iterator.patch. 30 January 2023: George - Add duration variable for speed_local.test. 26 January 2023: Wouter - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes. 23 January 2023: George - Fix #833: [FR] Ability to set the Redis password. 23 January 2023: Wouter - Fix #835: [FR] Ability to use Redis unix sockets. 20 January 2023: Wouter - Merge #819: Added new static zone type block_a to suppress all A queries for specific zones. 19 January 2023: Wouter - Set max-udp-size default to 1232. This is the same default value as the default value for edns-buffer-size. It restricts client edns buffer size choices, and makes unbound behave similar to other DNS resolvers. The new choice, down from 4096 means it is harder to get large responses from Unbound. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Add harden-unknown-additional option. It removes unknown records from the authority section and additional section. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Set default for harden-unknown-additional to no. So that it does not hamper future protocol developments. - Fix test for new default. 18 January 2023: Wouter - Fix not following cleared RD flags potentially enables amplification DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab, Tsinghua University. The fix stops query loops, by refusing to send RD=0 queries to a forwarder, they still get answered from cache. 13 January 2023: Wouter - Merge #826: Аdd a metric about the maximum number of collisions in lrushah. - Improve documentation for #826, describe the large collisions amount. 9 January 2023: Wouter - Fix python module install path detection. - Fix python version detection in configure. 6 January 2023: Wouter - Fix #823: Response change to NODATA for some ANY queries since 1.12, tested on 1.16.1. - Fix wildcard in hyperlocal zone service degradation, reported by Sergey Kacheev. This fix is included in 1.17.1rc2. That became 1.17.1 on 12 Jan 2023, the code repo continues with 1.17.2. 1.17.1 excludes fix #823, it is included forwards. 5 January 2023: Wouter - Tag for 1.17.1 release. 2 January 2023: Wouter - Fix windows compile for libunbound subprocess reap comm point closes. - Update github workflows to use checkout v3. 14 December 2022: George - Merge #569 from JINMEI Tatuya: add keep-cache option to 'unbound-control reload' to keep caches. 13 December 2022: George - Expose 'statistics-inhibit-zero' as a configuration option; the default value retains Unbound's behavior. - Expose 'max-sent-count' as a configuration option; the default value retains Unbound's behavior. - Merge #461 from Christian Allred: Add max-query-restarts option. Exposes an internal configuration but the default value retains Unbound's behavior. 13 December 2022: Wouter - Merge #808: Wrap Makefile script's directory variables in quotes. - Fix to wrap Makefile scripts directory in quotes for uninstall. 1 December 2022: Wouter - Fix #773: When used with systemd-networkd, unbound does not start until systemd-networkd-wait-online.service times out. 30 November 2022: George - Add SVCB and HTTPS to the types removed by 'unbound-control flush'. - Clear documentation for interactivity between the subnet module and the serve-expired and prefetch configuration options. 30 November 2022: Wouter - Fix #782: Segmentation fault in stats.c:404. 28 November 2022: Wouter - Fix for the ignore of tcp events for closed comm points, preserve the use after free protection features. 23 November 2022: Philip - Merge #720 from jonathangray: fix use after free when WSACreateEvent() fails. 22 November 2022: George - Ignore expired error responses. 11 November 2022: Wouter - Fix #779: [doc] Missing documention in ub_resolve_event() for callback parameter was_ratelimited. 9 November 2022: George - Complementary fix for distutils.sysconfig deprecation in Python 3.10 to commit 62c5039ab9da42713e006e840b7578e01d66e7f2. 8 November 2022: Wouter - Fix to ignore tcp events for closed comm points. - Fix to make sure to not read again after a tcp comm point is closed. - Fix #775: libunbound: subprocess reap causes parent process reap to hang. - iana portlist update. 21 October 2022: George - Merge #767 from jonathangray: consistently use IPv4/IPv6 in unbound.conf.5. 21 October 2022: Wouter - Fix that cachedb does not store failures in the external cache. 18 October 2022: George - Clarify the use of MAX_SENT_COUNT in the iterator code. 17 October 2022: Wouter - testcode/dohclient sets log identity to its name. 14 October 2022: Wouter - Merge #768 from fobser: Arithmetic on a pointer to void is a GNU extension. - In unit test, print python script name list correctly. 13 October 2022: Wouter - Tag for 1.17.0 release. The code repository continues with 1.17.1. 11 October 2022: George - Fix PROXYv2 header read for TCP connections when no proxied addresses are provided. 7 October 2022: Wouter - Tag for 1.17.0rc1 release. 7 October 2022: George - Fix to stop possible loops in the tcp reuse code (write_wait list and tcp_wait list). Based on analysis and patch from Prad Seniappan and Karthik Umashankar. - Fix unit test to properly test the reuse_write_wait_pop function. 6 October 2022: Wouter - Fix to stop responses with TC flag from resulting in partial responses. It retries to fetch the data elsewhere, or fails the query and in depth fix removes the TC flag from the cached item. - Fix proxy length debug output printout typecasts. 5 October 2022: Wouter - Fix dnscrypt compile for proxy protocol code changes. 5 October 2022: George - Use DEBUG_TDIR from environment in mini_tdir.sh for debugging. - Fix string comparison in mini_tdir.sh. - Make ede.tdir test more predictable by using static data. - Fix checkconf test for dnscrypt and proxy port. 4 October 2022: George - Merge #764: Leniency for target discovery when under load (for NRDelegation changes). 4 October 2022: Wouter - Fix static analysis report to remove dead code from the rpz_callback_from_iterator_module function. - Fix to clean up after the acl_interface unit test. 3 October 2022: George - Merge #760: PROXYv2 downstream support. (New proxy-protocol-port configuration option). 3 October 2022: Wouter - Fix to remove erroneous TC flag from TCP upstream. - Fix test tdir skip report printout. - Fix windows compile, the identifier interface is defined in headers. - Fix to close errno block in comm_point_tcp_handle_read outside of ifdef. 26 September 2022: George - Better output for skipped tdir tests.
2024-02-17 21:06:18 +03:00
SECTION AUTHORITY
net. IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600
Import unbound 1.5.9
2016-08-20 14:08:26 +03:00
ENTRY_END
ENTRY_BEGIN
MATCH opcode qname
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
ns.example.net. IN A
SECTION AUTHORITY
example.net. NS ns.example.net.
SECTION ADDITIONAL
ns.example.net. IN A 1.2.3.4
ENTRY_END
RANGE_END
; ns.example.net.
RANGE_BEGIN 0 100
ADDRESS 1.2.3.4
; example.net. zone
ENTRY_BEGIN
MATCH opcode qname
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
example.net. IN NS
SECTION ANSWER
example.net. NS ns.example.net.
