Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NetBSD/external/bsd/unbound/dist/testdata/iter_lamescrub.rpl

154 lines
3.9 KiB
Plaintext
Raw Permalink Normal View History

Import unbound 1.5.9
2016-08-20 14:08:26 +03:00
; config options
Import unbound-1.7.3 19 June 2018: Wouter - Fix for unbound-control on Windows and set TCP socket parameters more closely. - Fix windows unbound-control no cert bad file descriptor error. 18 June 2018: Wouter - Fix that control-use-cert: no works for 127.0.0.1 to disable certs. - Fix unbound-checkconf for control-use-cert. 15 June 2018: Wouter - tag for 1.7.3rc1. 14 June 2018: Wouter - #4103: Fix that auth-zone does not insist on SOA record first in file for url downloads. - Fix that first control-interface determines if TLS is used. Warn when IP address interfaces are used without TLS. - Fix nettle compile. 12 June 2018: Ralph - Don't count CNAME response types received during qname minimisation as query restart. 12 June 2018: Wouter - #4102 for NSD, but for Unbound. Named unix pipes do not use certificate and key files, access can be restricted with file and directory permissions. The option control-use-cert is no longer used, and ignored if found in unbound.conf. - Rename tls-additional-ports to tls-additional-port, because every line adds one port. - Fix buffer size warning in unit test. - remade dependencies in the Makefile. 6 June 2018: Wouter - Patch to fix openwrt for mac os build darwin detection in configure. 5 June 2018: Wouter - Fix crash if ratelimit taken into use with unbound-control instead of with unbound.conf. 4 June 2018: Wouter - Fix deadlock caused by incoming notify for auth-zone. - tag for 1.7.2rc1, became 1.7.2 release on 11 June 2018, trunk is 1.7.3 in development from this point. - #4100: Fix stub reprime when it becomes useless. 1 June 2018: Wouter - Rename additional-tls-port to tls-additional-ports. The older name is accepted for backwards compatibility. 30 May 2018: Wouter - Patch from Syzdek: Add ability to ignore RD bit and treat all requests as if the RD bit is set. 29 May 2018: Wouter - in compat/arc4random call getentropy_urandom when getentropy fails with ENOSYS. - Fix that fallback for windows port. 28 May 2018: Wouter - Fix windows tcp and tls spin on events. - Add routine from getdns to add windows cert store to the SSL_CTX. - tls-win-cert option that adds the system certificate store for authenticating DNS-over-TLS connections. It can be used instead of the tls-cert-bundle option, or with it to add certificates. 25 May 2018: Wouter - For TCP and TLS connections that don't establish, perform address update in infra cache, so future selections can exclude them. - Fix that tcp sticky events are removed for closed fd on windows. - Fix close events for tcp only. 24 May 2018: Wouter - Fix that libunbound can do DNS-over-TLS, when configured. - Fix that windows unbound service can use DNS-over-TLS. - unbound-host initializes ssl (for potential DNS-over-TLS usage inside libunbound), when ssl upstream or a cert-bundle is configured. 23 May 2018: Wouter - Use accept4 to speed up incoming TCP (and TLS) connections, available on Linux, FreeBSD and OpenBSD. 17 May 2018: Ralph - Qname minimisation default changed to yes. 15 May 2018: Wouter - Fix low-rtt-pct to low-rtt-permil, as it is parts in one thousand. 11 May 2018: Wouter - Fix contrib/libunbound.pc for libssl libcrypto references, from https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=226914 7 May 2018: Wouter - Fix windows to not have sticky TLS events for TCP. - Fix read of DNS over TLS length and data in one read call. - Fix mesh state assertion failure due to callback removal. 3 May 2018: Wouter - Fix that configure --with-libhiredis also turns on cachedb. - Fix gcc 8 buffer warning in testcode. - Fix function type cast warning in libunbound context callback type. 2 May 2018: Wouter - Fix fail to reject dead peers in forward-zone, with ssl-upstream. 1 May 2018: Wouter - Fix that unbound-control reload frees the rrset keys and returns the memory pages to the system. 30 April 2018: Wouter - Fix spelling error in man page and note defaults as no instead of off. 26 April 2018: Wouter - Fix for crash in daemon_cleanup with dnstap during reload, from Saksham Manchanda. - Also that for dnscrypt. - tag for 1.7.1rc1 release. Became 1.7.1 release on 3 May, trunk is from here 1.7.2 in development. 25 April 2018: Ralph - Fix memory leak when caching wildcard records for aggressive NSEC use 24 April 2018: Wouter - Fix contrib/fastrpz.patch for this release. - Fix auth https for libev. 24 April 2018: Ralph - Added root-key-sentinel support 23 April 2018: Wouter - makedist uses bz2 for expat code, instead of tar.gz. - Fix #4092: libunbound: use-caps-for-id lacks colon in config_set_option. - auth zone http download stores exact copy of downloaded file, including comments in the file. - Fix sldns parse failure for CDS alternate delete syntax empty hex. - Attempt for auth zone fix; add of callback in mesh gets from callback does not skip callback of result. - Fix cname classification with qname minimisation enabled. - list_auth_zones unbound-control command. 20 April 2018: Wouter - man page documentation for dns-over-tls forward-addr '#' notation. - removed free from failed parse case. - Fix #4091: Fix that reload of auth-zone does not merge the zonefile with the previous contents. - Delete auth zone when removed from config. 19 April 2018: Wouter - Can set tls authentication with forward-addr: IP#tls.auth.name And put the public cert bundle in tls-cert-bundle: "ca-bundle.pem". such as forward-addr: 9.9.9.9@853#dns.quad9.net or 1.1.1.1@853#cloudflare-dns.com - Fix #658: unbound using TLS in a forwarding configuration does not verify the server's certificate (RFC 8310 support). - For addr with #authname and no @port notation, the default is 853. 18 April 2018: Wouter - Fix auth-zone retry timer to be on schedule with retry timeout, with backoff. Also time a refresh at the zone expiry. 17 April 2018: Wouter - auth zone notify work. - allow-notify: config statement for auth-zones. - unit test for allow-notify 16 April 2018: Wouter - Fix auth zone target lookup iterator. - auth zone notify with prefix - auth zone notify work. 13 April 2018: Wouter - Fix for max include depth for authzones. - Fix memory free on fail for $INCLUDE in authzone. - Fix that an internal error to look up the wrong rr type for auth zone gets stopped, before trying to send there. - auth zone notify work. 10 April 2018: Ralph - num.query.aggressive.NOERROR and num.query.aggressive.NXDOMAIN statistics counters. 10 April 2018: Wouter - documentation for low-rtt and low-rtt-pct. - auth zone notify work. 9 April 2018: Wouter - Fix that flush_zone sets prefetch ttl expired, so that with serve-expired enabled it'll start prefetching those entries. - num.query.authzone.up and num.query.authzone.down statistics counters. - Fix downstream auth zone, only fallback when auth zone fails to answer and fallback is enabled. - Accept both option names with and without colon for get_option and set_option. - low-rtt and low-rtt-pct in unbound.conf enable the server selection of fast servers for some percentage of the time. 5 April 2018: Wouter - Combine write of tcp length and tcp query for dns over tls. - nitpick fixes in example.conf. - Fix above stub queries for type NS and useless delegation point. - Fix unbound-control over pipe with openssl 1.1.1, the TLSv1.3 tls_choose_sigalg routine does not allow the ciphers for the pipe, so use TLSv1.2. - ED448 support. 3 April 2018: Wouter - Fix #4043: make test fails due to v6 presentation issue in macOS. - Fix unable to resolve after new WLAN connection, due to auth-zone failing with a forwarder set. Now, auth-zone is only used for answers (not referrals) when a forwarder is set. 29 March 2018: Ralph - Check "result" in dup_all(), by Florian Obser. 23 March 2018: Ralph - Fix unbound-control get_option aggressive-nsec 21 March 2018: Ralph - Do not use cached NSEC records to generate negative answers for domains under DNSSEC Negative Trust Anchors. 19 March 2018: Wouter - iana port update. 16 March 2018: Wouter - corrected a minor typo in the changelog. - move htobe64/be64toh portability code to cachedb.c. 15 March 2018: Wouter - Add --with-libhiredis, unbound support for a new cachedb backend that uses a Redis server as the storage. This implementation depends on the hiredis client library (https://redislabs.com/lp/hiredis/). And unbound should be built with both --enable-cachedb and --with-libhiredis[=PATH] (where $PATH/include/hiredis/hiredis.h should exist). Patch from Jinmei Tatuya (Infoblox). - Fix #3817: core dump happens in libunbound delete, when queued servfail hits deleted message queue. - Create additional tls service interfaces by opening them on other portnumbers and listing the portnumbers as additional-tls-port: nr. 13 March 2018: Wouter - Fix typo in documentation. - Fix #3736: Fix 0 TTL domains stuck on SERVFAIL unless manually flushed with serve-expired on. 12 March 2018: Wouter - Added documentation for aggressive-nsec: yes. - tag 1.7.0rc3. That became the 1.7.0 release on 15 Mar, trunk now has 1.7.1 in development. - Fix #3727: Protocol name is TLS, options have been renamed but documentation is not consistent. - Check IXFR start serial. 