SECTION ADDITIONAL
ns.example.net. IN A 1.2.3.4
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.example.net. IN A
SECTION ANSWER
ns.example.net. IN A 1.2.3.4
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR AA NOERROR
SECTION QUESTION
ns.example.net. IN AAAA
SECTION ANSWER
Import 1.19.1 (previous was 1.16.3) 2 November 2023: Wouter - Set version number to 1.19.0. - Tag for 1.19.0rc1 release. 1 November 2023: George - Mention flex and bison in README.md when building from repository source. 1 November 2023: Wouter - Fix SSL compile failure for definition in log_crypto_err_io_code_arg. - Fix SSL compile failure for other missing definitions in log_crypto_err_io_code_arg. - Fix compilation without openssl, remove unused function warning. 31 October 2023: George - Fix #941: dnscrypt doesn't work after upgrade to 1.18 with suggestion by dukeartem to also fix the udp_ancil with dnscrypt. 30 October 2023: George - Merge #930 from Stuart Henderson: add void to log_ident_revert_to_default declaration. 30 October 2023: Wouter - autoconf. 24 October 2023: George - Clearer configure text for missing protobuf-c development libraries. 20 October 2023: Wouter - Merge #951: Cachedb no store. The cachedb-no-store: yes option is used to stop cachedb from writing messages to the backend storage. It reads messages when data is available from the backend. The default is no. 19 October 2023: Wouter - Fix to print detailed errors when an SSL IO routine fails via SSL_get_error. 18 October 2023: George - Mailing list patches from Daniel Gröber for DNS64 fallback to plain AAAA when no A record exists for synthesis, and minor DNS64 code refactoring for better readability. - Fixes for the DNS64 patches. - Update the dns64_lookup.rpl test for the DNS64 fallback patch. - Merge #955 from buevsan: fix ipset wrong behavior. - Update testdata/ipset.tdir test for ipset fix. 17 October 2023: Wouter - Fix #954: Inconsistent RPZ handling for A record returned along with CNAME. 16 October 2023: George - Expose the script filename in the Python module environment 'mod_env' instead of the config_file structure which includes the linked list of scripts in a multi Python module setup; fixes #79. - Expose the configured listening and outgoing interfaces, if any, as a list of strings in the Python 'config_file' class instead of the current Swig object proxy; fixes #79. - For multi Python module setups, clean previously parsed module functions in __main__'s dictionary, if any, so that only current module functions are registered. 13 October 2023: George - Better fix for infinite loop when reading multiple lines of input on a broken remote control socket, by treating a zero byte line the same as transmission end. Addesses #947 and #948. 12 October 2023: Wouter - Merge #944: Disable EDNS DO. Disable the EDNS DO flag in upstream requests. This can be helpful for devices that cannot handle DNSSEC information. But it should not be enabled otherwise, because that would stop DNSSEC validation. The DNSSEC validation would not work for Unbound itself, and also not for downstream users. Default is no. The option is disable-edns-do: no 11 October 2023: George - Fix #850: [FR] Ability to use specific database in Redis, with new redis-logical-db configuration option. 11 October 2023: Wouter - Fix #949: "could not create control compt". - Fix that cachedb does not warn when serve-expired is disabled about use of serve-expired-reply-ttl and serve-expired-client-timeout. - Fix for #949: Fix pythonmod/ubmodule-tst.py for Python 3.x. 10 October 2023: George - Fix infinite loop when reading multiple lines of input on a broken remote control socket. Addesses #947 and #948. 9 October 2023: Wouter - Fix edns subnet so that queries with a source prefix of zero cause the recursor send no edns subnet option to the upstream. - Fix that printout of EDNS options shows the EDNS cookie option by name. 4 October 2023: Wouter - Fix #946: Forwarder returns servfail on upstream response noerror no data. 3 October 2023: George - Merge #881: Generalise the proxy protocol code. 2 October 2023: George - Fix misplaced comment. 22 September 2023: Wouter - Fix #942: 1.18.0 libunbound DNS regression when built without OpenSSL. 18 September 2023: Wouter - Fix rpz tcp-only action with rpz triggers nsdname and nsip. 15 September 2023: Wouter - Merge #936: Check for c99 with autoconf versions prior to 2.70. - Fix to remove two c99 notations. 14 September 2023: Wouter - Fix authority zone answers for obscured DNAMEs and delegations. 8 September 2023: Wouter - Fix send of udp retries when ENOBUFS is returned. It stops looping and also waits for the condition to go away. Reported by Florian Obser. 7 September 2023: Wouter - Fix to scrub resource records of type A and AAAA that have an inappropriate size. They are removed from responses. - Fix to move msgparse_rrset_remove_rr code to util/msgparse.c. - Fix to add EDE text when RRs have been removed due to length. - Fix to set ede match in unit test for rr length removal. - Fix to print EDE text in readable form in output logs. 6 September 2023: Wouter - Merge #931: Prevent warnings from -Wmissing-prototypes. 31 August 2023: Wouter - Fix autoconf 2.69 warnings in configure. - Fix #927: unbound 1.18.0 make test error. Fix make test without SHA1. 30 August 2023: Wouter - Fix for WKS call to getservbyname that creates allocation on exit in unit test by testing numbers first and testing from the services list later. 28 August 2023: Wouter - Fix for version generation race condition that ignored changes. 25 August 2023: Wouter - Fix compile error on NetBSD in util/netevent.h. 23 August 2023: Wouter - Tag for 1.18.0rc1 release. This became the 1.18.0 release on 30 aug 2023, with the fix from 25 aug, fix compile on NetBSD included. The repository continues with version 1.18.1. 22 August 2023: Wouter - Set version number to 1.18.0. 21 August 2023: Wouter - Debug Windows ci workflow. - Fix windows ci workflow to install bison and flex. - Fix for #925: unbound.service: Main process exited, code=killed, status=11/SEGV. Fixes cachedb configuration handling. - Fix #923: processQueryResponse() THROWAWAY should be mindful of fail_reply. - Fix unit test for unbound-control to work when threads are disabled, and fix cache dump check. 18 August 2023: Wouter - Fix for iter_dec_attempts that could cause a hang, part of capsforid and qname minimisation, depending on the settings. - Fix uninitialized memory passed in padding bytes of cmsg to sendmsg. - Fix stat_values test to work with dig that enables DNS cookies. 17 August 2023: Wouter - Merge PR #762: Downstream DNS Server Cookies a la RFC7873 and RFC9018. Create server cookies for clients that send client cookies. This needs to be explicitly turned on in the config file with: `answer-cookie: yes`. A `cookie-secret:` can be configured for anycast setups. Without one, a random cookie secret is generated. The acl option `allow_cookie` allows queries with either a valid cookie or over a stateful transport. The statistics output has `queries_cookie_valid` and `queries_cookie_client` and `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:` value determines a rate limit for queries with cookies, if desired. - Fix regional_alloc_init for potential unaligned source of the copy. - Fix ip_ratelimit test to work with dig that enables DNS cookies. 2 August 2023: George - Move a cache reply callback in worker.c closer to the cache reply generation. 1 August 2023: George - Merge #911 from natalie-reece: Exclude EDE before other EDNS options when there isn't enough space. - For #911: Try to trim EXTRA-TEXT (and LDNS_EDE_OTHER options altogether) before giving up on attaching EDE options. - More braces and formatting for Fix for EDNS EDE size calculation to avoid future bugs. - Fix to use the now cached EDE, if any, for CD_bit queries. 1 August 2023: Wouter - Fix for EDNS EDE size calculation. 31 July 2023: George - Merge #790 from Tom Carpay: Add support for EDE caching in cachedb and subnetcache. 31 July 2023: Wouter - iana portlist update. 30 July 2023: George - Merge #759 from Tom Carpay: Add EDE (RFC8914) caching. 28 July 2023: George - Fix unused variable compile warning for kernel timestamps in netevent.c 21 July 2023: George - Merge #857 from eaglegai: fix potential memory leaks when errors happen. - For #857: fix mixed declarations and code. - Merge #118 from mibere: Changed verbosity level for Redis init & deinit. - Merge #390 from Frank Riley: Add missing callbacks to the python module. - Cleaner failure code for callback functions in interface.i. - Merge #889 from borisVanhoof: Free memory in error case + remove unused function. - For #889: use netcat-openbsd instead of netcat-traditional. - For #889: Account for num_detached_states before possible mesh_state_delete when erroring out. 20 July 2023: George - Merge #909 from headshog: Numeric truncation when parsing TYPEXX and CLASSXX representation. - For #909: Fix return values. - Merge #901 from Sergei Trofimovich: config: improve handling of unknown modules. 20 July 2023: Wouter - For #909: Fix RR class comparison. 14 July 2023: George - More clear description of the different auth-zone behaviors on the man page. 13 July 2023: George - Merge #880 from chipitsine: services/authzone.c: remove redundant check. 11 July 2023: George - Merge #664 from tilan7763: Add prefetch support for subnet cache entries. - For #664: Easier code flow for subnetcache prefetching. - For #664: Add testcase. - For #664: Rename subnet_prefetch tests to subnet_global_prefetch to differentiate from the new subnet prefetch support. 3 July 2023: George - Merge #739: Add SVCB dohpath support. - Code cleanup for sldns_str2wire_svcparam_key_lookup. - Merge #802: add validation EDEs to queries where the CD bit is set. - For #802: Cleanup comments and add RCODE check for CD bit test case. - Skip the 00-lint test. splint is not maintained; it either does not work or produces false positives. Static analysis is handled in the clang test. 3 July 2023: Wouter - Fix #906: warning: ‘Py_SetProgramName’ is deprecated. - Fix dereference of NULL variable warning in mesh_do_callback. 29 June 2023: George - More fixes for reference counting for python module and clean up failure code. - Merge #827 from rcmcdonald91: Eliminate unnecessary Python reloading which causes memory leaks. 29 June 2023: Wouter - Fix python modules with multiple scripts, by incrementing reference counts. 27 June 2023: George - Merge #892: Add cachedb hit stat. Introduces 'num.query.cachedb' as a new statistical counter. - Remove warning about unknown cast-function-type warning pragma. 22 June 2023: Wouter - Merge #903: contrib: add yocto compatible init script. 