9 March 2018: Wouter - Fix #3598: Fix swig build issue on rhel6 based system. configure --disable-swig-version-check stops the swig version check. 8 March 2018: Wouter - tag 1.7.0rc2. 7 March 2018: Wouter - Fixed contrib/fastrpz.patch, even though this already applied cleanly for me, now also for others. - patch to log creates keytag queries, from A. Schulze. - patch suggested by Debian lintian: allow to -> allow one to, from A. Schulze. - Attempt to remove warning about trailing whitespace. 6 March 2018: Wouter - Reverted fix for #3512, this may not be the best way forward; although it could be changed at a later time, to stay similar to other implementations. - svn trunk contains 1.7.0, this is the number for the next release. - Fix for windows compile. - tag 1.7.0rc1. 5 March 2018: Wouter - Fix to check define of DSA for when openssl is without deprecated. - iana port update. - Fix #3582: Squelch address already in use log when reuseaddr option causes same port to be used twice for tcp connections. 27 February 2018: Wouter - Fixup contrib/fastrpz.patch so that it applies. - Fix compile without threads, and remove unused variable. - Fix compile with staticexe and python module. - Fix nettle compile. 22 February 2018: Ralph - Save wildcard RRset from answer with original owner for use in aggressive NSEC. 21 February 2018: Wouter - Fix #3512: unbound incorrectly reports SERVFAIL for CAA query when there is a CNAME loop. - Fix validation for CNAME loops. When it detects a cname loop, by finding the cname, cname in the existing list, it returns the partial result with the validation result up to then. - more robust cachedump rrset routine. 19 February 2018: Wouter - Fix #3505: Documentation for default local zones references wrong RFC. - Fix #3494: local-zone noview can be used to break out of the view to the global local zone contents, for queries for that zone. - Fix for more maintainable code in localzone. 16 February 2018: Wouter - Fixes for clang static analyzer, the missing ; in edns-subnet/addrtree.c after the assert made clang analyzer produce a failure to analyze it. 13 February 2018: Ralph - Aggressive NSEC tests 13 February 2018: Wouter - tls-cert-bundle option in unbound.conf enables TLS authentication. - iana port update. 12 February 2018: Wouter - Unit test for auth zone https url download. 12 February 2018: Ralph - Added tests with wildcard expanded NSEC records (CVE-2017-15105 test) - Processed aggressive NSEC code review remarks Wouter 8 February 2018: Ralph - Aggressive use of NSEC implementation. Use cached NSEC records to generate NXDOMAIN, NODATA and positive wildcard answers. 8 February 2018: Wouter - iana port update. - auth zone url config. 5 February 2018: Wouter - Fix #3451: dnstap not building when you have a separate build dir. And removed protoc warning, set dnstap.proto syntax to proto2. - auth-zone provides a way to configure RFC7706 from unbound.conf, eg. with auth-zone: name: "." for-downstream: no for-upstream: yes fallback-enabled: yes and masters or a zonefile with data. 2 February 2018: Wouter - Fix unfreed locks in log and arc4random at exit of unbound. - unit test with valgrind - Fix lock race condition in dns cache dname synthesis. - lock subnet new item before insertion to please checklocks, no modification of critical regions outside of lock region. 1 February 2018: Wouter - fix unaligned structure making a false positive in checklock unitialised memory. 29 January 2018: Ralph - Use NSEC with longest ce to prove wildcard absence. - Only use *.ce to prove wildcard absence, no longer names. 25 January 2018: Wouter - ltrace.conf file for libunbound in contrib. 23 January 2018: Wouter - Fix that unbound-checkconf -f flag works with auto-trust-anchor-file for startup scripts to get the full pathname(s) of anchor file(s). - Print fatal errors about remote control setup before log init, so that it is printed to console. 22 January 2018: Wouter - Accept tls-upstream in unbound.conf, the ssl-upstream keyword is also recognized and means the same. Also for tls-port, tls-service-key, tls-service-pem, stub-tls-upstream and forward-tls-upstream. - Fix #3397: Fix that cachedb could return a partial CNAME chain. - Fix #3397: Fix that when the cache contains an unsigned DNAME in the middle of a cname chain, a result without the DNAME could be returned.
2018-09-03 17:08:55 +03:00
server:
qname-minimisation: "no"
Import unbound 1.5.9
2016-08-20 14:08:26 +03:00
stub-zone:
name: "."
stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET.
CONFIG_END
SCENARIO_BEGIN Test lameness detection after scrubber.
; K.ROOT-SERVERS.NET.
RANGE_BEGIN 0 100
ADDRESS 193.0.14.129
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
. IN NS
SECTION ANSWER
. IN NS K.ROOT-SERVERS.NET.