15 June 2023: Philip - Fix for issue #887 (Timeouts to forward servers on BSD based system with ASLR) - Probably fixes #516 (Stream reuse does not work on Windows) as well 14 June 2023: George - Properly handle all return values of worker_check_request during early EDE code. - Do not check the incoming request more than once. 12 June 2023: Wouter - Merge #896: Fix: #895: pythonmodule: add all site-packages directories to sys.path. - Fix #895: python + sysconfig gives ANOTHER path comparing to distutils. - Fix for uncertain unit test for doh buffer size events. 25 May 2023: Wouter - Fix unbound-dnstap-socket printout when no query is present. - Fix unbound-dnstap-socket time fraction conversion for printout. 19 May 2023: Wouter - Fix RPZ removal of client-ip, nsip, nsdname triggers from IXFR. - Fix to remove unused variables from RPZ clientip data structure. 16 May 2023: Wouter - Fix #888: [FR] Use kernel timestamps for dnstap. - Fix to print debug log for ancillary data with correct IP address. 11 May 2023: Wouter - Fix warning in windows compile, in set_recvtimestamp. 4 May 2023: Wouter - Fix #885: Error: util/configlexer.c: No such file or directory, adds error messages explaining to install flex and bison. - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h. - Fix doxygen in addr_to_nat64 header definition. 1 May 2023: George - Merge #722 from David 'eqvinox' Lamparter: NAT64 support. - For #722: minor fixes, formatting, refactoring. 1 May 2023: Wouter - Fix RPZ IP responses with trigger rpz-drop on cache entries, that they are dropped. 26 April 2023: Philip - Fix issue #860: Bad interaction with 0 TTL records and serve-expired 26 April 2023: Wouter - Merge #882 from vvfedorenko: Features/dropqueuedpackets, with sock-queue-timeout option that drops packets that have been in the socket queue for too long. Added statistics num.queries_timed_out and query.queue_time_us.max that track the socket queue timeouts. - Fix for #882: small changes, date updated in Copyright for util/timeval_func.c and util/timeval_func.h. Man page entries and example entry. - Fix for #882: document variable to stop doxygen warning. 19 April 2023: Wouter - Fix for #878: Invalid IP address in unbound.conf causes Segmentation Fault on OpenBSD. 14 April 2023: Wouter - Merge #875: change obsolete txt URL in unbound-anchor.c to point to RFC 7958, and Fix #874. 13 April 2023: Wouter - Fix build badge, from failing travis link to github ci action link. 6 April 2023: Wouter - Fix for #870: Add test case for the qname minimisation and CNAME. 4 April 2023: Wouter - Fix #870: NXDOMAIN instead of NOERROR rcode when asked for existing CNAME record. 24 March 2023: Philip - Fix issue #676: Unencrypted query is sent when forward-tls-upstream: yes is used without tls-cert-bundle - Extra consistency check to make sure that when TLS is requested, either we set up a TLS connection or we return an error. 21 March 2023: Philip - Fix issue #851: reserved identifier violation 20 March 2023: Wouter - iana portlist update. 17 March 2023: George - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option to ignore the unexpected eof while reading in openssl >= 3. 16 March 2023: Wouter - Fix ssl.h include brackets, instead of quotes. 14 March 2023: Wouter - Fix unbound-dnstap-socket test program to reply the finish frame over a TLS connection correctly. 23 February 2023: Wouter - Fix for #852: Completion of error handling. 21 February 2023: Philip - Fix #825: Unexpected behavior with client-subnet-always-forward and serve-expired 10 February 2023: George - Clean up iterator/iterator.c::error_response_cache() and allow for better interaction with serve-expired, prefetch and cached error responses. 9 February 2023: George - Allow TTL refresh of expired error responses. - Add testcase for refreshing expired error responses. 9 February 2023: Wouter - Fix to ignore entirely empty responses, and try at another authority. This turns completely empty responses, a type of noerror/nodata into a servfail, but they do not conform to RFC2308, and the retry can fetch improved content. - Fix unit tests for spurious empty messages. - Fix consistency of unit test without roundrobin answers for the cnametooptout unit test. - Fix to git ignore the library symbol file that configure can create. 8 February 2023: Wouter - Fix #841: Unbound won't build with aaaa-filter-iterator.patch. 30 January 2023: George - Add duration variable for speed_local.test. 26 January 2023: Wouter - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes. 23 January 2023: George - Fix #833: [FR] Ability to set the Redis password. 23 January 2023: Wouter - Fix #835: [FR] Ability to use Redis unix sockets. 20 January 2023: Wouter - Merge #819: Added new static zone type block_a to suppress all A queries for specific zones. 19 January 2023: Wouter - Set max-udp-size default to 1232. This is the same default value as the default value for edns-buffer-size. It restricts client edns buffer size choices, and makes unbound behave similar to other DNS resolvers. The new choice, down from 4096 means it is harder to get large responses from Unbound. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Add harden-unknown-additional option. It removes unknown records from the authority section and additional section. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Set default for harden-unknown-additional to no. So that it does not hamper future protocol developments. - Fix test for new default. 18 January 2023: Wouter - Fix not following cleared RD flags potentially enables amplification DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab, Tsinghua University. The fix stops query loops, by refusing to send RD=0 queries to a forwarder, they still get answered from cache. 13 January 2023: Wouter - Merge #826: Аdd a metric about the maximum number of collisions in lrushah. - Improve documentation for #826, describe the large collisions amount. 9 January 2023: Wouter - Fix python module install path detection. - Fix python version detection in configure. 6 January 2023: Wouter - Fix #823: Response change to NODATA for some ANY queries since 1.12, tested on 1.16.1. - Fix wildcard in hyperlocal zone service degradation, reported by Sergey Kacheev. This fix is included in 1.17.1rc2. That became 1.17.1 on 12 Jan 2023, the code repo continues with 1.17.2. 1.17.1 excludes fix #823, it is included forwards. 5 January 2023: Wouter - Tag for 1.17.1 release. 2 January 2023: Wouter - Fix windows compile for libunbound subprocess reap comm point closes. - Update github workflows to use checkout v3. 14 December 2022: George - Merge #569 from JINMEI Tatuya: add keep-cache option to 'unbound-control reload' to keep caches. 13 December 2022: George - Expose 'statistics-inhibit-zero' as a configuration option; the default value retains Unbound's behavior. - Expose 'max-sent-count' as a configuration option; the default value retains Unbound's behavior. - Merge #461 from Christian Allred: Add max-query-restarts option. Exposes an internal configuration but the default value retains Unbound's behavior. 13 December 2022: Wouter - Merge #808: Wrap Makefile script's directory variables in quotes. - Fix to wrap Makefile scripts directory in quotes for uninstall. 1 December 2022: Wouter - Fix #773: When used with systemd-networkd, unbound does not start until systemd-networkd-wait-online.service times out. 30 November 2022: George - Add SVCB and HTTPS to the types removed by 'unbound-control flush'. - Clear documentation for interactivity between the subnet module and the serve-expired and prefetch configuration options. 30 November 2022: Wouter - Fix #782: Segmentation fault in stats.c:404. 28 November 2022: Wouter - Fix for the ignore of tcp events for closed comm points, preserve the use after free protection features. 23 November 2022: Philip - Merge #720 from jonathangray: fix use after free when WSACreateEvent() fails. 22 November 2022: George - Ignore expired error responses. 11 November 2022: Wouter - Fix #779: [doc] Missing documention in ub_resolve_event() for callback parameter was_ratelimited. 9 November 2022: George - Complementary fix for distutils.sysconfig deprecation in Python 3.10 to commit 62c5039ab9da42713e006e840b7578e01d66e7f2. 8 November 2022: Wouter - Fix to ignore tcp events for closed comm points. - Fix to make sure to not read again after a tcp comm point is closed. - Fix #775: libunbound: subprocess reap causes parent process reap to hang. - iana portlist update. 21 October 2022: George - Merge #767 from jonathangray: consistently use IPv4/IPv6 in unbound.conf.5. 21 October 2022: Wouter - Fix that cachedb does not store failures in the external cache. 18 October 2022: George - Clarify the use of MAX_SENT_COUNT in the iterator code. 17 October 2022: Wouter - testcode/dohclient sets log identity to its name. 14 October 2022: Wouter - Merge #768 from fobser: Arithmetic on a pointer to void is a GNU extension. - In unit test, print python script name list correctly. 13 October 2022: Wouter - Tag for 1.17.0 release. The code repository continues with 1.17.1. 11 October 2022: George - Fix PROXYv2 header read for TCP connections when no proxied addresses are provided. 7 October 2022: Wouter - Tag for 1.17.0rc1 release. 7 October 2022: George - Fix to stop possible loops in the tcp reuse code (write_wait list and tcp_wait list). Based on analysis and patch from Prad Seniappan and Karthik Umashankar. - Fix unit test to properly test the reuse_write_wait_pop function. 6 October 2022: Wouter - Fix to stop responses with TC flag from resulting in partial responses. It retries to fetch the data elsewhere, or fails the query and in depth fix removes the TC flag from the cached item. - Fix proxy length debug output printout typecasts. 5 October 2022: Wouter - Fix dnscrypt compile for proxy protocol code changes. 5 October 2022: George - Use DEBUG_TDIR from environment in mini_tdir.sh for debugging. - Fix string comparison in mini_tdir.sh. - Make ede.tdir test more predictable by using static data. - Fix checkconf test for dnscrypt and proxy port. 4 October 2022: George - Merge #764: Leniency for target discovery when under load (for NRDelegation changes). 4 October 2022: Wouter - Fix static analysis report to remove dead code from the rpz_callback_from_iterator_module function. - Fix to clean up after the acl_interface unit test. 3 October 2022: George - Merge #760: PROXYv2 downstream support. (New proxy-protocol-port configuration option). 3 October 2022: Wouter - Fix to remove erroneous TC flag from TCP upstream. - Fix test tdir skip report printout. - Fix windows compile, the identifier interface is defined in headers. - Fix to close errno block in comm_point_tcp_handle_read outside of ifdef. 26 September 2022: George - Better output for skipped tdir tests.
2024-02-17 21:06:18 +03:00
SECTION AUTHORITY
example.net. IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600
Import unbound 1.5.9
2016-08-20 14:08:26 +03:00
ENTRY_END
; example.com. zone
ENTRY_BEGIN
MATCH opcode qname qtype
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
example.com. IN NS
SECTION ANSWER
example.com. IN NS ns.example.com.
example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
ENTRY_END
ENTRY_BEGIN
MATCH opcode qname qtype
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
ns.example.com. IN AAAA
SECTION ANSWER
Import 1.19.1 (previous was 1.16.3) 2 November 2023: Wouter - Set version number to 1.19.0. - Tag for 1.19.0rc1 release. 1 November 2023: George - Mention flex and bison in README.md when building from repository source. 1 November 2023: Wouter - Fix SSL compile failure for definition in log_crypto_err_io_code_arg. - Fix SSL compile failure for other missing definitions in log_crypto_err_io_code_arg. - Fix compilation without openssl, remove unused function warning. 31 October 2023: George - Fix #941: dnscrypt doesn't work after upgrade to 1.18 with suggestion by dukeartem to also fix the udp_ancil with dnscrypt. 30 October 2023: George - Merge #930 from Stuart Henderson: add void to log_ident_revert_to_default declaration. 30 October 2023: Wouter - autoconf. 24 October 2023: George - Clearer configure text for missing protobuf-c development libraries. 20 October 2023: Wouter - Merge #951: Cachedb no store. The cachedb-no-store: yes option is used to stop cachedb from writing messages to the backend storage. It reads messages when data is available from the backend. The default is no. 19 October 2023: Wouter - Fix to print detailed errors when an SSL IO routine fails via SSL_get_error. 18 October 2023: George - Mailing list patches from Daniel Gröber for DNS64 fallback to plain AAAA when no A record exists for synthesis, and minor DNS64 code refactoring for better readability. - Fixes for the DNS64 patches. - Update the dns64_lookup.rpl test for the DNS64 fallback patch. - Merge #955 from buevsan: fix ipset wrong behavior. - Update testdata/ipset.tdir test for ipset fix. 17 October 2023: Wouter - Fix #954: Inconsistent RPZ handling for A record returned along with CNAME. 16 October 2023: George - Expose the script filename in the Python module environment 'mod_env' instead of the config_file structure which includes the linked list of scripts in a multi Python module setup; fixes #79. - Expose the configured listening and outgoing interfaces, if any, as a list of strings in the Python 'config_file' class instead of the current Swig object proxy; fixes #79. - For multi Python module setups, clean previously parsed module functions in __main__'s dictionary, if any, so that only current module functions are registered. 13 October 2023: George - Better fix for infinite loop when reading multiple lines of input on a broken remote control socket, by treating a zero byte line the same as transmission end. Addesses #947 and #948. 12 October 2023: Wouter - Merge #944: Disable EDNS DO. Disable the EDNS DO flag in upstream requests. This can be helpful for devices that cannot handle DNSSEC information. But it should not be enabled otherwise, because that would stop DNSSEC validation. The DNSSEC validation would not work for Unbound itself, and also not for downstream users. Default is no. The option is disable-edns-do: no 11 October 2023: George - Fix #850: [FR] Ability to use specific database in Redis, with new redis-logical-db configuration option. 11 October 2023: Wouter - Fix #949: "could not create control compt". - Fix that cachedb does not warn when serve-expired is disabled about use of serve-expired-reply-ttl and serve-expired-client-timeout. - Fix for #949: Fix pythonmod/ubmodule-tst.py for Python 3.x. 10 October 2023: George - Fix infinite loop when reading multiple lines of input on a broken remote control socket. Addesses #947 and #948. 9 October 2023: Wouter - Fix edns subnet so that queries with a source prefix of zero cause the recursor send no edns subnet option to the upstream. - Fix that printout of EDNS options shows the EDNS cookie option by name. 4 October 2023: Wouter - Fix #946: Forwarder returns servfail on upstream response noerror no data. 3 October 2023: George - Merge #881: Generalise the proxy protocol code. 2 October 2023: George - Fix misplaced comment. 22 September 2023: Wouter - Fix #942: 1.18.0 libunbound DNS regression when built without OpenSSL. 18 September 2023: Wouter - Fix rpz tcp-only action with rpz triggers nsdname and nsip. 15 September 2023: Wouter - Merge #936: Check for c99 with autoconf versions prior to 2.70. - Fix to remove two c99 notations. 14 September 2023: Wouter - Fix authority zone answers for obscured DNAMEs and delegations. 8 September 2023: Wouter - Fix send of udp retries when ENOBUFS is returned. It stops looping and also waits for the condition to go away. Reported by Florian Obser. 7 September 2023: Wouter - Fix to scrub resource records of type A and AAAA that have an inappropriate size. They are removed from responses. - Fix to move msgparse_rrset_remove_rr code to util/msgparse.c. - Fix to add EDE text when RRs have been removed due to length. - Fix to set ede match in unit test for rr length removal. - Fix to print EDE text in readable form in output logs. 6 September 2023: Wouter - Merge #931: Prevent warnings from -Wmissing-prototypes. 31 August 2023: Wouter - Fix autoconf 2.69 warnings in configure. - Fix #927: unbound 1.18.0 make test error. Fix make test without SHA1. 30 August 2023: Wouter - Fix for WKS call to getservbyname that creates allocation on exit in unit test by testing numbers first and testing from the services list later. 28 August 2023: Wouter - Fix for version generation race condition that ignored changes. 25 August 2023: Wouter - Fix compile error on NetBSD in util/netevent.h. 23 August 2023: Wouter - Tag for 1.18.0rc1 release. This became the 1.18.0 release on 30 aug 2023, with the fix from 25 aug, fix compile on NetBSD included. The repository continues with version 1.18.1. 22 August 2023: Wouter - Set version number to 1.18.0. 21 August 2023: Wouter - Debug Windows ci workflow. - Fix windows ci workflow to install bison and flex. - Fix for #925: unbound.service: Main process exited, code=killed, status=11/SEGV. Fixes cachedb configuration handling. - Fix #923: processQueryResponse() THROWAWAY should be mindful of fail_reply. - Fix unit test for unbound-control to work when threads are disabled, and fix cache dump check. 18 August 2023: Wouter - Fix for iter_dec_attempts that could cause a hang, part of capsforid and qname minimisation, depending on the settings. - Fix uninitialized memory passed in padding bytes of cmsg to sendmsg. - Fix stat_values test to work with dig that enables DNS cookies. 17 August 2023: Wouter - Merge PR #762: Downstream DNS Server Cookies a la RFC7873 and RFC9018. Create server cookies for clients that send client cookies. This needs to be explicitly turned on in the config file with: `answer-cookie: yes`. A `cookie-secret:` can be configured for anycast setups. Without one, a random cookie secret is generated. The acl option `allow_cookie` allows queries with either a valid cookie or over a stateful transport. The statistics output has `queries_cookie_valid` and `queries_cookie_client` and `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:` value determines a rate limit for queries with cookies, if desired. - Fix regional_alloc_init for potential unaligned source of the copy. - Fix ip_ratelimit test to work with dig that enables DNS cookies. 2 August 2023: George - Move a cache reply callback in worker.c closer to the cache reply generation. 1 August 2023: George - Merge #911 from natalie-reece: Exclude EDE before other EDNS options when there isn't enough space. - For #911: Try to trim EXTRA-TEXT (and LDNS_EDE_OTHER options altogether) before giving up on attaching EDE options. - More braces and formatting for Fix for EDNS EDE size calculation to avoid future bugs. - Fix to use the now cached EDE, if any, for CD_bit queries. 1 August 2023: Wouter - Fix for EDNS EDE size calculation. 31 July 2023: George - Merge #790 from Tom Carpay: Add support for EDE caching in cachedb and subnetcache. 31 July 2023: Wouter - iana portlist update. 30 July 2023: George - Merge #759 from Tom Carpay: Add EDE (RFC8914) caching. 28 July 2023: George - Fix unused variable compile warning for kernel timestamps in netevent.c 21 July 2023: George - Merge #857 from eaglegai: fix potential memory leaks when errors happen. - For #857: fix mixed declarations and code. - Merge #118 from mibere: Changed verbosity level for Redis init & deinit. - Merge #390 from Frank Riley: Add missing callbacks to the python module. - Cleaner failure code for callback functions in interface.i. - Merge #889 from borisVanhoof: Free memory in error case + remove unused function. - For #889: use netcat-openbsd instead of netcat-traditional. - For #889: Account for num_detached_states before possible mesh_state_delete when erroring out. 20 July 2023: George - Merge #909 from headshog: Numeric truncation when parsing TYPEXX and CLASSXX representation. - For #909: Fix return values. - Merge #901 from Sergei Trofimovich: config: improve handling of unknown modules. 