SECTION ADDITIONAL
K.ROOT-SERVERS.NET. IN A 193.0.14.129
ENTRY_END
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id copy_query
REPLY QR NOERROR
SECTION QUESTION
com. IN A
SECTION AUTHORITY
com. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
a.gtld-servers.net. IN AAAA
SECTION ANSWER
Import 1.19.1 (previous was 1.16.3) 2 November 2023: Wouter - Set version number to 1.19.0. - Tag for 1.19.0rc1 release. 1 November 2023: George - Mention flex and bison in README.md when building from repository source. 1 November 2023: Wouter - Fix SSL compile failure for definition in log_crypto_err_io_code_arg. - Fix SSL compile failure for other missing definitions in log_crypto_err_io_code_arg. - Fix compilation without openssl, remove unused function warning. 31 October 2023: George - Fix #941: dnscrypt doesn't work after upgrade to 1.18 with suggestion by dukeartem to also fix the udp_ancil with dnscrypt. 30 October 2023: George - Merge #930 from Stuart Henderson: add void to log_ident_revert_to_default declaration. 30 October 2023: Wouter - autoconf. 24 October 2023: George - Clearer configure text for missing protobuf-c development libraries. 20 October 2023: Wouter - Merge #951: Cachedb no store. The cachedb-no-store: yes option is used to stop cachedb from writing messages to the backend storage. It reads messages when data is available from the backend. The default is no. 19 October 2023: Wouter - Fix to print detailed errors when an SSL IO routine fails via SSL_get_error. 18 October 2023: George - Mailing list patches from Daniel Gröber for DNS64 fallback to plain AAAA when no A record exists for synthesis, and minor DNS64 code refactoring for better readability. - Fixes for the DNS64 patches. - Update the dns64_lookup.rpl test for the DNS64 fallback patch. - Merge #955 from buevsan: fix ipset wrong behavior. - Update testdata/ipset.tdir test for ipset fix. 17 October 2023: Wouter - Fix #954: Inconsistent RPZ handling for A record returned along with CNAME. 16 October 2023: George - Expose the script filename in the Python module environment 'mod_env' instead of the config_file structure which includes the linked list of scripts in a multi Python module setup; fixes #79. - Expose the configured listening and outgoing interfaces, if any, as a list of strings in the Python 'config_file' class instead of the current Swig object proxy; fixes #79. - For multi Python module setups, clean previously parsed module functions in __main__'s dictionary, if any, so that only current module functions are registered. 13 October 2023: George - Better fix for infinite loop when reading multiple lines of input on a broken remote control socket, by treating a zero byte line the same as transmission end. Addesses #947 and #948. 12 October 2023: Wouter - Merge #944: Disable EDNS DO. Disable the EDNS DO flag in upstream requests. This can be helpful for devices that cannot handle DNSSEC information. But it should not be enabled otherwise, because that would stop DNSSEC validation. The DNSSEC validation would not work for Unbound itself, and also not for downstream users. Default is no. The option is disable-edns-do: no 11 October 2023: George - Fix #850: [FR] Ability to use specific database in Redis, with new redis-logical-db configuration option. 11 October 2023: Wouter - Fix #949: "could not create control compt". - Fix that cachedb does not warn when serve-expired is disabled about use of serve-expired-reply-ttl and serve-expired-client-timeout. - Fix for #949: Fix pythonmod/ubmodule-tst.py for Python 3.x. 10 October 2023: George - Fix infinite loop when reading multiple lines of input on a broken remote control socket. Addesses #947 and #948. 9 October 2023: Wouter - Fix edns subnet so that queries with a source prefix of zero cause the recursor send no edns subnet option to the upstream. - Fix that printout of EDNS options shows the EDNS cookie option by name. 4 October 2023: Wouter - Fix #946: Forwarder returns servfail on upstream response noerror no data. 3 October 2023: George - Merge #881: Generalise the proxy protocol code. 2 October 2023: George - Fix misplaced comment. 22 September 2023: Wouter - Fix #942: 1.18.0 libunbound DNS regression when built without OpenSSL. 18 September 2023: Wouter - Fix rpz tcp-only action with rpz triggers nsdname and nsip. 15 September 2023: Wouter - Merge #936: Check for c99 with autoconf versions prior to 2.70. - Fix to remove two c99 notations. 14 September 2023: Wouter - Fix authority zone answers for obscured DNAMEs and delegations. 8 September 2023: Wouter - Fix send of udp retries when ENOBUFS is returned. It stops looping and also waits for the condition to go away. Reported by Florian Obser. 7 September 2023: Wouter - Fix to scrub resource records of type A and AAAA that have an inappropriate size. They are removed from responses. - Fix to move msgparse_rrset_remove_rr code to util/msgparse.c. - Fix to add EDE text when RRs have been removed due to length. - Fix to set ede match in unit test for rr length removal. - Fix to print EDE text in readable form in output logs. 6 September 2023: Wouter - Merge #931: Prevent warnings from -Wmissing-prototypes. 31 August 2023: Wouter - Fix autoconf 2.69 warnings in configure. - Fix #927: unbound 1.18.0 make test error. Fix make test without SHA1. 30 August 2023: Wouter - Fix for WKS call to getservbyname that creates allocation on exit in unit test by testing numbers first and testing from the services list later. 28 August 2023: Wouter - Fix for version generation race condition that ignored changes. 25 August 2023: Wouter - Fix compile error on NetBSD in util/netevent.h. 23 August 2023: Wouter - Tag for 1.18.0rc1 release. This became the 1.18.0 release on 30 aug 2023, with the fix from 25 aug, fix compile on NetBSD included. The repository continues with version 1.18.1. 22 August 2023: Wouter - Set version number to 1.18.0. 21 August 2023: Wouter - Debug Windows ci workflow. - Fix windows ci workflow to install bison and flex. - Fix for #925: unbound.service: Main process exited, code=killed, status=11/SEGV. Fixes cachedb configuration handling. - Fix #923: processQueryResponse() THROWAWAY should be mindful of fail_reply. - Fix unit test for unbound-control to work when threads are disabled, and fix cache dump check. 18 August 2023: Wouter - Fix for iter_dec_attempts that could cause a hang, part of capsforid and qname minimisation, depending on the settings. - Fix uninitialized memory passed in padding bytes of cmsg to sendmsg. - Fix stat_values test to work with dig that enables DNS cookies. 17 August 2023: Wouter - Merge PR #762: Downstream DNS Server Cookies a la RFC7873 and RFC9018. Create server cookies for clients that send client cookies. This needs to be explicitly turned on in the config file with: `answer-cookie: yes`. A `cookie-secret:` can be configured for anycast setups. Without one, a random cookie secret is generated. The acl option `allow_cookie` allows queries with either a valid cookie or over a stateful transport. The statistics output has `queries_cookie_valid` and `queries_cookie_client` and `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:` value determines a rate limit for queries with cookies, if desired. - Fix regional_alloc_init for potential unaligned source of the copy. - Fix ip_ratelimit test to work with dig that enables DNS cookies. 2 August 2023: George - Move a cache reply callback in worker.c closer to the cache reply generation. 1 August 2023: George - Merge #911 from natalie-reece: Exclude EDE before other EDNS options when there isn't enough space. - For #911: Try to trim EXTRA-TEXT (and LDNS_EDE_OTHER options altogether) before giving up on attaching EDE options. - More braces and formatting for Fix for EDNS EDE size calculation to avoid future bugs. - Fix to use the now cached EDE, if any, for CD_bit queries. 1 August 2023: Wouter - Fix for EDNS EDE size calculation. 31 July 2023: George - Merge #790 from Tom Carpay: Add support for EDE caching in cachedb and subnetcache. 31 July 2023: Wouter - iana portlist update. 30 July 2023: George - Merge #759 from Tom Carpay: Add EDE (RFC8914) caching. 28 July 2023: George - Fix unused variable compile warning for kernel timestamps in netevent.c 21 July 2023: George - Merge #857 from eaglegai: fix potential memory leaks when errors happen. - For #857: fix mixed declarations and code. - Merge #118 from mibere: Changed verbosity level for Redis init & deinit. - Merge #390 from Frank Riley: Add missing callbacks to the python module. - Cleaner failure code for callback functions in interface.i. - Merge #889 from borisVanhoof: Free memory in error case + remove unused function. - For #889: use netcat-openbsd instead of netcat-traditional. - For #889: Account for num_detached_states before possible mesh_state_delete when erroring out. 20 July 2023: George - Merge #909 from headshog: Numeric truncation when parsing TYPEXX and CLASSXX representation. - For #909: Fix return values. - Merge #901 from Sergei Trofimovich: config: improve handling of unknown modules. 20 July 2023: Wouter - For #909: Fix RR class comparison. 14 July 2023: George - More clear description of the different auth-zone behaviors on the man page. 13 July 2023: George - Merge #880 from chipitsine: services/authzone.c: remove redundant check. 11 July 2023: George - Merge #664 from tilan7763: Add prefetch support for subnet cache entries. - For #664: Easier code flow for subnetcache prefetching. - For #664: Add testcase. - For #664: Rename subnet_prefetch tests to subnet_global_prefetch to differentiate from the new subnet prefetch support. 3 July 2023: George - Merge #739: Add SVCB dohpath support. - Code cleanup for sldns_str2wire_svcparam_key_lookup. - Merge #802: add validation EDEs to queries where the CD bit is set. - For #802: Cleanup comments and add RCODE check for CD bit test case. - Skip the 00-lint test. splint is not maintained; it either does not work or produces false positives. Static analysis is handled in the clang test. 3 July 2023: Wouter - Fix #906: warning: ‘Py_SetProgramName’ is deprecated. - Fix dereference of NULL variable warning in mesh_do_callback. 29 June 2023: George - More fixes for reference counting for python module and clean up failure code. - Merge #827 from rcmcdonald91: Eliminate unnecessary Python reloading which causes memory leaks. 29 June 2023: Wouter - Fix python modules with multiple scripts, by incrementing reference counts. 27 June 2023: George - Merge #892: Add cachedb hit stat. Introduces 'num.query.cachedb' as a new statistical counter. - Remove warning about unknown cast-function-type warning pragma. 22 June 2023: Wouter - Merge #903: contrib: add yocto compatible init script. 