20 July 2023: Wouter - For #909: Fix RR class comparison. 14 July 2023: George - More clear description of the different auth-zone behaviors on the man page. 13 July 2023: George - Merge #880 from chipitsine: services/authzone.c: remove redundant check. 11 July 2023: George - Merge #664 from tilan7763: Add prefetch support for subnet cache entries. - For #664: Easier code flow for subnetcache prefetching. - For #664: Add testcase. - For #664: Rename subnet_prefetch tests to subnet_global_prefetch to differentiate from the new subnet prefetch support. 3 July 2023: George - Merge #739: Add SVCB dohpath support. - Code cleanup for sldns_str2wire_svcparam_key_lookup. - Merge #802: add validation EDEs to queries where the CD bit is set. - For #802: Cleanup comments and add RCODE check for CD bit test case. - Skip the 00-lint test. splint is not maintained; it either does not work or produces false positives. Static analysis is handled in the clang test. 3 July 2023: Wouter - Fix #906: warning: ‘Py_SetProgramName’ is deprecated. - Fix dereference of NULL variable warning in mesh_do_callback. 29 June 2023: George - More fixes for reference counting for python module and clean up failure code. - Merge #827 from rcmcdonald91: Eliminate unnecessary Python reloading which causes memory leaks. 29 June 2023: Wouter - Fix python modules with multiple scripts, by incrementing reference counts. 27 June 2023: George - Merge #892: Add cachedb hit stat. Introduces 'num.query.cachedb' as a new statistical counter. - Remove warning about unknown cast-function-type warning pragma. 22 June 2023: Wouter - Merge #903: contrib: add yocto compatible init script. 15 June 2023: Philip - Fix for issue #887 (Timeouts to forward servers on BSD based system with ASLR) - Probably fixes #516 (Stream reuse does not work on Windows) as well 14 June 2023: George - Properly handle all return values of worker_check_request during early EDE code. - Do not check the incoming request more than once. 12 June 2023: Wouter - Merge #896: Fix: #895: pythonmodule: add all site-packages directories to sys.path. - Fix #895: python + sysconfig gives ANOTHER path comparing to distutils. - Fix for uncertain unit test for doh buffer size events. 25 May 2023: Wouter - Fix unbound-dnstap-socket printout when no query is present. - Fix unbound-dnstap-socket time fraction conversion for printout. 19 May 2023: Wouter - Fix RPZ removal of client-ip, nsip, nsdname triggers from IXFR. - Fix to remove unused variables from RPZ clientip data structure. 16 May 2023: Wouter - Fix #888: [FR] Use kernel timestamps for dnstap. - Fix to print debug log for ancillary data with correct IP address. 11 May 2023: Wouter - Fix warning in windows compile, in set_recvtimestamp. 4 May 2023: Wouter - Fix #885: Error: util/configlexer.c: No such file or directory, adds error messages explaining to install flex and bison. - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h. - Fix doxygen in addr_to_nat64 header definition. 1 May 2023: George - Merge #722 from David 'eqvinox' Lamparter: NAT64 support. - For #722: minor fixes, formatting, refactoring. 1 May 2023: Wouter - Fix RPZ IP responses with trigger rpz-drop on cache entries, that they are dropped. 26 April 2023: Philip - Fix issue #860: Bad interaction with 0 TTL records and serve-expired 26 April 2023: Wouter - Merge #882 from vvfedorenko: Features/dropqueuedpackets, with sock-queue-timeout option that drops packets that have been in the socket queue for too long. Added statistics num.queries_timed_out and query.queue_time_us.max that track the socket queue timeouts. - Fix for #882: small changes, date updated in Copyright for util/timeval_func.c and util/timeval_func.h. Man page entries and example entry. - Fix for #882: document variable to stop doxygen warning. 19 April 2023: Wouter - Fix for #878: Invalid IP address in unbound.conf causes Segmentation Fault on OpenBSD. 14 April 2023: Wouter - Merge #875: change obsolete txt URL in unbound-anchor.c to point to RFC 7958, and Fix #874. 13 April 2023: Wouter - Fix build badge, from failing travis link to github ci action link. 6 April 2023: Wouter - Fix for #870: Add test case for the qname minimisation and CNAME. 4 April 2023: Wouter - Fix #870: NXDOMAIN instead of NOERROR rcode when asked for existing CNAME record. 24 March 2023: Philip - Fix issue #676: Unencrypted query is sent when forward-tls-upstream: yes is used without tls-cert-bundle - Extra consistency check to make sure that when TLS is requested, either we set up a TLS connection or we return an error. 21 March 2023: Philip - Fix issue #851: reserved identifier violation 20 March 2023: Wouter - iana portlist update. 17 March 2023: George - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option to ignore the unexpected eof while reading in openssl >= 3. 16 March 2023: Wouter - Fix ssl.h include brackets, instead of quotes. 14 March 2023: Wouter - Fix unbound-dnstap-socket test program to reply the finish frame over a TLS connection correctly. 23 February 2023: Wouter - Fix for #852: Completion of error handling. 21 February 2023: Philip - Fix #825: Unexpected behavior with client-subnet-always-forward and serve-expired 10 February 2023: George - Clean up iterator/iterator.c::error_response_cache() and allow for better interaction with serve-expired, prefetch and cached error responses. 9 February 2023: George - Allow TTL refresh of expired error responses. - Add testcase for refreshing expired error responses. 9 February 2023: Wouter - Fix to ignore entirely empty responses, and try at another authority. This turns completely empty responses, a type of noerror/nodata into a servfail, but they do not conform to RFC2308, and the retry can fetch improved content. - Fix unit tests for spurious empty messages. - Fix consistency of unit test without roundrobin answers for the cnametooptout unit test. - Fix to git ignore the library symbol file that configure can create. 8 February 2023: Wouter - Fix #841: Unbound won't build with aaaa-filter-iterator.patch. 30 January 2023: George - Add duration variable for speed_local.test. 26 January 2023: Wouter - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes. 23 January 2023: George - Fix #833: [FR] Ability to set the Redis password. 23 January 2023: Wouter - Fix #835: [FR] Ability to use Redis unix sockets. 20 January 2023: Wouter - Merge #819: Added new static zone type block_a to suppress all A queries for specific zones. 19 January 2023: Wouter - Set max-udp-size default to 1232. This is the same default value as the default value for edns-buffer-size. It restricts client edns buffer size choices, and makes unbound behave similar to other DNS resolvers. The new choice, down from 4096 means it is harder to get large responses from Unbound. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Add harden-unknown-additional option. It removes unknown records from the authority section and additional section. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Set default for harden-unknown-additional to no. So that it does not hamper future protocol developments. - Fix test for new default. 18 January 2023: Wouter - Fix not following cleared RD flags potentially enables amplification DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab, Tsinghua University. The fix stops query loops, by refusing to send RD=0 queries to a forwarder, they still get answered from cache. 13 January 2023: Wouter - Merge #826: Аdd a metric about the maximum number of collisions in lrushah. - Improve documentation for #826, describe the large collisions amount. 9 January 2023: Wouter - Fix python module install path detection. - Fix python version detection in configure. 6 January 2023: Wouter - Fix #823: Response change to NODATA for some ANY queries since 1.12, tested on 1.16.1. - Fix wildcard in hyperlocal zone service degradation, reported by Sergey Kacheev. This fix is included in 1.17.1rc2. That became 1.17.1 on 12 Jan 2023, the code repo continues with 1.17.2. 1.17.1 excludes fix #823, it is included forwards. 5 January 2023: Wouter - Tag for 1.17.1 release. 2 January 2023: Wouter - Fix windows compile for libunbound subprocess reap comm point closes. - Update github workflows to use checkout v3. 14 December 2022: George - Merge #569 from JINMEI Tatuya: add keep-cache option to 'unbound-control reload' to keep caches. 13 December 2022: George - Expose 'statistics-inhibit-zero' as a configuration option; the default value retains Unbound's behavior. - Expose 'max-sent-count' as a configuration option; the default value retains Unbound's behavior. - Merge #461 from Christian Allred: Add max-query-restarts option. Exposes an internal configuration but the default value retains Unbound's behavior. 