15 June 2023: Philip - Fix for issue #887 (Timeouts to forward servers on BSD based system with ASLR) - Probably fixes #516 (Stream reuse does not work on Windows) as well 14 June 2023: George - Properly handle all return values of worker_check_request during early EDE code. - Do not check the incoming request more than once. 12 June 2023: Wouter - Merge #896: Fix: #895: pythonmodule: add all site-packages directories to sys.path. - Fix #895: python + sysconfig gives ANOTHER path comparing to distutils. - Fix for uncertain unit test for doh buffer size events. 25 May 2023: Wouter - Fix unbound-dnstap-socket printout when no query is present. - Fix unbound-dnstap-socket time fraction conversion for printout. 19 May 2023: Wouter - Fix RPZ removal of client-ip, nsip, nsdname triggers from IXFR. - Fix to remove unused variables from RPZ clientip data structure. 16 May 2023: Wouter - Fix #888: [FR] Use kernel timestamps for dnstap. - Fix to print debug log for ancillary data with correct IP address. 11 May 2023: Wouter - Fix warning in windows compile, in set_recvtimestamp. 4 May 2023: Wouter - Fix #885: Error: util/configlexer.c: No such file or directory, adds error messages explaining to install flex and bison. - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h. - Fix doxygen in addr_to_nat64 header definition. 1 May 2023: George - Merge #722 from David 'eqvinox' Lamparter: NAT64 support. - For #722: minor fixes, formatting, refactoring. 1 May 2023: Wouter - Fix RPZ IP responses with trigger rpz-drop on cache entries, that they are dropped. 26 April 2023: Philip - Fix issue #860: Bad interaction with 0 TTL records and serve-expired 26 April 2023: Wouter - Merge #882 from vvfedorenko: Features/dropqueuedpackets, with sock-queue-timeout option that drops packets that have been in the socket queue for too long. Added statistics num.queries_timed_out and query.queue_time_us.max that track the socket queue timeouts. - Fix for #882: small changes, date updated in Copyright for util/timeval_func.c and util/timeval_func.h. Man page entries and example entry. - Fix for #882: document variable to stop doxygen warning. 19 April 2023: Wouter - Fix for #878: Invalid IP address in unbound.conf causes Segmentation Fault on OpenBSD. 14 April 2023: Wouter - Merge #875: change obsolete txt URL in unbound-anchor.c to point to RFC 7958, and Fix #874. 13 April 2023: Wouter - Fix build badge, from failing travis link to github ci action link. 6 April 2023: Wouter - Fix for #870: Add test case for the qname minimisation and CNAME. 4 April 2023: Wouter - Fix #870: NXDOMAIN instead of NOERROR rcode when asked for existing CNAME record. 24 March 2023: Philip - Fix issue #676: Unencrypted query is sent when forward-tls-upstream: yes is used without tls-cert-bundle - Extra consistency check to make sure that when TLS is requested, either we set up a TLS connection or we return an error. 21 March 2023: Philip - Fix issue #851: reserved identifier violation 20 March 2023: Wouter - iana portlist update. 17 March 2023: George - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option to ignore the unexpected eof while reading in openssl >= 3. 16 March 2023: Wouter - Fix ssl.h include brackets, instead of quotes. 14 March 2023: Wouter - Fix unbound-dnstap-socket test program to reply the finish frame over a TLS connection correctly. 23 February 2023: Wouter - Fix for #852: Completion of error handling. 21 February 2023: Philip - Fix #825: Unexpected behavior with client-subnet-always-forward and serve-expired 10 February 2023: George - Clean up iterator/iterator.c::error_response_cache() and allow for better interaction with serve-expired, prefetch and cached error responses. 9 February 2023: George - Allow TTL refresh of expired error responses. - Add testcase for refreshing expired error responses. 9 February 2023: Wouter - Fix to ignore entirely empty responses, and try at another authority. This turns completely empty responses, a type of noerror/nodata into a servfail, but they do not conform to RFC2308, and the retry can fetch improved content. - Fix unit tests for spurious empty messages. - Fix consistency of unit test without roundrobin answers for the cnametooptout unit test. - Fix to git ignore the library symbol file that configure can create. 8 February 2023: Wouter - Fix #841: Unbound won't build with aaaa-filter-iterator.patch. 30 January 2023: George - Add duration variable for speed_local.test. 26 January 2023: Wouter - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes. 23 January 2023: George - Fix #833: [FR] Ability to set the Redis password. 23 January 2023: Wouter - Fix #835: [FR] Ability to use Redis unix sockets. 20 January 2023: Wouter - Merge #819: Added new static zone type block_a to suppress all A queries for specific zones. 19 January 2023: Wouter - Set max-udp-size default to 1232. This is the same default value as the default value for edns-buffer-size. It restricts client edns buffer size choices, and makes unbound behave similar to other DNS resolvers. The new choice, down from 4096 means it is harder to get large responses from Unbound. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Add harden-unknown-additional option. It removes unknown records from the authority section and additional section. Thanks to Xiang Li, from NISL Lab, Tsinghua University. - Set default for harden-unknown-additional to no. So that it does not hamper future protocol developments. - Fix test for new default. 18 January 2023: Wouter - Fix not following cleared RD flags potentially enables amplification DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab, Tsinghua University. The fix stops query loops, by refusing to send RD=0 queries to a forwarder, they still get answered from cache. 13 January 2023: Wouter - Merge #826: Аdd a metric about the maximum number of collisions in lrushah. - Improve documentation for #826, describe the large collisions amount. 9 January 2023: Wouter - Fix python module install path detection. - Fix python version detection in configure. 6 January 2023: Wouter - Fix #823: Response change to NODATA for some ANY queries since 1.12, tested on 1.16.1. - Fix wildcard in hyperlocal zone service degradation, reported by Sergey Kacheev. This fix is included in 1.17.1rc2. That became 1.17.1 on 12 Jan 2023, the code repo continues with 1.17.2. 1.17.1 excludes fix #823, it is included forwards. 5 January 2023: Wouter - Tag for 1.17.1 release. 2 January 2023: Wouter - Fix windows compile for libunbound subprocess reap comm point closes. - Update github workflows to use checkout v3. 14 December 2022: George - Merge #569 from JINMEI Tatuya: add keep-cache option to 'unbound-control reload' to keep caches. 13 December 2022: George - Expose 'statistics-inhibit-zero' as a configuration option; the default value retains Unbound's behavior. - Expose 'max-sent-count' as a configuration option; the default value retains Unbound's behavior. - Merge #461 from Christian Allred: Add max-query-restarts option. Exposes an internal configuration but the default value retains Unbound's behavior. 13 December 2022: Wouter - Merge #808: Wrap Makefile script's directory variables in quotes. - Fix to wrap Makefile scripts directory in quotes for uninstall. 1 December 2022: Wouter - Fix #773: When used with systemd-networkd, unbound does not start until systemd-networkd-wait-online.service times out. 30 November 2022: George - Add SVCB and HTTPS to the types removed by 'unbound-control flush'. - Clear documentation for interactivity between the subnet module and the serve-expired and prefetch configuration options. 30 November 2022: Wouter - Fix #782: Segmentation fault in stats.c:404. 28 November 2022: Wouter - Fix for the ignore of tcp events for closed comm points, preserve the use after free protection features. 23 November 2022: Philip - Merge #720 from jonathangray: fix use after free when WSACreateEvent() fails. 22 November 2022: George - Ignore expired error responses. 11 November 2022: Wouter - Fix #779: [doc] Missing documention in ub_resolve_event() for callback parameter was_ratelimited. 9 November 2022: George - Complementary fix for distutils.sysconfig deprecation in Python 3.10 to commit 62c5039ab9da42713e006e840b7578e01d66e7f2. 8 November 2022: Wouter - Fix to ignore tcp events for closed comm points. - Fix to make sure to not read again after a tcp comm point is closed. - Fix #775: libunbound: subprocess reap causes parent process reap to hang. - iana portlist update. 21 October 2022: George - Merge #767 from jonathangray: consistently use IPv4/IPv6 in unbound.conf.5. 21 October 2022: Wouter - Fix that cachedb does not store failures in the external cache. 18 October 2022: George - Clarify the use of MAX_SENT_COUNT in the iterator code. 17 October 2022: Wouter - testcode/dohclient sets log identity to its name. 14 October 2022: Wouter - Merge #768 from fobser: Arithmetic on a pointer to void is a GNU extension. - In unit test, print python script name list correctly. 13 October 2022: Wouter - Tag for 1.17.0 release. The code repository continues with 1.17.1. 11 October 2022: George - Fix PROXYv2 header read for TCP connections when no proxied addresses are provided. 7 October 2022: Wouter - Tag for 1.17.0rc1 release. 7 October 2022: George - Fix to stop possible loops in the tcp reuse code (write_wait list and tcp_wait list). Based on analysis and patch from Prad Seniappan and Karthik Umashankar. - Fix unit test to properly test the reuse_write_wait_pop function. 6 October 2022: Wouter - Fix to stop responses with TC flag from resulting in partial responses. It retries to fetch the data elsewhere, or fails the query and in depth fix removes the TC flag from the cached item. - Fix proxy length debug output printout typecasts. 5 October 2022: Wouter - Fix dnscrypt compile for proxy protocol code changes. 5 October 2022: George - Use DEBUG_TDIR from environment in mini_tdir.sh for debugging. - Fix string comparison in mini_tdir.sh. - Make ede.tdir test more predictable by using static data. - Fix checkconf test for dnscrypt and proxy port. 4 October 2022: George - Merge #764: Leniency for target discovery when under load (for NRDelegation changes). 4 October 2022: Wouter - Fix static analysis report to remove dead code from the rpz_callback_from_iterator_module function. - Fix to clean up after the acl_interface unit test. 3 October 2022: George - Merge #760: PROXYv2 downstream support. (New proxy-protocol-port configuration option). 3 October 2022: Wouter - Fix to remove erroneous TC flag from TCP upstream. - Fix test tdir skip report printout. - Fix windows compile, the identifier interface is defined in headers. - Fix to close errno block in comm_point_tcp_handle_read outside of ifdef. 26 September 2022: George - Better output for skipped tdir tests.