13 December 2022: Wouter - Merge #808: Wrap Makefile script's directory variables in quotes. - Fix to wrap Makefile scripts directory in quotes for uninstall. 1 December 2022: Wouter - Fix #773: When used with systemd-networkd, unbound does not start until systemd-networkd-wait-online.service times out. 30 November 2022: George - Add SVCB and HTTPS to the types removed by 'unbound-control flush'. - Clear documentation for interactivity between the subnet module and the serve-expired and prefetch configuration options. 30 November 2022: Wouter - Fix #782: Segmentation fault in stats.c:404. 28 November 2022: Wouter - Fix for the ignore of tcp events for closed comm points, preserve the use after free protection features. 23 November 2022: Philip - Merge #720 from jonathangray: fix use after free when WSACreateEvent() fails. 22 November 2022: George - Ignore expired error responses. 11 November 2022: Wouter - Fix #779: [doc] Missing documention in ub_resolve_event() for callback parameter was_ratelimited. 9 November 2022: George - Complementary fix for distutils.sysconfig deprecation in Python 3.10 to commit 62c5039ab9da42713e006e840b7578e01d66e7f2. 8 November 2022: Wouter - Fix to ignore tcp events for closed comm points. - Fix to make sure to not read again after a tcp comm point is closed. - Fix #775: libunbound: subprocess reap causes parent process reap to hang. - iana portlist update. 21 October 2022: George - Merge #767 from jonathangray: consistently use IPv4/IPv6 in unbound.conf.5. 21 October 2022: Wouter - Fix that cachedb does not store failures in the external cache. 18 October 2022: George - Clarify the use of MAX_SENT_COUNT in the iterator code. 17 October 2022: Wouter - testcode/dohclient sets log identity to its name. 14 October 2022: Wouter - Merge #768 from fobser: Arithmetic on a pointer to void is a GNU extension. - In unit test, print python script name list correctly. 13 October 2022: Wouter - Tag for 1.17.0 release. The code repository continues with 1.17.1. 11 October 2022: George - Fix PROXYv2 header read for TCP connections when no proxied addresses are provided. 7 October 2022: Wouter - Tag for 1.17.0rc1 release. 7 October 2022: George - Fix to stop possible loops in the tcp reuse code (write_wait list and tcp_wait list). Based on analysis and patch from Prad Seniappan and Karthik Umashankar. - Fix unit test to properly test the reuse_write_wait_pop function. 6 October 2022: Wouter - Fix to stop responses with TC flag from resulting in partial responses. It retries to fetch the data elsewhere, or fails the query and in depth fix removes the TC flag from the cached item. - Fix proxy length debug output printout typecasts. 5 October 2022: Wouter - Fix dnscrypt compile for proxy protocol code changes. 5 October 2022: George - Use DEBUG_TDIR from environment in mini_tdir.sh for debugging. - Fix string comparison in mini_tdir.sh. - Make ede.tdir test more predictable by using static data. - Fix checkconf test for dnscrypt and proxy port. 4 October 2022: George - Merge #764: Leniency for target discovery when under load (for NRDelegation changes). 4 October 2022: Wouter - Fix static analysis report to remove dead code from the rpz_callback_from_iterator_module function. - Fix to clean up after the acl_interface unit test. 3 October 2022: George - Merge #760: PROXYv2 downstream support. (New proxy-protocol-port configuration option). 3 October 2022: Wouter - Fix to remove erroneous TC flag from TCP upstream. - Fix test tdir skip report printout. - Fix windows compile, the identifier interface is defined in headers. - Fix to close errno block in comm_point_tcp_handle_read outside of ifdef. 26 September 2022: George - Better output for skipped tdir tests.
2024-02-17 21:06:18 +03:00
SECTION AUTHORITY
example.com. 3600 IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600
example.com. 3600 IN RRSIG SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AC23LvSspto6Zqctz05urK/2OKTnB+7nppMKInYkyjZbZotq2wjJA9s=
Import unbound 1.5.9
2016-08-20 14:08:26 +03:00
ENTRY_END
; response to DNSKEY priming query
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.com. IN DNSKEY
SECTION ANSWER
example.com. 3600 IN DNSKEY 256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
example.com. 3600 IN RRSIG DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
SECTION AUTHORITY
example.com. IN NS ns.example.com.
example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
ENTRY_END
; response to query of interest
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN A 10.20.30.40
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
SECTION AUTHORITY
example.com. IN NS ns.example.com.
example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
www.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
ENTRY_END
RANGE_END
STEP 1 QUERY
ENTRY_BEGIN
REPLY RD DO
SECTION QUESTION
www.example.com. IN A
ENTRY_END
; recursion happens here.
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA AD DO NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
www.example.com. IN A 10.20.30.40
www.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
SECTION AUTHORITY
example.com. IN NS ns.example.com.
example.com. 3600 IN RRSIG NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
ENTRY_END
; make sure glue fetch is done.
STEP 11 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
ns.example.net. IN AAAA
ENTRY_END
STEP 12 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA NOERROR
SECTION QUESTION
ns.example.net. IN AAAA
SECTION ANSWER
SECTION AUTHORITY
Import 1.19.1 (previous was 1.16.3) 2 November 2023: Wouter - Set version number to 1.19.0. - Tag for 1.19.0rc1 release. 1 November 2023: George - Mention flex and bison in README.md when building from repository source. 1 November 2023: Wouter - Fix SSL compile failure for definition in log_crypto_err_io_code_arg. - Fix SSL compile failure for other missing definitions in log_crypto_err_io_code_arg. - Fix compilation without openssl, remove unused function warning. 31 October 2023: George - Fix #941: dnscrypt doesn't work after upgrade to 1.18 with suggestion by dukeartem to also fix the udp_ancil with dnscrypt. 30 October 2023: George - Merge #930 from Stuart Henderson: add void to log_ident_revert_to_default declaration. 30 October 2023: Wouter - autoconf. 24 October 2023: George - Clearer configure text for missing protobuf-c development libraries. 20 October 2023: Wouter - Merge #951: Cachedb no store. The cachedb-no-store: yes option is used to stop cachedb from writing messages to the backend storage. It reads messages when data is available from the backend. The default is no. 19 October 2023: Wouter - Fix to print detailed errors when an SSL IO routine fails via SSL_get_error. 18 October 2023: George - Mailing list patches from Daniel Gröber for DNS64 fallback to plain AAAA when no A record exists for synthesis, and minor DNS64 code refactoring for better readability. - Fixes for the DNS64 patches. - Update the dns64_lookup.rpl test for the DNS64 fallback patch. - Merge #955 from buevsan: fix ipset wrong behavior. - Update testdata/ipset.tdir test for ipset fix. 17 October 2023: Wouter - Fix #954: Inconsistent RPZ handling for A record returned along with CNAME. 16 October 2023: George - Expose the script filename in the Python module environment 'mod_env' instead of the config_file structure which includes the linked list of scripts in a multi Python module setup; fixes #79. - Expose the configured listening and outgoing interfaces, if any, as a list of strings in the Python 'config_file' class instead of the current Swig object proxy; fixes #79. - For multi Python module setups, clean previously parsed module functions in __main__'s dictionary, if any, so that only current module functions are registered. 13 October 2023: George - Better fix for infinite loop when reading multiple lines of input on a broken remote control socket, by treating a zero byte line the same as transmission end. Addesses #947 and #948. 12 October 2023: Wouter - Merge #944: Disable EDNS DO. Disable the EDNS DO flag in upstream requests. This can be helpful for devices that cannot handle DNSSEC information. But it should not be enabled otherwise, because that would stop DNSSEC validation. The DNSSEC validation would not work for Unbound itself, and also not for downstream users. Default is no. The option is disable-edns-do: no 11 October 2023: George - Fix #850: [FR] Ability to use specific database in Redis, with new redis-logical-db configuration option. 11 October 2023: Wouter - Fix #949: "could not create control compt". - Fix that cachedb does not warn when serve-expired is disabled about use of serve-expired-reply-ttl and serve-expired-client-timeout. - Fix for #949: Fix pythonmod/ubmodule-tst.py for Python 3.x. 10 October 2023: George - Fix infinite loop when reading multiple lines of input on a broken remote control socket. Addesses #947 and #948. 9 October 2023: Wouter - Fix edns subnet so that queries with a source prefix of zero cause the recursor send no edns subnet option to the upstream. - Fix that printout of EDNS options shows the EDNS cookie option by name. 4 October 2023: Wouter - Fix #946: Forwarder returns servfail on upstream response noerror no data. 3 October 2023: George - Merge #881: Generalise the proxy protocol code. 2 October 2023: George - Fix misplaced comment. 22 September 2023: Wouter - Fix #942: 1.18.0 libunbound DNS regression when built without OpenSSL. 18 September 2023: Wouter - Fix rpz tcp-only action with rpz triggers nsdname and nsip. 15 September 2023: Wouter - Merge #936: Check for c99 with autoconf versions prior to 2.70. - Fix to remove two c99 notations. 14 September 2023: Wouter - Fix authority zone answers for obscured DNAMEs and delegations. 8 September 2023: Wouter - Fix send of udp retries when ENOBUFS is returned. It stops looping and also waits for the condition to go away. Reported by Florian Obser. 7 September 2023: Wouter - Fix to scrub resource records of type A and AAAA that have an inappropriate size. They are removed from responses. - Fix to move msgparse_rrset_remove_rr code to util/msgparse.c. - Fix to add EDE text when RRs have been removed due to length. - Fix to set ede match in unit test for rr length removal. - Fix to print EDE text in readable form in output logs. 6 September 2023: Wouter - Merge #931: Prevent warnings from -Wmissing-prototypes. 31 August 2023: Wouter - Fix autoconf 2.69 warnings in configure. - Fix #927: unbound 1.18.0 make test error. Fix make test without SHA1. 30 August 2023: Wouter - Fix for WKS call to getservbyname that creates allocation on exit in unit test by testing numbers first and testing from the services list later. 28 August 2023: Wouter - Fix for version generation race condition that ignored changes. 25 August 2023: Wouter - Fix compile error on NetBSD in util/netevent.h. 23 August 2023: Wouter - Tag for 1.18.0rc1 release. This became the 1.18.0 release on 30 aug 2023, with the fix from 25 aug, fix compile on NetBSD included. The repository continues with version 1.18.1. 22 August 2023: Wouter - Set version number to 1.18.0. 21 August 2023: Wouter - Debug Windows ci workflow. - Fix windows ci workflow to install bison and flex. - Fix for #925: unbound.service: Main process exited, code=killed, status=11/SEGV. Fixes cachedb configuration handling. - Fix #923: processQueryResponse() THROWAWAY should be mindful of fail_reply. - Fix unit test for unbound-control to work when threads are disabled, and fix cache dump check. 18 August 2023: Wouter - Fix for iter_dec_attempts that could cause a hang, part of capsforid and qname minimisation, depending on the settings. - Fix uninitialized memory passed in padding bytes of cmsg to sendmsg. - Fix stat_values test to work with dig that enables DNS cookies. 17 August 2023: Wouter - Merge PR #762: Downstream DNS Server Cookies a la RFC7873 and RFC9018. Create server cookies for clients that send client cookies. This needs to be explicitly turned on in the config file with: `answer-cookie: yes`. A `cookie-secret:` can be configured for anycast setups. Without one, a random cookie secret is generated. The acl option `allow_cookie` allows queries with either a valid cookie or over a stateful transport. The statistics output has `queries_cookie_valid` and `queries_cookie_client` and `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:` value determines a rate limit for queries with cookies, if desired. - Fix regional_alloc_init for potential unaligned source of the copy. - Fix ip_ratelimit test to work with dig that enables DNS cookies. 2 August 2023: George - Move a cache reply callback in worker.c closer to the cache reply generation. 1 August 2023: George - Merge #911 from natalie-reece: Exclude EDE before other EDNS options when there isn't enough space. - For #911: Try to trim EXTRA-TEXT (and LDNS_EDE_OTHER options altogether) before giving up on attaching EDE options. - More braces and formatting for Fix for EDNS EDE size calculation to avoid future bugs. - Fix to use the now cached EDE, if any, for CD_bit queries. 1 August 2023: Wouter - Fix for EDNS EDE size calculation. 31 July 2023: George - Merge #790 from Tom Carpay: Add support for EDE caching in cachedb and subnetcache. 31 July 2023: Wouter - iana portlist update. 30 July 2023: George - Merge #759 from Tom Carpay: Add EDE (RFC8914) caching. 28 July 2023: George - Fix unused variable compile warning for kernel timestamps in netevent.c 21 July 2023: George - Merge #857 from eaglegai: fix potential memory leaks when errors happen. - For #857: fix mixed declarations and code. - Merge #118 from mibere: Changed verbosity level for Redis init & deinit. - Merge #390 from Frank Riley: Add missing callbacks to the python module. - Cleaner failure code for callback functions in interface.i. - Merge #889 from borisVanhoof: Free memory in error case + remove unused function. - For #889: use netcat-openbsd instead of netcat-traditional. - For #889: Account for num_detached_states before possible mesh_state_delete when erroring out. 20 July 2023: George - Merge #909 from headshog: Numeric truncation when parsing TYPEXX and CLASSXX representation. - For #909: Fix return values. - Merge #901 from Sergei Trofimovich: config: improve handling of unknown modules. 20 July 2023: Wouter - For #909: Fix RR class comparison. 14 July 2023: George - More clear description of the different auth-zone behaviors on the man page. 13 July 2023: George - Merge #880 from chipitsine: services/authzone.c: remove redundant check. 11 July 2023: George - Merge #664 from tilan7763: Add prefetch support for subnet cache entries. - For #664: Easier code flow for subnetcache prefetching. - For #664: Add testcase. - For #664: Rename subnet_prefetch tests to subnet_global_prefetch to differentiate from the new subnet prefetch support. 3 July 2023: George - Merge #739: Add SVCB dohpath support. - Code cleanup for sldns_str2wire_svcparam_key_lookup. - Merge #802: add validation EDEs to queries where the CD bit is set. - For #802: Cleanup comments and add RCODE check for CD bit test case. - Skip the 00-lint test. splint is not maintained; it either does not work or produces false positives. Static analysis is handled in the clang test. 3 July 2023: Wouter - Fix #906: warning: ‘Py_SetProgramName’ is deprecated. - Fix dereference of NULL variable warning in mesh_do_callback. 29 June 2023: George - More fixes for reference counting for python module and clean up failure code. - Merge #827 from rcmcdonald91: Eliminate unnecessary Python reloading which causes memory leaks. 29 June 2023: Wouter - Fix python modules with multiple scripts, by incrementing reference counts. 27 June 2023: George - Merge #892: Add cachedb hit stat. Introduces 'num.query.cachedb' as a new statistical counter. - Remove warning about unknown cast-function-type warning pragma. 22 June 2023: Wouter - Merge #903: contrib: add yocto compatible init script. 15 June 2023: Philip - Fix for issue #887 (Timeouts to forward servers on BSD based system with ASLR) - Probably fixes #516 (Stream reuse does not work on Windows) as well 14 June 2023: George - Properly handle all return values of worker_check_request during early EDE code. - Do not check the incoming request more than once. 12 June 2023: Wouter - Merge #896: Fix: #895: pythonmodule: add all site-packages directories to sys.path. - Fix #895: python + sysconfig gives ANOTHER path comparing to distutils. - Fix for uncertain unit test for doh buffer size events. 25 May 2023: Wouter - Fix unbound-dnstap-socket printout when no query is present. - Fix unbound-dnstap-socket time fraction conversion for printout. 19 May 2023: Wouter - Fix RPZ removal of client-ip, nsip, nsdname triggers from IXFR. - Fix to remove unused variables from RPZ clientip data structure. 16 May 2023: Wouter - Fix #888: [FR] Use kernel timestamps for dnstap. - Fix to print debug log for ancillary data with correct IP address. 11 May 2023: Wouter - Fix warning in windows compile, in set_recvtimestamp. 4 May 2023: Wouter - Fix #885: Error: util/configlexer.c: No such file or directory, adds error messages explaining to install flex and bison. - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h. - Fix doxygen in addr_to_nat64 header definition. 1 May 2023: George - Merge #722 from David 'eqvinox' Lamparter: NAT64 support. - For #722: minor fixes, formatting, refactoring. 1 May 2023: Wouter - Fix RPZ IP responses with trigger rpz-drop on cache entries, that they are dropped. 26 April 2023: Philip - Fix issue #860: Bad interaction with 0 TTL records and serve-expired 26 April 2023: Wouter - Merge #882 from vvfedorenko: Features/dropqueuedpackets, with sock-queue-timeout option that drops packets that have been in the socket queue for too long. Added statistics num.queries_timed_out and query.queue_time_us.max that track the socket queue timeouts. - Fix for #882: small changes, date updated in Copyright for util/timeval_func.c and util/timeval_func.h. Man page entries and example entry. - Fix for #882: document variable to stop doxygen warning. 