2024-02-17 21:06:18 +03:00
SECTION AUTHORITY
net. IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600
Import unbound 1.5.9
2016-08-20 14:08:26 +03:00
ENTRY_END
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
a.gtld-servers.net. IN A
SECTION ANSWER
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
RANGE_END
; a.gtld-servers.net.
RANGE_BEGIN 0 100
ADDRESS 192.5.6.30
ENTRY_BEGIN
MATCH opcode qtype qname
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
com. IN NS
SECTION ANSWER
com. IN NS a.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. IN A 192.5.6.30
ENTRY_END
ENTRY_BEGIN
MATCH opcode subdomain
ADJUST copy_id
REPLY QR NOERROR
SECTION QUESTION
example.com. IN A
SECTION AUTHORITY
example.com. IN NS ns.example.com.
SECTION ADDITIONAL
ns.example.com. IN A 1.2.3.4
ENTRY_END
RANGE_END
; ns.example.com.
; This server is Lame!
RANGE_BEGIN 0 100
ADDRESS 1.2.3.4
ENTRY_BEGIN
MATCH opcode
ADJUST copy_id copy_query
REPLY QR RD NOERROR
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
com. 155182 IN NS a.gtld-servers.net.
com. 155182 IN NS b.gtld-servers.net.
com. 155182 IN NS c.gtld-servers.net.
com. 155182 IN NS d.gtld-servers.net.
com. 155182 IN NS e.gtld-servers.net.
com. 155182 IN NS f.gtld-servers.net.
com. 155182 IN NS g.gtld-servers.net.
com. 155182 IN NS h.gtld-servers.net.
com. 155182 IN NS i.gtld-servers.net.
com. 155182 IN NS j.gtld-servers.net.
com. 155182 IN NS k.gtld-servers.net.
com. 155182 IN NS l.gtld-servers.net.
com. 155182 IN NS m.gtld-servers.net.
SECTION ADDITIONAL
a.gtld-servers.net. 155182 IN A 192.5.6.30
b.gtld-servers.net. 155182 IN A 192.33.14.30
c.gtld-servers.net. 155182 IN A 192.26.92.30
d.gtld-servers.net. 155182 IN A 192.31.80.30
e.gtld-servers.net. 155182 IN A 192.12.94.30
f.gtld-servers.net. 155182 IN A 192.35.51.30
g.gtld-servers.net. 155182 IN A 192.42.93.30
h.gtld-servers.net. 155182 IN A 192.54.112.30
i.gtld-servers.net. 155182 IN A 192.43.172.30
j.gtld-servers.net. 155182 IN A 192.48.79.30
k.gtld-servers.net. 155182 IN A 192.52.178.30
l.gtld-servers.net. 155182 IN A 192.41.162.30
m.gtld-servers.net. 155182 IN A 192.55.83.30
a.gtld-servers.net. 155182 IN AAAA 2001:503:a83e::2:30
ENTRY_END
RANGE_END
STEP 1 QUERY
ENTRY_BEGIN
REPLY RD
SECTION QUESTION
www.example.com. IN A
ENTRY_END
; recursin happens here
; check that the answer is a failure (lame server)
; and not a nodata-noerror message (false answer classification).
STEP 10 CHECK_ANSWER
ENTRY_BEGIN
MATCH all
REPLY QR RD RA SERVFAIL
SECTION QUESTION
www.example.com. IN A
SECTION ANSWER
SECTION AUTHORITY
SECTION ADDITIONAL
ENTRY_END
SCENARIO_END