19 April 2023: Wouter - Fix for #878: Invalid IP address in unbound.conf causes Segmentation Fault on OpenBSD. 14 April 2023: Wouter - Merge #875: change obsolete txt URL in unbound-anchor.c to point to RFC 7958, and Fix #874. 13 April 2023: Wouter - Fix build badge, from failing travis link to github ci action link. 6 April 2023: Wouter - Fix for #870: Add test case for the qname minimisation and CNAME. 4 April 2023: Wouter - Fix #870: NXDOMAIN instead of NOERROR rcode when asked for existing CNAME record. 24 March 2023: Philip - Fix issue #676: Unencrypted query is sent when forward-tls-upstream: yes is used without tls-cert-bundle - Extra consistency check to make sure that when TLS is requested, either we set up a TLS connection or we return an error. 21 March 2023: Philip - Fix issue #851: reserved identifier violation 20 March 2023: Wouter - iana portlist update. 17 March 2023: George - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option to ignore the unexpected eof while reading in openssl >= 3. 16 March 2023: Wouter - Fix ssl.h include brackets, instead of quotes. 14 March 2023: Wouter - Fix unbound-dnstap-socket test program to reply the finish frame over a TLS connection correctly. 23 February 2023: Wouter - Fix for #852: Completion of error handling. 21 February 2023: Philip - Fix #825: Unexpected behavior with client-subnet-always-forward and serve-expired 10 February 2023: George - Clean up iterator/iterator.c::error_response_cache() and allow for better interaction with serve-expired, prefetch and cached error responses. 9 February 2023: George - Allow TTL refresh of expired error responses. - Add testcase for refreshing expired error responses. 9 February 2023: Wouter - Fix to ignore entirely empty responses, and try at another authority. This turns completely empty responses, a type of noerror/nodata into a servfail, but they do not conform to RFC2308, and the retry can fetch improved content. - Fix unit tests for spurious empty messages. - Fix consistency of unit test without roundrobin answers for the cnametooptout unit test. - Fix to git ignore the library symbol file that configure can create. 8 February 2023: Wouter - Fix #841: Unbound won't build with aaaa-filter-iterator.patch. 30 January 2023: George - Add duration variable for speed_local.test. 26 January 2023: Wouter - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes. 23 January 2023: George - Fix #833: [FR] Ability to set the Redis password. 23 January 2023: Wouter - Fix #835: [FR] Ability to use Redis unix sockets. 20 January 2023: Wouter - Merge #819: Added new static zone type block_a to suppress all A queries for specific zones. 19 January 2023: Wouter - Set max-udp-size default to 1232. This is the same default value as the default value for edns-buffer-size. It restricts client edns buffer size choices, and makes unbound behave similar to other DNS resolvers. The new choice, down from 4096 means it is harder to get large responses from Unbound. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Add harden-unknown-additional option. It removes unknown records from the authority section and additional section. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Set default for harden-unknown-additional to no. So that it does not hamper future protocol developments. - Fix test for new default. 18 January 2023: Wouter - Fix not following cleared RD flags potentially enables amplification DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab, Tsinghua University. The fix stops query loops, by refusing to send RD=0 queries to a forwarder, they still get answered from cache. 13 January 2023: Wouter - Merge #826: Аdd a metric about the maximum number of collisions in lrushah. - Improve documentation for #826, describe the large collisions amount. 9 January 2023: Wouter - Fix python module install path detection. - Fix python version detection in configure. 6 January 2023: Wouter - Fix #823: Response change to NODATA for some ANY queries since 1.12, tested on 1.16.1. - Fix wildcard in hyperlocal zone service degradation, reported by Sergey Kacheev. This fix is included in 1.17.1rc2. That became 1.17.1 on 12 Jan 2023, the code repo continues with 1.17.2. 1.17.1 excludes fix #823, it is included forwards. 5 January 2023: Wouter - Tag for 1.17.1 release. 2 January 2023: Wouter - Fix windows compile for libunbound subprocess reap comm point closes. - Update github workflows to use checkout v3. 14 December 2022: George - Merge #569 from JINMEI Tatuya: add keep-cache option to 'unbound-control reload' to keep caches. 13 December 2022: George - Expose 'statistics-inhibit-zero' as a configuration option; the default value retains Unbound's behavior. - Expose 'max-sent-count' as a configuration option; the default value retains Unbound's behavior. - Merge #461 from Christian Allred: Add max-query-restarts option. Exposes an internal configuration but the default value retains Unbound's behavior. 13 December 2022: Wouter - Merge #808: Wrap Makefile script's directory variables in quotes. - Fix to wrap Makefile scripts directory in quotes for uninstall. 1 December 2022: Wouter - Fix #773: When used with systemd-networkd, unbound does not start until systemd-networkd-wait-online.service times out. 30 November 2022: George - Add SVCB and HTTPS to the types removed by 'unbound-control flush'. - Clear documentation for interactivity between the subnet module and the serve-expired and prefetch configuration options. 30 November 2022: Wouter - Fix #782: Segmentation fault in stats.c:404. 28 November 2022: Wouter - Fix for the ignore of tcp events for closed comm points, preserve the use after free protection features. 23 November 2022: Philip - Merge #720 from jonathangray: fix use after free when WSACreateEvent() fails. 22 November 2022: George - Ignore expired error responses. 11 November 2022: Wouter - Fix #779: [doc] Missing documention in ub_resolve_event() for callback parameter was_ratelimited. 9 November 2022: George - Complementary fix for distutils.sysconfig deprecation in Python 3.10 to commit 62c5039ab9da42713e006e840b7578e01d66e7f2. 8 November 2022: Wouter - Fix to ignore tcp events for closed comm points. - Fix to make sure to not read again after a tcp comm point is closed. - Fix #775: libunbound: subprocess reap causes parent process reap to hang. - iana portlist update. 21 October 2022: George - Merge #767 from jonathangray: consistently use IPv4/IPv6 in unbound.conf.5. 21 October 2022: Wouter - Fix that cachedb does not store failures in the external cache. 18 October 2022: George - Clarify the use of MAX_SENT_COUNT in the iterator code. 17 October 2022: Wouter - testcode/dohclient sets log identity to its name. 14 October 2022: Wouter - Merge #768 from fobser: Arithmetic on a pointer to void is a GNU extension. - In unit test, print python script name list correctly. 13 October 2022: Wouter - Tag for 1.17.0 release. The code repository continues with 1.17.1. 11 October 2022: George - Fix PROXYv2 header read for TCP connections when no proxied addresses are provided. 7 October 2022: Wouter - Tag for 1.17.0rc1 release. 7 October 2022: George - Fix to stop possible loops in the tcp reuse code (write_wait list and tcp_wait list). Based on analysis and patch from Prad Seniappan and Karthik Umashankar. - Fix unit test to properly test the reuse_write_wait_pop function. 6 October 2022: Wouter - Fix to stop responses with TC flag from resulting in partial responses. It retries to fetch the data elsewhere, or fails the query and in depth fix removes the TC flag from the cached item. - Fix proxy length debug output printout typecasts. 5 October 2022: Wouter - Fix dnscrypt compile for proxy protocol code changes. 5 October 2022: George - Use DEBUG_TDIR from environment in mini_tdir.sh for debugging. - Fix string comparison in mini_tdir.sh. - Make ede.tdir test more predictable by using static data. - Fix checkconf test for dnscrypt and proxy port. 4 October 2022: George - Merge #764: Leniency for target discovery when under load (for NRDelegation changes). 4 October 2022: Wouter - Fix static analysis report to remove dead code from the rpz_callback_from_iterator_module function. - Fix to clean up after the acl_interface unit test. 3 October 2022: George - Merge #760: PROXYv2 downstream support. (New proxy-protocol-port configuration option). 3 October 2022: Wouter - Fix to remove erroneous TC flag from TCP upstream. - Fix test tdir skip report printout. - Fix windows compile, the identifier interface is defined in headers. - Fix to close errno block in comm_point_tcp_handle_read outside of ifdef. 26 September 2022: George - Better output for skipped tdir tests.
2024-02-17 21:06:18 +03:00
example.net. IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600
Import unbound 1.5.9
2016-08-20 14:08:26 +03:00
SECTION ADDITIONAL
ENTRY_END
SCENARIO_END